Hello everyone. I have just installed SMF for a web designers' community site and I have some concerns regarding the copyright messages generated by SMF. The site will contain several copyright notices including the one generated by SMF. All the other copyright messages are fine except for the SMF copyright which muddles the other copyright messages.
There have been a few questions regarding *removing* the copyright message generated by the software. The answer to all those questions have been in the line of "you cannot remove the copyright messages". I am aware that the SMF license prohibits removal of the copyright notices that are generated by the software. That's okay. Lewis Media is well within its rights to have those clauses in their license.
I have read the thread found here:
http://www.simplemachines.org/community/index.php?topic=36056.0
However it's already too watered down that I felt the best course of action is to start a new thread. So here goes...
My main concern is how the copyright message is worded. Another concern is with security (explained later). Here is an example:
Some Forum on Some Site | Powered by SMF 1.1 Beta 3.
© 2001-2005, Lewis Media. All Rights Reserved.
It is not clear here what this copyright message is acknowledging. Does it mean that:
1. Lewis Media owns the copyright to SMF;
or
2. Lewis Media owns the copyright to the "Some Forum on Some Site" forum and its contents;
or
3. Lewis Media owns the copryight to the whole site itself;
I already know that the correct interpretation is #1 here. But to casual visitors to the site, the interpretation remains open to either 1, 2, or 3. I am also aware that one can also add one's copyright message (i.e. the copyright to the site itself). But that would only confuse things even more. Now there will be two copyright claims on the same page!
My proposal is to reword the copyright message generated by SMF as such:
Some Forum on Some Site | Powered by SMF (Simple Machines Forum)
SMF is © 2001-2005, Lewis Media. All Rights Reserved.
This effectively disambiguates the copyright notice and makes it possible to place several copyright claims on the same page without muddling the other claims.
Note that I removed the version number here on purpose. Which brings me to my second concern: security.
As with the recent phpBB security debacle, advertising the software version number increases the likelihood that SMF sites will also be hax0red. Eventually, SMF will replace phpBB (unless the phpBB team get their act together). By then, SMF will be the new target. Kiddies will download and install SMF on their local XAMPP installation and start to poke around to find holes and ways of exploiting them. Once they do, all that is needed is to search for the string "Powered by SMF x.x.x" to find vulnerable sites. Easy because of the "sticky-copyright" clause in the license. You know what will happen next...
So hopefully the devs consider this request and include it in the next release. I am sure that it will satisfy all concerned parties, even ones who find the "sticky-copyright" clause in the license too restrictive. In the meantime, I hope that it is okay with the devs if I reword the copyright message to the second example given above.
--
J. Baller Esq.
I cant really say anything about the copyright notices, but about the security points. I know others have removed the version number just to be safe, but what phpBB and others dont have is the same development skill and logic of the SMF team, ever if SMF is hacked/exploited it only takes a very short time for the development team to quickly repair that small bit of code, and release a full patch into the Package Manager. A quick patch, a quick flick of a switch, SMF calls home, SMF goes nuts telling you about updates. All mods still working away, everything just purring along nicely. The way in which SMF conducts itself is a lot more secure than phpBB. Even the way in which versions are released, by going down a ladder to get to the normal users, it allows a huge ammount of time to squash bugs which could otherwise be exploits.
Quote from: Trekkie101 on July 16, 2005, 06:39:40 AM
but what phpBB and others dont have is the same development skill and logic of the SMF team, ever if SMF is hacked/exploited it only takes a very short time for the development team to quickly repair that small bit of code, and release a full patch into the Package Manager. A quick patch, a quick flick of a switch, SMF calls home, SMF goes nuts telling you about updates. All mods still working away, everything just purring along nicely. The way in which SMF conducts itself is a lot more secure than phpBB. Even the way in which versions are released, by going down a ladder to get to the normal users, it allows a huge ammount of time to squash bugs which could otherwise be exploits.
Yes but this is assuming that
every SMF board is patched at the exact same time that the patch is released, which is impossible. We all live in different timezones and it could very well be that I am asleep when an exploitable bug was discovered by kiddies, they write the exploit and search using everyone's favorite search engine for the SMF copyright phrase+version number. They find my board and they target it. I wake up the next day and my board is hax0red.
If I am lucky, the exploit did not allow them to changed my admin password and allow me to download the patch.
If I am lucky maybe they haven't messed up the system enough and the patch will work.
If I am lucky.
And mind you,
some kiddies can more subtle and not just deface your site straight off. They can plant a mass mailer and use your server as a spambot. Or just prepare your machine for a rootkit insertion. In this case, you will never know that it was through SMF that your machine got compromised, and neither will the devs. Unless of course the exploit becomes so widespread that it gets noticed and finally fixed. But by then, it could already be too late for you.
It is not right to downplay the issue because you have total confidence in the developers and the release process. I have total confidence in them as well. But security is still at the top of my priorities when maintaining a website. It is far better to use pre-emptive and proactive measures such as not displaying the version number of the software in public than it is to be passive and reactive.
And as for the copyright messages, I certainly do hope the devs and Lewis Media do consider the rewording. I could reword it myself in
my installation. But that would be in violation of
their terms. If that is not acceptable to them, then I propose that they provide a list of
acceptable reworded versions and certainly an FAQ or something with regards to this. I am sure this issue will come up over and over again.
The current copyright message is not that totally
ambiguous when displayed on its own as explained in my initial posting. It is not that
I have trouble understanding it. It is because when it is thrown in with other copyright messages on the same page, the SMF copyright message muddles everything because of its ambiguity.
And btw, IAALS :)
--
J. Baller Esq.
I completely understand what you mean, and hope the day an exploit does appear we can all patch fast.
You can remove the version by removing it from index.php.
I actually thought it was against the forum licence to interfere with any part of the notice.
And the concern about version number is absolutely right - simply helps hackers, not users.
How about something like this?
Forum powered by SMF 3.1.2 © Lewis Media. All Rights Reserved.
(SMF & Lewis Media are links)
Quote from: Cerberus on July 18, 2005, 06:15:05 AM
How about something like this?
Forum powered by SMF 3.1.2 © Lewis Media. All Rights Reserved.
(SMF & Lewis Media are links)
That would be acceptable too. It would even be better if the devs could provide a way for users to configure the display of the copyright message. Some options come to mind:
1. Show/Hide SMF version number.
2. Select which copyright message format they want. Devs and Lewis Media could provide a list of accepted message formats.
I would prefer that there would be a way to select between different versions of the copyright message, at least when SMF generates the message it will be one of the approved versions.
--
J. Baller Esq.
Quote from: NewUsername on July 18, 2005, 12:16:37 PM
...
It would even be better if the devs could provide a way for users to configure the display of the copyright message. Some options come to mind:
1. Show/Hide SMF version number.
2. Select which copyright message format they want. Devs and Lewis Media could provide a list of accepted message formats.
I would prefer that there would be a way to select between different versions of the copyright message, at least when SMF generates the message it will be one of the approved versions.
--
J. Baller Esq.
I think that's an excellent suggestion, and would keep things simple, as opposed to member requests for alterations
Quote from: NewUsername on July 18, 2005, 12:16:37 PM
Quote from: Cerberus on July 18, 2005, 06:15:05 AM
How about something like this?
Forum powered by SMF 3.1.2 © Lewis Media. All Rights Reserved.
(SMF & Lewis Media are links)
That would be acceptable too. It would even be better if the devs could provide a way for users to configure the display of the copyright message. Some options come to mind:
1. Show/Hide SMF version number.
2. Select which copyright message format they want. Devs and Lewis Media could provide a list of accepted message formats.
I would prefer that there would be a way to select between different versions of the copyright message, at least when SMF generates the message it will be one of the approved versions.
--
J. Baller Esq.
Nice idea, post in features and request? I'd use this feature.
Let's wait for the devs' opinion on the matter :)
Quote from: Cerberus on July 18, 2005, 12:44:58 PM
Let's wait for the devs' opinion on the matter :)
Yeah, hence why I said maybe post it in features and request :) It'll be cool to see what the dev's think of this idea. It could be useful for some, or at least I think giving people the option to hide the version number is a good idea.
Quote from: I, Brian on July 18, 2005, 06:00:55 AM
And the concern about version number is absolutely right - simply helps hackers, not users.
I disagree, if people don't upgrade then they are still at risk, hiding the version number is giving them a false sence of security, having the version displayed makes it far easier to provide support, the ammount of people that don't bothered to mention what version they are running is getting silly.
Quote from: Cerberus on July 18, 2005, 06:15:05 AM
How about something like this?
Forum powered by SMF 3.1.2 © Lewis Media. All Rights Reserved.
(SMF & Lewis Media are links)
That would probably be the best option :).
Quote from: Ben_S on July 18, 2005, 12:56:56 PM
I disagree, if people don't upgrade then they are still at risk, hiding the version number is giving them a false sence of security, having the version displayed makes it far easier to provide support, the ammount of people that don't bothered to mention what version they are running is getting silly.
But people can't be online 24-7 and upgrade the forum immediately when an update is released :(. Let's suppose I'm on a 2 weeks vacation and a critical update is released. Scriptkiddies may attack and even hack my forum if they do know that my version has that hole.
hehe.. guys, am I paranoic? ;D
yes, but automatic updates is just stupid... the frist thing I do with any software (Especially windows!) that has auto-update is TURN IT OFF! There is absolutely no reason that any software should be doing anything to my system (or in this case, my site) without *ME* intitiating the action.
If you're on a 2 week vacation, then make a backup of your site before you go.... or have a Cron job that does a streaming backup...
What would you do on that same vacation if your host had connectivity problems?
If I were a script kiddy, I'd probably search for forums that aren't displaying the version number personally.
Quote from: Kindred on July 18, 2005, 01:50:36 PM
yes, but automatic updates is just stupid... the frist thing I do with any software (Especially windows!) that has auto-update is TURN IT OFF! There is absolutely no reason that any software should be doing anything to my system (or in this case, my site) without *ME* intitiating the action.
If you're on a 2 week vacation, then make a backup of your site before you go.... or have a Cron job that does a streaming backup...
What would you do on that same vacation if your host had connectivity problems?
In fact I don't use them :)
I have regular backups as well, but I'm really concerned about security and server's uptime.
Quote from: Ben_S on July 18, 2005, 02:06:04 PM
If I were a script kiddy, I'd probably search for forums that aren't displaying the version number personally.
Why?
In order to try out all the exploits discovered since the 1st version os SMF has been released?
IMHO it's too complicated for them ;)
Quote from: Cerberus on July 18, 2005, 02:23:39 PM
In order to try out all the exploits discovered since the 1st version os SMF has been released?
IMHO it's too complicated for them ;)
How many is it, about 2 maybe 3? No time at all.
Quote from: Ben_S on July 18, 2005, 03:01:34 PM
How many is it, about 2 maybe 3? No time at all.
Really?
I thought there're more exploits ::)
I found this: http://www.simplemachines.org/community/index.php?topic=28315.0
Quote from: UnknownAs the license says, you are not allowed to modify the copyright statement. You are more than welcome to add above or below it, but I'm afraid we simply don't allow any changes to the statement itself except by very special exception./quote]
owned.
It really is common courtesy for script developers to allow people to remove the version number. Every script I have used allows this, some don't even ship with Version Number showing.
I'm not here to debate if this helps at all, it doesn't prevent you being hacked, but sure stops lazy Script Kiddies searching for targets through Google.
Invision Board which is paid software, and charges for Copyright Removal, allows you to remove the Version Number.
SMF needs to wake up to the fact that Search Engines are used to find expoitable boards, I doubt unless you run a porn forum many script kiddies would know about your forums - so removing a version number can atleast shield you from the Lazy Script Kiddies.
Even if you remove the version number, a script would only need about 3 seconds on each site to carry out the exploit, so it would be just as easy searcging for
http://www.google.com/search?hs=y69&hl=en&lr=&c2coff=1&client=firefox&rls=org.mozilla%3Aen-US%3Aunofficial&q=Powered+by+SMF&btnG=Search
"Powered by SMF" and it will still show all the results.
Quote from: Sanosuke on July 18, 2005, 11:05:54 PM
I found this: http://www.simplemachines.org/community/index.php?topic=28315.0
Quote from: UnknownAs the license says, you are not allowed to modify the copyright statement. You are more than welcome to add above or below it, but I'm afraid we simply don't allow any changes to the statement itself except by very special exception.
:o :(
You can remove the version number if you like, but don't expect to get as good support from us if you do.
You cannot change the "format" of the copyright statement. If you don't like it, use another software.
-[Unknown]
Quote from: [Unknown] on July 19, 2005, 07:51:48 PM
You can remove the version number if you like, but don't expect to get as good support from us if you do.
Now what's that supposed to mean? Anyway, the point is moot with regards to removing the version number as Ben_S has kindly pointed out.
Quote from: [Unknown] on July 19, 2005, 07:51:48 PM
You cannot change the "format" of the copyright statement. If you don't like it, use another software.
-[Unknown]
Well I guess that settles it then. Maybe this should be in a FAQ somewhere, perhaps with a less hostile answer like that. I believe this can be settled in a another manner than telling off users of your software like this. How about providing two or three alternate
and approved by Lewis Media versions of the copyright message? I started this topic because the SMF copyright, when thrown in with other copyright messages on the same page muddles everything.
Try this on the same page:
Some Company Public Forum | Powered by SMF 1.1 Beta 3 Public.
© 2001-2005, Lewis Media. All Rights Reserved.
Contents Copyright © 2003 - 2005 Some Company. All Rights Reserved.
Contents Copyright © 2001 - 2003 Some Other Company Who We Bought This Site From. All Rights Reserved.
All I am saying is that there is a need to disambiguate when it comes to mixing
your copyright claims to
your software with
my copyright claims to
my site's content. It does not matter with the placement of the lines since they all appear on the same page, therefore they apply to everything on that page. It is clear what the latter two claims are claiming. But what about the SMF claim?
--
J. Baller Esq.
Quote from: Sanosuke on July 18, 2005, 11:05:54 PM
I found this: http://www.simplemachines.org/community/index.php?topic=28315.0
Quote from: UnknownAs the license says, you are not allowed to modify the copyright statement. You are more than welcome to add above or below it, but I'm afraid we simply don't allow any changes to the statement itself except by very special exception.
emphasis in red above is mine.
As an addendum to my last posting, since it is forbidden to change or reword the copyright notice for SMF on your own. How about the following, which is based on my interpretation of the statement by [Unknown]
Contents Copyright © 2003 - 2005 Some Company. All Rights Reserved.
Contents Copyright © 2001 - 2003 Some Other Company Who We Bought This Site From. All Rights Reserved.
The following claim applies only to the Simple Machines Forum sofware used in this site:
Some Company Public Forum | Powered by SMF 1.1 Beta 3 Public.
© 2001-2005, Lewis Media. All Rights Reserved.
This can be implemented in the skin without having to tangle with the SMF code itself to modify the copyright wording. I find this reasonable enough. Though I still think the best course of action is to be able to select between two or three
approved copyright messages.
I hope [Unknown] and Lewis Media will also find this reasonable. If not then I will take [Unknown]'s response to this thread into consideration.
--
J. Baller Esq.
QuoteWell I guess that settles it then. Maybe this should be in a FAQ somewhere, perhaps with a less hostile answer like that.
From license.txt...
Quote1. Permission is hereby granted to use, copy, modify and/or distribute this
Package, provided that:
a. All copyright notices within source files and as generated by the
Software as output are retained, unchanged.
...
2. You may make Modifications to this Package or a derivative of it, and
distribute your Modifications in a form that is separate from the Package,
such as patches. The following restrictions apply to Modifications:
a. A Modification must not alter or remove any copyright notices in
the Software or Package, generated or otherwise.
...
5. This Agreement will terminate automatically if you fail to comply with the
limitations described herein. Upon termination, you must destroy all copies
of this Package, the Software, and any derivatives within 48 hours.
That seems pretty clear to me.
Quote from: kegobeer on July 21, 2005, 01:28:54 PM
QuoteWell I guess that settles it then. Maybe this should be in a FAQ somewhere, perhaps with a less hostile answer like that.
From license.txt...
Quote1. Permission is hereby granted to use, copy, modify and/or distribute this
Package, provided that:
a. All copyright notices within source files and as generated by the
Software as output are retained, unchanged.
...
2. You may make Modifications to this Package or a derivative of it, and
distribute your Modifications in a form that is separate from the Package,
such as patches. The following restrictions apply to Modifications:
a. A Modification must not alter or remove any copyright notices in
the Software or Package, generated or otherwise.
...
5. This Agreement will terminate automatically if you fail to comply with the
limitations described herein. Upon termination, you must destroy all copies
of this Package, the Software, and any derivatives within 48 hours.
That seems pretty clear to me.
::)
You failed to put into context what is at issue here and simply did a knee-jerk posting.
Yes I am fully aware of what is on the license. If you have read the entire thread instead of just glossing over it, you would have understood what is at issue here:
on a page with multiple copyrights, the SMF copyright is ambiguous and interferes with the other copyright claims on the same page.
Henceforth this thread which asks for either:
a.) permission from the devs and Lewis Media to modify the SMF copyright claim to a less ambiguous notice or b.) give the SMF user / administrator the ability to select from two or more reworded claims as provided by the devs or Lewis Media.
I can also put that in "lawyerese" if you want. :P
I certainly hope the devs or Lewis Media would give us option B since option A is definitely out of the question. I am waiting for their response to my previous post.
--
J. Baller Esq.
and your reaction is just as knee-jerk and quite a bit more condescending... kegobeer's comment was specifically directed to ONE comment of yours:
Quote
Well I guess that settles it then. Maybe this should be in a FAQ somewhere, perhaps with a less hostile answer like that.
to which he was pointing out that it is fairly clear and unambiguous... so why do you think we need an FAQ?
As for the interference or confusion with other copyrights, I have to disagree with you... I think it's fairly clear what the copyright (as listed) reflects... adding one line, above or below stating "content copyright XXX" works perfectly well, IMO...
my god it's an f'ing copyright. Who cares how it's worded? You get free top notch bulletinboard software, and all the developers ask for in return is to have a few words at the bottom of your page. Leave it like it is, it isnt hurting anyone.
Quote from: Tippmaster on July 21, 2005, 05:10:58 PM
my god it's an f'ing copyright. Who cares how it's worded?
I do. It's called
proper attribution and I care so much about that. I can see where this discussion is going. My point has already been watered down beyond reason. I guess if my avatar said "Charter Member" my comments and suggestions would have gotten better reception. But judging from what reaction I've got, and one from the lead developer no less, I would rather spend my money elsewhere.
Best of luck to all of you.
:-X
--
J. Baller Esq.
Quote from: NewUsername on July 21, 2005, 05:39:33 PM
Quote from: Tippmaster on July 21, 2005, 05:10:58 PM
my god it's an f'ing copyright. Who cares how it's worded?
I do. It's called proper attribution and I care so much about that. I can see where this discussion is going. My point has already been watered down beyond reason. I guess if my avatar said "Charter Member" my comments and suggestions would have gotten better reception. But judging from what reaction I've got, and one from the lead developer no less, I would rather spend my money elsewhere.
Best of luck to all of you.
:-X
--
J. Baller Esq.
Now thats not very fair. I stand here, a non-charter member, and I haven't once felt that a Charter Member has been given more in the way of being listened to just because of their donation to SMF. Everything ive ever posted has been read and usually responded to by a team member and I have always felt I was valued in my comments.
Theres already a lot of history to the copyright, do a search, youll see it all. Usually in the end the team and a user make ends meet to a state of satisfaction. Simple Machines as one thing of us, and thats to respect their copyright.
And from what ive seen and heard, you can add "Content of posts copyright scooby doo" if you want, just above, or below the SMF copyright.
I believe SMF does have a lawyer at their disposal - I would even hazard a guess that their lawyer has looked at the copyright statement. If that is indeed the case I'm sure their lawyer would have pointed out any particular problems with it. I'm sure one of the devs will correct me if I am incorrect.
Oh, and as Kindred pointed out, my reply was directed at one statement in your post, but you must have glossed over it instead of reading the entire post. ::)
Quote from: [Unknown] on July 19, 2005, 07:51:48 PM
You cannot change the "format" of the copyright statement. If you don't like it, use another software.
-[Unknown]
Nevertheless, I suppose we may add text before/after?
ATM I'm working on a new site (for a circle of friends, nothing fancy ;)) which will be running SMF & MKP. I would like to have a similar copyright:
© Site name
Site powered by MKPortal | Board powered by SMF © Lewis Media. All Rights Reserved.
Is it ok? I've just removed the years and modified some commas.
Simple Machines Community Forum | Powered by SMF 1.1 Beta 3 Public.
©
2001-2005, Lewis Media. All Rights Reserved.
Of course I left the links intact ;)
I'll leave it up to [unknown] for the final word... but I would say that that actually changes the copyright...
As I think we have beaten to death in this and the other copyright post, you are not allowed to change the copyright in any way, shape or form.
Adding text before or after is NOT what you did...
This text must remain unchanged:
Simple Machines Community Forum | Powered by SMF 1.1 Beta 3 Public.
© 2001-2005, Lewis Media. All Rights Reserved.
So, you could do THIS:
Content © 2005 Site name | Powered by MKPortal
Simple Machines Community Forum | Powered by SMF 1.1 Beta 3 Public.
© 2001-2005, Lewis Media. All Rights Reserved.
The years MUST be included in a copyright statement.
(why would it be OK to remove the years form the SMF copyright when you make a year statement in your site copyright?)
Quote from: Kindred on August 02, 2005, 01:52:50 PM
Adding text before or after is NOT what you did...
Sorry for not being clear enough. There're 2 questions on my post above. I've divided them now :)
Quote
The years MUST be included in a copyright statement.
(why would it be OK to remove the years form the SMF copyright when you make a year staement in your site copyright?)
I'd like to remove all the years :)
Quote from: Kindred on August 02, 2005, 01:52:50 PM
As I think we have beaten to deat in this and the other copyright post, you are not allowed to change the copyright in any way, shape or form.
I see :)
Just a thought: can we use an image with the copyright text? :)
Quote from: Cerberus on August 02, 2005, 02:09:14 PM
I'd like to remove all the years :)
Why?
Quote from: Cerberus on August 02, 2005, 02:09:14 PM
Just a thought: can we use an image with the copyright text? :)
No.
-[Unknown]
after a few months of research, i have put together a formula that will answer all copywrite questions.
Change + Copyright = No.
I know it looks complicated, but do not worry. It will click eventually.
Quote from: Tippmaster on August 02, 2005, 05:30:10 PM
after a few months of research, i have put together a formula that will answer all copywrite questions.
Change + Copywrite = No.
I know it looks complicated, but do not worry. It will click eventually.
Ermm... except it's copyright, the right to copy (more than that but basically), not copywrite... the ability to write to copies...? Incidentally, you can change copies of the source code, just not the copyright statement.
-[Unknown]
haha. oops. :-[
Has there been any changes/progress on this front? I agree 100% with the thread starter. It is plain stupid to leave the version number in the footer. Yes you will argue it takes a script kiddie 5minutes to test for all known exploits, but you're taking the narrow view.
Think of how many phpBB boards there are out there. How long has phpBB been around? What's the oldest version you can find out there? How many exploits are available for that version? Can you still get all the exploits since the first? Would you waste your time to do it when there's plenty of boards vulnerable to the lastest exploits?
There is going to be thousands and thousands of SMF installs in the future, and not everyone is like the people on this board that will tend to their boards 24/7, and get paged to wake up when there are updates. Many people have jobs, lives outside their boards. Hell many people just setup a board and never touch it for years.
These 'outdated boards' will eventually give SMF a bad rep. And don't be naive and think 'SMF Coders are Gods! They don't make mistakes like phpBB coders!'--because that's the biggest load of ******. There will be holes in it no matter who is coding it. Think SMF coders are better than NASA engineers who are trained never ever to fail? Well even NASA ******s up.
So to summarize
1) Version numbers will be beacons for hackers in the coming months/years.
2) There WILL BE EXPLOITS for SMF in the future--don't be naive.
3) The people who haven't removed their version numbers will be the easiest targets.
4) Yes removing your version number doesn't make you invulnerable, but it will get rid of 98% of the 'script kiddies' out there.
5) If everyone has their version numbers removed, it increases the effort of finding and successfully hacking sites by at least 20 fold. You can no longer search for vulnerable installs, you need to attempt to crack every single one.
As for the copyright, I agree it makes it seem like lewis media owns your site, domain, graphics and content. I think this is wrong.
I also agree it would be very beneficial to users to choose from 3-4 differently styled/worded copyrights approved by lewis media. This is a very silly thing to be stubborn about.
Change + Copyright = No.
Quote from: Tippmaster on August 09, 2005, 02:17:26 AM
Change + Copyright = No.
Yes, very clever.
- No + Change + Copyright = 0
sheesh.... what is so bloody hard to understand or comply with regarding this copyright?
Agentbob, I believe the SMF team have stated (multiple times) the reason that the version is included... and the reason that it will continue to be included.
You are correct, there are some script kiddies out there who may attempt to search for a specific version of SMF once a hack is found. With the SMF team's response, the hacks are closed, usually before they actually happen. However, I would rebut your argument and state that it is the repsonsibility of the owner of the site to make certain that his/her site is up to date and as protected as possible.
With the SMF Package system, communicating an important update becomes simple and does not rely on the owner to come to SMF and check.... only to view their own site on a regular basis (which EVERY admin should do, anyway). And installing the update consists of maybe 3 clicks on their own site...
As for the other thing.... it has been stated (again, multiple times) that adding text above and/or below the copyright is permissible....
So, feel free to clarify the forum vs site copyrights by doing so...
Have you ever looked at the FAQ or Policy? so you could see where lies the copyright :)
best regards
http://www.freerolls.dk (http://www.freerolls.dk)
Quote from: btv on August 09, 2005, 11:10:10 AM
Have you ever looked at the FAQ or Policy? so you could see where lies the copyright :)
btv, Who were you responding to with that?
be clear who you are addressing such comments to....
agentbob,
It has been said repeatidly that you may remove the version number if you wish. If you feel that the wording is unclear add some stuff above or below it to clarify. Such as:
Forum Copyright Information
Powered By SMF
© 2001-2005, Lewis Media. All Rights Reserved.
Website Copyright Information
blah blah blah blah
bleh bleh bleh bleh
There you've now cleared it up and kept the copyright information the same.
Is it okay to "un center" the copyright? The text is still displayed, exactly the same. I just thought it would look better to have all the "powered by" and "valid" logos to one side of the copyright. So now, my copyright is shifted to the right of the page. This is perfectly okay, right?
Quote from: Tippmaster on August 10, 2005, 02:20:09 AM
Is it okay to "un center" the copyright? The text is still displayed, exactly the same. I just thought it would look better to have all the "powered by" and "valid" logos to one side of the copyright. So now, my copyright is shifted to the right of the page. This is perfectly okay, right?
Yes. It is done with the "Comic" theme used as an option on these support forums.
Would it be possible to use this as a copyright:
Powered by SMF 1.0.5 © 2001-2005, Lewis Media. All Rights Reserved.
No re-wording there just removed the board name, a comma and a <br /> tag.
I know it's long but it may come in handy for me.
Quote from: nesianstyles on August 10, 2005, 04:11:14 PM
Would it be possible to use this as a copyright:
Powered by SMF 1.0.5 © 2001-2005, Lewis Media. All Rights Reserved.
No re-wording there just removed the board name, a comma and a <br /> tag.
I know it's long but it may come in handy for me.
Do you really think so...
Unless it has changed:
I asked before and the answer I got was that the forum name is NOT part of the copyright and thus may be removed.
In fact from http://www.simplemachines.org/community/index.php?topic=34184.0 [Unknown] answered the question about the line break (its ok).
And from http://www.simplemachines.org/community/index.php?topic=33879.0 both [Unknown] and Joseph Fung both answer about removing the board name (its ok).
Perfect.
Quote
Site Contents and Design © 2005 Example.com
Powered by SMF. © 2001-2005, Lewis Media. All Rights Reserved.
I think that's perfectly reasonable, gives credit, is less ambiguous and provides extra security--no matter how little that may be.
cool :)
Quote from: agentbob on August 10, 2005, 09:30:21 PM
I think that's perfectly reasonable, gives credit, is less ambiguous and provides extra security--no matter how little that may be.
But, if you make this change, I assume you plan to post your version number expressly with every support topic you post here, every time.
-[Unknown]
How do I change it?
Extra security? Why the hell not just update? hello?
and didnt you see the google search results? That's how the kiddies find vulnerabilities. Not by randomly visiting different forums looking for an out of date version...at least, that's what i would do...
Extra security? pffft...
Quote from: Tippmaster on August 10, 2005, 10:51:14 PM
Extra security? Why the hell not just update? hello?
and didnt you see the google search results? That's how the kiddies find vulnerabilities. Not by randomly visiting different forums looking for an out of date version...at least, that's what i would do...
Extra security? pffft...
Every little bit helps.
not really.
Quote from: Tippmaster on August 10, 2005, 11:27:46 PM
not really.
You are evil. You do not believe in security.
It does. Many scripts using search engines look for a version number which can be hacked.
It may not really do anything, but once a exploit comes out many hackers will try and use it.
It may help hackers to find vulnerable SMF installations, but it also helps us to track outdated installs and contact the owners to upgrade.
Quote from: Alexandre P. on August 10, 2005, 11:55:53 PM
It may help hackers to find vulnerable SMF installations, but it also helps us to track outdated installs and contact the owners to upgrade.
ooooh....a predicament.
Quote from: Seta Soujiro on August 10, 2005, 11:34:43 PM
Quote from: Tippmaster on August 10, 2005, 11:27:46 PM
not really.
You are evil. You do not believe in security.
No. You dont get my point.
Tippmaster's point-
1. [Unknown] said "You can remove the version number if you'd like, but dont expect to get good support here".
2. There is no point in hiding your version number if you simply keep your installations up to date.
So, youre basically saying this-
"I will sacrafice good support from the SMF team for not having to upgrade my SMF installations"
Now ask yourself, doesnt that seem stupid, when all you have to do is click a link in the package manager to do it?! Think about it.
Why is this topic still open? It's useless... Why not keep he current copyright and add a <br /> and THEN add your own?
-Dan the Man
Quote from: [Unknown] on August 10, 2005, 10:45:46 PM
But, if you make this change, I assume you plan to post your version number expressly with every support topic you post here, every time.
But of course =) SMF's homepage claims it's designed with security in mind. This should be added to the list of things to keep in mind. Yes security by obscurity is no substitute for real security and keeping software up to date, but it still helps.
Quote from: OIDanTheManIO on August 11, 2005, 12:08:58 AM
Why is this topic still open? It's useless... Why not keep he current copyright and add a <br /> and THEN add your own?
-Dan the Man
Lol nice! Motion to close down the topic, then throw in a jab to get the conversation stirring again! hahaha ;D
- Dan
So what do I edit to get it to say:
Site Contents and Design © 2005 Example.com
Powered by SMF. © 2001-2005, Lewis Media. All Rights Reserved.
Quote from: agentbob on August 11, 2005, 12:14:20 AM
Quote from: [Unknown] on August 10, 2005, 10:45:46 PM
But, if you make this change, I assume you plan to post your version number expressly with every support topic you post here, every time.
But of course =) SMF's homepage claims it's designed with security in mind. This should be added to the list of things to keep in mind. Yes security by obscurity is no substitute for real security and keeping software up to date, but it still helps.
I'm sorry, but I just don't agree. If I wanted to hack every phpBB forum out there not up to date, I could do it easily. Searching based on version number wouldn't be a problem - I'd just find them all and hack them all. It wouldn't matter.
Of course, I don't want to do this. The point is that hiding behind a paper shield only protects you from paper arrows.
Anyway, if you were so right that this is a huge security problem and makes SMF not designed with security, you should look at... everything else. I mean everything. Why do secure areas in buildings say "secure area" - isn't that an advertisement to break in? Why do other software packages almost unanimously show the version number in some form or another? Why are keyholes always uniformly in the same place, using generally the same mechanisms as all other locks?
Having security in mind doesn't mean throwing everything out. It's nice to have a metal safe no one can get into, but if you can't get into it yourself it's at least as useless as no box would be.
-[Unknown]
If you fear that your forum is at risk because it's at a version that can be easily hacked, UPGRADE! Don't be lazy and just take out the version part of the copyright.
-Dan The Man
Quote from: [Unknown] on August 11, 2005, 12:42:09 AM
Of course, I don't want to do this. The point is that hiding behind a paper shield only protects you from paper arrows.
Anyway, if you were so right that this is a huge security problem and makes SMF not designed with security, you should look at... everything else. I mean everything. Why do secure areas in buildings say "secure area" - isn't that an advertisement to break in? Why do other software packages almost unanimously show the version number in some form or another? Why are keyholes always uniformly in the same place, using generally the same mechanisms as all other locks?
Trouble is that paper arrows are cheap, so theres many of them available to any lay person. Since that's the case, >90% of the arrows thrown at you will be made of paper. Nice to avoid those if at all possible.
The reason it doesn't exactly translate into real-world security, is that you can't do a google search for every house using a mastercraft model 19559-TPB lock within your neighbourhood.... A lock that we've found out can be opened by a 3 year old using scissors and a paper clip... but of course it's the owner's fault for not upgrading their locks yet, right?
Don't get me wrong, I think SMF is a great product, and the copyright code should remain and give credit where it's due. And it makes sense if a person doesn't know what they're doing, it's easier to support them or tell them to upgrade if you can easily see their version number on their site. It's always a good idea to keep an open mind to new ideas and ways of doing things though.
- Dan
Quote from: OIDanTheManIO on August 11, 2005, 12:55:06 AM
If you fear that your forum is at risk because it's at a version that can be easily hacked, UPGRADE!
-Dan The Man
EXACTLY.
or, you can do it the way everyone wants and remove the version number (which would probabally take longer than upgrading to the next release) and lose the priveledge of good support here.
The answer seems pretty obvious to me. Why waste your time removing the version number?
Why modify the copyright at all? All SMF asks for in return for great software is TWO SMALL LINES on the BOTTOM of every page. Is that so much to ask? No one said you couldn't add your copyright on a third line.
-Dan The Man
Quote from: OIDanTheManIO on August 11, 2005, 12:55:06 AM
If you fear that your forum is at risk because it's at a version that can be easily hacked, UPGRADE! Don't be lazy and just take out the version part of the copyright.
-Dan The Man
Sure, after all it's pretty easy right? Unless of course you maintain 20 forums. And then of course there's always pesky vacations that may get in the way. Or any other number of valid reasons. I mean people just
love microsoft cause it's so easy to run windows update and install the latest security patches every second day.
Quote from: agentbob on August 11, 2005, 01:00:59 AM
I mean people just love microsoft cause it's so easy to run windows update and install the latest security patches every second day.
Just shows how vulnerable Microsoft is to attacks. So how is that good that you update every other day?
-Dan The Man
Quote from: agentbob on August 11, 2005, 01:00:59 AM
Quote from: OIDanTheManIO on August 11, 2005, 12:55:06 AM
If you fear that your forum is at risk because it's at a version that can be easily hacked, UPGRADE! Don't be lazy and just take out the version part of the copyright.
-Dan The Man
Sure, after all it's pretty easy right? Unless of course you maintain 20 forums. And then of course there's always pesky vacations that may get in the way. Or any other number of valid reasons. I mean people just love microsoft cause it's so easy to run windows update and install the latest security patches every second day.
would you rather upgrade 20 forums, or remove the version number off of 20 forums?
Remember, that with the stable releases...you can usually just click a link in the package manager to upgrade.....
Quote from: OIDanTheManIO on August 11, 2005, 01:02:01 AM
Just shows how vulnerable Microsoft is to attacks. So how is that good that you update every other day?
Perhaps I should have added </sarcasm> in my previous post? Point is why stay still like a sitting duck and draw a big bulls eye on your forehead? Make the f**kers chase you. :D
Quotewould you rather upgrade 20 forums, or remove the version number off of 20 forums?
I'd rather do both personally. Like I said, can never have enough un-intrusive security measures.
Unless you're a lazy Admin, there's no need to remove the version number.
Quote from: agentbob on August 11, 2005, 12:57:18 AM
Trouble is that paper arrows are cheap, so theres many of them available to any lay person. Since that's the case, >90% of the arrows thrown at you will be made of paper. Nice to avoid those if at all possible.
Wooden arrows are almost as cheap. If you think that 90% of the arrows sent at you are going to be paper, you're definitely *not* thinking with security in mind. Plus, that's not even true.
Quote from: agentbob on August 11, 2005, 01:00:59 AM
Sure, after all it's pretty easy right? Unless of course you maintain 20 forums. And then of course there's always pesky vacations that may get in the way. Or any other number of valid reasons. I mean people just love microsoft cause it's so easy to run windows update and install the latest security patches every second day.
I can update one forum in under a minute. I can update 20 in about 12, and most of that time is entering my passwords. If they're all on the same server, it's quite possible I could streamline it too.
It's really not nearly that hard to upgrade - even on vacation or even with someone to watch things while you're gone.
And, Microsoft only releases security updates once a month now, because doing it every other day became too much for IT people. This means you're unpatched (potentially) for up to 30 days, if they patch it on the first day of the cycle. But, really, this isn't that much of a problem - the sea of forums or Windows installs take a long time to sift through, and as long as you update within a reasonable timeframe (a month is reasonable enough) you'll be fine.
Still, of course, I would recommend updating immediately. But, surely, taking a vacation for a week is highly unlikely, especially with the backups you are (we assume) making periodically, to lead to a security problem, even in the unlikely event that a patch is released while you are on vacation.
And, don't even go into automatic updates. There leads to even more problems than without. It's better for a forum to keep working, than for it to update and suddenly stop because of the update - and not be able to update itself again. There are countless problems down that road.
-[Unknown]
Forums have been hacked in the past because:
1. they have serious securities in the first place
2. Updates fixing these are slow to come
3. People don't update them
now SMF hasn't had any serious security holes that I'm aware of. (at least in public versions). Stopping the process at the first problem means that the other steps are irrelevant.
In the unlikely event that a version is published with a serious flaw, it is most likely it will get fixed before people even know about it, and another version made soon after. If people don't know about it then hackers won't know to use it against an unupdated version.
If somehow it does become widely publicised, then it is possible that unupdated forums could be at risk. HOWEVER if you take the simple measure of always keeping updated then it's unlikely you'll be at danger. You mentioned going on vacation, well I think the chances of a serious flaw being included in a public version that you update to, becoming widely known and widespread across the internet to the stage when people write scripts to exploit it, and where people search through google for your version number so that they can attack you at random, all in the time of your vacation, is highly remote.
In the even more remote chance that a serious exploit escapes being noticed for a few versions, well, a hacker would have to know the SMF code more thoroughly than [Unknown] to be able to exploit it. If the numerous SMF crew can't find it, no hacker will.
Even if you do remove the version number, the phpBB worm that went across the net never looked for the version.....
It specifically went after any forum with "Powered by phpBB" and thats what google blocked! A lot of updated forums even had the spider hit them to try, it never got anywhere though.
Search the phpBB forums, version numbers werent even remotely useful in the attack, removing them would be pointless.
If I was a script kiddy, I'd go looking for forums not displaying a version number based on the assumption that if they have wanted to removed it, they are likely to not have updated.
That said, I can't beleive the length of the discussion about it, if you want to remove it, remove it.
Quote from: Ben S on August 11, 2005, 06:51:51 AM
If I was a script kiddy, I'd go looking for forums not displaying a version number based on the assumption that if they have wanted to removed it, they are likely to not have updated.
That said, I can't beleive the length of the discussion about it, if you want to remove it, remove it.
I thought I saw this claim along way back on the thread?
Anyway, I've done a bit of thinking and it doesn't matter if you remove the version number. If a forum has a issue fixed then the spyders will look at the next one and leave yours alone.
If your going on vacation or something then get a friend to update it. It's very easy.
I guess I've switched sides.
Quote from: nesianstyles on August 11, 2005, 04:44:13 PM
Quote from: Ben S on August 11, 2005, 06:51:51 AM
If I was a script kiddy, I'd go looking for forums not displaying a version number based on the assumption that if they have wanted to removed it, they are likely to not have updated.
That said, I can't beleive the length of the discussion about it, if you want to remove it, remove it.
I thought I saw this claim along way back on the thread?
Anyway, I've done a bit of thinking and it doesn't matter if you remove the version number. If a forum has a issue fixed then the spyders will look at the next one and leave yours alone.
If your going on vacation or something then get a friend to update it. It's very easy.
I guess I've switched sides.
It was my intellegent, well-proven points that made you decide to switch sides, wasnt it? :P
Im sorry guys, but for all the ease with which it is possible to update SMF, there are still those out there running SMF 1.0.4. I found
http://www.x-zone.co.uk/
by shoving "Powered by SMF 1.0.4" into Google. And although I really respect what you guys do and the way you go about doing it, you cannot always beat the hackers to finding and pluggin the hole and I would be generally...... happier if I could remove the version number without feeling like a c**t.
As for "why not just update", I do generally get worried about how the whole updating thing works wrt mods (as in from the package manager) - I dont trust it to not go tits up on me. This isnt due to me not trusting you (the authors) to be competent to write it, its just because Murpheys law says what can go wrong will go wrong in the worst way at the worst time.
And just because I am paranoid does not mean that are not out to get me......
QuoteBut, if you make this change, I assume you plan to post your version number expressly with every support topic you post here, every time.
Yes, I would. If not only for your information, but for people who then look at these forums in one month/year time and search for their problem and see that my help was for version 1.0.5 and they are now on 1.6.17 so it might not apply and they might want to search on a little bit more.
Hiding the version number does not make those 1.0.4 boards any more secure.
Quote from: Caveman on August 12, 2005, 11:32:22 AM
As for "why not just update", I do generally get worried about how the whole updating thing works wrt mods (as in from the package manager) - I dont trust it to not go tits up on me.
So if the version wasn't displayed, you would be less likely to stay upto date? Good reason for displaying it then isn't there.
Quote from: Caveman on August 12, 2005, 11:32:22 AM
Yes, I would.
You would be one of the few then.
Quote from: Ben_S on August 12, 2005, 11:38:36 AM
Hiding the version number does not make those 1.0.4 boards any more secure.
No, it makes them less likely to be found and exploited. And surely any steps you can take to make things "more secure" (read less likely to be exploited, as it isn't really more secure at all, but meh) should be taken.
QuoteSo if the version wasn't displayed, you would be less likely to stay upto date? Good reason for displaying it then isn't there.
Not at all. I am as equally unlikely to keep up to date if it is there as I would be checking it wouldn't blow up in my face when I try to update, so I might be a day or two behind depending on my workload.
QuoteQuote from: Caveman on August 12, 2005, 11:32:22 AM
Yes, I would.
You would be one of the few then.
I worked in tech support for half-life adminmod, I know how much of a pain in the ass it can be if people dont give you the whole story and how much easier it is if they just state it straight off. I also dont want to sound like a complete muppet so I would try and explain the problem in as full terms as possible.
It's easiest to stop arguing about this as the developers probably won't change their mind and change the version number yourself. (http://www.simplemachines.org/community/index.php?topic=45305.msg326202#msg326202)
security through obscurity is not security at all...
your argument about scriptkiddies searching for 1.0.4 is specious... they could search for and attack all smf that DON'T show a version... because (one can assume) those people are more likely to be out of date...
They could search for all SMF that DON'T have 1.1... heck they could search for anything with a copyright DATE of before 2005....
(and the date IS required as part of the copyright)
I have a couple things I'd like to point out on the subject of the copyright notice...I'm not complaining, I just want to point out a few facts as I see them....
The first one is that removing the dates from ANY copyright is a no-no. The proper format of a copyright demands that the date MUST be placed in the copyright notice in a specific format.
Here is the link for the Library of Congress and it is to the Copyright division:
http://www.copyright.gov/
I completely respect the smf copyright on my forum.
The problem that I've had is that the name of your company is Lewis MEDIA....part of my forums will be used by professionals eventually...(psychology researchers primarily) Where research credit is important...I realize that it's as simple as placing your own copyright in each post, but really...that sort of distorts the ease of a forum...(pointing this out as a marketing factor for the smf product)
I've had a couple personal comments to me regarding the fact that it seems that a MEDIA company has over written the sites basic copyright notice...yes, I could likely add my own notice down there someplace...but, I'm NOT a coder (though I'd like to be...and am trying to learn as I can) I don't have enough time off of school right now to build and run my forums and work on coding templates...
This is a key marketing factor even if there IS a simple answer because not everyone who LOOKS into using the software understands how support sites work...
After all, for someone like me who has experience working with the phpbb forums, I'm afraid to try to add my own wording there because I might mess everything up completely....I see this as being a potential risk where future smf (non code savvy) clients may opt out of using the smf due to fear that others will refuse to fully use the forums because they're paranoid about the loss of their copyright.
I have however thought of a couple things that could help remedy this issue...
1. LEAVE the copyright rules that smf already contains! I mean, it's only right that software developers have the UTMOST protection! I'm sure too many people already assume that because smf is currently free that it is under the GNU license.
Although the addition of the word IS does remove any question that there is an ulterior motive for Lewis Media to jump up and claim they own the rights to this or that...I realize that this is an unreasonable way for people to see this...But you have to consider that many on line companies do attempt to infringe on intellectual property rights in their TOS and so on! It's important to avoid this stigma right from the beginning!
Keeping in mind that to market a product you MUST look at that product in it's entirety and see it from the view of the prospective buyer...if PROFESSIONALS refuse to use the forum fearing they will lose their research due to fancy legal maneuvers than they aren't going to use the software...and though I personally trust the developers...others may not.
Adding the word IS allows users of forums to feel safe in posting their information in such forums. I don't understand why this is being so strongly objected to...and I can see (though I don't necessarily agree with) the paranoia that is being conveyed here...I mean, people are asking to have a small bit of added protection that doesn't remove ANY rights from Lewis Media yet they are being denied...speaking psychologically...it does SEEM shady to someone who doesn't KNOW and understand copyrights...which in the end...WILL be somewhat harmful to marketing this product to those in a professional field like psychology, scientific research, authors...these are people who can afford to buy the forums, or even pay hefty amounts to simply have it installed..just some thoughts on that part...mind you I am not saying I see this motive - just that I can see how others see this...
So considering that the copyright notice WILL NEVER be altered from it's current state, I suggest the following as one possible advancement in the product...
2. Links in the footer...Ok, I think that if those running a forum have the option of placing their own notices in the footer that this would negate any effects caused by assumption regarding the wording of the smf copyright. I believe that the developers feel this way as well...which is why they don't object to allowing this to be done...
Problem with this is that many who are simply reviewing dozens of forums to find the right one will not even know that this is POSSIBLE! I realize that such people should likely just hire someone to do it for them...but what if they don't know how? What if they hire someone who messes it all up and then blames the forum it's self for the difficulties? This site doesn't plaster offers to hire their services out to do such things...a definite bonus as it shows how serious you are about client relations.
Possible solution...avoid ALL of these future issues by employing a admin section that allows the admin to create and place their OWN Legal notices! (I think this would greatly improve the product in many ways!)
If someone could make it so that the footer looks similar to this, I think it would be great:
Clickable links of course!
yoursite copyrights | Privacy Policy | Terms of Use| Adminchoice 1| Admin choice 2| Admin Choice 3
Then, below this would be the standard smf copyright notice...
This method would allow the site owner to have clear legal notices, and the smf license would stand out because it would be centered...And unchanged- also no one would have any reason to suggest changes in it anymore...
I would try to make this myself if I knew how to do it...
I think it would need to have forms added to the admin panel where one could add the title to appear in the footer, the position of each title, up to say 2 rows of links (allowing for disclaimers, rules or other stuff they need to add pages for.) Also of course, the field to add the body of the notice text. Or possibly arrange it so that there is ONE forum set up specifically for these notices...then when someone uses a link at the footer they are taken to that specific forum...full of all legal type notices that appear in the footer...This would make owners feel protected!
Another thought is to also make it so that these links are added to the footer of the emails that are sent from the site...but this is just a suggestion.
Just some thoughts that I figured I'd throw out for others to think about.
thanks for reading,
Sabastina
The GNU GPL isn't as good as people generally think it is. For this reason and others, SMF has its own licence, which is included with it, and located here http://www.simplemachines.org/about/license.php. However, just because its not GNU GPL, doesn't mean its not free open software :)
If you're worried about post content, or users are, you can direct them to the agreement, which states (by default) in so many words that you remain responsible for all content you post.
You are also free to add under the copyright notice another notice describing the ownership and copyrights as they apply to the post content.
-[Unknown]