moot

FYI, station agents will merge/combine MetroCards for you, so you can recover small balances from old/unexpired ones.

Now you can download memes from 4chan marginally faster!!

(I'm really glad they did this, because at 4chan's patented "SOON™" dev pace, it'll take us another decade to add native IPv6 support.)

Sounds like a good plan to me!

Our investors have been incredibly supportive -- especially these past few [rough] months.

The biggest concern I have is not so much the price it would fetch (which is probably not much given recent events), but rather finding a suitable steward for the community.

I found myself in the same exact position with Canvas/DrawQuest earlier this year. Everyone (including myself) was laid off a few months ago, but we'd hoped to keep the app running with the remaining revenue/cash-on-hand and volunteered time (cut short by a recent hack).

It sucks, but I think we'll see more of it in the coming months/year. A lot of the seed-funded apps/companies from the past few years simply won't represent later-stage venture opportunities, and may find themselves in a position where they can't raise additional capital but can keep the service afloat without the payroll overhead.

> Would it be possible, however, to take donations (cryptocurrencies?) that can be used specifically for the bounties?

I appreciate the kind gesture, but I really hate accepting donations, and to that end we haven't accepted any in ~8.5 years.

> I think it would be a very good idea for moot to bite the bullet and pay for a moderately thorough security audit of 4chan's code.

Where/who would you suggest? I'm certainly open to the idea.

> they were still committed by a dev as experienced as moot

I'm not a terribly good programmer, and have been very hands-off with 4chan's code for quite some time. I still direct development and am responsible for the servers/sysadmin tasks, but there are far more talented developers out there than I. In the case of Canvas/DrawQuest, I was 100% uninvolved on the tech side.

But again, in both cases I accept full responsibility for the breaches since ultimately it's up to the project leader to ensure these things don't happen -- even if not active on the technical side.

> I wonder how old the code was for "Mistake 2"?

Very new. It was in a once-off file that we used to quickly pull stats about reported posts, which a) shouldn't have been on a domain without HTTP auth, b) should have been deleted long ago, c) shouldn't have had a bugged auth check or injection vuln to begin with.

Good point -- frankly I'd suggest doing both (clean repo and revoke/replace the secrets). The developer in question simply overlooked the issue, and since we were busy spinning down the company, nobody else caught it.

Venture capital for a separate business/entity != money for 4chan and/or myself personally. It's incredible how so many 4channers confuse the two and have a fundamental misunderstanding of VC...