HFS v2.x security update By DANNY

[danny]

I agree that a multi-group discussion area is more sustainable, because more topics gets more proportion of actual people traffic.  I guess there's about 2000 HFS2X servers.  There are daily downloads of updated HFS2X, by real people, but not in large numbers.  So far as I know, HFS2X is the only windows server using its own code as the distribution server, without a CDN buffer.  The uses for HFS2X are niche:  The main specialty is to catalog a lot of files any way you want to.  The streaming-list beats the performance of list-before-draw and pagination schemes.  The HFS2X update is router-cooperative so it doesn't need speed-limit, yet it will find and list your files really fast. 

Anti-bot setup with HFS2x:   Currently, the zip with updated HFS2x includes a txt note with anti-bot filter examples you can use in Events (menu).  Also, templates are updated to decreased verbosity for fast recovery and less cpu time.  For files, a recommendable organization is Unbrowsable root folder (left panel, right click /, flags, uncheck browsable), for the purpose of access forwarded (to browseable subfolder) by DNS.  Currently, I have 5 websites (1 hfs server, 1 dynamic dns, and 5 forwarding address that help by specifying folder and port number); and the method is helpful if your ISP blocks port 80 (forwarder answers on 80 and sends to the real folder and port).  You can make a copy of either throwback.tpl or stripes.tpl named as hfs.diff.tpl putting it into a high volume (or public) folder for which the fast little template is helpful at saving cpu work and data. 

Except for a banip compatible router (or similar) with curated filter lists installed, there really isn't a 'one fell swoop' approach to dropping bot traffic.  Behavior filters, such as use real browser, ban hacky request, forward to a different port, unbrowsable root, can do a cumulative 12% apiece, approximately.  Not one thing will have a big effect, but the combination does.

[danny]

I've just completed another round of security inspection and didn't find anything big.
However, the update does spend less cpu time on bots, so it can serve more real people.

The new Lite version is available here.
It can run bigger templates just fine.

[rejetto]

I've just completed another round of security inspection and didn't find anything big.

i suggest you to install codex and ask it to find security bugs by also making a script to verify it's real and not just theory

[danny]

Thanks!  However, this particular project completed satisfactorily. 
Approximately 4000 of HFS2x servers are updated.
The lite version keeps up with 300+ megabit fiber internet.
It is very conservative with drive access, for compatibility with mechanical drives.
It is easy to do significant appearance customization without creating software code to do so.
CVE's blocked, performance doubled, limits validated, crash bug deleted, on/off bug bypassed, exec disabled.

Download Links:
The same lite version running my server:  https://startfetch.com/hfs/HFS2x_2026.zip
Also available: a translate version 'drop-in' update for HFS2.3M

Or HFS Lite S (most popular) or HFS Lite T that are are stored on the forum at 1/2 megabyte size; Use peazip or zpaq to uncompress.

This lite version has a small efficient onboard template.  A collection of larger templates for HFS Lite, is attached below.  If you have a large template set as primary, you can still use others this way:  The view can be customized, such as make a copy of stripes or throwback, named hfs.diff.tpl and dropping that in a folder, can change the view for that particular folder.  The method is handy for a clean straightforward distribution folder.