Comments on Project Euler

Any chance of anyone persuading euler to have an optional email field for the user accounts, so then if a user has set an email they can then link to WeChall ?

This is the latest news from PE:
Project Euler is back. However, it has been necessary to restore the database to 28 July 2015 which means that a number of members will have lost a couple of days of progress. It is also with ever greater sadness I report that I have been unable to identify the method of attack used to hack the database. It is quite possible that a similar attack may never happen again or it may happen again and again. If a similar hack occurs then I will be forced to restore the database once more. Clearly this is neither ideal nor can it continue indefinitely. For this reason we are calling on some of you, members of the Project Euler community, with expertise in web security to help identify vulnerabilities in the website. If anyone is able to provide information then not only will it be met with my own personal gratitude but with the appreciation of the rest of the members. Otherwise, if the method of attack is not discovered, and the website continues to be hacked, then the current content (problems and threads) will be permanently converted into a static website; an alternative method of publishing future problems will need to be determined.

If there aren't any logs indicating what happened, there is no way to be sure that you have found the vulnerability, no matter how many you find. From the limited information I can see, I can't even be sure that it wasn't some obscure bug that was triggered somehow due to normal but rare behaviour. Additionally, there are also questions about how adequate things like DB access and logging are implemented. Things I would like to know more about if I were to consider putting a lot of effort in evaluating the site from the outside. Not that I'm qualified to do any extensive evalution like that.

Just a heads up: https://projecteuler.net/profile/sabretooth.txt works too and is easier to parse as OCRing the png ;)
Still it doesn't really help without some form of authentication from the user.