A few people in the other thread assumed that it was required to fork the code to disable those filters. That’s not the case, the filters can be configured, and are off by default.
To hide the reputation system, here’s a line of CSS that admins can add in the admin area to hide it for every user
That CSS line can also be used by any user wanting to hide the score at the user level.
Wait what? I read in other threads the code was bad, not I didn’t think it’d be this bad.
They’re just making shit up. In their mind I guess Javascript that is intentionally included by an admin to customize their instance counts as ACE. In that sense any webserver you ever browse to is capable of ACE.
Any webserver you browse is possibly capable of ACE depending on the implementation. When it starts to hold user data is when that starts to be a big concern. The more points of entry, the more that needs to be secured.
I don’t have any experience with piefed admin, or any opinion on piefed itself, just too many years of web admin experience. And as soon as I see intentionally made doors that allow code input, I start to worry about how much experience the devs who made it have with web admin.
Booo. Here I was hoping for something serious to spice up the news and it just turns out it’s “it runs on a browser”.
I’m not a spice merchant, and most exploits rarely involve a single step. This screenshot is just a system design red flag.
You’re free to examine the repo yourself and find your own spice, my 5 min look tells me that piefed needs to expend a significant amount of effort on infosec to maintain user trust in the longer term.
Sorry, pal. It’s a good software.
As others have pointed out, it does still require (with some caveats about the infra setup) the user to be an admin. But if someone manages to get in to the interface, or another person is granted admin access who shouldn’t have been, it makes it more risky than it needs to be. It also for me is a design choice that indicates other parts of the system should be carefully examined for how they’re handling and sanitizing input.