Squinchpix and Security
It’s important for us to say something about site security because we’ve recently made far-reaching changes in how the site handles requests.
To begin with, Squinchpix does not gather personal information about users of the site. That may change in future but, for now, you will not be asked to say anything about yourselves before viewing the pictures. That fact is the strongest security of all. Even if the site were to come under a successful attack there is no user information to give away.
Those who do not maintain their own web sites will have difficulty imagining how many and how varied are the attacks on even the most innocent web site. (Even pictures of churches.) The first degree of seriousness is occupied by the ’scrapers’. These are bots which are like an evil version of Google. They troll the Internet looking for content which they then copy, organize, and sell to customers. There is a huge number of such scrapers and when I see one in the logs I block it forever. The second degree of seriousness is occupied by hackers who modify the URL line in order to get you to click on their web site. Here’s an example from my logs:
http://www.squinchpix.com/searchn.php?zoom_query=http://210.1.XXX.XXX:2082/index.html?
At first it looks like a simple call to squinchpix’s search engine: /searchn.php?zoom_query=
but then it follows with a query string that contains the ip address of the site they want your software to click on. In this example I’ve changed the two lower octets to X’s instead of the original numbers. The purpose of such attacks, I think, isn’t necessarily nefarious. What they want is the clicks in order to raise their profile in search engines like Google. Throughout the Internet there must be hundreds of thousands if not millions of such attacks every day. Such attempts are identified in SquinchPix’s software and then automatically blocked forever. Moral: DON’T FOOL WITH THE URL LINE!
The third degree of seriousness consists of those hackers who embed actual database commands in the URL line in an attempt to gain access to the database. These are truly evil because, if successful, they could compromise, destroy, or copy the entire database. SquinchPix’s software automatically detects such attempts and blocks such hackers forever.
Squinchpix’s security errs on the side of caution. If anything, it’s over zealous and we’ve done that on purpose. Every character from the URL line and from the search boxes is checked at input time and, of the 255 available, only a very small number of characters are accepted. Any other characters will result in the Garden Screen of Death which warns you about acceptable characters. This screen does not block you and you are encouraged to try again if you see this screen. If you see this screen repeatedly or if you feel that you are mysteriously blocked or if you see an http error when you try to access Squinchpix then you should write us here: bob@squinchpix.com and explain what was going on. I promise you that your letters will be taken seriously.
We take internet site security very seriously at SquinchPix and, to all of our users, safe browsing!