Skip to content

Vision/3 Bundle v0.6.1

Latest
Latest

Choose a tag to compare

View all tags
@robbiew robbiew released this 04 Aug 22:08
v0.6.1
de403fe
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Vision/3 Full Distribution v0.6.1

Each bundle is a full distribution: extract and run. No need to build from source or clone the vision3 repo.

WFC console security hardening, from a security audit of the console and its
admin channel, plus an expanded WFC sysop guide.

Waiting-For-Caller console

  • Terminal escape injection closed: caller handles are stripped of control bytes before the WFC TUI renders them (node table, event feed, details view), and handles with control characters are rejected at registration. A hostile handle could previously replay escape sequences — title changes, screen clears — into the sysop's terminal. Note: the sanitization is client-side, so remote sysops need this release's rebuilt wfc binary to pick it up.
  • Revoked admins are disconnected live: open wfc-admin sessions re-check authorization every 30 seconds and drop when it no longer holds (WFC access disabled, user demoted or banned). Removing a public key still requires a BBS restart to take effect; the security guide documents this.
  • Refresh requests are rate-limited to the configured tick interval, so a compromised admin key can no longer flood the CPU and logs with forced snapshot rebuilds.
  • Unknown public-key offers are logged (debug level) with their SHA256 fingerprint for auditing.

Docs

  • WFC sysop guide expanded: console functions reference, key generation → transfer → registration walkthrough, auth troubleshooting, and an updated security model (re-authorization window, revocation caveat, what co-sysop-level admins can see).

Quick start

  1. Download the archive for your platform (see Assets below).
  2. Extract to a directory (e.g. /opt/vision3 or C:\vision3).
  3. From that directory, optionally run once: ./setup.sh (Unix) or .\setup.ps1 (Windows) to generate the SSH host key.
  4. Start the BBS: ./vision3 (Unix) or .\vision3.exe (Windows).

Default login: felonius / password — change after first login!

Bundle contents

  • Root — vision3, ue, strings, helper, v3mail, config, menuedit (main executables)
  • bin/ — binkd, sexyz, sexyz.ini (and zip/unzip on Windows)
  • configs/ — template configs (edit configs/config.json for your BBS)
  • menus/v3/ — menu set
  • data/ — skeleton (users, files, logs, msgbases, ftn, infoforms, oneliners)
  • ziplab/ — ZIP processing templates (BBS ad, file comment)
  • scripts/examples/ — example JS scripts for the scripting engine
  • setup.sh (Unix) / setup.ps1 + setup.bat (Windows) — one-time setup (SSH key, dirs)

Paths on Windows

Path strings in the JSON configs use forward slashes; they work on Windows too. For paths you edit (e.g. doors), you can use forward or backslashes.

Platforms

  • linux-amd64, linux-arm64, linux-armv7
  • macOS: one universal bundle (Intel + Apple Silicon), built for amd64 and arm64 then combined
  • windows-amd64, windows-386
Assets 10
Loading