Camen Design Forum

What's planned for NoNonsense Forum, and what would you like to see next?

append delete Kroc

On my radar:

:: Image and YouTube embedding

I know this is feature is much-desired. Mods will be able to embed images and videos. There won't be any special syntax for it; any image (PNG, GIF, JPE?G) or YouTube URL on a blank line (no other text) will automatically embedded

:: Greyscale theme colour alts

Now I'm able to generate the various images via a script, it won't be too hard to create alternative colour themes for Greyscale. These will be selectable from within Greyscale, rather than being separate themes entirely so that users can choose their own preferred colour scheme and the admin can set a default.

:: stick / unstick button

The ability to sticky / unsticky threads within NNF (without having to use FTP) has become a necessity. This is not difficult to add, but will be limited to the site admin only and not mods. The first user listed in mods.txt will be the site admin who will have access to many more admin features in the future.

The long-term goal is to provide a management panel for the site admin where they can do a lot of administrative tasks without having to FTP in.

:: Running without HTAccess

I am aware of the desire for this feature, but it's not the easiest thing to implement elegantly. This will be handled via a long branch, much as DOMTemplating and translation were.

The core difficulty is that all URL construction within the code must generate URLs that work with or without htaccess. At the moment it's all just string concatenation, but I'll have to add a helper function, which will complicate the code a bit.

I'm in two minds about how to best handle no-htaccess. I would like to move the NNF code out of the root and into a sub-folder, but that would break being able to silently fallback to no-htaccess mode without any work on the part of the site admin.

---

*Areas for Discussion*

Some areas I feel that need community discussion

:: Bans

Without a database, it will be hard to implement effective bans. The only option will be IP-based bans, but care must be taken to produce a simple and elegant system that won't break if left alone.

The most difficult aspect is that IP data is not stored with each post; NNF does not know the IP of any user who made a post. This is tricky problem to overcome without creating some form of messy database that duplicates data. Your input on methods we could use to track IPs and effect bans would be appreciated.

:: Flood control

Hand-in-hand with banning comes flood control. There's no limit at all to how quickly anybody can post. I don't wish to impose a limit, because this breaks the zero-hurdles approach to NNF. I would never want to prevent someone from posting something because of pissing them off with hurdles. Bad people are a problem, good people are not and shouldn't be treated like one. If you've any thoughts on flood control, let me know.

*Any personal requirements?*

Lastly, if you have any personal requirements for features in NNF, please add your reply. I feel it helps to debate an idea here to find an elegant solution that's unique and treats the matter with care and consideration. (rather than a "let's solve it with more BBCode!" kind of attitude)

Reply RSS

Replies

append delete #1. Akerhielm

:: Bans

My first idea would be to have a hash (with salt) of the IP that posted the message could be stored as metadata for each post. And then listing banned hashes in a 'banned.txt' and checking against it whenever someone tries to post.

This is a bad idea because:

This would mean including data in the document which is useless to readers.

This would also make identifying what posts are made from the same IP-address possible however. This could be solved with two way encryption of the hashes, but the key could still be stolen in one way or another.

append delete #2. Kroc

Good idea about salting the IPs; this is a very good starting point.

What if the unique post ID (e.g. #75uo9wwmclox) was a hash of the IP / time? This way we're not adding any non-RSS data to the XML, it'll be part of the URL instead.

Salting, and checking is then the difficult question. You don't want to include the username in the hash, since NNF allows you to use infinite different usernames. If we hash using the IP and time, we have something that is unique, only one part of the hash is known by the public (the time, not the IP) and we have the time saved so that we can re-hash from an IP to check against the ban.

That said, we can't store banned information in the RSS, because you'd have to parse every feed every time to look for it. There would need to be a banned.txt where the IPs were hashed in some way that was still private. We could store banned.txt in the users folder, which is protected, and just keep the IPs unhashed so that the admin has access to them and can manually manage the list if need be.

There would need to be a self-managing way for bans to last for 24-hours. The bans list could include a timestamp and then re-save itself whenever one has expired and gets removed.

append delete #3. Jose Pedro Arvela

An idea for having the IP from an user could be to have some backwards compatible format for storing the username and passwords in which a newline in the document would split the hashed password and the last IP used, hashed. That way the IP would still be hashed, it would be inaccessible to other users, but there would be no problems for the admin to find the hashed version to add to the ban list (remember that if you hash the IP with the date, a different hash of the IP only without the date would still be needed for the banned.txt file and figuring it from the IP+date has would be hard).

For usernames without password, as a newline is used to split, if the file started with a newline the person didn't "register" the username yet.

append delete #4. Kroc

It’s not useful to store IP with the user because the two are not necessarily related. Anybody could spam using a different username every post whilst on the same IP.

append delete #5. Jose Pedro Arvela

Nonetheless, what matters is that the admin can check that IP somewhere, and that way it's not being openly saved visibly on the feed itself. That's why I suggested it is saved on the username file.

Especially because the IP hashed together with the date and the IP hashed individually are different and one can't be used for the other's purpose.

append delete #6. Akerhielm

"
What if the unique post ID (e.g. #75uo9wwmclox) was a hash of the IP / time? This way we're not adding any non-RSS data to the XML, it'll be part of the URL instead.
Salting, and checking is then the difficult question. You don't want to include the username in the hash, since NNF allows you to use infinite different usernames. If we hash using the IP and time, we have something that is unique, only one part of the hash is known by the public (the time, not the IP) and we have the time saved so that we can re-hash from an IP to check against the ban.
"
If you want to use a one-way hash, including time is probably a bad idea, since you'd need to compute a hash once for each ban every time you check whether an IP is banned.

append delete #7. Kroc

@Jose Pedro Arvela Yes, didn’t think of it that way. That’s actually a good idea, since it’s easy for NNF to look up the IP to ban based on an RSS item

append delete #8. wes

Just a small thing: Why not use Duckduckgo instead of Google search?

append delete #9. Kroc

Already tried that, it’s just not effective enough yet. Any individual admin can change the search engine themselves if they have a preference.

append delete #10. Kroc

Note to self: Automatic state configuration is _hard_.

I've been working on the no-htaccess feature and it's seriously difficult. NNF has to function in a interchangeable mix of environments that combines auto-selected states:

1. With (reliable) or without (unreliable) htaccess +
2. Running in root (reliable), or in a sub-folder (unreliable)

These two are responsible for making URLs very complex to construct. After a lot of breakage, I've just about got it into order. clean URLs (+htaccess) are relative, but ugly URLs (-htaccess) are absolute, but the path (sub-forum) in pretty URLs includes the NNF root-folder (if not running in web-root), but ugly URLs don't: i.e. pretty: `/nnf/sub-forum/` ugly: `nnf/index.php?path=sub-forum/`.

Once I'd worked out a way to get the many varieties of input to my central `url` function to canonicalise pretty and ugly URLs to absolute URLs I then discovered the joy of Apache confusing threads with the same names as sub-forums. Turning DirecotrySlash off would fix this, but would then mandate that all links pointing to NNF when running in a sub-folder (e.g. `website.com/nnf/`) end in a slash otherwise you'd get a 403. That wasn't acceptable to me so I had to find a work-around.

By taking the pretty canonicalised absolute URL and stripping off the start of it that matches the location of the current page, we can turn the absolute URL into a relative URL without having to alter the caller's parameters. (One of the hardest aspects has been making all calls to `url` be the same, regardless of +htaccess, -htaccess, root or sub-folder)

I think I've overcome the biggest hurdles now and need to work on refactoring this solution a little and adding some more comments. To finish the feature we need to mandate the admin move the users folder into a private space when running without htaccess, otherwise all the passwords would be easily exposed.

append delete #11. Stephen :)

IP Ban would be cool like to click on the ip on a post which is shown only to mods when you log-in and when you click on it you get a option of ban or unban a IP. :) But thx for everything so far!! Oh and to be able to use this without HTAccess :).

append delete #12. Kroc

We won't be making the IP visible, even to the site admin, just so as to be secure and not leak people's data; but you will be able to ban the IP by banning the username in the UI.

No-HTAccess support is not done yet, but it's nearing completion. A difficult hurdle to get over is the signin link needs to be crafted on every page, and that now requires knowing the path, file & page number which is different on index and thread pages. I could either make it ugly with more parameters, or make it odd and confusing by making these variables global.

append delete #13. oldtimes

Just my thoughts: IP/DNS based bans are waste of time. IP is usually dynamic and even with static IP, someone who really wants to be ******* can always use TOR network or some anonymiser proxy. Also if you plan to implement IPv4 based restrictions, you should take care of IPv6 too. Regardless if it is IPv4 or IPv6 you should ban whole subnets and then ban would stop everyone from the subnet.

append delete #14. Kroc

@oldtimes Whilst IP banning can never be totally effective, I noted in the original NoNonsense Forum article (http://camendesign.com/forums) that other forums have all kinds of registration hurdles, CAPTCHAs and the like and *still* get spammed, so I am under no illusion that adding banning to NNF would ever solve the problem entirely, but it can solve _some_ problems (mainly automated spam bots).

I'll be using the REMOTE_ADDR HTTP header provided by Apache, I have no knowledge of IPV6 support, but I would expect that an IPV6 address would appear there when used.

Banning subnets and what not is a job for the site-admin and not NNF at this time. Initial support will be for single IP-banning for 24-hours / permanent.

append delete #15. oldtimes

I mentioned IPv6 because quite many networks use and are going to use stateless address autoconfiguration. Most operating systems support "hiding" your MAC address by creating temporary IPv6 addresses within same subnet. So each time host will boot they will get different IPv6 address. Windows XP + sp2 and newer hosts do this by default.

So now evil guy with IPv6 access only needs to reboot the windows (or probably some netsh command does same thing) and he will have a new address. That's why I suggested banning whole subnets if implementing any IP bans.

http://superuser.com/questions/243669/how-to-avoid-exposing-my-mac-address-when-using-ipv6
http://tools.ietf.org/html/rfc3041
http://blackundertone.wordpress.com/2011/08/04/disable-windows-7-ipv6-random-temporary-addresses/

append delete #16. Kroc

Aha, excellent information Sir, thanks!

append delete #17. Web Designer

I think that everyone must be able to embed images and videos, and not only Mods!

This will contribute to the wider use and acceptance of the platform. ;)

append delete #18. Web Designer

As it is, the only window page title we get is only the name of the thread or the name of the Sub-Forum. For example:

Thread

I think that at least it must be like this:

(Web Site Title) - Thread or Sub-Forum name

Or at best:

(Web Site Title) - Thread or Sub-Forum nam - (Web Site Moto)

I still can't figure out where to find these variables in config.php

I know CSS but not MOD. ;)

append delete #19. Web Designer

Also, I would like through "config.php" to be able to put any text in the position where the following text is:

“This is camendesign.com’s forum to discuss technology and all things site-related, particularly NoNonsense Forum (which this forum uses), and for those interested in Kroc’s work to hang out and to get to know each other better.”

But I want it to appear in every page and not only on the main page.

append delete #20. Web Designer

Last but not least, I would like a built-in search function to avoid Google.

Get Simple http://www.get-simple.info is PHP based (NO SQL) and has built-in search.

append delete #21. Web Designer

In some servers, when you put "www" before the web link, the link is not applied to the entire web address.

See it in a test forum I created on Site 5's http://www.site5.com servers:

http://test3.macsupport.gr/sample

For two days I am trying to find what is going on with Site 5 Support and we can't figure it out.

If this is a bug, please fix it in the future.

If it isn't a bug, do you have any ideas what might be causing this? ;)

append delete #22. Kroc

@WebDesigner

Hello, thanks for the feedback. Let me reply to each of these comments in turn:

“I think that everyone must be able to embed images and videos, and not only Mods!”

Simply far too dangerous. Any random spam bot could post images. There is also no flood control or fast enough methods for cleaning up spam. I will provide an option in the future to allow _members_ of a forum to post images, but not non-members. Therefore in your forum that you trust to be allowed to post images, you can make a member and they will be able to embed images, without having mod powers.

“As it is, the only window page title we get is only the name of the thread or the name of the Sub-Forum.”

Change `THEME_TITLE*` constants in your "theme.config.php", these specify the HTML titles, which you can append a prefix or suffix as you like.

“Also, I would like through "config.php" to be able to put any text [at the top] but I want it to appear in every page and not only on the main page.”

Modify the theme files, or create your own custom theme. Full instructions on themes, here: https://github.com/Kroc/NoNonsenseForum/wiki/How-to-Make-A-NoNonsense-Forum-Theme

“Last but not least, I would like a built-in search function to avoid Google.”

You may use any search engine you want, it doesn't have to be Google. Just modify the theme to use DuckDuck Go or Yahoo instead. Built-in search won't be happening for a while. Search is hard to do right and adds a _lot_ of code. I won't be doing it soon, and probably not without assistance.

“In some servers, when you put "www" before the web link, the link is not applied to the entire web address.”

This is a current bug, download the development version of NNF to fix this, the next official version will include the fix. https://github.com/Kroc/NoNonsenseForum/zipball/development

Hope this all helps.
Kind regards,

Kroc Camen.

append delete #23. Web Designer

@Kroc

Thank you very much for the time you dedicated to answer my questions.

I trully appareciate it.

NoNonsense Forum is a great piece of software and it has me quite impressed.

It has great potential. Greater than you might think...

Following your instructions I did some code digging and I manage to find my way in MOD themes!

I have one more observation to make:

Although NoNonsense Forum supports unicode, If the thread title is written in a language that is not based upon latin characters, Hellenic (Greek) for example, the web address of the tread looks like this:

http://www.testforum.gr/__1

But when I create a folder VIa CPanel on the server in order to create a sub forum, it appears normally:

http://www.testforum.gr/ΔΕΙΓΜΑ ΩΜΕΓΑ/

;)

Best Regards,

George

append delete #24. Kroc

“Although NoNonsense Forum supports unicode, If the thread title is written in a language that is not based upon latin characters, Hellenic (Greek) for example, the web address of the tread looks like this:

http://www.testforum.gr/__1”

This is fixed (depending on your server), in the development version. If you have PHP 5.4, Greek letters will be transliterated to a-z. If you don't have PHP 5.4 most accented letters will be transliterated, but not more complex scripts (Greek / Cyrillic / Hebrew &c.)

“But when I create a folder VIa CPanel on the server in order to create a sub forum, it appears normally”

This is because when a user creates a thread, they could attempt to hack by writing thread names (and therefore filenames) with specially crafted Unicode, and so for safety reasons, thread titles are restricted to a-z. When you create a folder on your server, you're a trusted person with admin access, so you can name it what you want.

append delete #25. Michiel

I would enjoy the new features on your radat Kroc!
Also,would it be possible to share file links with a description ?
Like on Facebook? I was thinking facebooklogin would also be great.

Reply

(Leave this as-is, it’s a trap!)

There is no need to “register”, just enter the same name + password of your choice every time.

Pro tip: Use markup to add links, quotes and more.

Your friendly neighbourhood moderators: Kroc, Impressed, theraje, Martijn