Search options

I can imagine several legitimage uses that would be severly hindered by this simple anti-flooding technique. Large groups of users sharing an IP is one of them.  My message board is used for an RPG and users often have a different account for each role play character.  It is not uncommon for a user to set up 2 or 3 accounts at once.

Making the timeout configurable is one step towards making this more flexible.  Another would be to add a configurable "number of acceptable registrations within a given time" variable.  In other words, you might want to only allow 1 registration per IP every 30 minutes.  Or you might want to allow 4 registrations per IP every 60 minutes.

By allowing for a small number of registrations to happen before the user is affected by the timeout period, you greatly diminish the chances of legitimate users being affected.  But you still prevent the DDOS type registration attacks from being effective.

I mentioned them on punRes and you said to bring them here.  I don't believe either of these issues were resolved on punres.

---

As for messages going back and forth in email, that's true, but I value user privacy.  Users can always choose to exchange actual emails or to display those emails on their profile page.  They can also choose to quote whatever they want into new email messages should that be necessary. Personally, I can think of issues where private communication is appropriate but perhaps exchanging email addresses is not.

I'll probably just do this one myself.  I understand that not everyone will want it, I just think it should be a choice.  Private messages really exist so that users don't have to divulge email addresses.  I'd just like to adjust the email system to mimic that functionality without the overhead.

I'd seen the first link you list, which is similar, but not really the same thing, in my opinion.  He wants to give different moderators different powers and I just want different moderator enabled group so that I can use the exisiting forum controls to turn access on and off.

The second link is what I was thinking about.  Though I hadn't considered the option of just putting users in more than one group.

Personally, i think managing users in multiple groups is harder from a UI standpoint than just being able to apply mod status to existing groups.  You can also work around the users in multiple groups thing by creating enough groups to handle all your different access needs.  There really isn't a work around for the moderator thing.

-- edit --
you updated while i was typing.  Sounds like a reasonable plan.  I haven't had time to dig into the sql structure and examine the queries on the pages to see where moderator status was checked.