That Really Sucks.... I'm sorry.. It just reinforces my whole thought that people just suck.

Sorry Ray. Thanks for all you do man. I hope Mr. Idiot feels shame for being the town idiot.

The world would be a better place without people. I mean, without mean people. Ahem.

Let me just say for the record, I greatly appreciate the effort you put in, both on your excellent blog and making life easier for so many of us by taking the time to do the aggregator. I know from experience myself that the negative stuff seems to weigh 100 times more than the positive stuff seems to balance, but nonetheless THANKS!

BTW, I think its safe to say that this guys feed should be removed from ColdFusion Bloggers! He's certainly lost his aggregation privileges!!

Ray,

Just ignore the mean people, they are not worth the effort, I really enjoy your work and post.

Please keep up the good work

paul

I'll just add my voice to the many... THANK YOU RAY for the CFbloggers site... I have really <strike this>wasted a ton of otherwise perfectly productive work hours</strike> enjoyed it since being added, then subscribing to the RSS feed.

In just the past week I have picked up a lot of great tips, met a few really decent web-folk, and been directly inspired to actually write something on my own blog from time to time.

I suggest you spend at least 17 seconds pondering the endless horde of CF junkies forever in your gratitude <strike this too> pummeling the offending stats-tweaker with over-ripe pomegranates</strike> and try not to let it bug you too much... you're an inspiration to us all.

I know how you feel Ray. I had a couple of idiots trying to ruin CFDevCon for no good reason, and it makes you so angry when someone has to come along and try to ruin your work, especially when its not even something you get paid for. Unfortunately some people really don't care who they piss off because they think anonimity of the internet protects them.

It would seem he is using BlogCFC, maybe its time to exploit one of those back doors Mr. Horn claimed there were.

Well, today I feel better. I hope my blog entry didn't sound too much like a pity plea.

I got an email from someone today who said he was behind some of the stats (I don't think he was the guy who wrote the blog article). He apologized and I accept his apology (but can't write him back as he used a fake email). I'm past it - and just want to move on today.

Russ/Scott P: Geek the Tube _is_ ready to launch - I basically just need to write the intro. Scott P you need to IM me though.

Ben N: You've written bad stuff? I don't believe it. ;) I'm not going to remove him. I need to treat CFBloggers (and my other sites) as _community_ sites, not Ray sites, so I don't want to start down a route of taking things personally there. That's what this blog is for. ;)

The offending post was removed but thanks to Big Brother Google you can see it via the Google cache at:
http://72.14.209.104/search?q=cache:blog.brianflov...

I've had sites (using phpNuke) get corrupted by a hackers bot. It's not fun but I learned a bit about security, open source, and Turkish IP addresses. It wasn't a nice action on the stat tweaker blogger's part and I amazed how dumb he was to post it and make himself the idiot of the CF village.

Hey Ray,

Glad to see you airing your frustrations on your blog! I think it’s a healthy attitude to take, everyone should complain more, and it makes us feel better in the end :-)

This whole situation does pose a few interesting ideas and questions though, one of my main beefs with AJAX all along has been the security possibilities, it’s probably one of the reasons I’ve been VERY slow on the uptake of anything AJAX related, I've never been a JS fan, I'm sure plenty of people have read over opinionated posts from me in the past on the subject.

I'd be interested to see some serious presentations on the security exploits of AJAX and the ways to tackle them, as generally we're all Server Side developers and we all know about protecting our user produced content against SQL Injection and XXS, but for some reason many developers seem to forget these principles when dealing with JS.

It's a shame that Brain Flove had to blog about the exploit, that was a little unfair, he should have contacted you directly, on the other hand, I do like the concept of use challenging one another’s application security a little, and it’s a responsibility we should all share. I know when working on development for my application, I'll always buzz the dev server version over to some trusted developer friends and ask them to try and break it, and then we can work on actively patching the problems.

As CF developers we have quite a blessing when it comes to security, things like queryparam and script protect make it VERY simpler of us to build secure applications, and with J2EE sessions being as they are, they’re also very safe, at least from your average attacker, however this simplicity also probably makes us complaisant and I suspect a large number of people don’t make as much effort to strive for security as they should do... me included!... security isn’t really one of those things that can be ‘patched’ as an afterthought, it needs to be at the core of our design from the get go.

Thanks Ray,

Rob

Here's another take on this...

http://www.webtrenches.com/post.cfm/mean-people-an...

Maybe I'm not being clear. I do expect people to find/report security issues. As I said, I knew this was a potential security issue (showing content like that). My problem was with how people played with it. I am over it - but I just want to be sure folks know - if you find a security problem with my app - please don't hesitate to bring it to my attention.