BioTorrents.de’s version of Gazelle
You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
ohm eaae22f6fa Remove issue templates 4 months ago
classes Many small pre-update fixes 4 months ago
design Many small pre-update fixes 4 months ago
sections Quick fixes after applying update 4 months ago
static Quick fixes after applying update 4 months ago
templates Many small pre-update fixes 4 months ago
.gitignore Add $ENV->convert, update readme and config template, add more Twig templates, etc. 4 months ago
announce.php Empty commit 10 months ago
api.php Big broken commit: redo torrents_group schema, remove "capture user" and "donor forum honorific" features, add ability to call API from Gazelle, duplicate API for new version, style updates, etc. 6 months ago
artist.php Empty commit 10 months ago
better.php Empty commit 10 months ago
blog.php Empty commit 10 months ago
bookmarks.php Empty commit 10 months ago
browse.php Empty commit 10 months ago
collage.php Empty commit 10 months ago
collages.php Empty commit 10 months ago
comments.php Empty commit 10 months ago
composer.json Add Skeleton CSS support, mostly 4 months ago
composer.lock Add basic bioinformatics support 4 months ago
contest.php Empty commit 10 months ago
donate.php Empty commit 10 months ago
enable.php Empty commit 10 months ago
error.php Empty commit 10 months ago
feeds.php Fix 500 errors on torrent group editing and missing CSS assets 4 months ago
flush.php Empty commit 10 months ago
forums.php Empty commit 10 months ago
friends.php Empty commit 10 months ago
gazelle.sql Quick fixes after applying update 4 months ago
image.php Fix 500 errors on torrent group editing and missing CSS assets 4 months ago
inbox.php Empty commit 10 months ago
index.php Empty commit 10 months ago
legal.php Empty commit 10 months ago
license.md Empty commit 10 months ago
locked.php Empty commit 10 months ago
log.php Empty commit 10 months ago
login.php Empty commit 10 months ago
logout.php Empty commit 10 months ago
manifest.php Remove /sections/ajax 6 months ago
peerupdate.php Empty commit 10 months ago
readme.md Many small pre-update fixes 4 months ago
register.php Empty commit 10 months ago
reports.php Empty commit 10 months ago
reportsv2.php Empty commit 10 months ago
requests.php Empty commit 10 months ago
robots.txt Empty commit 10 months ago
rules.php Start to implement Seqhash and fix lots of stuff (the site is still broken) 6 months ago
schedule.php Empty commit 10 months ago
scrape.php Empty commit 10 months ago
snatchlist.php Empty commit 10 months ago
sphinx.conf More incremental improvements 4 months ago
staff.php Empty commit 10 months ago
staffpm.php Empty commit 10 months ago
stats.php Empty commit 10 months ago
store.php Empty commit 10 months ago
tools.php Empty commit 10 months ago
top10.php Empty commit 10 months ago
torrents.php Empty commit 10 months ago
upload.php Empty commit 10 months ago
user.php Empty commit 10 months ago
userhistory.php Empty commit 10 months ago
wiki.php Empty commit 10 months ago

readme.md

BioTorrents.de Gazelle

This software is twice removed from the original What.cd Gazelle. It’s based on the security hardened PHP7 fork Oppaitime Gazelle. It shares several features with Orpheus Gazelle. The goal is to organize a functional database with pleasant interfaces, and render insightful views using data from robust external sources.

Changelog: OT → Bio

Bearer token authorization

API Docs. API tokens can be generated in the user security settings and used with the JSON API.

Good typography

BioTorrents.de supports an array of unobtrusive fonts with the appropriate bold/italic glyphs and monospace. These options are available to every theme. Font Awesome 5 is also universally available. Download the fonts.

Markdown support

SimpleMDE markdown editor with extended custom editor interface. All the Markdown Extra features supported by Parsedown Extra are documented and the useful ones exposed in the editor interface. Support for the default Gazelle recursive regex BBcode parser.

$ENV recursive singleton

The site configuration is being migrated to a format govered by the ENV special class for modified recursive ArrayObjects.

Twig template system

Similar to ENV, the Twig interface operates as a singleton because it’s an external module with its own cache. Twig provides a security benefit by escaping rendered output, and a secondary benefit of clarifying the PHP running the site sections. Several custom filters are available from OPS.

Active data minimization

BioTorrents.de has real lawyer-vetted policies. In the process of matching the tech to the legal word, we dropped support for a number of compromising features:

  • Bitcoin, PayPal, and currency exchange API and system calls;
  • Bitcoin addresses, user donation history, and similar metadata; and
  • IP address and geolocation, email address, passphrase, and passkey history.

Besides that, BioTorrents has several passive developments in progress:

  • prepare all queries with parameterized statements;
  • declare strict mode at the top of every PHP and JS file;
  • check strict equality and strong typing, including function arguments;
  • run all files through generic formatters such as PHP-CS-Fixer; and
  • move all external libraries to uncomplicated package management.

Minor changes

  • Database crypto bumped up to AES-256
  • Good subresource integrity support
  • Configurable HTTP status code errors
  • Integrated diceware passphrase generator
  • TLS database connections
  • Semantic HTML5 themes (WIP)

Changelog: WCD → OT

Integrated Database Encryption

Using a database key provided by staff and only ever stored as a hash in memory (via APCu), the integrated database encryption is used to encrypt sensitive user data like IP addresses, emails, and private messages regardless of the underlying system gazelle is running on.

The rest of gazelle must be aware that some of the data it fetches from the DB is encrypted, and must have a fallback if that data is unavailable (the key is not in memory). You will see plenty of if (!apcu_exists('DBKEY')) { in this codebase.

Two-Factor Authentication

Despite our other (less intrusive) methods of protecting user accounts being more than sufficient for virtually all feasible attacks, we also ship optional 2FA should users feel the need to enable it.

Universal 2nd Factor

Support for physical U2F tokens has also been added as an optional alternative to normal 2FA. U2F allows users to protect their account with something less likely to be lost or erased than 2FA keys stored on a phone.

Unique Infohashes

Upon upload, torrent files are modified to contain a “source” field in the info dict containing the concatination of the site name and some generated junk data (unique per-torrent). This prevents infohash collisions with torrents cross-seeded from other sites in the same client, and also helps protect against some not particularly likely peer-leaking attacks.

Resource Proxying

All external resources that may appear on a page are fetched and served by the server running gazelle. This prevents the leak of user information to third parties hosting content that has been included on a page through an image tag or similar.

Scheduler

The scheduler has been broken up into more manageable parts and has additional selective runtime features for manual execution.

Bonus Points

Like most gazelle forks, we’ve added a bonus point system and store.

Modern password hashing

We use modern PHP password hashing features that automatically rehash your password when a better hashing algorithm is made available and employ prehashing to allow you to use a secure password of any length. Original gazelle would effectively truncate your password after around 72 characters (if the tracker even allowed you to use a password that long). This codebase does not have the same problem, and allows passwords of virtually unlimited length (over 30,000 characters by default) that remain useful after a few tens of characters.

Minor Changes

  • When a torrent is trumped, the new torrent is made freeleech to users who snatched the old torrent for a few days.
  • Sends headers to tell cloudflare to use HTTP/2 Server Push for most resources.
  • Support for optional per-user stylesheet additions and tweaks
  • This codebase expects to run over https only.

Mascot

Gracie Gazelle

Gracie Gazelle

Gracie is a veteran pirate of the Digital Ocean. On land, predators form companies to hunt down prey. But in the lawless water, prey attack the predators’ transports. Gracies steals resources from the rich and shares them with the poor and isolated people. Her great eyesight sees through the darkest corners of the Internet for her next target. Her charisma attracts countless salty goats to join her fleet. She proudly puts the forbidden share symbols on her hat and belt, and is now one of the most wanted women in the world.

High resolution downloads here

Character design and bio by Tyson Tan, who offers mascot design services for free and open source software, free of charge, under a free license.

Contact: tysontan.com / tysontan@mail.com