bigmoat

2005. There was still code and pages dating back to then running and being used. But over the years, more and more was built on top of it rather than a different stack.

Frontend code would vary with whatever flavor a developer liked at the time, but the backend was still always going through Rivet/TCL.

ICs would complain about it but the founders cashed out to the tune of 9 figures in the end, so it worked out for them.

I’ll agree that TCL isn’t inherently insecure, but you aren’t getting any libraries or frameworks with it either to make your life easier or safer.

The website still looks like the TCL monster it has always been, so I doubt it. But I have no intimate knowledge of the inner workings there soon after the Raytheon buyout.

As someone who used to work there, the passwords were definitely stored salted and hashed in the database.

The email mostly makes it sound like what’s in the user account table, though last 4 of credit card I didn’t think was in it. And mentioning passwords, not salted/hashed passwords, makes me think it was more.

I’m wondering if this is an Apache or Apache Rivet issue that possibly intercepted everything you sent to the server, which could then be your actual password if you logged in during the timeframe or even credit card if you bought something.

Also Rivet was full of footguns. IIRC, variables would exist for the life of the Apache child, so you had to clear them out or the next request had access to them, so if someone deleted or didn’t run the huge “delete all variables we probably set” proc, and someone was able to get an “info var” output, they’d see everything set in the previous request or further back if nothing overrode it. Like user info, which was just stored in a big global “user” array