[pw change] Just received this email from vBulletin...

[Floris]

Good thing to regenerate this password, more small too

PS: update your kernel too, there is a big security issue

there isn't a new kernel out yet for RHEL

[diettalk]

When i first saw the email i found it alittle suspicious!

I thought the same thing. A forum announcement would have been nice.

[Onimua]

I will say that it would've been nice to know ahead of time. They let us know about the server maintenance, but not this (which effects us more as customers I think). Other than that, it's not really that much of a problem as some people have claimed it to be on this site.

[Yves R.]

there isn't a new kernel out yet for RHEL

There is a local root exploit in linux kernel 2.6.xx

http://it.slashdot.org/it/08/02/10/2011257.shtml

[Creepshow]

Yeah my new password has a '!' in it.

Which I was kind of surprised about...

[Mez]

Yeah my new password has a '!' in it.

Which I was kind of surprised about...

and the ! portrays your shock quite well !

[Creepshow]

and the ! portrays your shock quite well !

Heh

[Scott MacVicar]

There is a local root exploit in linux kernel 2.6.xx

http://it.slashdot.org/it/08/02/10/2011257.shtml

Lucky we have no regular users that don't have root already

The patch for RHEL hasn't been released yet, its going through QA. When it gets released I'll upgrade.

[Tailfeathers]

Yes, all the customers.

About the recent password change on your vBulletin Members' Area account.

This step was taken as part of a general review of our security, privacy and anti-piracy operations. As a part of this review, a decision was made to more closely adhere to best practices in terms of password security, such as the use of good strong passwords with letters, numbers and punctuation.

Please accept our apologies for any inconvenience caused. As stated in the email, this change will have no effect on on your assigned "priority support" forum accounts, the passwords for which remain unchanged.

If this wasn't some urgent necessary change, then I think it vB should really have let people know in advance because this will create a lot of problems for a lot of people (and extra work for vB).

I agree that knowing about this in advance is a lot more important than knowing in advance that vbulletin.com will be down for a little bit.

[DanaSoft]

If this wasn't some urgent necessary change, then I think it vB should really have let people know in advance because this will create a lot of problems for a lot of people (and extra work for vB).

I agree that knowing about this in advance is a lot more important than knowing in advance that vbulletin.com will be down for a little bit.

Got a new password assigned to an account that wasn't even a week old.

:shrug:

[Gladius]

I think that the fact that no one from Jelsoft is willing to answer whether their client details database has been compromised or is suspected to have been compromised is quite telling.

[Wayne Luke]

Its to do with how passwords are now handled in our system. Support staff will not ask for passwords as a form of license verification anymore. We don't have access to them under any case. Instead you will obtain an authorization code if we need to verify license information and will request that.

This means that the password doesn't have to be stored in the database as plaintext anymore and will protect you should the database somehow be compromised in the future. It is a increase in our security measures to keep your licenses safe in a day and age when attempted license theft is on the rise. There was no compromise of your data or our database, this is just a precautionary change for the future.

[Gladius]

Thanks for the explanation - makes more sense now.

[Reeve of Shinra]

I think this was a rather sudden change... we should've been given advance notice and there should be an announcement made in the forum. This wasn't the best way to learn about this.

[Wayne Luke]

In hindsight, we agree and will take that into consideration in the future. The current change has already been implemented though and there is no way to undo that.