mIRC scripting

mIRC scripts can be helpful in many ways. They can do almost anything from hosting simple IRC games, to keeping PM spam out, to protecting the user and channel. Scripted correctly, most of them don’t cause any annoyance or frustration. Scripted incorrectly, they can prove to be quite hilarious to watch 🙂

[16:22:54] (&Tikitiki) !down
[16:22:54] * Q sets mode: -ao Tikitiki Tikitiki
[16:22:55] * Q sets mode: +o Tikitiki
[16:22:55] * Q sets mode: +a Tikitiki
[16:22:57] (&Tikitiki) try banning me now
[16:22:58] (&Tikitiki) omg
[16:23:00] (&Tikitiki) STUPID SCRIPT
[16:23:01] (&Tikitiki) rofl
[16:23:14] * Tikitiki sets mode: -a Tikitiki
[16:23:16] (@Tikitiki) try now
[16:23:27] * DennisTT sets mode: +b Tikitiki*!*@*
[16:23:27] * Info: This Tikitiki*!*@* ban affects @Tikitiki
[16:23:27] * Tikitiki sets mode: -b+b Tikitiki*!*@* *!*@dennistt.net
[16:23:27] * Info: This *!*@dennistt.net ban affects &@DennisTT
[16:23:27] * DennisTT sets mode: -b *!*@dennistt.net
[16:23:28] -ChanServ- You have been unbanned from #mybb.
[16:23:31] (@Tikitiki) lol
[16:23:34] (@Tikitiki) 1 moment
[16:23:41] * Tikitiki sets mode: -o Tikitiki
[16:23:41] * Q sets mode: +o Tikitiki
[16:23:41] * Tikitiki sets mode: -o Tikitiki
[16:23:41] * Q sets mode: +a Tikitiki
[16:23:41] * Q sets mode: -o Tikitiki
[16:23:41] * Q sets mode: +o Tikitiki
[16:23:41] * Tikitiki sets mode: -o Tikitiki
[16:23:41] * Tikitiki was kicked by Tikitiki (deop protection)
[16:23:44] (&DennisTT) lol
[16:23:45] (&DennisTT) owned
[16:23:46] (&DennisTT) by
[16:23:47] (+bc> self owned
[16:23:47] (&DennisTT) himself
[16:23:48] (&DennisTT) :p
[16:23:52] (+bc) rofl
[16:23:58] (&Belloman) ROFL
[16:23:58] * Joins: Tikitiki ([email protected])
[16:23:59] * Q sets mode: +oa Tikitiki Tikitiki
[16:23:59] (&Q) [tikitiki] MyBB Support Team
[16:24:01] (&DennisTT) Owned
[16:24:02] (&DennisTT) :D
[16:24:05] (&Ryan) ROFL
[16:24:06] (&Tikitiki) >.>

MyBB 1.2 Beta: Multi-quoting

I’m going to be posting this series of screenshots in new posts now.

One of the new features of MyBB 1.2 is multi-quoting. This function allows you to select as many posts as you want, from a one or more threads, and have them all ‘pre-quoted’ in the message box when creating a new thread or reply.

The following screenshot shows the postbit. The multi-quote button is the one to the right of the “Reply” button (which was “Quote” before 1.2). (The postbit display of the new reputation system is also shown here)

Selecting Multiquote Replies

The screenshot below shows the new reply page with the selected quotations pre-quoted.

Multi-quote new reply screen

MyBB 1.2 Beta

Every few days I will post a screenshot of the MyBB 1.2 Beta for those of you who didn’t get invited into the beta group (or beta-testers who are still interested in looking at these screenshots). In case you miss one, they will be archived on my Flickr gallery.

June 28, 2006

A view of one of the new sections of the Admin CP. You can now add in your own custom MyCode (using Regex expressions) without having to use plugins.

Add MyCode screen

June 27, 2006

With the new reputation system, the reputation is user-based instead of post based. Now you can view a lot more detail about the reputations you and anyone else gets:

Reputation Report

June 26, 2006

The beta-testing will start in a few hours, so here’s a sneak peek of the new reputation system.

User CP Main Page

Adding Reputation

MyBB Security

These are just my thoughts about MyBB security updates.  I’m not a security expert of any sort, but I just offer my opinion based on the knowledge I have.
Over the last few weeks there have been two releases to MyBB to patch potential security vulnerabilities that have been discovered by various parties. I have seen some people who have found these seemingly miniscule updates too trivial to apply to their own boards, despite the fact that I and various other members of the MyBB staff have recommended these updates.

These people seem to believe that just because no harm has been done by people attempting to exploit the vulnerability, or just because no harm has been done when they try the exploit script by themselves, that the upgrade is not required. Personally I find this absurd.

First of all, I’d like to point out that not all proof-of-concept scripts are harmful; as their name suggests, these scripts prove the concept, but may not actually compromise the system. Wikipedia says: “In both computer security and encryption, proof of concept refers to a demonstration that in principle shows how a system may be protected or compromized, without the necessity of building a complete working vehicle for that purpose.”

Just because a board administrator cannot find a way to exploit the vulnerability, doesn’t mean that another malacious user won’t find a way. Just because nothing has been “done” to the board when an attempt has been made, doesn’t mean that eventually someone else won’t find a way to compromise the board. For example, the 1.1.3 release patched a serious security vulnerability where a malacious user could execute arbitrary PHP code at their own heart’s content (with a malaciously-formed username). As an administrator, you may not even detect any problems on the surface if you tried the proof-of-concept script, or seen usernames that have registered on your board, but nothing harmful has happened. In fact, much more serious and critical information may have been available to the hands of malacious users, if they indeed have compromised the board in this manner, and the patch released was not applied.

As well, once the security vulnerability has been patched, anyone with a malacious intent would be able to figure out how to exploit it, and may be able to compromise boards which have not patched the vulnerability.

Okay, so I may not be a security expert, however, I do use my common sense (and I do hope that you use yours). When a security vulnerability has been found, and has been identified to affect the particular version of MyBB (or any other software), we do not just release these patches to annoy our users with little upgrades every few weeks. No, we actually do want to improve our software by patching these holes and keeping our users safe. If a vulnerability has been reported, it is most likely that something harmful can be done to your board, and if a board administrator wishes to take that risk and not upgrade, it is his or her decision, and I cannot force anyone to apply the patch.
Obviously it is possible that sometimes the malacious users will compromise boards before we can find the vulnerability and release the patch, but I assure you that security is at the highest priority with the MyBB Group, and we strive to keep our customers safe from these exploits in as a timely manner as possible.

However, once we have released a patch, it is up to each and every individual board administrator to update their board to keep them and their board safe from the exploit. Each security patch, no matter how small, should be considered as significant. I hope that you all take this into mind the next time you ponder whether or not to update your board.

After writing all this about security, I hope I won’t get hit on my behind by something that I have just fervently preached. 🙂