Originally by: CCP Sreegs

---

Originally by: Lubomir Penev

---

Originally by: CCP Sreegs

---

Originally by: Lubomir Penev

---

The best part about that dev blog : it's true, or at least we can't prove it false because the proofs are now offline and it won't come back online before getting the proper pen test and audit it should have had in the first place.

---

The blog never said there wasn't an audit. The blog also said you couldn't insert script.

---

I wasn't even critical, just commenting on the fact we got no choice but believe you as the particular forum version will never see the light of day again.

As for the audit that's the worrying part, if there was one, how could it miss two very classical OWASP top 10 vulns (this is actually generous, they are OWASP top 3 vulns)... It's not like the forum had so many entry points for possible XSS injection that exhaustive testing was impossible or even hard. Nobody used ground breaking stuff to break the new toy open, it was one guy with an hour to spare and an XSS cheat sheet (the injection part). So yes, as someone that was in the field pretty recently, I wonder how the forums passed a security audit if there was one. But yes, I know sometime the obvious escape the prying eyes of seasoned professionals, happens to everyone, even happened to me. But the sheer amount of uncaught stuff looks odd to me.

---

It looks odd to me too. This is why we have internal investigations. :) I had them do some pretty extensive testing to verify that we were properly filtering the script tags today, which was why the blog was delayed. Were we not filtering it I'd have said so.

---