Or, to change the content of the current feed to be more like the previous CI,

Definitely looks way better, easier to navigate.


Matthew,

Is there a reason you don't use an SSL certificate on this site? It would be really good to have an encrypted connection since we all pass our credentials on this site over an unsecured connection which could easily be jacked by a semi-decent hacker. I could pull everyone's credentials off this site pretty easily if I wanted to (been in IT for 13 years, used to hack before that). A cheap SSL certificate would prevent it.

Something to think about.

Yes there is a reason.
Yeah if you buy it from those crooks at GoDaddy. 



No, not everything is public. Private Messages are not public, nor is passing your credentials. But they are public if anyone were do a MITM attack on your server, which is pretty easy.


I could, but I'm not malicious. I'm not talking about the database, I'm talking about passing credentials and private messages across the internet unencrypted, which is stupid.

There are other ways to get into the database. I am not talking about accessing your database that way, I was referring to your users. Who probably use their names/passwords on multiple sites. And by not encrypting that traffic when they pass their credentials your server, those packets can easily be captured and used. It is super easy to do for anyone who is remotely good at hacking. The reason I bring this up is to protect fellow Catholics who use this site. I created a unique password for just your site that I don't use anywhere else because you don't encrypt your site.

I am not trying to piss you off, I'm just trying to help you make the site more secure.

I could pull everyone's credentials off this site pretty easily if I wanted to (been in IT for 13 years, used to hack before that).  A cheap SSL certificate would prevent it.

[....] I stuck with the same [CathInfo] software for 11 years!  But that software, Mercuryboard, is from 2006--and it hasn't been updated since then.  It is a DEAD piece of software[†], kept alive only by my own Dr. Frankenstein programmer powers.

Easily? 
Make me laugh! No you couldn't. You're just going to have to prove it, or shut up with your boasting. I completely spit on, and deny your abilities in this matter.

I bet you $50 that you can't "get all" of the PMs on CathInfo.com.


I have to object to what you said here. You allege that private messages on CathInfo are not private, that there is no real security in place. You allege that any perceived security is false, much like "security through obscurity" (hiding a key to the house under the welcome mat). Anyone who knows what they're doing, and who wants in, can just flip up the welcome mat, take the key, and enter the house. Or the tiny padlock on a diary -- anyone who really wants in can just cut the thin leather strap with a scissors and open the diary like a regular book.

That is simply not true about the PM system on CathInfo. You can't just get at all the PMs "if you know what you're doing".

I'd like to see you try. My site is plenty secure. I'm using the latest version of SMF. I doubt there are any mindless SQL injection bugs present in the code.  Protecting against SQL injection is pretty standard fare these days. Maybe 10 years ago many sites had vulnerabilities like this. But just as you've learned a lot over the years, so have software developers. Many programming libraries protect against things automatically in 2017 that used to require a hired security expert to implement in 2005.

The Laravel PHP framework, for example, makes it trivial to protect against HTML form injection attacks, SQL injection, etc.

But that's a moot point, because I decided an hour ago that I will buy an SSL certificate for CathInfo. I surrender. The world is crazy. I disagree that it's necessary, but the whole world is stacked against website owners. They each have to "play the game" and pay up.

You know part of hacking reconnaissance, it's the first level before enumeration, and all the info you've given me and on this thread makes it that much easier for me, just FYI.