Will it come back, or did Hiroshimoot fuck up things for good this time?
In case you didn't already hear it all over the web, the 4chons server has been hacked because the software was literally years old.

In addition to actually playing videogames now I am trying out ourchan. It is slow right now, but such is life.

https://tech.slashdot.org/story/25/04/16/0012230/ 4chan-has-been-down-since-monday-night-after-prett y-comprehensive-own

Someone in the comments describes the method as such:
>4chan allows uploading PDF to certain boards (/gd/, /po/, /qst/, /sci/, /tg/)
>They neglected to verify that the uploaded file is actually a PDF file. As such, PostScript files, containing PostScript drawing commands, can be uploaded.
>Said PostScript file will be passed into Ghostscript to generate a thumbnail image.
>The version of Ghostscript that 4chan uses is from 2012, so it is trivial to exploit.
>From there, we exploit a mistaken suid binary to elevate to the global user.
I don't know whether this is true or not.

I started archiving heyuri's /f/ (pages, files, replies and reply files) on a whim when its latest incarnation went up in case Ants is interested, but it's unnecessary because the thread/page limit (if there is any) hasn't been hit so far. I mostly just want all the files to be covered by swfchan.

We're fucking back bros

has also said that /f/ is not coming back

I was going to wait for when /f/ returned, but since that isn't happening, does anyone know the filename for the JP Spelunker flash that used a dance song (Middle of it had a guy just go 'Ahhhhhhhhh! Come on!'?
I thought it would be under Spelunker or the moonrunes, but can't find anything.

Welp. Where do we go now? Heyuri or stay here on swfchan? swfchan has always been our second home but heyuri has a more 4/f/ like appearance/structure.

I am honestly, greatly pissed at this decision. All they have to do is serve swfs and the execution is most definitely handled client side. If they're worried about that, they can just include the link to the ruffle extension in a standard embed player and not serve it themselves. Anybody who wants to run them can just install ruffle and run it. And just sandbox /f/ from the rest of the infrastructure. It isn't very active so even if you had separate credentials for it and ran it in a VM, I doubt that'll hinder administration. If /f/ then gets hacked, it'll only be /f/ and we can wait out till they slowly restore it.

All they need to do is to restrict filesystem access server side if they're paranoid, given they don't allow multifile swfs anyway. If they can't write a 10 line bash script to do that, they should just close the whole fucking site.

Can you tell us if flash really is that insecure that you have to protect against it and what all mitigations you take if that's true?

>>103715
Flash doesn't run on the local plugin anymore, how is it insecure even for the client??
It does still, but that doesn't matter it was just the usual OMG SECURITY excuse used since the EOL of flash.
A nice sandbox and flash plugin in browser would be no security issue to the server.

>>103740
The big guy himself. Mr. Bossman admin legend of swfchan.

>>103750
Honestly Ants if you're reading this I would still recommend you go look at the low hanging fruit, at some point you probably wrote something on this site that sticks a swf filename into a command to run.
Have you triple checked that you are sanitizing it correctly?
Do you strip ../ and such? Do you run the command in a shell or execute the target binary directly? If doing it with a shell did you strip inline execution characters like `` and $() ?
If the target binary takes arguments are you making sure that you don't let the swf filename contain things like -- or - to set flags?
The Flash thumbnailing is probably a vulnerability but it would take someone a lot more effort than some of the low hanging fruit like that, this coming from someone who wrote Flash exploits against Adobe Flash player.
Do you support any other things on this site besides .swfs? I thought I remembered reading something about people uploading .rars.
Are those handled by you manually putting them in the archive or are they automatically parsed and if so have you checked the same things as above on this part of the system? etc...

As for the anti virus stuff I wouldn't bother, that stuff mostly just catches stuff being spammed everywhere. Not stuff made buy someone trying things one at a time against your site. You time is better spent cleaning up tech debit on the backend.

Also https would be nice, but that's just for our privacy. (I would still love if you could setup https though, this is I think the only site that I visit occasionally that doesn't support https)

You could even just grab the draw surface of the VM program instead of waiting for whatever is running inside of it to grab and write a picture but that would need altering this part of the scripting more.