Re^9: Ideas for "fixing" PerlMonks 1.0

[erzuuli]

I'm not very motivated to start a lengthy process if the monastery was not capable to hash the passwords in the first place.

Then don't. But don't then complain when others take the same attitude.

I need to know the main mailing interface of PM.

That's the sort of thing I was referring to when I said I'd help with any interfacing to the framework. Since I'm helping you, we'll use my preferred way. ;-)

I would need a Dev environment to test effectively.

Not going to happen (unfortunately). Is it a deal-breaker?

Do I have the possibility to copy code into a node and run it directly?

I will make you a new htmlcode node. You submit patches to it.

[LanX]

> Is it a deal-breaker?

I need to apply patches to the node in question to code efficiently, yes.

> Then don't. But don't then complain when others take the same attitude.

Ok if there are no plans to hash the passwords, why bother?

[erzuuli]

I need to apply patches to the node in question to code efficiently, yes.

You write 'em, we'll apply 'em. Yes it goes slower, but it will still be faster than the current pace of development!

Ok if there are no plans to hash the passwords, why bother?

What do you mean by "plans"? Obviously we'd all like to see improvements made. Simply goading the gods isn't how it happens. If you can provide coding & subject matter expertise, we can work together.

[LanX]

Ok, look.

If I can apply the patches on that isolated node it'll take me probably a week, considering all edge cases and the weirdness of the monastery. ¹

If I have to wait for you guys to act, it'll take a month at least.

Sorry, no!

Maybe I'll find time next year to locally set up the old download version of the Everything engine and can develop it locally on my box.

Provided Everything::MAIL.pm is the same. Then you'll get a full node in one go, without patch/dev history.

Or maybe etj will do better and faster.

On another note:

I've reported a serious security issue in 2019 and provided code to patch Everything.pm.

No matter how you patch it - I don't really care anymore if disabled or optional - please patch it.

Updates

¹) The necessity to document and test it included.

There is also injection detection logic to report if someone tried to manipulate the parameters.

It's also limiting the time window and reset attempts to a fixed number per interval to block DNS and brute force attacks.

We are talking about hundreds of LOC.