Some concern has been raised over the current point system. Now, to me, it seems that most people are fine with it, and I don't see anything wrong with it; Jacob concurs. But whatever, I'll give you a chance to voice your opinions [url=http://www.wcipeg.com/forum/viewtopic.php?p=989]here[/url].

[b]RULES[/b]
1. Don't forget to announce your identity first, if you are not a forum regular.
2. If you make a suggestion, make it [b]clear and precise[/b] so we can vote on it afterward and it can be immediately implemented if it passes. I don't want this to drag on.
3. Do not post replies merely concurring with others' opinions; just vote for them when the time comes. Feel free to concur however if you have additional arguments in support.
4. Do not post replies rejecting others' opinions unless you have an alternative suggestion.
5. Discussion will close on March 1st, after which voting will begin immediately. Voting will be conducted on a thread on the main Judge, to prevent fraud.

Don't think that I won't ban you for spamming. You know who you are.

The backend has been overhauled. Compilation and testing now take place in a [url=http://en.wikipedia.org/wiki/chroot]chroot[/url]ed environment, for security. If you notice anything unusual, tell me and I'll try to fix it.

SSL ([i]a.k.a.[/i], https) is now enabled everywhere on this site. However, you will have to accept my [url=http://t3nsor.wordpress.com/openssl-key/]OpenSSL key[/url] if you don't want your browser to complain that this site's identity isn't verified because the certification authority is not trusted blah blah blah.

In light of the fact that a [url=http://codebutler.github.com/firesheep/]proof-of-concept exploit[/url] of the ubiquitous cookie-based session authentication mechanism over unencrypted HTTP now exists, I personally recommend using SSL [url=http://www.eff.org/https-everywhere]everywhere[/url].

Note that, for the time being, I am too lazy to figure out how to cleanly separate the HTTP and HTTPS interfaces while still keeping them synced, so that  currently, for example, if you login to the HTTP server, you also login to the HTTPS server, and [i]vice versa[/i]. This is less than desirable, but oh well. (One consequence is that links from the wiki to the Judge will sometimes be http links and sometimes https links, but it depends on whether the last person to edit the page was using one or the other.)

Submissions, comments, and the server time indicator at the bottom of the page will now display the correct local time, provided that you have set your time zone correctly in your account info.

The default time zone for accounts "grandfathered in" (created before this update) is America/Toronto; if you live in Canada and you are in the same time zone as Toronto, you don't need to change anything. All new accounts however will default to UTC.

You are encouraged to create accounts on [url=/wiki/index.php]the wiki[/url] and add your name and some basic info to the [url=/wiki/index.php/PEG:Memberlist]memberlist[/url].

[i][b][color=#ff0000]Important[/color]: Please do not post any information that could be used to personally identify you, as the wiki is completely public.[/b][/i]

However, since the JVM uses up gobs of memory, we can still only run one submission at once. (This VPS has double the RAM of the previous one.)

I am offering a [b]$100 prize[/b] to the [b]first person[/b] to discover an XSS vulnerability in the PEG Judge. Here's an example: if you discovered that submission details were not properly escaped, you might be able to manipulate your submission so that when an admin views your submission detail, some nasty JavaScript gets injected into the page which steals his cookie and gives you admin access.

On the other hand, if you're the first to find some non-XSS vulnerability, such as some server-side PHP function that only checks authentication in the front end and not the back end, that would allow you to perform some action you're not supposed to be able to do by sending custom POST variables, I'll pay you $50.

Note that if you actually implement this exploit and compromise security in a destructive way, you're not going to receive the prize. Also, this offer does not extend to the wiki or forum. Those just contain a lot of code that we don't understand.

I'm pretty sure the Judge is secure right now. However, I will be implementing the problem-setter and contest-setter features soon (in imitation of SPOJ); this of course will increase the probability of exposure to insecure user-generated content.

2 years! Yeahhhh!

I've moved the forum from wcipeg.com/forum to this site. The link now appears in the menu bar.
Whether you want to use it is another story.