<p><em>If you are looking for web interface of my bot (known as Supybot on freenode), click <ahref="OtusBot.html">here.</a></em></p>
<h1id="latest-version-of-supybot-was-released-in-2005">Latest version of Supybot was released in 2005</h1>
<p>All activity happens in git repository of Supybot nowadays and it happens seldomly. The version, which was released in 2005 is 0.83.4.1.</p>
<p>It's available from <ahref="http://supybot.sf.net/">SourceForge</a>, Debian repositories, Ubuntu repositories and repositories of many other Linux distributions.</p>
<h1id="has-critical-issues">0.83.4.1 has critical issues</h1>
<p>What issues?</p>
<h2id="anyone-can-crash-it-and-computer-where-its-running-on">1. Anyone can crash it and computer where it's running on</h2>
<p>And this is very easy. Just run the command</p>
<pre><code>!misc last --regexp m/(.*\w){512}/</code></pre>
<p>where ! is the prefix character.</p>
<p>Misc is loaded by default and cannot be unloaded without modifying the config.</p>
<h2id="the-previous-wasnt-the-only-way-to-do-this">2. The previous wasn't the only way to do this</h2>
<p>Everyone can also make the bot count an equation, which brings it and the host computer down.</p>
<h2id="anyone-can-access-network-services-via-the-bot.">3. Anyone can access network services via the bot.</h2>
<p>I don't have example command for this, but it happens by nesting "format cut" and "misc tell".</p>
<p>What does this mean? Anyone can tell the bot to ghost someone else on same account, take over a channel by telling the bot to give flags (if it has correct flags), change password of the account and everything else what you do with network services.</p>
<h1id="are-these-issues-publicly-known">Are these issues publicly known?</h1>
<p><STRONG>Of course they are.</strong> They have been reported to</p>
<li><p><ahref="http://debian.org/">Debian</a>, <ahref="http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=672214">issue 1</a> and <ahref="http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=672215">issue 2</a>.</p></li>
</ol>
<p>The first issue has been also used to take down some of <ahref="https://wiki.ubuntu.com/IRC/Bots">Ubuntu IRC bots</a> several times. At least UbotX (I don't remember the number) and meetingology.</p>
<p>Some of them are fixed in git repository, but most people aren't using it.</p>
<h2id="how-to-avoid-them">How to avoid them?</h2>
<p>You can add anticapability for these commands using "owner defaultcapability", but that is only a temporary solution. There can also be other issues.</p>
<p>There are also two active Supybot forks, known as <ahref="https://github.com/ProgVal/Limnoria">Limnoria</a> and <ahref="http://sourceforge.net/apps/mediawiki/gribble/index.php?title=Main_Page">Gribble</a>, which are actively developed and have fixed these issues. If you want permanent solution, you should install either of them.</p>
<p>I recommend <ahref="https://github.com/ProgVal/Limnoria">Limnoria</a>, because it seems to be more active (activity of <ahref="http://sourceforge.net/apps/mediawiki/gribble/index.php?title=Main_Page">Gribble</a> isn't announced anywhere) and it has additional commands, translations and new plugin called <ahref="https://github.com/ProgVal/Limnoria/tree/master/plugins/PluginDownloader">PluginDownloader</a>, which makes installing of 3rd party plugins easy.</p>
