Forums

Unfortunately no one can be told what FluxBB is - you have to see it for yourself.

You are not logged in.

#1 2010-08-09 00:02:48

hcgtv
Member
From: Charlotte, NC
Registered: 2008-05-07
Posts: 463
Website

FluxBB with certain mods shipped installed

All the talk of late has been about direction, don't quite know if anything has been decided yet. As I mentioned in this post, one of the biggest issues facing forum admins is bots signing up and spam.

Since mods exist, and if the direction is to incrementally update FluxBB, could certain mods make it into the shipping package?

Right now I'm running 1 FluxBB forum, but plan on launching at least 3 more forums. With the amount of sites I maintain, having to keep them modded and updating them whenever a security or a new stable release is launched doesn't appeal to me. I know that with diffs it's not such a daunting task, but the time involved of doing a local install and testing an upgrade prior to a live update, is time I could spend doing something else.

I've been playing with 1.4.1 locally, I like the new Air theme and all the nice additions to the core. I'm perfectly fine with core and a means to tackle signups and spam, of which the Akismet mod has been working fine, any other option would be ok with me, like ReCaptcha.

On PHPXref, many years ago, I started noticing more hits on PunBB related files, of which I informed Rickard. It was good and bad news I later learned, while more users were looking at the Xref, there apparently were more bots targeting the htmlized files.

Today, you can't put up a PunBB/FluxBB forum without having the bots come a-calling in short order. On the forums at PHPXref, I had over 70,000 signups, the majority were bots. These bots end up generating uneeded traffic, not to mention the weekly visit to my webhost via PuTTY to launch mutt to clean up the mail store of bounced messages.

At one time, PunBB was under the radar, where we could install a forum and not have to deal with it much. Today, it's another story, and an otherwise clean and simple procedure, of which I would imagine all the devs are proud of, has a small blemish.

I truly feel if FluxBB is launched with anti measures, all this bot traffic would eventually subside and script kiddies will be somewhat subdued. They won't give up entirely, since their scripts are dumb, just make a post on one of your blogs and call it, User Forums, then watch your logs fill up.

Another option is to ship a clean core and a modded one also, eventually downloads would dictate what users prefer, dictating future releases.

Anyway, just wanted to know your thoughts.

Offline

#2 2010-08-09 00:20:51

Franz
Lead developer
From: Germany
Registered: 2008-05-13
Posts: 6,483
Website

Re: FluxBB with certain mods shipped installed

I have actually been thinking about recommendations for development for mods, which goes in similar direction of your thoughts.

The fact that we now use Git (and, specifically, GitHub) should make things like this really simple. In theory, every mod developer would develop their mod on a forked FluxBB repository (or one repository with different branches, for that matter). Keeping the code up-to-date with the core would just be a matter of merging the changes from the "official" repo. And then comes the exciting part: people creating a forum site would have a local copy somewhere which could be "assembled" by merging the code from the repos of the mods they want to use. Conflicts still have to be resolved, but all the readme stuff is done automatically.

The downside: One has to install / learn Git. The benefit: Much more comfort, faster installation and the possibility of automating these task - just imagine a form where you select the mods you want to install, and a package just for you being thrown together by some Git merging actions after you click Submit.

Ok, this just went further then I thought it would go. Parts of what I wrote just came to mind as I was going on.

Would that road be worth walking on? What do you think?


fluxbb.de | develoPHP

"As code is more often read than written it's really important to write clean code."

Offline

#3 2010-08-09 00:55:06

hcgtv
Member
From: Charlotte, NC
Registered: 2008-05-07
Posts: 463
Website

Re: FluxBB with certain mods shipped installed

Franz wrote:

The downside: One has to install / learn Git.

I've been meaning to install and learn Git, since more and more projects are using it and I like the idea that more developers can jump in and play with their own code base.

Lenny backports has a rather recent Git release, 1.7.1, since 1.7.2 seems to be the latest stable release.

Franz wrote:

Would that road be worth walking on? What do you think?

I'm for being able to grab a modded forum, and using that to update all my installed instances. If you think using Git would be the way to go, then yeah I'm for it.

Edit: Just had a caveat, some forums have official plugins, mods what have you. This is due to the fact that certain mods are somewhat crucial, and waiting for the mod maintainer to update them whenever a new release comes out, can be a drag on the new release. These official plugins/mods are maintained by the core team, this insures that everything runs smoother on a new release.

Last edited by hcgtv (2010-08-09 01:08:23)

Offline

#4 2010-08-09 12:14:08

Gary
Moderator
From: Sydney, Australia
Registered: 2009-09-07
Posts: 217

Re: FluxBB with certain mods shipped installed

I am for what you have put forward on this topic hcgtv. If specific modifications were included with the forum software, it would benefit its users in a number of ways. I have not yet installed a FluxBB forum, however knowing that I'd be downloading something that comes with anti-spam methods built within it would make me feel as if FluxBB is completely secure.

I know there is no such thing as complete security, but I'm sure you guys get my drift. I don't want to be a person that installs forum software and only finds out that it gets hit with tons of spam accounts and spam posts. It is something I have been experiencing lately ever since buying my domain (and installing a WordPress blog and IPB forum on it).

Offline

#5 2010-08-09 12:18:18

Franz
Lead developer
From: Germany
Registered: 2008-05-13
Posts: 6,483
Website

Re: FluxBB with certain mods shipped installed

There's a whole discussion on the anti spam in core topic. The real problem is that there's no solution that works for everybody (details in that thread) and that we thus can't just include one claiming it is the way to go. Maybe having multiple options included and allowing for them to be switched on and off is the way to go, but that doesn't seem to be the way to go. Official modifications might be the only way to go...


fluxbb.de | develoPHP

"As code is more often read than written it's really important to write clean code."

Offline

#6 2010-08-09 12:32:23

Gary
Moderator
From: Sydney, Australia
Registered: 2009-09-07
Posts: 217

Re: FluxBB with certain mods shipped installed

Either way, so long as there's something in place could make the difference. How does this forum deal with spambots itself?

Offline

#7 2010-08-09 12:35:34

Franz
Lead developer
From: Germany
Registered: 2008-05-13
Posts: 6,483
Website

Re: FluxBB with certain mods shipped installed

We have a custom modification installed (honeypot, stopforumspam.com integration and some other funny stuff). Jamie (Reines) wrote about it in some more detail somewhere.


fluxbb.de | develoPHP

"As code is more often read than written it's really important to write clean code."

Offline

#8 2010-08-09 12:42:17

Gary
Moderator
From: Sydney, Australia
Registered: 2009-09-07
Posts: 217

Re: FluxBB with certain mods shipped installed

And it is not included in your releases at all?

Offline

#9 2010-08-09 12:45:55

Reines
Administrator
From: Scotland
Registered: 2008-05-11
Posts: 3,197
Website

Re: FluxBB with certain mods shipped installed

We have the username field renamed on the register form, and a new hidden field added with the old name. When the form is submit we check if the hidden field has been filled out, if it has then the user is a bot. This seems to catch 100% of bots. Some of the bots target stock PunBB/FluxBB installs and hence fill out the field with the old name and leave the new field blank, hence the registration is denied as the username field is blank. Some other bots fill out all fields, hence the registration is denied because they filled out the hidden field.

If they pass those checks, we check the IP and email address (not username) against the stopforumspam API. This catches a few human spammers.

Overall this cuts us down from 300+ spam registrations a day to 0-5. Any spammer caught is reported back to stopforumspam. We're actually now the 6th biggest contributor there even though we only started ~3 months ago.

PorkoWog wrote:

And it is not included in your releases at all?

No. Spam bots could easily be altered to fill out the correct field. The only reason it works is because it is unique, and not part of the normal set up.

Offline

#10 2010-08-09 12:50:17

Gary
Moderator
From: Sydney, Australia
Registered: 2009-09-07
Posts: 217

Re: FluxBB with certain mods shipped installed

Is there any advice you could give someone like me in regards to security and avoiding spam? The reason I ask is because my domain seems to get hit with spambots on a daily basis. I wouldn't want them completely taking over my forum, mainly due to it being bad for my hosting service business I will be setting up. I want it to be eradicated.

Offline

#11 2010-08-09 12:53:45

Reines
Administrator
From: Scotland
Registered: 2008-05-11
Posts: 3,197
Website

Re: FluxBB with certain mods shipped installed

I would definitely recommend using a honey pot approach smile I may be able to pull the changes we've made out of the site here for you, but I don't promise anything!

Last edited by Reines (2010-08-09 13:04:01)

Offline

#12 2010-08-09 13:03:22

Gary
Moderator
From: Sydney, Australia
Registered: 2009-09-07
Posts: 217

Re: FluxBB with certain mods shipped installed

That would definitely be a plus Reines, I'd really appreciate it. Anything to help me out would be appreciated. Would it take long to gain from this community and implement into my own?

Offline

#13 2010-08-09 13:04:47

Reines
Administrator
From: Scotland
Registered: 2008-05-11
Posts: 3,197
Website

Re: FluxBB with certain mods shipped installed

Here is a patch to add the honeypot and stopforumspam stuff we use. Though some parts are a bit of a hack (the API key is hardcoded, you'll need to add that in). Also it needs a table called test_registrations to log attempts, unless you comment out that part.

Offline

#14 2010-08-09 13:10:45

Gary
Moderator
From: Sydney, Australia
Registered: 2009-09-07
Posts: 217

Re: FluxBB with certain mods shipped installed

Where would I add all of this? And what exactly do I need to change in regards to the API key, use one of my own? How would I set up a table and stuff?

Newbie questions I know... tongue

Offline

#15 2010-08-09 13:15:45

Reines
Administrator
From: Scotland
Registered: 2008-05-11
Posts: 3,197
Website

Re: FluxBB with certain mods shipped installed

Use a patch tool to apply it (applying patches). You can get an API key from www.stopforumspam.com. To change it, add it into:

$pun_config['o_stopforumspam_api'] = ''; // Hack, this shouldn't be hardcoded here!

If you want to log attempts set up a table using PHPMyAdmin, otherwise comment out the line:

$db->query('INSERT INTO test_registrations (username, email, email_setting, timezone, dst, ip, referer, user_agent, date, spam, errors) VALUES(\''.$db->escape($req_username).'\', \''.$db->escape($email1).'\', '.$email_setting.', '.$timezone.', '.$dst.', \''.get_remote_address().'\', \''.$db->escape($_SERVER['HTTP_REFERER']).'\', \''.$db->escape($_SERVER['HTTP_USER_AGENT']).'\', '.time().', '.$spam.', '.count($errors).')') or error('Unable to log user registration', __FILE__, __LINE__, $db->error());

I missed it out in the patch, but you'll need to add something like:

.pun .usernamefield { display: none }

In all styles you use to hide the hidden field.

Offline

#16 2010-08-09 13:18:53

Gary
Moderator
From: Sydney, Australia
Registered: 2009-09-07
Posts: 217

Re: FluxBB with certain mods shipped installed

Alrighty then. I'll be sure to bookmark this page so when my forum is up and running I can implement it correctly. tongue

Thanks Jamie.

Offline

#17 2010-08-09 13:23:51

Franz
Lead developer
From: Germany
Registered: 2008-05-13
Posts: 6,483
Website

Re: FluxBB with certain mods shipped installed

This topic should really be split (awesome feature) tongue


fluxbb.de | develoPHP

"As code is more often read than written it's really important to write clean code."

Offline

#18 2010-08-09 13:27:19

Gary
Moderator
From: Sydney, Australia
Registered: 2009-09-07
Posts: 217

Re: FluxBB with certain mods shipped installed

Ha ha, it should be if it existed on FluxBB. wink

Do I hear a new addition coming?

Offline

#19 2010-08-09 13:32:36

Franz
Lead developer
From: Germany
Registered: 2008-05-13
Posts: 6,483
Website

Re: FluxBB with certain mods shipped installed

We already have this feature tongue


fluxbb.de | develoPHP

"As code is more often read than written it's really important to write clean code."

Offline

#20 2010-08-09 13:36:07

Gary
Moderator
From: Sydney, Australia
Registered: 2009-09-07
Posts: 217

Re: FluxBB with certain mods shipped installed

I can't see it... Maybe a moderator/administrator feature. Or you may not have it enabled for normal members of course. tongue

Offline

#21 2010-08-09 13:54:03

zaher
Member
From: Damascus, Syria
Registered: 2008-07-12
Posts: 126
Website

Re: FluxBB with certain mods shipped installed

1 - Why not the core team make branch for important MODs maintain it offically,
We can download this branch from GIThub, i mean we can download FluxBB already MODed by the core team.

2 - Using GIT merge not always good way with complex code, it will make confilect every time update from the Git REPO, i am talk about parser.php adding new BBCode.

Offline

#22 2010-08-09 14:11:10

Gary
Moderator
From: Sydney, Australia
Registered: 2009-09-07
Posts: 217

Re: FluxBB with certain mods shipped installed

There are a number of modifications that I feel should be officially maintained by the FluxBB team...

Offline

#23 2010-08-09 14:14:20

Franz
Lead developer
From: Germany
Registered: 2008-05-13
Posts: 6,483
Website

Re: FluxBB with certain mods shipped installed

While that is a good idea in general, I would say that currently we just don't have the time and man-power.


fluxbb.de | develoPHP

"As code is more often read than written it's really important to write clean code."

Offline

#24 2010-08-09 14:18:37

Gary
Moderator
From: Sydney, Australia
Registered: 2009-09-07
Posts: 217

Re: FluxBB with certain mods shipped installed

You could think about adding an active member of the community that does have experience with modifications and FluxBB and appoint him as a developer, or possibly create a new group; Modifiers? tongue

Offline

#25 2010-08-09 14:21:18

Reines
Administrator
From: Scotland
Registered: 2008-05-11
Posts: 3,197
Website

Re: FluxBB with certain mods shipped installed

Anyone can fork on GitHub and maintain a modded version, they don't need to be in any special user group here unless they wanted to.

Offline

Board footer

Powered by FluxBB