What's wrong with XF 2?

[Jordan]

I don't like repeated words. So many of the XF2 themes have "threads", "replies" posted so much. MyBB is better in that there is one line for replies and threads and then the numbers of them are listed below.

You can disable that though in like, every single software out there 😛

A user goes to a site, and it's kinda slow, but well.

Unless it's a complete shit software, the slowness of the site is due to the owner's mistakes. Whether that be using a crap host, too many plugins, not optimizing and compressing static files, etc.

then a moderator who probably engages in actual discussion perhaps three times a year will appear, just to tell you off.

Again, this would be the fault of the owner (or whoever is running the forum). Every single website out there can have this issue regardless of the software they use.

where every page loads instantly, they can quickly push content out and the moment it's posted, they get a like.

And then, they are graciously received by a courteous moderator or regular who patiently goes over what to do and what-not.

This can also be achieved with pretty much ever software out there as well (albeit addon may be needed for instant post without reload)

 

[Jason76]

Again, this would be the fault of the owner (or whoever is running the forum). Every single website out there can have this issue regardless of the software they use.

I agree that it seems like nearly all forum software isn't worth complaining about. In fact, as said, it's normally the owner. However, that's not saying, though, that premium stuff don't have included bells and whistles, hence justifying the price - and also there is the one-on-one support.

 

[Azareal]

Discourse actually incentivises people to give likes. One of the criteria for trust level 3 is the number of likes given out in a certain time range, etc. and there are achievements for it too.

You can almost be sure that people will be out looking for excuses to give likes.

One reason I like action posts, at-least with moves, is to inform the user of the action without opening direct engagement and creating the opportunity for it to come off as judgemental.

 

[Carlos X]

It's not like MySpace was particularly secure lol

I don't disagree. It's just that users exploited that. In large numbers. You want someone else's page? hack it with a few paragraphs of old HTML code.

You just need an intelligently written HTML parser, not one of those insecure XSS-ridden ones from the 2000s. I hope no one's writing ones like that in 2018 at-least, it would be a travesty.

*snorts* vBulletin still does it today! *points and laughs*

If you try to make everyone happy, it will make no one happy, basics of competition. Thinking otherwise is how you get IPB and vB. Even in 2009, vB was just getting more bloated and bloated and bloated with half-done features, etc.

You don't have to explain it to us. We know this. vB3 was fine in the shape it was in, the only thing it needed was easy breadcrumb/navigation modification, and easy sidebar (widgets) modification. Both didn't arrive until vB4/5/xenForo came to market.

And you really don't need descriptions anywhere other than maybe the index, after you're there for like two days, you probably have the things memorised anyway, they're just noise in that sort of quick topic feature.

xenForo only has descriptions in the index, "forum view," and now quick thread.

And frankly, forums are generally self-descriptive 99% of the time.

Trust me when I say this: A lot of people don't understand forum descriptions. I see people posting clan threads in the wrong place.

To be frank, what matters is making the users happy and getting them active. Strict rules, procedures, and hop through 20 hoops just puts them off. That is why forums are dying.

I want to make users happy, and I do want them active, but not at the expense of rules. Not very strict rules, but simple rules. There's a reason for rules. I don't want a fucking racist shithead on my board. I just won't stand for it.

And if someone can't figure what a forum is for from it's title, why would you think a description would help? A title is just a description in far fewer words.

It does help. Some people don't understand that when an admin makes a forum for "Call of Duty talk" it's designed for Call of Duty talk. But they don't care, and just let things go over their heads like they don't understand the point of that forum. I wanted Call of Duty talk, not a clan thread.

It's not that I don't want them there, it's just that I want threads related to things that people want to talk about. If you want to talk about clans, post it in the right place! It's really not that hard!

This ain't 2009 where users had nowhere else to go.

Uh.. Yes, it is. Back then, we had many forums. Back then, we had MySpace, we had tumblr, we had quora, we had Twitter, and so on and on. Today, we have few forums, but we have Facebook, the world's largest Social Network in existance. Twitter exists in this universe, Tumbler exists in this universe, Myspace exists in this universe (but it's a shadow of its former self), Quora exists, and so on and on. The only difference is people are. lazy. Very. lazy. Like "I'm bored" lazy. LAZY. Lazy. Lazy. And fucking lazy. Instagram exists in this universe, and people treat it as a forum, too. Except, there's either a photo, or a video, followed by a few words or a long comment about something, followed by a thread. Still lazy. Lazy. Lazy.

It all ties into what people hate about forums. Slow. Clunky. Petty moderators who chase them over insignificant things no one cares about elsewhere. Etc.

That's your opinion. xenForo has always been fast. Those whom are slow, are just not adapting. xenForo is. You think it's clunky, but I disagree. It's very simple, you just don't like what you see. I'll talk about the rules below...

Double posting, posting in the wrong place, locks at the drop of a hat, countless rules and regulations which, to be honest, no one ever really reads.

Double posting isn't really a bad thing, but I don't want people to have a habit of doing it. It wastes server space. Kinda like spam. Posting in the wrong places either disrupts the idea of the forum, and it makes the forum disorganized. (IMHO.) Locks at the drop of the hat is something people complain, but it's also something people need to understand to have COMMON SENSE. Would you go into a thread and trash a user for being a white boy? No, because that's racism. Would you go into Facebook and start throwing propaganda about how "blacks are nothing bunch of losers!" No, because that's still racism! Would you allow Nazi propaganda on your own Social Network, like Facebook? No, you wouldn't.

Facebook is actually lenient, but enough complaints will bring the comment or thread to a staff member's attention - what he/she decides to do with your account is entirely in his/her hands.

XenForo in comparison to newer software at-least, is like an embodiment of that classical mindset.

xenForo is middle ground between classical, and progressive. As soon as Facebook implemented a way to notify you of new posts, I was thinking "I want this on my forum!" When I first saw xenForo for the first time, I was like "Oh shit! I thought this!" I fell in love with it. Next thing I know, IB sues them, and implements a similar behavior, followed by IPB.

 

[Azareal]

I don't disagree. It's just that users exploited that. In large numbers. You want someone else's page? hack it with a few paragraphs of old HTML code.

*snorts* vBulletin still does it today! *points and laughs*

vBulletin is insecure for the simple fact that PHP is insecure, especially 2007 PHP which was a steaming heap of incompetence and indifference from PHP's core developers.

People simply adopted it at the time so they could shovel out sites and software quickly for little regard for security, until they got hacked... Again... And... Again.
That is why if you're on legacy, you're so exposed and practically screwed, unless the people are really meticulous at patching the holes.

Whether it was magic quotes, register globals, or all the little features the core developers created to "help" people, they winded up backfiring and creating even more problems.

In addition, back then, the way to bypass MySpace's filters if I recall, was just to drop a piece of Unicode or a newline between the tags and the crudely written lenient filter would just let whatever you want through. That is not how you write a safe HTML parser and is just playing a game of cat and mouse.

Not that Facebook was much better, ten year olds were able to hijack your account in Starbucks with a single click just by running a Firefox Extension as the thing didn't use HTTPS everywhere.

xenForo only has descriptions in the index, "forum view," and now quick thread.

Which defeats the object of quick thread. Which is to be... Quick.
It was the worst possible implementation for it, it not only punishes regulars who do know what's up, but if you really want to flash a notice, you can do that after they've selected a forum.

I don't want a fucking racist shithead on my board. I just won't stand for it.

That's really what I'd call "common sense rules". You shouldn't need to read the rules and regulations just to figure that you shouldn't do that. And they're probably not reading it anyway.

It's not unusual to get kicked and banned from places, even without rules, forum or not, if you do things really out of the ordinary like that.

That's your opinion. xenForo has always been fast. Those whom are slow, are just not adapting. xenForo is. You think it's clunky, but I disagree. It's very simple, you just don't like what you see. I'll talk about the rules below...

Uh no. Performance is not an opinion. It simply is. We can play with NodeBB and friends right now, if you'd like. It's simply not possible to debate performance, only how bad it can get.

Would you allow Nazi propaganda on your own Social Network, like Facebook? No, you wouldn't.

We all probably know that Facebook doesn't care for anything but making money and the occasional psychological experiment. Someone hangs themselves? At-least they're using Facebook.

The creepiest one isn't Facebook either, but Mark Zuckerberg.
I wouldn't trust him with a ten foot pole.

Double posting isn't really a bad thing, but I don't want people to have a habit of doing it. It wastes server space. Kinda like spam.

It doesn't really matter, to be honest. Better to have a site that's twenty times more active and there's really no such thing as "server space" in 2018.

Space for all intents and purposes is infinite, especially with modern terabyte hard drives. A forum will never fill that, regardless of activity. And sizes of hard drives will only continue to go up.

If someone is being a nuisance, then it's one matter, but even that can be a little vague.

The only difference is people are. lazy. Very. lazy. Like "I'm bored" lazy. LAZY. Lazy. Lazy. And fucking lazy.

When in Rome, do as the Romans do.

It does help. Some people don't understand that when an admin makes a forum for "Call of Duty talk" it's designed for Call of Duty talk. But they don't care, and just let things go over their heads like they don't understand the point of that forum. I wanted Call of Duty talk, not a clan thread.

If it's Call of Duty, I would hazard a guess that a lot of them are kids.
They probably shouldn't be on there anyway (under 13s), but if they're going to be, then I guess you could redirect them to another area.

 

[Carlos X]

vBulletin is insecure for the simple fact that PHP is insecure, especially 2007 PHP which was a steaming heap of incompetence and indifference from PHP's core developers.

PHP has gotten a lot better with time. vBulletin was just too slow to adapt. For example, for the longest time, I've been on PHP5.4, and didn't upgrade until recently. I was upgrading to XF2 more, and more. I realized, cPanel hasn't upgraded the server as much as I thought it would. So, long story short, I was on legacy EasyApache, which required manual upgrade, and rebooting. So, basically, something else would have to happen in order for me to push up the PHP number.

My point is, some people adapt quickly, others not so much. I do want to upgrade to the latest and greatest, but I have to realize it before someone else does. vBulletin realized it, but didn't upgrade the standard because they don't have the tools available to understand the wide spectrum of the community. xenForo recently did that, and boy, it was genius....

https://twitter.com/CarlosX360/status/959294911307694080

Which defeats the object of quick thread. Which is to be... Quick.

I disagree. It helps tell you where to post. I doubt people will understand at the reply box (which, by the way is another place descriptions go in xenForo, but people still don't get it - which should tell you how stupid people really are.)

It was the worst possible implementation for it, it not only punishes regulars who do know what's up, but if you really want to flash a notice, you can do that after they've selected a forum.

It's not designed for regulars. It's designed for new users, ya know... people who don't get it?

That's really what I'd call "common sense rules". You shouldn't need to read the rules and regulations just to figure that you shouldn't do that. And they're probably not reading it anyway.

People don't have common sense. The best site I ever launched was BlackOps3Forum.com, not only because I was able to capture a niche in a short amount of time, but because of how much "common sense" there was among users. I didn't even have to put up rules! It was that jolly! But every once in a while on CODForums, I get users who post threads with racist rhetoric.

Uh no. Performance is not an opinion. It simply is. We can play with NodeBB and friends right now, if you'd like. It's simply not possible to debate performance, only how bad it can get.

xenForo are a bunch of performance junkies. The team there, always talks about performance. Every time I read them talk about performance, I move my trust level to the next level. Every time they fix something, it moves up. When I sent them a ticket about adding back a feature that helped aid my moderation, they added it quickly.

We all probably know that Facebook doesn't care for anything but making money and the occasional psychological experiment. Someone hangs themselves? At-least they're using Facebook.

They have a team of moderators to take care of that, but not everyone can catch stuff quickly. They manage a community of 800 Million to a Billion users worldwide. That's way too big.

The creepiest one isn't Facebook either, but Mark Zuckerberg.
I wouldn't trust him with a ten foot pole.

I don't know him too well, so I can't make judgements on him until I've seen first hand what he's done. I doubt he is what is "rumored." Stop believing the propaganda being sold to you. Whatever garbage people say about him, ignore it. I would say the same for Trump.

It doesn't really matter, to be honest. Better to have a site that's twenty times more active and there's really no such thing as "server space" in 2018.

Yes, there is. My server went offline 2 times in the last 8 years. The first time it was because of Black Ops 2 being popular, the second time it was because someone in a momma's basement, they were trying to DDoS my site. I even got similar threats of DDoS attacks, and prepared for it. In fact, I am currently using about 40% of my server usage...



That's for the first 2 weeks of my server usage. My server grace period starts on the 3rd of the month, to the 3rd of the next month. Peak times are worse than this. More than 7 websites does this.

Space for all intents and purposes is infinite, especially with modern terabyte hard drives. A forum will never fill that, regardless of activity. And sizes of hard drives will only continue to go up.

As shown, it can fill up quickly.

When in Rome, do as the Romans do.

...And what would that be?

If it's Call of Duty, I would hazard a guess that a lot of them are kids.
They probably shouldn't be on there anyway (under 13s), but if they're going to be, then I guess you could redirect them to another area.

If I catch anyone below 17 on my site, they're banned.

 

[Azareal]

xenForo are a bunch of performance junkies. The team there, always talks about performance. Every time I read them talk about performance, I move my trust level to the next level. Every time they fix something, it moves up. When I sent them a ticket about adding back a feature that helped aid my moderation, they added it quickly.

And it is great to hear that they are so receptive to feedback, something to be respected and looked up-to, probably a point in their favour in contrast to some more... Hostile support teams.

But, that doesn't have much bearing on actual performance.
For a quickie, just pop onto community.nodebb.org, navigate around a little and see how fast pages load. That's the tip of the iceberg. And it's been around for quite a few years now, probably five or so.

Recent advances not seen in NodeBB would bump up possible performance even more, although perhaps not on laptop / desktop, that's easy mode. But certainly for mobile.

I don't know him too well, so I can't make judgements on him until I've seen first hand what he's done. I doubt he is what is "rumored." Stop believing the propaganda being sold to you. Whatever garbage people say about him, ignore it. I would say the same for Trump.

I've been wary of the guy since the first time the media broke the news about a private discussion he had where he called people who give him data, "dumb fucks".

From there, it just escalated to Facebook proudly presenting research they gathered about how people feel when they see certain bits of data where they deliberately tried to manipulate people's emotions without even informing anyone.

And then, they were shocked that people would actually be offended by it. You see, it's not so much that Facebook does all that garbage, but that they fundamentally see nothing wrong with it and will act as such, in comparison to Google which at-least presents a veneer of pretending that they care.

And he's at the heart of it all, the only way for it to really change would be for him to step down, which he would probably never do.
It would also improve it's reputation by a fair bit as he is the symbol of all that is wrong with Facebook. He doesn't even need to vanish forever, but he does have to disappear from the limelight and loosen his grip.

The biggest difference between Facebook and Google is that Google is largely controlled by the shareholders, while Facebook is basically controlled by him. Every decision made is made with his endorsal. That makes him a very easy villain, and oh boy, do the public love a person they can hold accountable as opposed to a faceless organisation.

the second time it was because someone in a momma's basement, they were trying to DDoS my site

If you're having trouble with DDoS attacks, you might want to consider using Cloudflare or something, they can help to deflect the attacks while keeping the site up.

They can also help cache static resources on the edge (aka physically closer to the user), so that they load faster. They're free, but they do have higher tier packages which you can pay for for extra performance / etc. benefits.

That's for the first 2 weeks of my server usage. My server grace period starts on the 3rd of the month, to the 3rd of the next month. Peak times are worse than this. More than 7 websites does this.

Yes. But what is most of this data?

Also, a post with an essay will not consume the same amount of disk space as one just saying "yo", unless the software stores a ridiculous amount of metadata.

They have a team of moderators to take care of that, but not everyone can catch stuff quickly. They manage a community of 800 Million to a Billion users worldwide. That's way too big.

The have a team of moderators, most likely, due to public outrage and probably to deal with child porn. No seriously. Google, Twitter, Facebook, etc. are really diligent at removing that stuff, to the point we never really have to see it. But, not so much at anything else.

 

[Carlos X]

For a quickie, just pop onto community.nodebb.org, navigate around a little and see how fast pages load. That's the tip of the iceberg. And it's been around for quite a few years now, probably five or so.

Yeah, but it's basic. Too basic. There's a lot of whitespace.

I've been wary of the guy since the first time the media broke the news about a private discussion he had where he called people who give him data, "dumb fucks".

I would say the same. People are stupid. I explained somewhere on this site (or TAZ) some examples of stupidity of some people on facebook. If you wanted your post to be private, look for the option! Don't blame facebook for your own "ooops." People are very lazy, so they blame the corporation for this and that. I mean, seriously.

From there, it just escalated to Facebook proudly presenting research they gathered about how people feel when they see certain bits of data where they deliberately tried to manipulate people's emotions without even informing anyone.

Most of this is in the background, you shouldn't be worried about this. It's the same thing other corporations are doing.

And then, they were shocked that people would actually be offended by it. You see, it's not so much that Facebook does all that garbage, but that they fundamentally see nothing wrong with it and will act as such, in comparison to Google which at-least presents a veneer of pretending that they care.

They were shocked by the outrage towards it, not "being offended by it." The problems is, these are fake "outrage." If I were Zuckerberg, I would just ignore it. I am a firm believer in constructive criticism, not this "fake criticism." If you can be nice, and give constructive feedback, then I'll take it, but all this outrage is just mindboggling stupid. It's not just laziness, it's not just stupidity, it's people who overreact to the smallest thing.

Facebook, and Zuckerberg are not fans of invasion of privacy. I can tell you from the outside looking in. Facebook just wants to serve you a "product" that targets you. But people get freaked out and react too quickly, without asking questions.

And he's at the heart of it all, the only way for it to really change would be for him to step down, which he would probably never do.

He's the C.E.O of the company. Of course, he has to make these decisions. If you change C.E.O's in companies like Facebook, you run the risk of alienating the market. You risk losing staff, also. The founder is the person who made the company, so if a new guy comes in and starts changing shit up... Company crashes and burn. It's what happened with Apple, and Steve Jobs. Once Jobs returned, the company went in the right direction. Iphone happened, ipod happened, and so on. The rest is history. And it's still happening; once Jobs died, a new C.E.O. was named, but that person couldn't take the Apple ship through a rough change.

Mark Zuckerberg is a hacker, so right now, he's the modern day "Bill Gates." And Microsoft is worse than Facebook with the "evil" practices. Worst part is, THEY'RE still doing the same practices that landed them into antitrust in the first place!

The biggest difference between Facebook and Google is that Google is largely controlled by the shareholders, while Facebook is basically controlled by him. Every decision made is made with his endorsal. That makes him a very easy villain, and oh boy, do the public love a person they can hold accountable as opposed to a faceless organisation.

Mmmmh. No. Facebook and Google are both corporations. Facebook and Google are both largely controlled by shareholders. Same. Same. Same. Same. Larry Page is the founder of Google. Mark Zuckerberg is the founder of Facebook.

If you're having trouble with DDoS attacks, you might want to consider using Cloudflare or something, they can help to deflect the attacks while keeping the site up.

Cloudflare scrapes your entire site, server, and info. That's why I never use it.

 

[Azareal]

One thing I'll ask is if you're using Oracle MySQL or MariaDB.
Oracle MySQL can be fairly slow, very slow in fact, databases are complicated beasts and not all databases are built equal.

MariaDB is also wholly compatible with anything compatible with MySQL.

And while people say that MySQL is slower in contrast to Mongo, etc... Let's just say that I can run circles around software which use even faster things than Mongo with MariaDB.

I would like to go into a certain incident which showed me just how truly slow PHP software can be, but it's probably not something to hijack this thread over, as at that point it would be more about PHP than XenForo.

Mmmmh. No. Facebook and Google are both corporations. Facebook and Google are both largely controlled by shareholders. Same. Same. Same. Same. Larry Page is the founder of Google. Mark Zuckerberg is the founder of Facebook.

Google has a couple of co-founders, Larry Page was just the CEO for a short while. He still has considerable influence however.

Cloudflare scrapes your entire site, server, and info. That's why I never use it.

I don't believe so, no. It has a crawler which crawls your site to serve a version of it while the thing is offline, kinda like Google Cache in a way, but served when you hit the domain itself.

Yeah, but it's basic. Too basic. There's a lot of whitespace.

That's the default theme, there are ones much much closer to XenForo / classical forums, if that's your cup of tea.
I have no idea why the developers are so obsessed with that sort of theme by default, maybe they think it's cute because Discourse does it /shrug

I could understand if it was something original with their own odd twist, as that's their vision on design, and well, art is a complex thing and everyone has their own opinions on every theme.

But, literally the main thing pushing people away from NodeBB is landing there on that theme which isn't that original in contrast to other players like Flarum and Discourse.

 

[Carlos X]

One thing I'll ask is if you're using Oracle MySQL or MariaDB.
Oracle MySQL can be fairly slow, very slow in fact, databases are complicated beasts and not all databases are built equal.

MariaDB is also wholly compatible with anything compatible with MySQL.

And while people say that MySQL is slower in contrast to Mongo, etc... Let's just say that I can run circles around software which use even faster things than Mongo with MariaDB.

I would like to go into a certain incident which showed me just how truly slow PHP software can be, but it's probably not something to hijack this thread over, as at that point it would be more about PHP than XenForo.

I'm not worried. 7.2 is faster than the 5 class it was on. I want to keep it there so I can support xenForo natively. xenForo 2 supports higher class PHP far better than the 5 class it was on. Hopefully, we can see continued improvements here.

Google has a couple of co-founders, Larry Page was just the CEO for a short while. He still has considerable influence however.

Yes, I know this. 😀 But from the wikipedia entry, it shows Larry Page as lead. Every time they list co-founders, they do it in the order of who founded the company first. Or how much stock they have. In this case it's Larry. I'm not discounting Sergey Brin. I'm just going by what is listed.

I don't believe so, no. It has a crawler which crawls your site to serve a version of it while the thing is offline, kinda like Google Cache in a way, but served when you hit the domain itself.

Yes, but some reports are saying that it scrapes your site.

That's the default theme, there are ones much much closer to XenForo / classical forums, if that's your cup of tea.
I have no idea why the developers are so obsessed with that sort of theme by default, maybe they think it's cute because Discourse does it /shrug

Yes, I know, but I have not seen a single NodeBB site that has been modified enough to convince me to convert. Most sites on it use the basic skin. I say the same for discourse. In fact, I saw a Battlefield website using Discourse with modifications and different colors and whatnot. I didn't like it. It was confusingly clunky. 90% of the time, it shows threads first, rather than forums and categories. So, it's easy to post in the wrong place. *shakes head and tries to open his eyes as if he was awoke from a sleep*

But, literally the main thing pushing people away from NodeBB is landing there on that theme which isn't that original in contrast to other players like Flarum and Discourse.

EXACTLY!

 

[Azareal]

In fact, I saw a Battlefield website using Discourse with modifications and different colors and whatnot.

Discourse isn't NodeBB, NodeBB looks to be a lot more customisable than Discourse. I've seen "custom" themes for Discourse, but they wind up being fairly hack-y a lot of the time.

90% of the time, it shows threads first, rather than forums and categories.

You can customise that, it's done on smaller sites because the index view adds a layer of overhead compared to just directly looking at things as they happen. Plus, you get to sit there as new updates come in from across the site as they happen.

Yes, but some reports are saying that it scrapes your site.

How so? I know an admin who uses the thing to help handle like 10 - 50TB of traffic, their servers would probably explode if that hit them (well, they could probably handle it, they managed to survive MyBB acting up when the site was smaller after-all). Huge site.

It can save a lot of money in other places too, I'm kinda curious where you're getting this information from. Fairly big sites like, I believe, it was the New York Times, etc. use it too.

And at the end of the day, why would I pay for bandwidth when I can cut those costs by 80% just by using something that's essentially free. I'm not big on wasting money unnecessarily. I have to wonder where you heard these reports, as they really don't need to clone your content, they have many big companies going after them.

I want to keep it there so I can support xenForo natively. xenForo 2 supports higher class PHP far better than the 5 class it was on. Hopefully, we can see continued improvements here.

PHP 5.6 is getting EOLed in like two months. No more security fixes.

 

[ConradBleu22]

That's not really mine, it's @Cessepedes17

It’s our site I may be the owner and founder of WWW.SWCNetwork.Com but you are my co-owner

 

[Carlos X]

Discourse isn't NodeBB, NodeBB looks to be a lot more customisable than Discourse. I've seen "custom" themes for Discourse, but they wind up being fairly hack-y a lot of the time.

That's what I'm saying. When I arrived to the battlefield forum (a fan site, not the official site), I was like 'EWW! What the fuck is this abomination!?' It WAS Discourse. I just checked the official site of both NodeBB and Discourse. The site is currently offline at the moment, but I guarantee you it was horrible looking.

It looks like an old vB2 site with Discourse features. lol.

You can customise that, it's done on smaller sites because the index view adds a layer of overhead compared to just directly looking at things as they happen. Plus, you get to sit there as new updates come in from across the site as they happen.

I wish that was part of xenForo, but that can't happen until xenForo knows how to accomplish it. As it stands, it bogs down the server, and usually crons take a while to talk to the server and vice versa.

How so? I know an admin who uses the thing to help handle like 10 - 50TB of traffic, their servers would probably explode if that hit them (well, they could probably handle it, they managed to survive MyBB acting up when the site was smaller after-all). Huge site.

Have you searched google for anything negative about Cloudflare? Most of the complaints were from 2015, but I still think it's prevalent today than ever. The following year, SEO experts call them out by saying it actually hurts your SEO (I like this article because it breaks everything down to the tiny details), because you're not actually touching the stationed server.

Here (here's another one), leads you to a Github after being asked if you can bypass the "5 second wait." Or any error screen. On top of that, most of the code in CloudFlair are using JavaScript. Meaning it's just as vulnerable to hacking or DDoS attacks as the host. I said it before and I'll say it again: I wouldn't trust JS code.

YCombinator is a Silicon Valley "hedge fund," if you will, for hackers. So, when they say cloudflare isn't really good, chances are, it's true. Tor spammers can easily access the site just as much as the hackers can. They complained about CAPTCHA being in front of the wall just to get you to the site (I experienced that a few times in the last few years, I didn't like it at all, it's the original reason why I hated the idea in the first place).

Most articles that cover Cloudflare say that Cloudflare actually slows down your site more than it appears.

It can save a lot of money in other places too, I'm kinda curious where you're getting this information from. Fairly big sites like, I believe, it was the New York Times, etc. use it too.

I read articles over the last few years on it, but searching doesn't bring back the article I read. Soo, I am lost finding you proof there. Thing is, Cloudflare received a lot of controversy at one point. (Heartbleed for example) However, if you look really hard, Cloudflare has negatives that actually back what I am saying, though. For example, cloudflare uses JS, basically on everything it serves. So, eventually, someone's going to hack Cloudflare and bring it down to their knees.

And at the end of the day, why would I pay for bandwidth when I can cut those costs by 80% just by using something that's essentially free. I'm not big on wasting money unnecessarily. I have to wonder where you heard these reports, as they really don't need to clone your content, they have many big companies going after them.

This is answered in many articles I post above... In fact, MaxCDN is now the most recommended CDN out there. But I'm not going to use it because of SEO reasons. If you change your IP address to a CDN-based one, especially if the company that serves MaxCDN is rife with abuse and bad reputation, it may reflect bad on you to google.

PHP 5.6 is getting EOLed in like two months. No more security fixes.

Then I made the perfect choice by migrating to 7.2 recently! 🙂

 

[Azareal]

I guarantee you it was horrible looking.

I can believe it, I looked at Imgur a year or two ago and it was pretty ugly.

I wish that was part of xenForo, but that can't happen until xenForo knows how to accomplish it. As it stands, it bogs down the server, and usually crons take a while to talk to the server and vice versa.

They know how to achieve it, stop using PHP.

Well actually, you can do that with PHP, you just need to run a process in the background, really the way everyone else does it, it's just there's a bit of a culture around the PHP way to do things, especially for dealing shared hosts (so many concessions made there for those stupid hosts who can't do anything right), but it's not like they can't lead by example.

YCombinator is a Silicon Valley "hedge fund," if you will, for hackers. So, when they say cloudflare isn't really good, chances are, it's true.

You will love how they ripped PHP apart as a slow and insecure pile of garbage then. They're always finding new problems in the thing, it's their favourite toy which they hold in the utmost disdain.

On top of that, most of the code in CloudFlair are using JavaScript. Meaning it's just as vulnerable to hacking or DDoS attacks as the host.

It actually works. Something to understand is that a lot of DDoS attacks are volumetric attacks where you trick a bunch of servers across the web into sending a large amount of traffic to the wrong place.

It's called IP Address spoofing and works on ones using UDP rather than TCP, usually used for performance purposes.

For instance, many memcached instances were accidentally exposed to the web, Cloudflare and others discovered it, then malicious individuals sent requests for data for them while claiming to be Github, and then, they responded with 1MB payloads to Github taking the site down for ten minutes before they managed to mitigate the attack with Akamai.

That was the biggest DDoS attack in history and many big attacks abusing UDP hit Cloudflare every-day, one of which was the biggest in history before it was topped again and again.

They complained about CAPTCHA being in front of the wall just to get you to the site

That is what you do when you have a layer 7 attack trying to take-down your site, not really to stop spammers so much. And that's when Cloudflare's heuristics don't work.

DDoS attacks generally rely on overloading your app server with so much traffic that the thing goes down and that involves blasting you with as much traffic as possible to get the biggest desired affect while reducing the impact on themselves. Maybe they can handle JavaScript, but that takes additional computational power and processing.

I don't bother with CAPTCHAs and never seen them present on Cloudflare sites short of times they were being attacked, and to be really frank, users coming in from Tor should be treated as suspicious and it's not like I've never used Tor.

Thing is, Cloudflare received a lot of controversy at one point.

I don't think it really affected sites much, although they disclosed the incident like any responsible organisation should. If we want to talk, we can start with the billions of dollars of damage caused by PHP with all those SQL Injections and other problems brought about by the core team's incompetence.

Everyone has their blips in security and that one was a pretty long time ago.
Even Github has gotten hacked several times in the past.

And to be frank, Cloudflare has done more to push security than many others with a great effort to optimise HTTPS, rolling certificates for free (it wasn't that long ago when a certificates were premium goods on the web), pushes IPv6 to tackle IP address exhaustion, and makes large contributions to the open source community including optimising crypto algorithms so that HTTPS pages load faster and hence become more applicable.

That is a significant contribution to the deployment of HTTPS across the world, as opposed to the old days where admins would look at people like complete morons, if they were to propose deprecating HTTP (something Chrome / Firefox are doing).

Meanwhile, the PHP Core Team has their occasional brawl, had core contributors resign in big rages after big fights, keep accusing each other of plotting intrigue, etc. I have actually seen them in action, it's surreal.

Cloudflare even looks for SQL Injections in all the places app developers don't think to look like in the headers and automatically filter those out, etcetra and so forth.

https://www.seoblog.com/2016/05/cloudflare-hurt-websites-seo/
And uh, this article you posted basically says that Cloudflare improves your SEO, the title is a little deceptive, although it isn't entirely unfair.

If your site is down, then nothing is going to rescue your SEO, if it continues for an extended period of time, although Cloudflare might serve a cached version of the site to help reduce the amount of user frustration, however that cache is built by a crawler which runs once a week for free, daily for paid, but honestly, pro is a steal.

It said that it can make it slower for a highly optimised site and high powered server. I can easily qualify that with the ability to serve requests several magnitudes faster than Nginx with Golang at static files, and even then you have to take actual data transfer into account, plus physical distance is usually the bigger problem rather than how fast I can push which Cloudflare solves.

And a lot of requests do actually hit the origin server, mainly ones not for static assets like CSS, JS, etc. so I do see those, you don't get any stale copies, unless the site is down and Cloudflare on a best effort basis tries to serve the last thing it crawled, you can disable that though.

So, eventually, someone's going to hack Cloudflare and bring it down to their knees.

I'm not even sure how to respond to this, I think you're fundamentally misunderstanding how things work.

For starters, they are running JS in *your* browser. Even if the code was absolutely riddled with enough security holes to put Wordpress to shame, it really isn't, that does not mean they're running that on the server, although you can pay them to run a little service worker for simple rules like adding x header, etc.

However, that has been absolutely hardened, and it wouldn't be that difficult to do that with constraints on what it can do, where, when, and maybe some process isolation, etc.

And another thing. They have been doing a lot of optimisations, so it's even faster now than it was before and they're always doing some optimisation here and there.

I think that 90% of your problems are honestly, misunderstandings about how Cloudflare operates, etc. and I would hazard a guess that this is also the case for the "they scrape content" thing, perhaps the person misunderstood the bot crawling content, and perhaps, it did it a little fast or something?

Something which looked a bit off, perhaps? I mean, people have mistaken Discourse's Onebox script for malware before, as it completely ignores robots.txt and changes it's user agent when blocked to get around the blocks.

In that one case, they did have a bit of a legitimate case, as that's simply not how well-behaved scripts fundamentally behave. The reason that it does that is because a lot of admins block unknown user-agents to help trim the number of malicious bots, many of which proudly display exactly what they are there.

With a lot of vulnerability scanners which hit me, it is often the case that they will have "zgrab", nothing, or "python" as the user agent before blasting a thousand requests per second to probe for weaknesses (particularly python, zgrab is mainly there to add your site to a big database with all the vulnerabilities they could get from a glimpse listed).

That is enough traffic to bring many little sites to their knees.

Those buggers used to hit me really, really frequently (mainly to look for exposed instances of PMA, etc.). Thank goodness for Go absorbing that traffic. And now, they're getting filtered out entirely, zap, gone.

Anyways, we reeeeaaaalllllyyy should discuss this in the Cloudflare thread (I believe there was one), as this kinda detracts from the discussion about XenForo 2.0.

 

[Carlos X]

Well actually, you can do that with PHP, you just need to run a process in the background, really the way everyone else does it, it's just there's a bit of a culture around the PHP way to do things, especially for dealing shared hosts (so many concessions made there for those stupid hosts who can't do anything right), but it's not like they can't lead by example.

Like I said. xenForo may know how to accomplish it, but they need to know how to accomplish it on any host. Right now, they're telling everyone to move to 7.2. (Not straight up, but yes, that's what they're doing.)

You will love how they ripped PHP apart as a slow and insecure pile of garbage then. They're always finding new problems in the thing, it's their favourite toy which they hold in the utmost disdain.

I don't like them. But, if they know more about something, I won't discount them. PHP is the industry standard right now. Every time I see a new platform like Wordpress or xenForo, one of the requirements is PHP. Why? Not only because of it being industry standard, it's because hosts support it.

DDoS attacks generally rely on overloading your app server with so much traffic that the thing goes down and that involves blasting you with as much traffic as possible to get the biggest desired affect while reducing the impact on themselves. Maybe they can handle JavaScript, but that takes additional computational power and processing.

I knew this before you said it. That's (bolded) the other reason why I don't like JS. vBulletin has been using them for years, and it bogged down servers. When I finally got my own vBulletin license, I was ready to roll, until I realized as owner of a few sites, I realized JS is dragging the server sometimes. vB4 showed glaringly how bad it is. *snorts and laughs*

I don't think it really affected sites much, although they disclosed the incident like any responsible organisation should. If we want to talk, we can start with the billions of dollars of damage caused by PHP with all those SQL Injections and other problems brought about by the core team's incompetence.

I saw that, but then again, that was the old style of PHP. This is 2018, if that happens again, the PHP brand will be tarnished. I doubt Oracle will want that to happen again. A lot of site owners don't want it to happen again. Wordpress had some vulnerabilities with PHP a while ago, because some sites were on older versions of WP. There was a large scale hack towards a specific version of Wordpress. (I even saw a MW3 website get hacked.) It hurt Wordpress, but they were able to fix it in the next version.

Meanwhile, the PHP Core Team has their occasional brawl, had core contributors resign in big rages after big fights, keep accusing each other of plotting intrigue, etc. I have actually seen them in action, it's surreal.

That's what happened between xenForo, vBulletin, and IB. It was embarrassing for IB to be at ForumCon 2014, for example. It was hilarious. It's like the vB team was mad about the state of it all. Eh.

I think that 90% of your problems are honestly, misunderstandings about how Cloudflare operates, etc. and I would hazard a guess that this is also the case for the "they scrape content" thing, perhaps the person misunderstood the bot crawling content, and perhaps, it did it a little fast or something?

I could say the same for you and PHP. But, when I searched "Cloudflare scraping" (and I even linked it in the previous post), scraping is the act of pulling your content and put it on their site. It was automatic, yup. In that article, it also mentions that a person can scrape your site, too, so it makes the whole subject useless. After reading that, I pretty much gave up on the subject. I do however remember an article where it says that Cloudflair scrapes your site. That's why I was talking about it, but I can't find the article anymore, it's one of those "I'm hitting a wall."

Anyways, we reeeeaaaalllllyyy should discuss this in the Cloudflare thread (I believe there was one), as this kinda detracts from the discussion about XenForo 2.0.

We are talking about xenForo, and it's relevant. I bet when people search this page, they will learn a thing or two. But yeah, we could do that. 🙂

 

[Azareal]

Like I said. xenForo may know how to accomplish it, but they need to know how to accomplish it on any host. Right now, they're telling everyone to move to 7.2. (Not straight up, but yes, that's what they're doing.)

Let me put it simply then. A car is not an airplane. People will try to turn cars into little airplanes, but it simply will not happen.

Asides from WebFaction, I don't know of any shared hosts who allow the sort of things which are necessary and that it because the hosts themselves are probably a decade behind the rest of the world technologically.

Innovations happen, but they hold the world back. Plus, if you're paying $200 for a forum software, then you really want a host who actually knows what they're doing and makes an effort to stay current, otherwise just use phpBB.

Beyond that, there's always the choice of using a VPS, it's only like $3/month, although it might take some basic server administration know-how. There are VPS' complete with cPanel and people giving you help, but those are far pricier.

And that's even before we get to the point of supporting ridiculously old versions of PHP for really long times, when any host worth their salt should have phased those out long ago and holding back the software that way.

Again, if you're already paying a fair chunk, then they should at-least be that competent, it's not like people are going to be running this stuff on free hosts and the like. Pay a large premium for a top quality software only to skimp on the host.

I don't like them. But, if they know more about something, I won't discount them. PHP is the industry standard right now. Every time I see a new platform like Wordpress or xenForo, one of the requirements is PHP. Why? Not only because of it being industry standard, it's because hosts support it.

It's not an industry standard at all.

People use it because anyone and their grandma can deploy the thing, and even then, things aren't even that simple with things like fiddling with database permissions, file permissions, server settings, etc. so that you don't get hacked.

Above that, there are hordes of cheap Wordpress programmers who will do almost everything they can to make easily hackable plugins for you, but at-least they're cheap and plentiful.

You see, PHP appears easy and simple on the surface, right until you factor in security and that suddenly becomes the admin's problem.
It is so easy for anyone to quickly whip up a web-page, one of the tauted advantages of the language, but they can be hacked within a day and securing things involves reading countless thousands of pages from the manual, watching new reports closely in dozens of different places, or praying that the framework handles it.

Do you know what one of Drupal's vulnerabilities was? It was that instead of using real prepared statements, they decided to use *emulated* ones, a feature the PHP Core Team should never, ever, ever have implemented as it's not secure and people will wind up picking for "performance".

And for the record, in every platform other than PHP, prepared statements are actually faster than the emulated ones due to the use of query pools or the database caching the statements.

Even Facebook, the biggest user of PHP, winded up creating their own language which somewhat looks like PHP, but make no mistake, it is nowhere near similar.
The reason that XenForo uses PHP, especially the classical way of using it, is because it is easier to get their customers to migrate to PHP7 than it is to get them to migrate to Python or to get people to run it as a web app.

I knew this before you said it. That's (bolded) the other reason why I don't like JS. vBulletin has been using them for years, and it bogged down servers. When I finally got my own vBulletin license, I was ready to roll, until I realized as owner of a few sites, I realized JS is dragging the server sometimes. vB4 showed glaringly how bad it is. *snorts and laughs*

JavaScript is an order of magnitude faster than PHP, although it has it's own problems. The reason that your server is / was running slow is actually because of PHP and the architecture of your software.

With JavaScript, it fired off really frequent requests at a stack which can barely take any requests at all. Elsewhere, you can sometimes even get things faster by a factor of ten thousand or even more, it really depends on the route, architecture, and language.

Plus, with modern technologies like WebSockets and friends, you can just hold a connection open and push events as they happen rather than having every user firing off who knows how many queries just to get a bit of data every second, even if nothing has changed.

In addition to that, classical systems hold a lot of state on the server, rather than holding more data on the client and pushing only what's changed or is necessary.

I saw that, but then again, that was the old style of PHP. This is 2018, if that happens again, the PHP brand will be tarnished.

Have you ever read Eevee's Fractal of Bad Design? It's really the same PHP and it's broken in more ways you can possibly imagine. It's impossible to completely fix without breaking every bit of code and the core team are terrified of having the same sort of schism as with Python where some people are on 2 and others on 3 and the situation ensues for over a decade.

Every-time I speak to programmers from any stack other than PHP, there is one unanimous opinion. PHP is slow, insecure, and horribly designed. That is universal. People'll have their debates of whether one language is better than the other, but the moment PHP comes up, it's like a unifying force.

In fact, one major player in the PHP ecosystem who helps to do the standards left in a rage because all the recruiters thought they were incompetent because they were mainly a PHP programmer and wouldn't give them a senior position.

That is to say, the brand has been irreparably tarnished.

scraping is the act of pulling your content and put it on their site

I'm not even sure where you got this from or what it refers to, if you do find out, then we can continue that, otherwise it'll be a little unfruitful.

I could say the same for you and PHP

There is no misunderstanding, I'm not entirely a layperson looking at the situation from the outside, I have actually seen PHP's source-code, and have studied a fair bit about Cloudflare, DDoS attacks (bored lol), performance, building scalable systems, etc.

To put it simply, you can lead a man to water, but you can't make him drink.
I say what I say, and if you get to take something away from it, then great. Otherwise, meh.

I don't like them. But, if they know more about something, I won't discount them.

Do you know what they were criticising in one case recently? The random number generator. Random numbers are the lynch-pin of all security.

There was a case where the numbers were not truly random, and you wouldn't know if you didn't dig deep into a bit of the documentation no one ever reads. And then, they mocked the core team for dismissing the issue and blaming developers for not memorising the manual.

Do you know where random numbers are used in computer systems? Cryptography, session management, etc.

Every-time you login, the server generates a bunch of random numbers, translates those numbers to text, and then it sends that random text to you in a cookie and every-time you send that cookie to it, it'll recognise it as you and grant you admin access and what-not.

I can expect Google to take security seriously. Ditto for Microsoft. Facebook. Mozilla. The Python folks. And so on. It takes a certain air of paranoia. But, I can't take PHP seriously in the slightest, it's always... Uh, I think it should be safe.

That is partly because quite a few other languages for the large part are meticulously designed by some of the brightest minds in the world, while PHP was quickly cobbled together as a bunch of utilities for C programmers to quickly throw together a website and it grew far beyond what they intended.

It's like a physics teacher trying to compete against Einstein in physics.

Likewise, operating system developers and what-not who have been in the industry for many decades and written highly acclaimed papers and invented whole new paradigms, etc. meticulously designing systems against random C programmers randomly slapping things together.

And even then, PHP can be outright ridiculous at times. One of the errors, is or at-least was, this:

Parse error: syntax error, unexpected (T_PAAMAYIM_NEKUDOTAYIM)

That one error compared to every other error which is in English is instead in Hebrew. Hebrew. I mean, come on. And then, the core contributors had a brawl and the leader and creator of PHP, Rasmus and his faction, insisted on keeping it because it shows their respect to the contributions out of Israel.

In the end, they compromised after someone discovered some way of wrangling the parser into spitting out '::' as-well producing:

Parse error: syntax error, unexpected '::' (T_PAAMAYIM_NEKUDOTAYIM)

You now know what double colon means in Hebrew.
Learn something new every-day. Again, nothing against Israel, but this is simply bizarre.

There was a large scale hack towards a specific version of Wordpress.

The problem with Wordpress is that these sorts of exploits (SQL Injection, etc.) shouldn't even be happening, not in 2018. It's a solved problem.

I doubt Oracle will want that to happen again.

People don't even really use Oracle MySQL anymore, at-least not those who care about performance. There's that fork, MariaDB, which was done by the creator of MySQL.

We are talking about xenForo, and it's relevant. I bet when people search this page, they will learn a thing or two. But yeah, we could do that.

People will see the text wall and be like... Uh... No... Not reading this, most likely.

 

[Azareal]

it might take some basic server administration know-how.

Basically. Learn Basic Linux Commands. Maybe add rules to the firewall to block the baddies or to setup Cloudflare and if the software supports Docker, that does half the work, just a few commands there and maybe a wget or something here and there.

And then, run two commands once a week to update anything which needs to be updated. I don't really use Docker though, I'll have to investigate before doing more detail for that.

WebFaction lets you drop down Docker containers, hence letting you run anything with any architecture or language. And it's a shared host too. It's a little pricey (starts at around $10/month, if I recall), but MyBB's Lead Developer, Euan seems to be fond of it.

If you don't know what Docker is, it's a technology for deploying sites, etc. which has taken the world by storm in the last few years and MyBB supports it (apparently).

 

[Carlos X]

It's not an industry standard at all.

To you and techies worth their salt. Yeah, but a lot of people know PHP. It's like this, I don't know a lot about python, Debian, MariaDB, and so on and on. But I know PHP, not as in I know code, but I know what it is, and what it does. A lot of people are like that. Kinda like how vBulletin got popular because it was "the most powerful forum software." (I know that's marketing, but that's not what I'm saying...) A lot of people knew about vBulletin and recommends it. Just like I knew about Linux, and my friend recommended that I prefer it to (of course) Windows-based servers. (Why the fuck would you run a Windows server? Seriously. I say, "If you want to be hacked, then go ahead, serve a website powered by Windows, let's see how that turns out 10 years down the line.")

You see, PHP appears easy and simple on the surface, right until you factor in security and that suddenly becomes the admin's problem.
It is so easy for anyone to quickly whip up a web-page, one of the tauted advantages of the language, but they can be hacked within a day and securing things involves reading countless thousands of pages from the manual, watching new reports closely in dozens of different places, or praying that the framework handles it.

Anything can be hacked. Even your favorite language, all you have to do is keep current. And know the best combination of server backends.

Do you know what one of Drupal's vulnerabilities was? It was that instead of using real prepared statements, they decided to use *emulated* ones, a feature the PHP Core Team should never, ever, ever have implemented as it's not secure and people will wind up picking for "performance".

I never used drupal for the simple fact that it was ridiculously hard to get everything ready for market. I dropped it as soon as I realized how complicated the installation was. It was so confusing, I dropped it. I'm glad I did. Not even shortly thereafter, I hear all these horror stories about it, and then the hack months or years after I tried it out. *snorts and sighs in relief*

The reason that XenForo uses PHP, especially the classical way of using it, is because it is easier to get their customers to migrate to PHP7 than it is to get them to migrate to Python or to get people to run it as a web app.

Pretty much what I said a few posts now in this thread.

JavaScript is an order of magnitude faster than PHP, although it has it's own problems. The reason that your server is / was running slow is actually because of PHP and the architecture of your software.

Nope. It was on linux. With vB3, I could tolerate it for a while, but as soon as I got vB4 up and running. My first thought was this uneasiness. Stylevars for example, was slow because according to Kier, each var is loaded in the same container (or page, I forgot which). So, I guess what Kier was saying at the time, is that the options were ready, but it's like yanking the plug everytime you make a call to the server. Same for the reply box, which was using a combination of JS, and something else, I forget. The point is, vB4 made my sites slow, but also broke one of my sites. I transferred to xenForo on the first 6 months. I gave them chances. I gave them time to get the product stable.

Plus, with modern technologies like WebSockets and friends, you can just hold a connection open and push events as they happen rather than having every user firing off who knows how many queries just to get a bit of data every second, even if nothing has changed.

Now, see, I don't even know what WebSockets is.

Have you ever read Eevee's Fractal of Bad Design? It's really the same PHP and it's broken in more ways you can possibly imagine. It's impossible to completely fix without breaking every bit of code and the core team are terrified of having the same sort of schism as with Python where some people are on 2 and others on 3 and the situation ensues for over a decade.

Answer: Nope.

I'm not even sure where you got this from or what it refers to, if you do find out, then we can continue that, otherwise it'll be a little unfruitful.

Uh, have you even read any of the links I posted? I've seen people scrape my wordpress posts, and put it on their sites. That's what it is. In fact, I have another story: I was hired to post quality posts for a PS4 or 5 site. As soon as I logged in, I realized there was no content. I would be the first person to ever write an article in there. The owner was scraping other websites so it appears that he wrote the posts, but in reality, it's not really on the server. He did it so he can do minimal work, and worry. As soon as I saw it, I was like "What the fuck is this shit?" I never contacted the person again, I ...I just can't work with people like that. That was a horrible feeling, horrible experience. I vow to never work with people like that again.

I can expect Google to take security seriously. Ditto for Microsoft. Facebook. Mozilla. The Python folks. And so on. It takes a certain air of paranoia. But, I can't take PHP seriously in the slightest, it's always... Uh, I think it should be safe.

Microsoft uses a different codebase, and you can see it on any windows-based server by the index's extension (.asp or .aspx).

That is partly because quite a few other languages for the large part are meticulously designed by some of the brightest minds in the world, while PHP was quickly cobbled together as a bunch of utilities for C programmers to quickly throw together a website and it grew far beyond what they intended.

Like how Facebook designed a custom-made PHP architecture, with other codebases such as zend (which is also what xenForo uses for some behaviors).

The problem with Wordpress is that these sorts of exploits (SQL Injection, etc.) shouldn't even be happening, not in 2018. It's a solved problem.

I agree. I say the same for vBulletin, but the new team is a bunch of stupid idiots. Don't be surprised if vB6 ships as a broken product from the first install. Rendering it useless.

People will see the text wall and be like... Uh... No... Not reading this, most likely.

Me too, but at least I learned a little bit about this and that. Although I disagree with some points, I thank you. 🙂

 

[Azareal]

If you want to be hacked, then go ahead, serve a website powered by Windows, let's see how that turns out 10 years down the line.

I know mega big boards powered by Windows, I wouldn't do it, but some would.
I've also moderated an official site for a game before which for whatever reason winded up using Windows.

I think a lot of it is people who are really used to using the Windows GUI or who have dealing with it as their day job and it becomes a bit of a hassle to adjust to another operating system and simplified interface, plus... I think some of these people run it off their home computers.

And if you want to be hacked, run an old version of Linux, although it is true that Linux is generally better hardened than Windows.

I do support Windows though and throw languages like Crystal out the window because they don't, as I do need people to be able to develop without firing up a virtual machine.

And the kicker is that Windows is actually fairly slow for a server. I ran a program in Go and it starts up visibly slower. Perhaps, this is because Google mostly uses Linux, but you can be sure that the entire market optimises for Linux first before even considering Windows.

The only stack where it makes sense to use Windows is if you're using .NET, as the opposite is true there, fast on windows, and slower on Linux. No surprise there considering it's created by Microsoft.

And yes, it does work on Linux, but only the really newer versions which generally require a rewrite anyway.

I can understand running Windows on a home computer, particularly because everyone writes games (especially, the games), software, etc. for Windows while hesitating over Linux, but Linux is pretty much a no-brainer for a server.

Anything can be hacked. Even your favorite language, all you have to do is keep current. And know the best combination of server backends.

Anything can be hacked, including cars:
https://thehackernews.com/2018/05/bmw-smart-car-hacking.html

all you have to do is keep current

That doesn't protect you against a zero day. Particularly when a software has a vast code-base with an unknown number of SQL Injections, the hackers are most likely to find problems first.

The worst ones don't even announce their presence, they simply conduct their misdeeds without you being the wiser, perhaps grabbing up people's credentials and seeing if they use it for their Facebook / Paypal account, or perhaps directing them to a phishing site.

The sorts of people who buy zero days are not interested in simply defacing your site and humiliating you. They are out to make money selling your credentials and what-not and it is really important that we're *not* facing the same problem which was essentially solved a long, long time ago.

Any number of people could have been exploiting a vulnerability before day zero (when the manufacturer discovers the security exploit) and I wouldn't be surprised either.

Criminals often do not discover vulnerabilities on day zero, but sometimes long before. Quite a few will sell them to others. And with financial incentives, they will pore over details in a giant code-base people rarely fully explored to find security exploits.

https://blog.ircmaxell.com/2017/10/disclosure-wordpress-wpdb-sql-injection-background.html
And sometimes, you have to screech and threaten to release a security exploit to the public to even get Wordpress, etc. to take you seriously, otherwise they just go meh.

You really underestimate just how incompetent these people are.
Security vulnerabilities can and will fall by the wayside.

Don't be surprised if vB6 ships as a broken product from the first install.

Don't tempt fate, it'll wind up destroying XenForo, if you're not lucky.
In all seriousness though, vB has been dead in the water for a long, long time.

Not even really worth discussing anymore. They are just... irrelevant to the modern world.

undocumented behaviour

Also, quite a few security vulnerabilities in PHP programs arise because of undocumented behaviour in PHP C Code. and there's nothing anyone can do about it because PHP is written in C.

How many people in the ecosystem know C? I would probably eliminate most of the people in the PHP ecosystem, including XenForo. Although, who knows, maybe Kier / Mike know C and are capable of auditing the PHP code-base.

However, no matter how smart you are, you cannot audit something, if you fundamentally don't understand how it works. It's just a black box which spits out numbers to you and you have to use your experience about where you've been burnt in the past to avoid getting burnt again.

Python in contrast is fast enough that they don't need to abuse C as much.
Quite a large part of the standard library is actually written in Python, so any pythonista can pull open the hood and see what's going on. Ditto for Go, but they take it further.

PHP writes every little random thing it can in C just to get little speed boosts which don't even really matter. C is quite frankly an absolutely terrifying language, it is so easy to screw up and get a security exploit in.

What PHP is, in essence, is a program which wraps dozens upon dozens of C libraries which I'm not even sure the developers really fully understand.

Like how Facebook designed a custom-made PHP architecture, with other codebases such as zend (which is also what xenForo uses for some behaviors).

HHVM is going to be Hacklang only, they're dropping support for PHP:
https://hhvm.com/blog/2017/09/18/the-future-of-hhvm.html

Microsoft uses a different codebase

I don't see why using a different code-base is that strange.
Languages are not all going to share the same implementation.

Uh, have you even read any of the links I posted?

I looked at a couple, but really, you said yourself that you're hitting a wall.

Nope. It was on linux.

The architecture of the software.

PHP works by a server receiving a request, looking for a corresponding file on the filesystem, invokes PHP which turns around and parses that, runs that, and then most of the work is thrown away and done over for the next request (I know there are ways to optimise that, I take that into account in my calculations lol)

The modern web app architecture spins up a persistent process with all the data-structures, commonly used data, etc. kept in memory and when a request comes in, the server forwards the data to that process, and then, the thing responds.

And sometimes, the admin doesn't even bother with a server like Nginx or Apache and just has the web app service port 80 / 443 directly.

The web script model is absolutely horrendously slow and it's no surprise that you can get speeds ten thousand times faster than that and if you have a mostly static page, you might even be able to get it down to a hundred times faster.

That is before we even go into asynchronous programming and what-not.

Wordpress aside (it's gotten to the point where Wordpress is PHP), a large portion of the world has been shifting to other models, they're simply not as convenient, but the prices have crashed for VPS' and WebFaction embraced the newer technologies to try to get a competitive edge over their competitors.

It wasn't that long ago when Discourse was an expensive premium product which can only be run on pricey VPS'. Now, you can simply drop down $3/month to get the thing going, how the times change.

I can only see more and more players hopping on. And prices will only continue to fall. First wave is always priciest.

And to be honest, you can wrangle shared hosts into working other than WebFaction, it's just more work than Docker and doesn't work as seamlessly with their systems.

Answer: Nope.

https://eev.ee/blog/2012/04/09/php-a-fractal-of-bad-design/

Warning: It's a bit of rant lol
The thing is famous though, it has spread all over the industry.

Now, see, I don't even know what WebSockets is.

Things get a bit more complicated than this, but I'll try to keep it simple.

Basically, a HTTP connection involves sending data to the server complete with cookies, headers, etc. and then getting a response.
WebSockets is a technology where data can be sent to the server, from the server in any direction, at any time which helps to reduce the amount of bandwidth usage and overhead.

It's not the only technology in the area though, there's also event source and what-not. It's a W3C standard, so it's in every modern browser, although perhaps not older versions of internet explorer.

 

[Geoffrey]

I feel like I'm in the minority with this opinion, but I've always loved xenforo and still do. Based on what I've read of XF 2's planned feature upgrades, it all sounds very exciting and it appears to be taking forums in the right direction.

I'm not into all the back-end stuff, which it seems is a lot of what people here have issues with, but the front-end and features don't seem that bad at all.