Sunday, May 4, 2008

TBS == dead?

A few months ago, an old friend of mine, Chemi, returned to TBS, and suddenly asked me, "Hey, is TBS dead?". I answered, "Yeah, Inferno was being lazy"...

Actually although seeing the site dying, I was still waiting (or rather hoping) for some changes that would make the site alive again.

But that has yet to happen.

No new challenge has been added for like 8 months.

Many good users have gone into the shadow.

The forum has become a place for rhican to show off his 1337 h4x0r1ng skills.

An old CSRF bug that I found a few years ago has been exploited further that Inferno could do nothing but disabling the img tag and avatar feature.

And sadly most recent updates to the site were done by Erik, who officially declared retired a few years ago.

So I gotta admit TBS is pretty much dead now.

But maybe it's still not too late to revive the site once again?


Sphinx said...

Being one of the best challenge sites out there, it would be unfortunate if it were dead. So I hope TBS == Alive.

I'm reminded of the Product Life Cycle. A new product progresses through a sequence of stages from introduction to growth, maturity, and decline.

Do challenges sites follow such a cycle?

It would be sad it they do, because so much effort has been expended to get the site to the current state.

The crucial element, imho, is periodic maintenance. It's easier when the site is at the Introduction and Growth stages, because the codebase is new and small and the momentum is there.

But as the site reaches Maturity, the cobebase has grown to a monstrous size and maintenance because a nightmare.

I don't think it needs to add new challenges at this point in time. Rather, I think it's more important to work on a new look and perhaps consolidate the challenges - like fixing the ones that give problems or even throwing out outdated ones.

Just my 2 cents.

Anonymous said...

well euhm quang It would be nice if you could have a blog post without mentioning my handle actually ;-)

And please do not ever use the wording "1337 h4x0r1ng". Definitely not to refer to something I do. I don't show off. I share some info I know a good part of the community is interested in. And what i share there, definitely does not qualify as haxoring.

All i'm doing there is showing how real security in basic websites still is. By exposing that the websites that teach about these vulnerabilities, have weeknesses. To that end 6 out of 10 wechall-linked websites have had at least some easily discovered vulnerabilities. There are two more I have some info on, but it is too light a content to bother anybody with it.

If you check you see they specifically state they want to be informed about such bugs. I believe this to be true for all "internet security" challenge site owners.

O yeah, and some trolling, cause antagonizing as I am, I attract a lot of people who need to establish supremacy over me. which leads to some perfectly good trollin. It doesn't all have to happen on 4chan.

I don't really care too much about tbs being dead or alive. Too many crappy stegano's.;-). Then again it's the only site on the interwebs with a rhican-challenge.


Inferno said...

Maybe find an admin who is not, as is so nicely been put in the post, lazy. From my point of view, I have been far from lazy the last couple of months, since I've been working my a$$ off for University :).
I guess it doesn't matter how often you tell people that you don't do any coding/debugging for a challenge site, or how much time you spent on real life rather than providing "new" challenges. They still need something to bitch about.
Personally I don't like what the challenge community has become, and yes, feel free to see this as me throwing in the towel. There are more important things in life than providing support for a place I don't like anymore. Of course I could try and make it into something nice
again but that means I will have to spend time on it. A lot of it. Although I didn't change much for tbs, I do believe I have been the only one around (read: around).
And as far as the CSRF bug goes, well, read the above. In layman's terms: me sick of cleaning other people's mess, me no fixing code, me just around, me not incapable, me just don't want to :).

Might give you something to think about. Why am I assigned admin if I'm not doing anything? Well, there was a time when I enjoyed the community and was willing to spend time on it.
Second piece of thought: why don't I quit being an admin? Tough one, on the one hand I'd gladly stop being an "admin" at tbs, on the other hand, who should you guys blame for errors in (again, someone else's) code?
In the end it doesn't matter, just keep pointing fingers but don't forget that if it wasn't for me, there wouldn't have happened anything in the year before the last 8 months either.

The reason I post this here is because I'd like, for once, to tell you how I look at these things without having anyone else to say something for me instead (or ripping it out of context). In my opinion this happened a bit too often in the last 8 months.

Oh, and another strange observation I made throughout my time as an admin. People don't know what they want. I only hear two things nowadays. 1. "There are too many challenges" 2. "No new challenges are being added."
Of course I could throw away a lot of challenges (I could name a category) but then I get 3. "I worked so hard on a challenge and now it's gone!!". Quite a frustrating job and if I had seen this coming beforehand, I'd probably never become an admin in the first place.
Whatever you do or don't, it's never ok, and there's always someone bitching.

Anonymous said...

Hello, I would like to hire you to customize a bot you published. If you are interested please reply to