Skip to content
Snippets Groups Projects
  1. Nov 04, 2004
  2. Nov 03, 2004
  3. Nov 02, 2004
  4. Oct 20, 2004
  5. Oct 18, 2004
  6. Oct 16, 2004
  7. Oct 14, 2004
  8. Sep 17, 2004
  9. Jun 05, 2004
  10. May 30, 2004
  11. Apr 15, 2004
  12. Mar 19, 2004
  13. Jan 20, 2004
  14. Nov 26, 2003
  15. Nov 05, 2003
  16. Oct 26, 2003
  17. Oct 25, 2003
  18. Oct 16, 2003
  19. Oct 11, 2003
  20. Oct 09, 2003
  21. Sep 26, 2003
    • rswindell's avatar
      Server startup structures now include a private data pointer which is passed · ab579610
      rswindell authored
      back to callback functions (e.g. lputs, thread_up, etc). This allows servers
      to share the same callback functions, eliminating many nearly-identical
      functions. This was able to shave quite a bit of redundant code from ntsvcs.c.
      This feature is not utilized in sbbs (sbbscon.c) or sbbsctrl (mainformunit.cpp).
      ab579610
  22. Sep 16, 2003
  23. Sep 02, 2003
    • deuce's avatar
      Linux will now (sort of) run as a non-root user. After hours of trying · 772ac0b2
      deuce authored
      to track down the issue, I finally gave up... as a result, there is a new
      feature!
      
      Linux will no longer completely drop it's root privs (It never really did
      anyways, and you couldn't possibly make it... but now it does so even less)
      
      As a result, Linux can now recycle all servers when running as non-root.
      
      From a security standpoint, doing this is more secure than running as root,
      but less secure than the behaviour on POSIX.4 compliant pthreads.  Running
      the BBS as root means that if a user can create a file with the name of his
      choice, or pass *any* command through to a shell, that user will get root
      access to the machine.  Using the new behaviour, the user would need to
      trick the Synchronet binary itself into executing arbitrary and specially
      crafted code... probobly using the dreaded buffer overflow... of which
      there are probobly some in the web server code.  :-)  If the user can do
      this much more tricky feat, then the user gets root privs.  If not, the
      user will have to find something else to exploit on your system.
      
      Knowing that some *BSD users (surely not OpenBSD users though) will want to
      trade security for convenience, I stole a page out of the Sendmail book and
      implemented a "DONT_BLAME_SYNCHRONET" make option.  Compiling like this:
      gmake DONT_BLAME_SYNCHRONET=1
      
      Will implement this same behaviour on non-Linux platforms.  Allowing this
      partial security feature.
      772ac0b2
  24. Jul 30, 2003
  25. Jul 23, 2003
    • rswindell's avatar
      Fixed (finally) JavaScript object initialization segfaults when the JS runtime · 345eafda
      rswindell authored
      "max_bytes" value is insufficient for the number of configured items:
      by defining dynamically created objects and arrays as properties of child
      objects of the global object immediately after such objects are created,
      they are "implicitly rooted", protecting them from (unexpected) garbage
      collection. Now the initialization will simply fail with a nice "out of memory"
      error. This was a long-standing bug that rarely occurred in the wild.
      345eafda
  26. Jul 11, 2003
  27. Jul 04, 2003
  28. Jun 14, 2003
  29. Jun 13, 2003
  30. Jun 12, 2003
  31. Jun 07, 2003
  32. Jun 06, 2003
Loading