SRL Archive - Senior News and General

Widget has reported a post.

Reason:

Dunno what forum this should be in, you guys can decide :p

Post: SRL Installer
Forum: Other Scripts
Assigned Moderators: Freddy1990

Posted by: Widget
Original Content:

Current: rev 1

Sex has also reported this item.

Reason:

SRL downloaders were against the rules last time I checked..

Widget, do you have access to this forum ?

If not,I would like to re-post as a script that is visible, so people can see exactly what it does…..

except, I'm afraid people will manipulate it for malicious activity as stated…

Actualy, IT IS AGAINST THE RULES here….NO DOWNLOADERS OF ANY TYPE….this is to protect the general public from any malicious activity…you never know what's bundled up in that program…..if it wasn't from Widget, I would be concerned, seeing Widget is trusted, I'm not concerned for the program, but my concern comes from someone who manipulates the program for malicious behavior, then re-posts it down the line, either here or another forum….I'll leave the thread open for the time being, but remove the link pending a further investigation into this…

Well… This can always be done. I can just make a scar.exe that is a virus… Nothing can stop me really… People can always do this.

It should connect to villavu.com only, you srsly are a a moron not completely paying attention if you let scar connect to unsafe websites.
Besides it is a SCRIPT, not a program so it can't do that much harm at all. (ofc it's possible to install a keylogger by putting a malicious DLL in the SCAR folder, but that thingy won't come from the villavu repos).

@ Markus, ever googled SCAR/SRL ? you can even find it in torrent form…doesn't mean that , that particular copy of SCAR wasn't tampered with….I'm not worried for what happen here, i'm worried for the potential this has on the unsuspecting user..I think you pronounced it.."Moron" :p

Soo…I, was talking to Widget on this..my main concern is, giving people a "template for disaster"…we all know this was posted with good meaning, but I'm worried for the person that grabs it, modifies it for malicious activity, then posts it further down the line, perhaps not even these forums, and someone (moron) doesn't know that it should only connect with this site, and then blames us for anything bad resulting in this…

obviously, with 2400+ downloads of the Reflection Installer, it is a much needed script…especially with wanting to make these forums more "noob freindly" …

so, do we have him paste the actual script in code tags, so people know what they are downloading (doesn't mean Widget can't change the actual script posted for download I know, but I am not concerned for this, as we know Widget is trustworthy)…and show people how easy it could be to have the potential to make SCAR do malicious activity ?…I understand they could do this by downloading and modifying as well…

I also understand, it was Dankness' and Fakawi's rules, so the beginner had to work a little bit, rather than having everything handed to them, but with the new stance of making things easier on the beginner, i know how beneficial this script will be…

Just let me know how it should be handled ?

E. I moved this, so Widget can read the discusson….Widget, Please post when you can read this.

From: Widget
Ok, I was just worried that you thought I posted an executable or something that could have a virus bound to it. Also, i wasn't able to find that rule anywhere so I based it off the "no useful internet connecting" rule, and iirc the "no downloaders" rule was based on something like "If you can't figure out how to extract a RAR archive you shouldn't be using SRL," though it's not just extracting a rar archive anymore :)

Wizzup's plans are the reason I bothered to fix the reflection installer for porting to SRL's repository actually. What better way to make people want to write scar scripts than by showing them cool stuff (by scar standards :p) right away? (Or something like that)

I'm not really sure what to say about people using it to download viruses, other than that SCAR can't call other programs (unless API calls are enabled which gives some really loud text or it goes in the Startup folder on Windows [Start Menu\Programs\Startup], but hopefully no one will realize that :o). Also, they would have to set up their own svn repository or make it so that my thing can parse it, which goes a bit farther than I think most people would go.

Really it would just be nice if Freddy could put something in SCAR that would let you download from subversions and also let you add/change SVN URLs in case repositories move but I doubt that'll happen anytime soon :p

Edit: I can't track its views if I make it non-attached :(

I tried using this script last night, but didn't have much luck..it froze a couple of times while trying to download at the Reflection include…I then got some crazy errors, not sure if it was entirely your fault, as it was very early morning…anyway..I'll just stick to the old way of doing it….but, if this can help new users at all, then it's worth it….

Sorry for removing, I just wanted to investigate it a little further…so, if no one else (and it doesn't seem they do ?) has a problem with this, then just go ahead and re-post it Widget…

Well really, I don't see how this is related to Widget's script at all. Why would one want to alter his script? Isn't it just as easy to create your own malicious script? I mean, only the fool people would get tricked by such a script, so it doesn't really matter if it's based on Widget's script or if it's just a plain new script.

Besides that, I'm pretty sure SCAR was made in such a way it prevents people from doing malicious things, like installing viruses/keyloggers etc…

Besides that, I'm pretty sure SCAR was made in such a way it prevents people from doing malicious things, like installing viruses/keyloggers etc…

It can click its way to CMD and type in shutdown! >:0

From: mastaraymond
Well really, I don't see how this is related to Widget's script at all. Why would one want to alter his script? Isn't it just as easy to create your own malicious script? I mean, only the fool people would get tricked by such a script, so it doesn't really matter if it's based on Widget's script or if it's just a plain new script.

well, easier to alter than create a new 1, so, No, for the person that sees this and goes, Ohhh, sooo that's "how" it's done…it's much easier than starting from scratch ?

From: mastaraymond
Besides that, I'm pretty sure SCAR was made in such a way it prevents people from doing malicious things, like installing viruses/keyloggers etc…

You underestimate the Power, Young Grasshopper ;)

From: RAM
well, easier to alter than create a new 1, so, No, for the person that sees this and goes, Ohhh, sooo that's "how" it's done…it's much easier than starting from scratch ?



You underestimate the Power, Young Grasshopper ;)

One would need understanding of SCAR anyway to create an malicious script.. So it wouldn't make a difference between creating/altering a script. That's like saying you cannot use FireFox because it might download malicious files

I know by being Dutch (only 2nd generation American), we tend to be hardheaded, but you my friend "Take The Cake" ….This is my last post regarding this, but,

Just assume, seeing that I have limited knowledge of SCAR, or in making any file a malscious one…. I am confident, that it would be harder for me to learn how to do this, or write a script from SCRATCH to do this…There is no way in Hell, you can argue, that it wouldn't be easier to just take his script, analyze what it does…then edit it to do something malicious…then to spend day, weeks or more, learning all the different aspects of the different functions and procedures he used, then to apply it…

That was my whole point in removing it in the first place…

it's common logic…. you learn by looking at examples…well, here is a perfect example…WHY would I try to learn to do the exact same thing somewhere else, when he has posted exactly what I it want to do…except, download from SRL SVN, it downloads from my SVN, etc…aside from trying to disguise it, this can be accomplished in editing 1 line !?!?!?!??! maybe this person didn't even have this intent, maybe they just saw this script, then thought, :stirthepot: Hey, maybe I can make this do something malicious, redirect, download, etc, whatever…

I'm sorry if I jumped the gun and removed it, It's been common knowledge that this was against the rules for a long time, and for the above reasons noted….I was just trying to look out for the best interest of the community….if just the above thing happens, I'll point them in your direction, and you can try and explain this discussion to them…

As for me, I'm done wasting any more time on it…..

From: RAM
I know by being Dutch (only 2nd generation American), we tend to be hardheaded, but you my friend "Take The Cake" ….This is my last post regarding this, but,

Just assume, seeing that I have limited knowledge of SCAR, or in making any file a malscious one…. I am confident, that it would be harder for me to learn how to do this, or write a script from SCRATCH to do this…There is no way in Hell, you can argue, that it wouldn't be easier to just take his script, analyze what it does…then edit it to do something malicious…then to spend day, weeks or more, learning all the different aspects of the different functions and procedures he used, then to apply it…

That was my whole point in removing it in the first place…

it's common logic…. you learn by looking at examples…well, here is a perfect example…WHY would I try to learn to do the exact same thing somewhere else, when he has posted exactly what I it want to do…except, download from SRL SVN, it downloads from my SVN, etc…aside from trying to disguise it, this can be accomplished in editing 1 line !?!?!?!??! maybe this person didn't even have this intent, maybe they just saw this script, then thought, :stirthepot: Hey, maybe I can make this do something malicious, redirect, download, etc, whatever…

I'm sorry if I jumped the gun and removed it, It's been common knowledge that this was against the rules for a long time, and for the above reasons noted….I was just trying to look out for the best interest of the community….if just the above thing happens, I'll point them in your direction, and you can try and explain this discussion to them…

As for me, I'm done wasting any more time on it…..

Never was my intention to piss you off.

It's just that turning that one single SVN line will not turn this script into a Keylogging-Bastard script. You still would have to add, advanced/smart, lines to make it actually DO something malicious.

And if this script is dangerous then every script that interacts with the internet is, including SRL. Now you are right it's easier to alter this script, but WriteFileString(GetPage('LinkToMaliciousFile')) is something that's even done by SRL itself. So that would mean everyone can just change SRL to do something malicious. There is nothing that we can do to prevent such bad things from happening. Unless we want to ban every script that interacts with the internet.

I get where you're coming from though, but I think that with those restrictions a lot of good scripts will never be produced. Seeing the activity of SRL dropping anyways, I don't think it's a good idea to amplify this.

I think we should just approve the script and let Widget post it. In my opinion the pros cover up the worst scenario.

Let the fingers point at me if anything happens :D. I can always ban myself from SRL.

P.S.: Plugins/API's enabled are way more dangerous, those should actually be removed or monitored.

Shall I add that my Reflection installer hass been up for forever? All you have to do is replace "Reflection for SRL" with "SRL for SCAR" in a couple places…


Also, you're assuming they know how to set up a subversion repo, and after that know how to make something that steals passwords. They can't just use a keylogger unless they embed it into a DLL, so they're going to have to know how to write a scar function that sends the username(s) and password(s) to the server which would then have to have a php/python/asp/perl script to save it somewhere on the server. At this point writing their own little pascal thing isn't hard to do.

From: mastaraymond
Never was my intention to piss you off.

It's just that turning that one single SVN line will not turn this script into a Keylogging-Bastard script. You still would have to add, advanced/smart, lines to make it actually DO something malicious.

And if this script is dangerous then every script that interacts with the internet is, including SRL. Now you are right it's easier to alter this script, but WriteFileString(GetPage('LinkToMaliciousFile')) is something that's even done by SRL itself. So that would mean everyone can just change SRL to do something malicious. There is nothing that we can do to prevent such bad things from happening. Unless we want to ban every script that interacts with the internet.

I get where you're coming from though, but I think that with those restrictions a lot of good scripts will never be produced. Seeing the activity of SRL dropping anyways, I don't think it's a good idea to amplify this.

I think we should just approve the script and let Widget post it. In my opinion the pros cover up the worst scenario.

Let the fingers point at me if anything happens :D. I can always ban myself from SRL.

P.S.: Plugins/API's enabled are way more dangerous, those should actually be removed or monitored.

We can always make SRL closed source!

You're right Markus, every script IS potentially dangerous…the key logger doesn't even have to be in SCAR, I believe the 1 Munk had posted, was a duplicate site of RS, that stole the P/W when attempting to log in…

but yeah, I already agreed to the consensus, that this script will indeed to more good than harm, we just need not debate the possible negative impacts on the public side ;)

E.@ Wizzy….You get out of here with your silly comments :p

So can I put it back yet?

From: Widget
So can I put it back yet?

YEP :), somewhere in that ramblings I already gave it m blessing, and no one else has objected, don't worry for posting the actual script, just the download, then you can keep track, and we can have a record of who D/L it…

Sorry again for the confusion, and thanks for handling it so well :)