From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on gnuweeb.org X-Spam-Level: * X-Spam-Status: No, score=1.9 required=5.0 tests=DKIM_SIGNED,DKIM_VALID, DKIM_VALID_AU,FREEMAIL_FORGED_FROMDOMAIN,FREEMAIL_FROM, HEADER_FROM_DIFFERENT_DOMAINS,RCVD_IN_DNSWL_NONE,RCVD_IN_MSPIKE_H3, RCVD_IN_MSPIKE_WL,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED, URIBL_DBL_BLOCKED_OPENDNS autolearn=no autolearn_force=no version=3.4.6 Authentication-Results: gnuweeb.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: gnuweeb.org; dkim=pass (2048-bit key; unprotected) header.d=gmail.com header.i=@gmail.com header.a=rsa-sha256 header.s=20230601 header.b=HYEw9s10; dkim-atps=neutral Received-SPF: Pass (mailfrom) identity=mailfrom; client-ip=209.85.160.54; helo=mail-oa1-f54.google.com; envelope-from=louvianlyndal@gmail.com; receiver= Received: from mail-oa1-f54.google.com (mail-oa1-f54.google.com [209.85.160.54]) by gnuweeb.org (Postfix) with ESMTPS id A91F024BCA5 for ; Tue, 21 Nov 2023 11:07:06 +0700 (WIB) Received: by mail-oa1-f54.google.com with SMTP id 586e51a60fabf-1f93d0cd2ddso930347fac.1 for ; Mon, 20 Nov 2023 20:07:06 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1700539626; x=1701144426; darn=vger.gnuweeb.org; h=content-transfer-encoding:cc:to:subject:message-id:date:from :in-reply-to:references:mime-version:from:to:cc:subject:date :message-id:reply-to; bh=jrarLxweicgWWCIneWay3xphFTLLHj1WRugPiWeh18k=; b=HYEw9s10tnShp3ow7RZmu+DHnW6de+pA5cfn5sfRQ/YKRHLWPuel65FWctN965QSSP j3d5mbGpdq/iuqHU2dP4IRgk9oXZSc80cAr6QC7a3vnjuLVl3VsSe2AXHFiREzrExF+C xS/xGpw4Hz6CpqUFOSvc4VhCkTaZzx8msjLmZuFr3vkwrqBZIn5h9zUSm9zeaNjgEcZc L0yuKEkVqd5lTgQuhxHcXqOZ1bDU8Po+F7rDHHkh+cPCKt6OFQ6Zf6yoAEVJ+FhVDKCZ rpAgHQgsPyS5wlHrejNg8JV3g6up0vzaFdC1wi+Gp1X5RGwa6dWlwXqkiZmUL0GQ/EYL 6SBQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1700539626; x=1701144426; h=content-transfer-encoding:cc:to:subject:message-id:date:from :in-reply-to:references:mime-version:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=jrarLxweicgWWCIneWay3xphFTLLHj1WRugPiWeh18k=; b=MYC8ghdCfr/BN7TBlMj3PRv4mHWpP3QQsJ+DzwOo4kW+UtY2yq0F5qQF3CtFzS1qv7 gmqVcjSSk8+170pTaT+V7EWZxOpGSTdj+42b00V1vombufNZKZUUNmRz8bf5oKHoRDnB Y1LORG+/RvFYJ3FQxwJ8E6x7/nFB761WeDTLwC1ovoQcYieIXFiLJTbgy0WzhyGDHv/g lUmjl7hxj2pR7lh+2HUhDGuQHRuATWcJXM2V/UCgNtwuwQhotndqZ2FPngUfR+J9nnw8 KOtLt8B43le0s3bmaqh0QBoSqwGJDu08I5LwhhWcIjPYpDvRocLdtHka7M47SAJuU0tk HC8g== X-Gm-Message-State: AOJu0YzofP7V8rA22+5cmdnkRyB0Gu5SdFZRjjeFahmRengjLuTqIvZW ogG5IRQ39cZ+4bKfari6LCSWWUnD3zKgd5Mdgf8= X-Google-Smtp-Source: AGHT+IERf/k3mLrfzZvByzLkvTh52yR2Y4JW8/vIAFN2D63vP8HhdHEhrLxKJ9J5GWDCRVffm5Xwga32tjC62Wl7uus= X-Received: by 2002:a05:6871:e01a:b0:1eb:e8b:73cb with SMTP id by26-20020a056871e01a00b001eb0e8b73cbmr10415833oac.58.1700539625787; Mon, 20 Nov 2023 20:07:05 -0800 (PST) MIME-Version: 1.0 References: In-Reply-To: From: Louvian Lyndal Date: Tue, 21 Nov 2023 11:06:54 +0700 Message-ID: Subject: Re: gwcfd v2? To: Alviro Iskandar Setiawan Cc: "GNU/Weeb Mailing List" , "GNU/Weeb Facebook Team" , Ammar Faizi , Michael William Jonathan Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable List-Id: On Tue, Nov 21, 2023 at 10:59=E2=80=AFAM Alviro Iskandar Setiawan wrote: > On Tue, Nov 21, 2023 at 10:52=E2=80=AFAM Louvian Lyndal wrote: > > On Tue, Nov 21, 2023 at 10:42=E2=80=AFAM Alviro Iskandar Setiawan wrote= : > > > On Tue, Nov 21, 2023 at 10:23=E2=80=AFAM Alviro Iskandar Setiawan wro= te: > > > > On Tue, Nov 21, 2023 at 6:46=E2=80=AFAM Louvian Lyndal wrote: > > > > > On Tue, Nov 21, 2023 at 6:37=E2=80=AFAM Louvian Lyndal wrote: > > > > > > On Tue, Nov 21, 2023 at 5:08=E2=80=AFAM Alviro Iskandar Setiawa= n wrote: > > > > > > > There's a rumor that the current CF ticketing system is vulne= rable ( > > > > > > > https://ticket2u.id ). Will the GNU/Weeb security team assess= it? > > > > > > > > > > > > I'll give you some samples so you can be sure it's real. > > > > > > > > > > Here you go: > > > > > http://mbol2yli7np6mzfgwimfnhajat6sdnq5frs2w7w3b7ldppdawexaxyid.o= nion/comifuro2023/ > > > > > > > > > > It contains many events, not only CF. Your job is to create an OC= R > > > > > program to classify those tickets (group by event). And extract u= ser > > > > > identities. > > > > > > > > Ack, that's real. > > > > > > BTW, it's tiring to filter those out as I have not been able to > > > identify them programmatically. So far I couldn't find any CF tickets= , > > > > Neither have I. > > > > > could you please send a valid CF sample? Not expired tickets. > > > > I found one: > > https://mbol2yli7np6mzfgwimfnhajat6sdnq5frs2w7w3b7ldppdawexaxyid.onion/= comifuro2023/85b4bcb4-5455-4c91-9d55-76bcd648d165.pdf > > your claim is real > > tq tq, will give more effort on creating a program that helps this resear= ch Note that you cannot report this to Comifuro admins until you manage to create a filter to collect only CF tickets. After that, you must be able to extract user private information from the ticket to make the severity higher. Once everything is settled up, I will give you all of the dumps I collected (I'm still collecting newly generated tickets now).