{"id":135,"date":"2008-08-23T02:56:10","date_gmt":"2008-08-23T06:56:10","guid":{"rendered":"http:\/\/blogs.law.harvard.edu\/ahshieh\/?p=135"},"modified":"2008-08-23T02:57:35","modified_gmt":"2008-08-23T06:57:35","slug":"trillian-astra-is-nice-but-does-the-alpha-release-intentionally-have-no-security-alan-investigates","status":"publish","type":"post","link":"https:\/\/archive.blogs.harvard.edu\/ahshieh\/2008\/08\/23\/trillian-astra-is-nice-but-does-the-alpha-release-intentionally-have-no-security-alan-investigates\/","title":{"rendered":"trillian astra is nice. but does the alpha release intentionally have no security? alan investigates."},"content":{"rendered":"<p><img loading=\"lazy\" decoding=\"async\" src=\"http:\/\/blogs.law.harvard.edu\/ahshieh\/files\/2008\/08\/hvmb1zguifo0clhzjx9t.jpg\" alt=\"Trillian Astra\" width=\"400\" height=\"300\" \/><\/p>\n<p>I&#8217;m confused. Very confused. Poking around the Trillian website, I found a little link in the directory: <\/p>\n<p>http:\/\/www.ceruleanstudios.com\/sneakpreview\/trillian-v4.0a-current.exe<\/p>\n<p>Clicking this, theoretically, would have caused direct download of the newest version of the closed Trillian Astra alpha release. Of course, I gave the downloading a try, only to be presented by a simple script based password prompt. I was too lazy, and not that interested in downloading Trillian in the first place, so I thought I would just let this little opportunity to explore go by. Little did I know, simply typing in &#8220;beta&#8221; and &#8220;beta&#8221; for both the username and the password would result in direct access to the download.<\/p>\n<p>Is this intentionally easy? Maybe? Anyway, surprised at my success, I went ahead and downloaded the installer and booted up the new Trillian. I was greeted by an Alpha release login page. <\/p>\n<p>&#8220;So it really isn&#8217;t that easy&#8230;&#8221; I thought. Well it was. Trying &#8220;beta&#8221; and &#8220;beta&#8221; again failed, but I got a port connection error. I changed my port, with a couple of guesses to 4444, and suddenly my password string was longer than &#8220;beta&#8221;. I thought this was just some sort of password protection, but I clicked login anyway. <\/p>\n<p>Wow. <\/p>\n<p>Successful login. Honestly, I don&#8217;t believe Trillian intended to protect this alpha release, but just wanted to prevent overload of servers. If protection <em>was<\/em> intended though, I suggest Trillian get right on fixing it, or just release it to everyone. It&#8217;s pretty good, afterall.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>I&#8217;m confused. Very confused. Poking around the Trillian website, I found a little link in the directory: http:\/\/www.ceruleanstudios.com\/sneakpreview\/trillian-v4.0a-current.exe Clicking this, theoretically, would have caused direct download of the newest version of the closed Trillian Astra alpha release. Of course, I gave the downloading a try, only to be presented by a simple script based password [&hellip;]<\/p>\n","protected":false},"author":1892,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[901],"tags":[],"class_list":["post-135","post","type-post","status-publish","format-standard","hentry","category-life"],"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/archive.blogs.harvard.edu\/ahshieh\/wp-json\/wp\/v2\/posts\/135","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/archive.blogs.harvard.edu\/ahshieh\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/archive.blogs.harvard.edu\/ahshieh\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/archive.blogs.harvard.edu\/ahshieh\/wp-json\/wp\/v2\/users\/1892"}],"replies":[{"embeddable":true,"href":"https:\/\/archive.blogs.harvard.edu\/ahshieh\/wp-json\/wp\/v2\/comments?post=135"}],"version-history":[{"count":0,"href":"https:\/\/archive.blogs.harvard.edu\/ahshieh\/wp-json\/wp\/v2\/posts\/135\/revisions"}],"wp:attachment":[{"href":"https:\/\/archive.blogs.harvard.edu\/ahshieh\/wp-json\/wp\/v2\/media?parent=135"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/archive.blogs.harvard.edu\/ahshieh\/wp-json\/wp\/v2\/categories?post=135"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/archive.blogs.harvard.edu\/ahshieh\/wp-json\/wp\/v2\/tags?post=135"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}