Welcome to ModelEngineMaker !
If you have problems registering or logging in, please use the contact menu option to request assistance.
Posted by admin · 14d ago · 0 replies
As you may have read in the news recently, there's been a couple of nasty vulnerabilities discovered in the PHP programming language, which is used by millions of websites across the planet, including MEM (the forum software is implemented in PHP). Newer versions of PHP (8.5+) have already been fixed; but older versions will not be addressed.
The bad news is: We're running on an older version of PHP, one that won't be patched, and I can't upgrade to a newer one because SMF 2.0 doesn't support them. To do that, we'd also need to upgrade to SMF 2.1, which is a MAJOR job - and, I know from other forums that have made the switch, there are enough differences between 2.0 and 2.1 to cause significant friction with users (i.e. you lot
).
The good(ish) news is: Because I recently moved us to a new server & a new containerised system (docker, for those who know what that is - if you don't, it's not vital to the news), so we're already partly protected. I've also just made some configuration changes that SHOULD make us pretty much secure. It's not 100% guaranteed... but fingers crossed: And even if they do get into the system, they're stuck in a container they can't get out of, which will significantly reduce any damage they could do.
With regards to the database - the DB is backed up nightly, with one backup retained for a week - so if anyone does notice anything funky, as long as it's reported quickly, we'll lose at most 1 day's worth of posts.
Unfortunately I'm severely time constrained right now, which means I don't know how much of a chance I'll get to do a trial migration to v2.1 + upgrade to latest PHP + patches; but I'll try to fit it in if I can. Then I'll need some volunteers to take a look at it/test it to make sure the new user interface isn't going to cause problems. I'll post any news up here & in the chatterbox board.
Read moreThe bad news is: We're running on an older version of PHP, one that won't be patched, and I can't upgrade to a newer one because SMF 2.0 doesn't support them. To do that, we'd also need to upgrade to SMF 2.1, which is a MAJOR job - and, I know from other forums that have made the switch, there are enough differences between 2.0 and 2.1 to cause significant friction with users (i.e. you lot
).The good(ish) news is: Because I recently moved us to a new server & a new containerised system (docker, for those who know what that is - if you don't, it's not vital to the news), so we're already partly protected. I've also just made some configuration changes that SHOULD make us pretty much secure. It's not 100% guaranteed... but fingers crossed: And even if they do get into the system, they're stuck in a container they can't get out of, which will significantly reduce any damage they could do.
With regards to the database - the DB is backed up nightly, with one backup retained for a week - so if anyone does notice anything funky, as long as it's reported quickly, we'll lose at most 1 day's worth of posts.
Unfortunately I'm severely time constrained right now, which means I don't know how much of a chance I'll get to do a trial migration to v2.1 + upgrade to latest PHP + patches; but I'll try to fit it in if I can. Then I'll need some volunteers to take a look at it/test it to make sure the new user interface isn't going to cause problems. I'll post any news up here & in the chatterbox board.
), I think I'm basically ready to move the forum to a new server. This server is much more up-to-date, and also the way it's set up means that future migrations should be considerably less painful.