leafo

Just wanted to follow up and say that Hisham confirmed with me he didn't receive any contact from Vhyrro. Feel free to have Vhyrro forward the emails again so I can find out why all their attempts to report the issue disappeared into both of our spam folders. You are building something very relevant to LuaRocks.org, you should have a direct line of contact with me.

> Apart from that, we couldn't find any alternative way of reaching you.

I'll just be blunt, I find this very hard to believe.

I want to take a moment to express why I feel the way I do. If you were a random security researcher, then great. You tried to contact me, the emails got lost along the way. There isn't much you can do. But from what I can see, you're a member of the Lua community who actively uses LuaRocks.

Did you stop using LuaRocks while you were aware of this issue? Did you instruct other people not to use it within rocks.nvim? For all you knew, every module on the site could have been replaced with malware infecting anyone installing any package. The severity of this was a "drop everything and panic" scenario, not an "I asked a group chat, oh well."

When you say something like, "Apart from that, we couldn't find any alternative way of reaching you," it makes me scratch my head. I am grateful you tried to contact me, but statements like that make it hard for me to give you the benefit of the doubt regarding your attempts to contact me.

And that doesn't event address the parts you glossed over in your account of the situation, specifically the actual exploitation on the production server without clearly stating that from the get-go.

Yes, I did thorough scan of my email, with Vhyrro's email, name and other keywords related to luarocks. Nothing was found. I asked Hisham to take a look for an email as well.

> Vhyrro found your Gmail address and sent you an email on August 7th:

I just searched my email and found nothing. Do you have subject line, sender address or receipt or anything that would help me find the emails that were sent?

> found your personal Matrix handle. That's when Vhyrro DM'd you on Matrix.

I don't use Matrix. There's a gitter.im for Luarocks that's effectively dead. I last was there in January 2026 asking if the server was alive but never returned. I logged into gitter right now to check and I was able to find a DM request from August 20th, I wouldn't have seen this under any normal circumstances though

Well, thanks for sharing you attempted to contact me at least.

Throughout this our only contacts have been representatives at Stripe and PayPal. They indicated that they got a notice and kicked off their own audit.

As far as I'm aware, the Collective Shout letter caused a "formal card network inquiry" to originate from both Mastercard and Visa. I did not have access to the actual inquiry, but my assumption is that it wasn't "we see this content, take it down" and more like "we saw this letter, look into whats going on before we do our own investigation and fine you"

Interesting, this morning I got a response from a staff member of the parent company that owns iwantmyname saying they didn't get my response with regards to the abuse notification they sent and that's why they took the domain down.

Unfortunately the domain has a hold placed on it by the registrar, so I believe transferring is disabled. I also wouldn't want to risk doing a transfer at an hour when their staff aren't available to help with the current issue.

I suppose I haven't really fully considered this use case, but...

There's no requirement to put your entire app in a location / {} block. You can freely use as many location blocks as you want, and those that you want to be rendered by Lapis can call serve to the app as normal.

eg.

location = /exact-match { content_by_lua 'require("lapis").serve("app")'; }

location /directory-match { content_by_lua 'require("lapis").serve("app")'; }

Keep in mind pattern matching will still happen in the app: You will need to define the routes handled by Lapis within the definition of the Lapis app. Why is it done this way? Primarily, for named routes. Typically you want to be able to generate the URL of a resource within your app's code, so by having routes defined in Lua you can easily reference those. Secondly, easy parameter parsing and the parameter validation.

> It's got some nice utilities that we use, but we ended up just using regular location {} routes each with their own content_by_lua code block and none of the lapis routing/handler stuff.

Although it's very possible to pick and choose what components to use, keep in mind that the `serve` function does some important work with connection pooling. If you are using any query related functionality outside of a dispatch it will open and close connections per request, which is not ideal for performance.

I'm curious, you folks probably make money off of fraud right? You probably have negotiated whatever dispute fee you pay processors directly well below the $15 you pass on to sellers, pocketing the difference.

So I'm guessing that Radar's price was set with this in mind, you ran the regression to set a price to ensure revenue does not decrease by having better fraud detection. Hence the super expensive price. If this wasn't the case, Radar probably would be free.

Probably creates a really bizarre incentive. You don't want to deal with obvious scams that hurt processing reputation, but you probably also want to make your built in fraud detection just crappy enough to ensure you capitalize on that revenue.