IRC.com outlines its roadmap

Re:IRC.com outlines its roadmap by ryanlol on Sunday December 09, 2018 @01:16AM (#18639655)

Snoonet people seem to be heavily involved with IRC.com stuff, which isn't very surprising considering Andrew bought snoonet. In the past there have been some very credible accusations[1] from ex-snoonet operators claiming that snoonet operators spy on users messages.

I don't know if I'd trust IRC.com.

[1] https://bpaste.net/show/932b93fc2dce

  <rdv[swag]> ENOUGH
  <rdv[swag]> THIS IS MY NETWORK AND I WILL RUN IT THE WAY I WANT TO RUN IT
  <rdv[swag]> YOU CAN ALL QUIT FOR ALL I CARE

PIA decided to hire this person AFTER other network staff called him out for spying on users.

Oh and PIAs support site and customer DB were compromised using a deserialization vulnerability in kayako. They never bothered to publicly acknowledge this, clearly a very "privacy oriented" business.

Kayako seems to have taken down their page detailing this particular vulnerability. Their helpdesk product used to store users sessions as serialized objects in user-controlled cookies, allowing attackers to execute arbitrary code by just sticking an appropriate php object into their cookies.

Any automated auditing tool would've immediately discovered this bug, so clearly PIA just didn't bother.

The cookie looked like this, it's impossible to miss the serialized php object:

  Set-Cookie: SWIFT_client=a%3A1%3A%7Bs%3A15%3A%22templategroupid%22%3Bs%3A1%3A%221%22%3B%7D; expires=Wed, 28-Dec-2016 23:24:13 GMT; path=/; httponly

But hey, maybe their new CTO - Mark Karpeles - runs a tighter ship ;P

[ Parent | on HN ]

Re:IRC.com outlines its roadmap by SaberUK on Sunday December 09, 2018 @01:54PM (#18642517)

Full disclosure: i'm being paid to work on InspIRCd for use on the IRC.com network. This is my personal opinion not an official statement on behalf of my employer.

The IRC server software used by Snoonet, InspIRCd, does not contain any functionality for message interception (it doesn't even tell server operators the contents of a message that has matched a spam filter) and at least on the infrastructure I have access to Snoonet does not have any message interception capability either.

[ Parent | on HN ]

Re:IRC.com outlines its roadmap by ryanlol on Sunday December 09, 2018 @03:01PM (#18642932)

As an InspIRCd developer you must also be aware that it only takes minutes for anyone to patch an IRC daemon to log chats. I don't think the lack of such a feature in core inspircd indicates anything.

[ Parent | on HN ]

Re:IRC.com outlines its roadmap by SaberUK on Sunday December 09, 2018 @03:27PM (#18643071)

Whilst that is true as I have explicitly stated there is no intercept capability on the infrastructure that I have access to. If you're willing to believe some completely unverifiable logs dumped on a paste site over someone with access to IRC.com infrastructure then i'm not really sure what I can say to convince you otherwise.

You can use OTR for private IRC chats and an IRCv3 contributor is currently working on an end-to-end encryption system suitable for use in IRC channels so if you're concerned about your privacy you are welcome to use those.

[ Parent | on HN ]

Re:IRC.com outlines its roadmap by imode on Sunday December 09, 2018 @01:27AM (#18639694)

That's pretty damning. Glad I never went to Snoonet. Something seemed off about the network as a whole, and it appears that my assumptions were correct...

[ Parent | on HN ]

Re:IRC.com outlines its roadmap by techaddict009 on Sunday December 09, 2018 @05:27AM (#18640194)

MK the same man behind mt. gox?

[ Parent | on HN ]

Re:IRC.com outlines its roadmap by ryanlol on Sunday December 09, 2018 @05:50AM (#18640256)

Yes.

[ Parent | on HN ]

Re:IRC.com outlines its roadmap by IaisonQ on Monday December 10, 2018 @06:57AM (#18647230)

"Oh and PIAs support site and customer DB were compromised using a deserialization vulnerability in kayako."

Can you please detail when this was? I would assume based on your example in December 2016, however PIA Support wasn't using Kayako in December 2016. For clarity, I run PIA Support and one of the first things I did when I joined the company was replace Kayako.

[ Parent | on HN ]

Re:IRC.com outlines its roadmap by ryanlol on Monday December 10, 2018 @11:25AM (#18648976)

That cookie isn’t from PIA. It was a random example of the really obviously vulnerable fusion cookies I pulled by googling the cookie name.

Looking at some file timestamps on my laptop, I guess this was around feb or april 2015?

[ Parent | on HN ]

Re:IRC.com outlines its roadmap by meowface on Sunday December 09, 2018 @01:14PM (#18642293)

Even if you removed every other part of this comment, Mark Karpeles as CTO is more than enough by itself to stay very far away from this. Might as well hire Bernie Madoff as CFO of your new investment startup.

[ Parent | on HN ]

Re:IRC.com outlines its roadmap by prawnsalad on Sunday December 09, 2018 @06:47PM (#18644090)

As the CEO of IRC.com, I can say that Mark Karpeles has nothing to do with the project nor does he have access to any of the infrastructure IRC.com runs on. His work goes towards other projects that London Trust Media has running.

I’ve been running the open source kiwiirc.com project for around 7 years and have always been very careful of who has access to what and so far has been clear of any issues. Hopefully I can now bring the same scrutiny and planning to IRC.com too!

[ Parent | on HN ]

Re:IRC.com outlines its roadmap by meowface on Monday December 10, 2018 @01:16AM (#18645636)

Thanks for the information. I guess I just don't see how he's employable at all after what happened (even if you assume he had no malicious intent, which is still pretty unknown).

I use kiwiirc.com regularly and love it, by the way. Great work.

[ Parent | on HN ]