100% my own. It's basically an ASP app, using VBScript in the pages as glue to hold together a collection of ActiveX components that I wrote for it.

I'd been compiling a mental bitch-list about the BBS software I've used over the years. When Justin and I started talking about setting up the Zone, I had the perfect excuse to put my money where my mouth is and write my own. It doesn't have a bunch of frills, like emoticons and popularity contests, that some of the software out there has. I concentrated instead on the core function, going for both performance and security. Security's a neglected topic--BBS software (and lately blogging software) is unique in that its basic premise is to let users modify the contents of a Web site. Most of the public domain/shareware software out there is dangerously sloppy when it comes to security. The venerable Perl script wwwboard requires you to make the message directories publicly writable, which is an invitation for disaster (and there's a long list of other known vulnerabilities in wwwboard).

You bumped into part of the security--some HTML tags, like OBJECT, and particularly SCRIPT, can be very dangerous, and I wrote a comprehensive filter to keep out the "bad" tags. There's one BBS package in particular, whose name I won't mention, that's membership-based and stores every user's username and password in cookies for "convenience". Turns out, if you can inject a little script onto the page in a message, you can read the cookie and send the results off to your own server for recording. Eventually you'll capture an administrator's account, and then it's all over for that site.

The thing I'm kinda proud of is that I discovered that vulnerability after I'd written my own software, and it turns out that I anticipated and closed every vulnerability I've discovered in other BBS software.

In case you're wondering, I've never actually applied that knowledge of vulnerabilities in other software, although I have tested the attacks and verified that they work. That's where I draw the line--I can justify research that validates my own approaches to security, but then I keep quiet about it.

--Robert