Postmortem Security Breach on October 23rd, 2025

[Ed Special]

Thank you for the clear and concise summary of how and how badly you fucked up, Dear Feeder. I knew something had to've happened from how I was getting a generic 502 error page rather than your usual "Shit's fucked, please check back in five minutes" gray screen.

 

[Radical Forum User 2000]

I WAS RAPED BY PATRICK S TOMLINSON 2002, HE DID IT.

 

[Karen Horney]

Give em back their dancing miku gif

 

[The Wokest]

Are we sure no user identifiable info got leaked?
2 fat ladies are knocking on my door at the moment screaming
"Matt Jarbo! we know you're there!"
"We know you post on the evil forum!"
"You can't be woke if you post there!"

>why didn't you protect me @Null

 

[skunt]

56: 'persistent_id' => "please_work",

lol


shartyniggers aren't having much luck connecting to a database hosted on 127.0.0.1.

 

[Null]

lol

That config file has seen some dark times.

 

[Google.com]

What is the country of origin of the VPN IP? I need to pick a racial slur.

 

[skunt]

10,996 references to diversity. 94 for jew and only 3 for hitler. looks like it's missing the actual .git folder too which is a shame. oh well.

wtf is this:
styles/custom/logos/kiwi_foxdick.png

 

[RicoNecroDoc]

I'm so happy I switched my account email to lolcow.email back in 2021, right now.

 

[DavidS877]

I look forward to receiving emails from jewsh asking for Google Play cards

Are you implying that the guy I sent an Amazon gift card to last year when he claimed he was "Moving back to the US" and "Needs stuff" wasn't legitimate?

 

[Morrowind: GOTY Edition]

Backup S3 bucket will have an IP whitelist and be more purpose-specific to handle worst case scenario.

Reporting to the Xenforo management team for CoC infraction. Please use the pre-approved term of "allowlist" instead.

 

[Windy Moors]

Having to use the normal Internet:


Thanks Null.

 

[femboy fart huffer]

Idk if this is well known or anything but I found this random github page that seems to have a decent tracker for the site's usability. https://github.com/hickoryhouse/kf. I was having a shit load of trouble as the site went down with tor in general and wanted to check it was the site not me. That's the only tracker that actually seems to work for this site.

 

[Account]

> Exposted .git
Oof. At least (probably) nothing bad happened.

 

[Slav Power]

wtf is this

Well the file is still on the server so

Spoiler: kiwi_foxdick.png

Yes I realize it only raises more questions than it answers.

 

[Doug S]

 

[Null]

I've confirmed no malicious connections were made to the remote S3.

 

[Mr. Racewar1488]

Null has H1B pajeets working on the site CONFIRMED.

 

[Kokonut Kangs Klan]

It's weird there are no commit logs, multiple versions, or any other direct indication of .git being read in the archive itself. I don't see why they didn't include that folder/history. Unless you're deploying shallow clones, this indicates a degree of cluelessness / just doing it for the lulz.

 

[Shartavius]

I vote to let Jackie Singh take credit for it.