WTF Happened? Recent events FAQ

There are too many subforums. Please eliminate three.
Post Reply
Big Boss
User avatar
A tourist trap that can surpass Mystery Shack?
Rarity's Roughnecks
Posts: 105
Joined: Sat Oct 28, 2017 5:55 pm
Gender: Male
Location: Mother Base

WTF Happened? Recent events FAQ

Post by Big Boss (?) » Mon Oct 30, 2017 3:16 pm

So, what happened? Here's my hip and cool summary.

On October 28th, the forums/site mySQL database was hacked, either due to a Wordpress or phpBB vulnerability. The attackers wiped the user and posts table (but not before dumping the user table). Once we were made aware of the attack, we took the site down to evaluate the damage. Unfortunately, the prognosis was not good. SQL backups had a problem, and we would not be able to restore the forum to anywhere close to the present state. The oldest file backup was circa 2014 (since not much on the actual file side of the site had been changed except some images). This means that, unfortunately, a vast majority of content has been lost. In light of that, we decided to start a new forum from scratch. However, things are not as bleak as expected, and we'll address that further down in this post.

What, specifically, was compromised?

The front page and forums mySQL database. Filesystem was not accessed, as far as we can tell, and bronibooru was not touched. The database was completely compromised; theoretically they could have accessed any table but we do not have any evidence that they dumped the other tables. The users table is known to be dumped, other tables were cleared.

Were our passwords revealed?

The user table, which includes usernames, email addresses, and hashed passwords was dumped and leaked. phpBB hashes passwords, so that means plaintext passwords were not revealed. However, given enough effort those hashes could theoretically be cracked. I would recommend that if you shared your TRS password amongst other sites that you change those passwords ASAP. The userlist has been uploaded to haveibeenpwned so you can tell if you have been compromised.

Do I need to re-register?

Yes. Register a new account and an admin will approve it. Based on some previous knowledge we can try to confirm specific users to make sure someone doesn't gank your username.

Was Bronibooru affected?

No. Bronibooru ran on a separate database and was not compromised. We will be moving it over to the new host, but not at the moment. Passwords will be force-reset on Bronibooru.

What's the state of the site's hosting and ownership?

The site is hosted in a new, different Linode instance which is paid for by me. All relevant items for the site (domains, AWS content for broni) will be transferred to me. Once the transition period has ended, Cosmo will be admin emeritus and will not be involved in running or financing the site. VoidChicken will be stepping in to be a new technical admin. Some new staff may be brought on for technical assistance in some areas, but that will be handled down the line.

What will happen to threads I care(d) about?

Due to a great effort by many mods and volunteers, several threads have been archived from archive.org or google web cache for the site. Unfortunately, anything that bots couldn't see (such as the meetup forum) is lost except for 2014-backwards. These archived threads will be made available in some form soon. We've been considering some form of the 2014-era forum as an archive in some form, but that is a low priority at the moment.

When will the site be back up to full speed?

We don't know yet. The important thing is that, as far as posting function goes, the forum is basically ready to go but with some rough edges. Right now things like smileys are in an old state, and we're working to bring them all back.

Ranks are already back, but you will have to be reassigned your rank. I may try to implement user-selected ranks as well.

User profile fields (pronoun, gender, custom titles) are still a work in progress.

Themes will return, eventually, but they will need to be refactored to phpbb3 format.

What about the front page?

We have a front page? :gotcha:

But seriously, the live front page won't be coming back. Previous front page articles are currently accessible on archive.org. We may try to make a front page archive hosted here in the future, but that is low on priority. Not having wordpress on the site reduces our attack vectors considerably.

Is there any good news?

Yes, actually. The good news is that since we're fully on the latest phpbb, we can now use extensions and the default theme now has mobile support. We will try to adapt said mobile support to our normal themes. We're going to add some new plugins to give much-needed functionality, like tweet embedding and tapatalk support. There's also the chance to clean out some cruft, like old smileys and such.

Also, because people have expressed interest, I'll be setting up a Patreon for the costs of running the site/forum. Between the AWS, Linode, and other costs, I estimate the site is about $50/month. I am not looking to take in any more money than that, and if we have a surplus it would be reinvested back in some other way (e.g. a prize for a contest). I am capable of handling the costs of the forum, so it is not a problem for me to pick up the tab for a while.

I know it sucks that this happened, but I believe we can look at it as an opportunity to start fresh and move the site onwards and upwards. It's not old posts that make a place, it's the people, and I'd be happy to have everyone back and start anew.

Big Boss
User avatar
A tourist trap that can surpass Mystery Shack?
Rarity's Roughnecks
Posts: 105
Joined: Sat Oct 28, 2017 5:55 pm
Gender: Male
Location: Mother Base

Re: WTF Happened? Recent events FAQ

Post by Big Boss (?) » Sat Nov 04, 2017 7:06 am

Figured I would give a progress report:

Thanks to Void and Cosmo's hard efforts, the forum is now in a much more usable state than it was a few days ago. The themes are returning, but the prosilver-derived ones like Ponisummer and gala are coming first. Verb themes are coming later.

Many features like fixing ranks, custom titles, and other things have happened as well as placing users on the left.

Many smilies are back, but this will be an ongoing process.

If you need to be added to a usergroup or want/need a gangtag, please see DPC thread as I am adding things as time permits.

CosmogenicLily
Site Admin
Posts: 112
Joined: Sun Oct 29, 2017 4:34 pm
Gender: Female

Re: WTF Happened? Recent events FAQ

Post by CosmogenicLily (?) » Sun Nov 26, 2017 12:58 pm

Hey everyone, it's time for another update!

Styles

As you might have noticed, Shine is finally back, as are Strive, Play and Marble.

Shine

Click for Fullsize


Strive

Click for Fullsize


Play

Click for Fullsize


Marble

Click for Fullsize


We also now have three new entrants!

Love

Click for Fullsize


Race

Click for Fullsize


Learn

Click for Fullsize


Oh and uh... There is always this theme lurking about in the background...

Lisp

Click for Fullsize


Thanks as always to both Isaak and Kefka for their help with these themes.

Please note that everyone on Ponisilver has been automatically switched to Shine. If you would prefer to stay on Ponisilver, you can always switch back to it in the "Board preferences" section of your User Control Panel.

These themes are still works in progress, but should be reasonably stable enough at this time to live on. As always, the Forums Issues Thread in DPC is the place to leave your questions, concerns, and issues with the themes.

The Gem Mine

You may also have noticed that the Canterlot Gem Mine has been restored, as have The Jefferson Starship, LYAT: Love You and Tolerate and Rocks.

The first three have been restored with all pre-2014 threads, while Rocks has been recreated as best as possible thanks to the efforts of the Round Stable Archive Team (about 30 threads were unrecoverable). Where users have reregistered, posts have been assigned to them. Likewise, I have tried to ensure that intra-thread [ quote ] tags have been restored correctly (inter-thread [ quote ] tags are still broken).

If you have any issues with the restored threads, let us know in our DPC thread about them.

New Feature: The Media tag

Newly added to the forums is the [ media ] tag, which may be used to embed YouTube, Twitter, Imgur and Gfycat links directly into the forums (among other sites). The media tag is simple. Just drop your link in the middle of the tag like so:

Code: Select all

[media]https://www.youtube.com/watch?v=qQSz6gKdhO8[/media]
And it should just work!



You can also just put in a raw URL, and it should also be embedded upon posting:

Code: Select all

https://mobile.twitter.com/fyre_flye/status/289975870377054208?lang=en
Which will look something like this:



Note that, as part of these changes, the old [ youtube ] tag has been deprecated and will be automatically replaced with the [ media ] tag upon posting.

Next Steps

With these changes, most of the heavy lifting to restore the forums should be done and over with. Work is still needed to bootstrap the remaining Gem Mine threads recovered thanks to great efforts from the Round Stable Archive Team, and this work will continue for some time due to the necessarily incomplete nature of the recovered threads. I'll also be restoring select non-Gem-Mine threads from the pre-2014 forums that might help provide some context for the Gem-Mine threads and some other support work to make the Gem Mine more resilient to image hosts going down.

Aside from this work, however, I will begin winding down my involvement in the day-to-day technical aspects of the forums, passing the torch (and relevant technical details) to Kefka, Void Chicken, and anyone who might also take on the tasks of site maintenance.

It's been a great pleasure supporting you guys and helping this community grow from its very inception, when the original TVIV threads were closed, to the welcoming forums they are today. While I'll still be tinkering around the edges for a little while yet, and will probably still drop in from time to time, I just want to take the opportunity to thank everyone for making this place so great. It's been a pleasure. :twasnothin:

Big Boss
User avatar
A tourist trap that can surpass Mystery Shack?
Rarity's Roughnecks
Posts: 105
Joined: Sat Oct 28, 2017 5:55 pm
Gender: Male
Location: Mother Base

Re: WTF Happened? Recent events FAQ

Post by Big Boss (?) » Mon Nov 27, 2017 11:44 am

This thread is not for bug reporting or problems with features. Do not use it as such. Use the thread in DPC.

These posts will be moved eventually.

Post Reply