System Updates Thread ...7/21/20 . Security and Pictures

[conor912]

Maybe injecting bleach will help.

[Leon]

Originally Posted by conor912

Maybe injecting bleach will help.

It didn't.

.

[bmattioli]

As a 36 year Telecom Tech I feel your pain. Sorry can't help you technically but hang in there and fight the good fight.

Net54 Rocks!!

[Fred]

Originally Posted by Leon

Hey Folks
I think I am going to shoot myself .....Can't really say how this is going to go. I am sorry. I am constantly talking to folks. There are corrupted files that just aren't coming back.

Leon,

Before you shoot, can you please make sure that I'm in your will. I wouldn't mind having a card in my collection with LL provenance. 20 years from now I'll be able to say that I have a LL card in my collection.


I think most of the board members understand, and if they don't, then the only advice to be given is to take a deep breath, count to 10 and hit the refresh button or start a Leon "go fund me" page to pay for the mental health bill that is coming...

[Cliff Bowman]

Originally Posted by conor912

Maybe injecting bleach will help.

Maybe Corn Pop has a database background.

[Leon]

Thanks for the sympathy, guys.

To give a tiny explanation the situation is compounded by old s/w and a brute force attack. And as anyone vaguely familiar with this stuff knows, one thing leads to another and another and so on. Now we have some badly corrupted attacment files. I am hopeful the system stays up at this point and that's about all I can say right now.

And hopefully sooner than later we recover the other files. Just can't tell right now.

[clydepepper]

So far so good. Thanks for your hard work, Leon.


We appreciate you...and love this site!



.

[doug.goodman]

Originally Posted by Exhibitman

True...though it would make a pretty good satirical mockumentary on the crazy cardboard nerds and their life and death feuding over baseball cards. I want to be played by George Clooney...but I suspect it would be Jeff Garlin.

I think Weird Al would make a good "Doug"...

[wolf441]

Anyone who's been on NET54 for any length of time knows how much effort you put into this site.

I thank you for giving us a place to come to where we can enjoy our hobby with folks that are passionate about collecting. Stuff can always be rebuilt/replaced. Stay healthy and sane!

Best,

Steve

[hcv123]

Don't sweat the small stuff........and


It's ALL small stuff!


A day at a time my friend - do the best you can. Take a deep breath and know that you have built something appreciated by many.

[gabrinus]

Thanks for busting your ass Leon!!...a lot of us use this site as our archive...especially of cards we no longer have...and scans on computers we no longer have...Jerry

[Rhotchkiss]

Hang in there Leon, we all appreciate the effort and sympathize with the stress. If there is anything we can do, just ask - we are a community of diverse talents and abilities, who will likely do whatever they/we can to help. Just ask and I would bet many would be happy to help.

And I just saw the sticky post about systems administrators, nice! Unfortunately, I am horrible with technology.

[Eric72]

Hi, Leon.

I echo the sentiments expressed by many. We truly appreciate all that you do for us through your excellent stewardship of this site.

You provide us with a corner of the Internet where we can share our love for the hobby...with people who don't consider it odd to chase down century-old cardboard.

We understand you're doing everything possible to get the technology issues resolved. Keep up the the great work.

[Den*nis O*Brien]

Originally Posted by Leon

It didn't.

.

.....a very powerful light...you know...like inside.
But very seriously Thank You very much for making this place available to all of us. Certainly we can live with the occasional SNAFU. And I am sure everyone understands the torture and work you go through to keep this ship right side up !! Thank you Leon and moderators !!!

[Leon]

We have an OBC person, Wayne, looking at the DB Files right now. OBC guys rock.
It is not an easy process but he is going to try to pinpoint the corrupted files and manually fix them. There are no guarantees.
And if anyone can tell me if they see anything wacky except some pictures and the whole community picture album missing, I would appreciate it? Again. we have to get the system fixed and stable before we upgrade. And keeping the system up is my main goal....

,

[Copa7]

Leon,

I'm late to the news. I don't check in here every day. But I'm reading that our picture albums are wiped out?

Should I try to reload and build it again or wait until everything is fixed?

I appreciate this isn't your priority. I hope all goes well.

Cheers

[Leon]

Originally Posted by Copa7

Leon,

I'm late to the news. I don't check in here every day. But I'm reading that our picture albums are wiped out?

Should I try to reload and build it again or wait until everything is fixed?

I appreciate this isn't your priority. I hope all goes well.

Cheers

I think I would wait for now. It isn't working properly at all. It is the main thing we are trying to fix along with some other pictures. Should know in the next day or two if there will be success or not....

.

[ALBB]

Appreciate you keeping the site afloat !

[Leon]

There has been another attack a little while ago.....

We are addressing it. It is not just at us.....it is widespread.....

and ways are being investigated to fix these attacks for good too.. Wish me luck

[cubman1941]

Dang, Leon, this is just rubbish. I certainly do appreciate all your efforts in keeping us up and running!!!

[Seven]

Originally Posted by Leon

There has been another attack a little while ago.....

We are addressing it. It is not just at us.....it is widespread.....

and ways are being investigated to fix these attacks for good too.. Wish me luck

Thanks for all you do, Leon. Sorry to hear this has been such a headache!

[Leon]

Quick update

Still looking into fixing the current issues. As far as I am aware the issues are only some pictures (maybe quite a few) and the community tab, photo album pictures. if there are other things that are missing please PM me or post it here.

With the help of a few members quite a few database issues have been fixed. The system seems quite a bit faster today.
There was a conference call today with the hosting company for some more more reliable and secure solutions. Probably our own private physical server and more secure firewall. And we are still looking at minimally upgrading our current s/w version ..or maybe go a whole two iterations newer to the most current s/w. The look of the forum should stay the same. That is the goal.
Thanks for everyone's patience.


ps...so when the page reloaded for this particular post it was sketchy. Needless to say everything is still being looked at and worked on as we go..... (fingers crossed)
.

[bnorth]

Originally Posted by Leon

Quick update

Still looking into fixing the current issues. As far as I am aware the issues are only some pictures (maybe quite a few) and the community tab, photo album pictures. if there are other things that are missing please PM me or post it here.

With the help of a few members quite a few database issues have been fixed. The system seems quite a bit faster and today.
There was a conference call today, with the hosting company. for some more more reliable and secure solutions. Probably our own private physical server and more secure firewall. And we are still looking at minimally upgrading our current s/w version ..or maybe go a whole two iterations newer to the most current s/w. The look of the forum should stay the same. that is the goal.
Thanks for everyone's patience.


ps...so when the page reloaded for this particular post it was sketchy. Needless to say everything is still being looked at and worked on as we go..... (fingers crossed)
.

It was a few days ago. I had some PMs disappear and didn't get email notifications on a few. Been working good for me since.

[steve B]

It's a bit surprising the ISP isn't more helpful. But then failure to keep hosted data secure as an upsell opportunity is sooo software industry.

[Leon]

Had a conference call with the hosting company yesterday. We will most likely be moving to our own physical server. That should make us almost immune from the Brute force and other attacks.

We are trying to retrieve pictures between 7/6/2020 and 7/12?/2020.

The Community photo album might have been damaged beyond repair or erased altogether. It is still being looked at and by Monday or Tuesday we should know for sure.

That said, the Community photo album does look like it is working correctly at the moment, as far as loading new pics. I just loaded one and it worked. I don't want to promise anything but that is it for now.

And of course right after this post the system went down for a few minutes. I was back on the phone with them .

[cubman1941]

Gosh. Leon, I sure do thank you for all your efforts in getting this right.

[Joe_G.]

I do hope you are able to retrieve the Community "Pictures and Albums". I must have had hundreds of images to support information sharing with forum over the years. Without the images many of my posts have limited value (some might argue the same even with the images).

At any rate, hoping you are able to retrieve all the images for those who took the time to post them and those who take the time to view them.

Good Luck!

[davidb]

Leon,

We're Luckey to have you. Thans!

[steve B]

Sounds like they weren't really doing backups.

Not what I'd continue with.

[Leon]

Originally Posted by steve B

Sounds like they weren't really doing backups.

Not what I'd continue with.

I will do what I think is best for the forum and my sanity. They were doing backups but it was automated and they backed up a crashed site. Those things are being addressed.

.

[Ronnie73]

Originally Posted by steve B

It's a bit surprising the ISP isn't more helpful. But then failure to keep hosted data secure as an upsell opportunity is sooo software industry.

It usually depends on the hosting company and the package you sign up for. I was so unhappy with the service and costs that back in 2003 I started buying my own servers. So basically I only paid for a cable and DSL connection each month. For what I was doing at the time, I saved a lot of money and learned a lot too. Biggest issue was nearly every three months, a better faster server would be released. There's just no way to keep up. Currently I have a dedicated server with GoDaddy running Windows and Microsoft SQL because I've always had issues with jet databases or mySQL because they couldn't handle large amounts of data and would usually timeout before a read/write could happen. Service with GoDaddy is not much different than how it used to be many years ago. A few months ago I had a problem with my database password expiring but didn't know that it was set on a timer. So I would literally get an error as if the server wasn't even plugged in. It was like Microsoft SQL was deleted. They refused to even say one word to me or even say something like, maybe your password expired lol. The way I felt at the time was disappointing, especially for how much I was paying per month. It also made me feel like if I was paying the extra $200 per month for a support team, that it would be questionable if they would even know anything. Plus after they would tell me to try something, I'm still the one applying fixes on the server. That's why I stayed away from that package. All they do is apply Microsoft updates, which technically can be set up to automatically run on it's own. I think it was only $10 lol.

I wish I knew of a place with reasonable pricing, knowledge, and unlimited options. This is probably the exact same thing Leon needs too.

Leon, thank you for everything you do. You never get enough recognition running this site. There's noting worse than failed hardware. Which seems like was the original issue, which then corrupted database files. There should always be a hardware Raid configuration when working with large databases. Having the right configuration will alert a hardware failure and a hot swap hard drive replacement can be done with no data loss and no down time. I like to use Raid 5 or Raid 6. The only difference is Raid 5 only allows one hard drive failure at a time, while Raid 6 allows 2 hard drive failures at the same time. Raid 6 cost more because more hard drives are involved. Frequent off-site backups are always recommended for catastrophic events such as fire, theft, or natural disaster. I just wanted to mention these few things because I read that you were looking into a more advanced hosting package.

[AddieJoss]

Leon, like everyone else, I appreciate what you provide on Net54. I’m not sure if it’s related, but when I logon, in the URL area, it’s says “not secure”. I believe a security certificate makes it secure. I know that doesn’t solve everything but an easy fix and will definitely help. Just a quick thought.

[Leon]

Originally Posted by AddieJoss

Leon, like everyone else, I appreciate what you provide on Net54. I’m not sure if it’s related, but when I logon, in the URL area, it’s says “not secure”. I believe a security certificate makes it secure. I know that doesn’t solve everything but an easy fix and will definitely help. Just a quick thought.

It is secure. Click on the url and you will see the https....on a cell phone it shows the lock. WE have old links that are http and not https which is why you don't see the lock.....hopefully that can get figured out too but not too important as the secure certificate is there...

[RedSox3]

There's a Secure Sockets Layer (SSL) certificate in place, effective for about another 6 months.

A utility website, http://whynopadlock.com (enter net54baseball.com and click the "I'm not a robot" checkbox) shows that all the pieces of the puzzle are in place except one:

"Protocols: You currently have TLSv1 enabled. This version of TLS is being phased out. This warning won't break your padlock, however if you run an eCommerce site, PCI requirements state that TLSv1 must be disabled by June 30, 2018."

This doesn't sound like something we can fix ourselves, and the web hosting system administrators should probably do something about it.

What we found on the OBC site was that if there are any references to "http://" in any script producing a web page in the net54baseball.com domain, they should be changed to "https://" in the program script files. OBC had several dozen of those protocols that needed to be changed. I don't think users can easily change the vBulletin script files, and any changes would be overwritten when a newer version of vBulletin is installed.

In the meantime, as Leon said, even though the browser warns "Not secure," it'll behave like a regular secure website.

Best,
WMD

Wayne Delia, Webmaster, OBC (Old Baseball Cards), https://oldbaseball.com

[Leon]

Originally Posted by RedSox3

There's a Secure Sockets Layer (SSL) certificate in place, effective for about another 6 months.

A utility website, http://whynopadlock.com (enter net54baseball.com and click the "I'm not a robot" checkbox) shows that all the pieces of the puzzle are in place except one:

"Protocols: You currently have TLSv1 enabled. This version of TLS is being phased out. This warning won't break your padlock, however if you run an eCommerce site, PCI requirements state that TLSv1 must be disabled by June 30, 2018."

This doesn't sound like something we can fix ourselves, and the web hosting system administrators should probably do something about it.

What we found on the OBC site was that if there are any references to "http://" in any script producing a web page in the net54baseball.com domain, they should be changed to "https://" in the program script files. OBC had several dozen of those protocols that needed to be changed. I don't think users can easily change the vBulletin script files, and any changes would be overwritten when a newer version of vBulletin is installed.

In the meantime, as Leon said, even though the browser warns "Not secure," it'll behave like a regular secure website.

Best,
WMD

Wayne Delia, Webmaster, OBC (Old Baseball Cards), https://oldbaseball.com

Hey Wayne
The hosting company is currently restoring the attachment DB and doing what you had said to do. It is taking quite a bit of time..

I am not sure how to fix the HTTPS/lock issue as we have thousands (probably) of links that are http....
thanks again

.

[Ronnie73]

Originally Posted by Leon

I am not sure how to fix the HTTPS/lock issue as we have thousands (probably) of links that are http....
thanks again

I've used a program in the past from funduc.com that's a search and replace application. I've used it for similar changes such as updating a copyright date. It searches all the code and gives you the option to view each found example and apply the change one by one or you can change everything found with one click. It's also helpful when searching for certain code within a website and finding exactly what you were searching for and where it is. It saves a ton of time, especially when your dealing with a website that has many files. One of my websites has over 2500 files of code and it worked super fast every time I ever used it.

[Leon]

Originally Posted by Ronnie73

I've used a program in the past from funduc.com that's a search and replace application. I've used it for similar changes such as updating a copyright date. It searches all the code and gives you the option to view each found example and apply the change one by one or you can change everything found with one click. It's also helpful when searching for certain code within a website and finding exactly what you were searching for and where it is. It saves a ton of time, especially when your dealing with a website that has many files. One of my websites has over 2500 files of code and it worked super fast every time I ever used it.

Thanks Ron. I will look into it

I am also very aware of the issues the site security warning when logging in. They are being addressed. The site does have a security certificate. Just click through the security stuff. It only has to do with old http vs. https code. And on a mobile phone the lock shows.

Just spoke to the hosting company again...915am CST....they have applied the latest security cert but since they are not positive it will fix this I don't want to take the site down now for a reboot to apply the fix. The reboot is going to be done at 3am EST.....

.

[Rich Klein]

I think Richard "Dimples" Fields said all we need to know about Leon's month with this song

https://www.youtube.com/watch?v=qduCJYilnaY

Regards
Rich

[Leon]

The certificate upgrade was done last night but the security issues seem to remain (at least for me). So we will keep at it until it's fixed. The site is secure we just need to fix the old http links and make them https.....

After speaking with the hosting company this morning it looks like the process was done automatically and needed to be done manually. More to come later....

On the picture front, it is still being worked on too. It looks like the old pictures in the Community Photo album have been saved. Yay....
There is a chance the new ones (in the last week) can't be saved but we are still hopeful.
The 2 forum members working on the database have done an extraordinary job so far. We, especially me, owe then a debt of gratitude

[Leon]

It looks like the most recent security license update has cured some issues. We now have a padlock when on a pc. And we aren't getting that really awful looking security issue when logging in.... We are getting there....

Once these issues have settled down and we are stable for a short time (days) we will look at upgrading our s/w. The main thing is for the site to stay up and be stable.. I am in present discussions with the hosting company for more security to help prevent attacks in the future. WE will be addressing the backup policies and a lot more too....

And some 1946 Morley Studio cards....
.

[atx840]

Originally Posted by Leon

It looks like the most recent security license update has cured some issues. We now have a padlock when on a pc.

Woot!

One of my favs.

[Joe_G.]

Originally Posted by Leon

On the picture front, it is still being worked on too. It looks like the old pictures in the Community Photo album have been saved. Yay....
There is a chance the new ones (in the last week) can't be but we are still hopeful.
The 2 forum members working on the database have done an extraordinary job so far. We, especially me, owe then a debt of gratitude

On the picture front . . . thank you! I'm not worried about losing last couple weeks of pictures, easy to recover. Fixing the several years that proceeded that was my concern and looks like you are well on the way to having that fixed. Many thanks to those working their tails off to fix the issues (that includes you Chris).

[irv]

Originally Posted by Leon

The certificate upgrade was done last night but the security issues seem to remain (at least for me). So we will keep at it until it's fixed. The site is secure we just need to fix the old http links and make them https.....

After speaking with the hosting company this morning it looks like the process was done automatically and needed to be done manually. More to come later....

On the picture front, it is still being worked on too. It looks like the old pictures in the Community Photo album have been saved. Yay....
There is a chance the new ones (in the last week) can't be but we are still hopeful.
The 2 forum members working on the database have done an extraordinary job so far. We, especially me, owe then a debt of gratitude

Yes, thanks, Leon. I now see all my photos have returned!

Appreciate all you did and continue to do to keep this site up and running!

[Leon]

Originally Posted by Joe_G.

On the picture front . . . thank you! I'm not worried about losing last couple weeks of pictures, easy to recover. Fixing the several years that proceeded that was my concern and looks like you are well on the way to having that fixed. Many thanks to those working their tails off to fix the issues (that includes you Chris).

That was my thought too, Joe. I can easily tell the guys that we lost a few weeks of pictures and there probably won't be mayham. But if we lose it all, yikes, there could be a mutiny LOL..

I didn't want to say who it was until I asked if it was ok. But yes, Chris Br.owne, worked a lot on this and continues now. As a matter of fact he is now an administrator on the board too. And on another personnel issue, member Dan Bre.tta (hey Dan) SlideKellySlide has stepped down as a moderator. He said he is not on the forum as much and thought it was best. He is still here a member. Thanks again Dan for the years of helping oversee the forum. And Wayne De.lia also did the other heavy lifting on this current project of issues out the yin yang. Another great OBC'er.

More work to come in the future but the system does seem to be smoother than it's been in a long time (knock on wood).

.

.