Does MyBB have future?
(2019-02-18, 09:14 PM)Ben Cousins Wrote:
(2019-02-18, 08:15 PM)Euan T Wrote: Regarding HackerOne or some such for security reports. We've discussed this kind of thing a couple of times as a team. The only thing that's put us off using HackerOne as far as I can remember off the top of my head is that there tends to be an expectation for bounties when using HackerOne - we can't really offer bounties given that we're not making any money or anything...

You’ve wholly misunderstood. I would like to see something here that encompasses the same principle: That is, a vulnerability is hidden until fixed and then disclosed. I did not suggest actually using HackerOne - I get MyBB has no money to do payouts, and that’s not the expectation I want to set - but they’re perhaps the most notorious for this concept.

We do, in fact, plan to be present on HackerOne or equivalent (although with no monetary compensation) for numerous reasons (centralized index, a reporting platform that's separate from the product in question, a workflow that's compatible and ready to integrate + improved transparency), but it would go together with other organizational changes (1.9 or 1.10 in our case) to make the transition more smooth and to avoid complicating a process that's already in place (e.g. so data related to a specific branch can be tracked on a single platform).
A change that's also waiting to be introduced is switching to CVSS v3 assessments instead of arbitrary risk labels, and with improved git flow we should be able to safely prepare & release hotfixes independently of the standard development track - without the overhead caused by linear git history.
In the meantime we've put up an updated disclosure page, SECURITY.md, and the general security workflow at https://docs.mybb.com/1.8/development/se...-workflow/.

RE information on development status: our metadata tracking (Issues, PRs, milestones) improved enough to be relied upon without cross-referencing with the Community Forums when it comes to 1.8 (same should apply to subsequent branches close to final releases), so it will be much easier to provide links to status pages or listings related to versions, bugs and features in focus at any given moment; the 1.9 status is still somewhat fluid, but once that stabilizes there should be an Issue filter or Project on GH that will allow to replace rough estimates with a specific number of problems that should be addressed before the branch is ready.
devilshakerz.com/pgp (DF3A 34D9 A627 42E5 BC6A 6750 1F2F B8AA 28FF E1BC) ▪ keybase.io/devilshakerz
Reply


Messages In This Thread
Does MyBB have future? - by iagovar - 2017-12-11, 07:50 PM
RE: Does MyBB have future? - by Euan T - 2017-12-11, 07:57 PM
RE: Does MyBB have future? - by labrocca - 2017-12-11, 08:12 PM
RE: Does MyBB have future? - by iagovar - 2017-12-11, 08:26 PM
RE: Does MyBB have future? - by labrocca - 2017-12-11, 08:48 PM
RE: Does MyBB have future? - by Whiteneo - 2017-12-11, 11:02 PM
RE: Does MyBB have future? - by Ashley1 - 2017-12-15, 07:49 PM
RE: Does MyBB have future? - by kawaii - 2017-12-15, 07:56 PM
RE: Does MyBB have future? - by TaylorCTU - 2017-12-12, 12:26 AM
RE: Does MyBB have future? - by zag - 2017-12-12, 02:25 PM
RE: Does MyBB have future? - by labrocca - 2017-12-12, 06:41 PM
RE: Does MyBB have future? - by lomazzo - 2017-12-14, 03:23 PM
RE: Does MyBB have future? - by Sector - 2017-12-15, 09:04 AM
RE: Does MyBB have future? - by frostschutz - 2017-12-15, 01:09 PM
RE: Does MyBB have future? - by YeahIamBlond - 2017-12-15, 01:32 PM
RE: Does MyBB have future? - by iagovar - 2017-12-15, 06:08 PM
RE: Does MyBB have future? - by Ikerepc - 2017-12-15, 02:25 PM
RE: Does MyBB have future? - by labrocca - 2017-12-15, 06:18 PM
RE: Does MyBB have future? - by Ikerepc - 2017-12-15, 06:24 PM
RE: Does MyBB have future? - by VinnyVideo - 2017-12-15, 06:35 PM
RE: Does MyBB have future? - by labrocca - 2017-12-15, 07:00 PM
RE: Does MyBB have future? - by Wildcard - 2017-12-15, 09:31 PM
RE: Does MyBB have future? - by labrocca - 2017-12-15, 09:40 PM
RE: Does MyBB have future? - by Euan T - 2017-12-16, 11:14 PM
RE: Does MyBB have future? - by Ashley1 - 2017-12-16, 11:59 PM
RE: Does MyBB have future? - by andrewjs18 - 2017-12-17, 12:22 AM
RE: Does MyBB have future? - by Euan T - 2017-12-17, 10:59 AM
RE: Does MyBB have future? - by Ashley1 - 2017-12-17, 12:13 PM
RE: Does MyBB have future? - by Euan T - 2017-12-17, 01:47 PM
RE: Does MyBB have future? - by Ashley1 - 2017-12-17, 02:06 PM
RE: Does MyBB have future? - by Euan T - 2017-12-17, 02:21 PM
RE: Does MyBB have future? - by Ashley1 - 2017-12-17, 02:36 PM
RE: Does MyBB have future? - by Euan T - 2017-12-17, 02:44 PM
RE: Does MyBB have future? - by Ashley1 - 2017-12-18, 12:57 AM
RE: Does MyBB have future? - by labrocca - 2017-12-18, 01:47 AM
RE: Does MyBB have future? - by amanda_2011 - 2017-12-18, 07:48 AM
RE: Does MyBB have future? - by iagovar - 2017-12-18, 03:30 PM
RE: Does MyBB have future? - by Ikerepc - 2017-12-18, 03:51 PM
RE: Does MyBB have future? - by Euan T - 2017-12-18, 07:18 PM
RE: Does MyBB have future? - by NeedReds - 2020-04-23, 11:22 AM
RE: Does MyBB have future? - by Ikerepc - 2017-12-18, 07:25 PM
RE: Does MyBB have future? - by Euan T - 2017-12-18, 07:48 PM
RE: Does MyBB have future? - by iagovar - 2017-12-18, 11:16 PM
RE: Does MyBB have future? - by andrewjs18 - 2017-12-19, 12:28 AM
RE: Does MyBB have future? - by Ikerepc - 2017-12-18, 08:21 PM
RE: Does MyBB have future? - by labrocca - 2017-12-18, 08:29 PM
RE: Does MyBB have future? - by amanda_2011 - 2017-12-18, 08:57 PM
RE: Does MyBB have future? - by iagovar - 2017-12-19, 04:24 PM
RE: Does MyBB have future? - by Euan T - 2017-12-19, 08:03 PM
RE: Does MyBB have future? - by iagovar - 2017-12-19, 11:00 PM
RE: Does MyBB have future? - by Euan T - 2017-12-20, 07:58 PM
RE: Does MyBB have future? - by Tactrus - 2017-12-19, 04:48 PM
RE: Does MyBB have future? - by Ikerepc - 2017-12-19, 11:31 PM
RE: Does MyBB have future? - by Tactrus - 2017-12-20, 11:35 PM
RE: Does MyBB have future? - by andrewjs18 - 2017-12-21, 08:30 AM
RE: Does MyBB have future? - by kawaii - 2017-12-21, 08:57 AM
RE: Does MyBB have future? - by Dexxa - 2017-12-21, 03:16 PM
RE: Does MyBB have future? - by Euan T - 2017-12-21, 10:42 PM
RE: Does MyBB have future? - by lomazzo - 2017-12-21, 05:18 PM
RE: Does MyBB have future? - by labrocca - 2017-12-22, 07:37 AM
RE: Does MyBB have future? - by Ashley1 - 2017-12-22, 08:36 AM
RE: Does MyBB have future? - by Livewire - 2017-12-22, 12:07 AM
RE: Does MyBB have future? - by labrocca - 2017-12-22, 09:20 AM
RE: Does MyBB have future? - by Justin - 2017-12-22, 12:42 PM
RE: Does MyBB have future? - by labrocca - 2017-12-22, 06:06 PM
RE: Does MyBB have future? - by Euan T - 2017-12-22, 07:48 PM
RE: Does MyBB have future? - by Justin - 2017-12-22, 09:04 PM
RE: Does MyBB have future? - by Tactrus - 2017-12-22, 09:56 PM
RE: Does MyBB have future? - by Euan T - 2017-12-22, 10:54 PM
RE: Does MyBB have future? - by Ashley1 - 2017-12-22, 11:25 PM
RE: Does MyBB have future? - by kawaii - 2017-12-22, 11:07 PM
RE: Does MyBB have future? - by labrocca - 2017-12-22, 11:09 PM
RE: Does MyBB have future? - by lomazzo - 2017-12-23, 06:54 AM
RE: Does MyBB have future? - by Robbie626 - 2017-12-23, 07:11 AM
RE: Does MyBB have future? - by Euan T - 2017-12-23, 07:27 AM
RE: Does MyBB have future? - by marcgo15 - 2017-12-25, 07:40 PM
RE: Does MyBB have future? - by Sector - 2017-12-23, 08:28 AM
RE: Does MyBB have future? - by iagovar - 2017-12-26, 11:40 PM
RE: Does MyBB have future? - by s3_gunzel - 2017-12-27, 12:09 AM
RE: Does MyBB have future? - by labrocca - 2017-12-23, 07:43 PM
RE: Does MyBB have future? - by Justin - 2017-12-27, 01:16 PM
RE: Does MyBB have future? - by mrl586 - 2018-01-07, 08:05 PM
RE: Does MyBB have future? - by lomazzo - 2018-01-06, 09:17 PM
RE: Does MyBB have future? - by Justin - 2018-01-07, 08:27 PM
RE: Does MyBB have future? - by Ikerepc - 2018-01-07, 08:39 PM
RE: Does MyBB have future? - by labrocca - 2018-01-07, 09:23 PM
RE: Does MyBB have future? - by Sharree - 2018-01-07, 09:54 PM
RE: Does MyBB have future? - by Justin - 2018-01-07, 10:28 PM
RE: Does MyBB have future? - by labrocca - 2018-01-07, 10:59 PM
RE: Does MyBB have future? - by ScarletWavez - 2018-01-08, 02:52 PM
RE: Does MyBB have future? - by darkhorus - 2018-01-10, 06:07 PM
RE: Does MyBB have future? - by Euan T - 2018-01-10, 07:54 PM
RE: Does MyBB have future? - by darkhorus - 2018-01-11, 05:08 PM
RE: Does MyBB have future? - by andrewjs18 - 2018-01-15, 06:54 AM
RE: Does MyBB have future? - by darkhorus - 2018-01-15, 01:42 PM
RE: Does MyBB have future? - by Corey H - 2018-01-15, 08:40 PM
RE: Does MyBB have future? - by Ikerepc - 2018-01-15, 09:01 PM
RE: Does MyBB have future? - by lomazzo - 2018-01-16, 11:09 AM
RE: Does MyBB have future? - by kawaii - 2018-01-16, 11:18 AM
RE: Does MyBB have future? - by Ikerepc - 2018-01-16, 03:21 PM
RE: Does MyBB have future? - by DiegoPino - 2018-01-15, 09:58 PM
RE: Does MyBB have future? - by lomazzo - 2018-01-16, 06:31 PM
RE: Does MyBB have future? - by html_nerd - 2018-01-17, 01:54 PM
RE: Does MyBB have future? - by Ikerepc - 2018-01-16, 07:31 PM
RE: Does MyBB have future? - by Justin - 2018-01-17, 02:47 PM
RE: Does MyBB have future? - by lomazzo - 2018-01-17, 06:32 PM
RE: Does MyBB have future? - by html_nerd - 2018-01-17, 06:52 PM
RE: Does MyBB have future? - by Ikerepc - 2018-01-17, 08:05 PM
RE: Does MyBB have future? - by Ikerepc - 2018-01-17, 06:47 PM
RE: Does MyBB have future? - by Majcon - 2018-01-20, 01:21 AM
RE: Does MyBB have future? - by lomazzo - 2018-01-20, 02:07 AM
RE: Does MyBB have future? - by dragonexpert - 2018-02-07, 04:15 AM
RE: Does MyBB have future? - by Ikerepc - 2018-02-07, 10:05 AM
RE: Does MyBB have future? - by Zaqre - 2018-07-28, 10:27 AM
RE: Does MyBB have future? - by /r/ - 2018-07-29, 04:35 PM
RE: Does MyBB have future? - by Nasyr - 2018-10-23, 10:12 AM
RE: Does MyBB have future? - by Eldenroot - 2018-07-30, 03:52 PM
RE: Does MyBB have future? - by erich199 - 2018-12-21, 06:51 PM
RE: Does MyBB have future? - by Zeitgeist - 2018-12-22, 05:27 PM
RE: Does MyBB have future? - by Michael2014 - 2018-12-22, 05:36 PM
RE: Does MyBB have future? - by CloudyBright - 2019-02-16, 03:28 PM
RE: Does MyBB have future? - by Sector - 2019-01-14, 06:29 PM
RE: Does MyBB have future? - by Serpius - 2019-01-15, 02:00 AM
RE: Does MyBB have future? - by s3_gunzel - 2019-01-15, 02:15 AM
RE: Does MyBB have future? - by Serpius - 2019-01-15, 04:04 AM
RE: Does MyBB have future? - by viwewo - 2019-02-16, 08:55 AM
RE: Does MyBB have future? - by Sharree - 2019-02-17, 07:18 AM
RE: Does MyBB have future? - by labrocca - 2019-02-17, 06:37 PM
RE: Does MyBB have future? - by Euan T - 2019-02-17, 08:21 PM
RE: Does MyBB have future? - by labrocca - 2019-02-17, 11:04 PM
RE: Does MyBB have future? - by s3_gunzel - 2019-02-18, 01:57 AM
RE: Does MyBB have future? - by Wildcard - 2019-02-17, 11:41 PM
RE: Does MyBB have future? - by labrocca - 2019-02-18, 01:00 AM
RE: Does MyBB have future? - by Justin - 2019-02-18, 03:24 AM
RE: Does MyBB have future? - by effone - 2019-02-18, 05:12 AM
RE: Does MyBB have future? - by codedude - 2019-02-18, 11:42 AM
RE: Does MyBB have future? - by labrocca - 2019-02-18, 04:25 PM
RE: Does MyBB have future? - by someoneBig - 2019-02-18, 08:08 PM
RE: Does MyBB have future? - by Euan T - 2019-02-18, 08:19 PM
RE: Does MyBB have future? - by Euan T - 2019-02-18, 08:15 PM
RE: Does MyBB have future? - by s3_gunzel - 2019-02-18, 09:14 PM
RE: Does MyBB have future? - by Devilshakerz - 2019-02-18, 10:40 PM
RE: Does MyBB have future? - by Euan T - 2019-02-18, 10:43 PM
RE: Does MyBB have future? - by someoneBig - 2019-02-18, 08:40 PM
RE: Does MyBB have future? - by Nathan Malcolm - 2019-02-19, 04:07 AM
RE: Does MyBB have future? - by s3_gunzel - 2019-02-19, 05:13 AM
RE: Does MyBB have future? - by Euan T - 2019-02-19, 07:37 PM
RE: Does MyBB have future? - by s3_gunzel - 2020-04-24, 12:09 AM
RE: Does MyBB have future? - by DiegoD - 2020-05-30, 07:03 PM
RE: Does MyBB have future? - by ARx182 - 2020-05-31, 07:42 PM
RE: Does MyBB have future? - by DiegoPino - 2020-05-31, 01:54 PM
RE: Does MyBB have future? - by Darth Apple - 2020-05-31, 11:23 PM
RE: Does MyBB have future? - by Laird - 2020-06-02, 10:30 AM
RE: Does MyBB have future? - by Serpius - 2020-06-28, 01:53 AM
RE: Does MyBB have future? - by vbgamer45 - 2020-06-03, 06:36 PM
RE: Does MyBB have future? - by Laird - 2020-06-04, 09:46 AM
RE: Does MyBB have future? - by JoelR - 2020-06-26, 05:48 PM
RE: Does MyBB have future? - by Darth Apple - 2020-06-28, 02:08 AM
RE: Does MyBB have future? - by Furious - 2020-06-29, 12:54 AM
RE: Does MyBB have future? - by s3_gunzel - 2020-06-29, 02:46 AM
RE: Does MyBB have future? - by Johnny98 - 2020-06-30, 06:52 AM
RE: Does MyBB have future? - by s3_gunzel - 2020-06-30, 07:07 AM
RE: Does MyBB have future? - by DevLife - 2020-12-09, 06:34 PM
RE: Does MyBB have future? - by HopeGardner - 2020-12-09, 08:27 AM
RE: Does MyBB have future? - by DiegoPino - 2020-12-09, 08:17 PM

Forum Jump:


Users browsing this thread: 1 Guest(s)