http://www.everystockphoto.com/forum/index.php (if it hasn't already been listed here)

PunBB is very nicely integrated into their site design, with a nice clean, light grey/shadowed metallic colour scheme, and they have also simplified the Pun interface a useful amount too.

Alas on IE6 it is a bit of a mess - eg the navigation menu goes completely wonky and some of the CSS backgrounding in viewtopic.php dont work right - but on FF the whole interface works nicely.  The interface is also a bit slow since their pages load up about 1 tonne of jscripts and other crap.

127

(2 replies, posted in PunBB 1.2 show off)

Nice design, although some of the style elements are pretty familiar. I like 100% forums too.

The forum subject is a funny one though. Straight people truly are weird. smile

hcgtv wrote:

Expat forum: http://www.expat-blog.com/forum/

My God. look at all the sub-forums they have in some forums!! Top level forum Europe has about 40 sub-forums, and then some of these sub-forums themselves (eg Europe > France) have 10+ forums themselves. Overall number of forums/sub-forums on the site must exceed 200+.

The code must perform like a pig in terms of queries etc.

Also having all those subforums is not very user-friendly.  You get a very crowded set of top-level index pages.

There's also hardly any point having hundreds of sub-forums unless you have hundreds of thousands of users. You just end up with dozens of empty spaces. Better to just keep dedicated threads running within country-level forums on particular regions, for example, than to split every country up like that into smaller and smaller forums, IMHo.

But I like the visual aspects of the design. Very friendly colours, quite a clean and modern look.

I'd suggest starting your anti-spam efforts with something simple, like the simple 'human test' mod linked below.

http://punbb.informer.com/forums/viewtopic.php?id=16076

or the similar but more sophisticated human test mod by Jacky available here:

http://www.punres.org/files.php?pid=503

and discussed here:
http://punbb.informer.com/forums/viewtopic.php?id=19029
and
http://www.network-technologies.org/Pro … mod_punbb/

Both mods VERY easy to install.

Then add extra measures like for example a graphical CAPTCHA if the pain persists. Punres.org has tons of Pun anti-spam tools for you to choose from.

Interesting. A trace route from Beijing seems to confirm this - the packets die at 159.226.254.102, which seems to be a gateway in/out of the CN net.

They must have something against another of the sites on that IP ?

Punbb.org itself seems fairly inoffensive.

131

(4 replies, posted in PunBB 1.2 show off)

Hmmm. I don't mean to be negative, but it is indeed a bit visually boring, as matt1298 says.

Also it is not clear what the forum is about. If I stumbled upon it as a result of a page 3 SERP on some keyphrase or something, I don't think I'd linger on this forum for about more than 3 seconds, let alone register.

Oh, and why are you showing off a FluxxBB forum here smile

132

(13 replies, posted in PunBB 1.2 discussion)

11.11.0.0/16 might also work - it would ban the range 11.11.0.0 - 11.11.255.255.

That is, if CIDR notation is supported.

133

(59 replies, posted in General discussion)

I *knew* this would happen.

I've been through this before with the fork of the Mambo CMS > Joomla several years ago. Things changed with the original Mambo project (IP and ownership issues etc) in a similar manner to what has happened to PunBB, and a big chunk of the core devs and hackers soon left, worried that their input was being commercialised and open source ideals were being compromised.

But it is very disruptive and lots of things can suffer. For example with the Mambo/Joomla fork, the security of the code in Mambo (never that great) and Joomla went completely to crap for a long long time, since with the shift of devs and code no one knew what was going on and those who took an interest in security auditing in one project didn't bother with the other code base anymore.

The disruption caused by the fork also meant I never touched Mambo or Joomla again. I went across to a CMS with a more stable developer heritage and community instead.

For the moment I'll probably move on over to FluxBB too if the code is (at least for now) compatible with PunBB, since I have a lot of mods and hacks to worry about integrating into it. 

But please, no more radical moves, or I'll have to seriously start looking at Phorum or SMF or even (shudder) PhpBB...

PS - don't the core devs who are leaving now for FluxBB feel bad about ragging so heavily on the poor guy who forked v1.3 into SunBB about a year ago? smile

134

(20 replies, posted in PunBB 1.2 troubleshooting)

How do other open source LAMP forums (eg phpBB, Phorum, SMF etc) handle non-Latin language full-text search?

135

(8 replies, posted in PunBB 1.2 show off)

As a fellow Windows 2000 user too, I'm all with you MattF. New and shiny does not always trump secure and stable.

There is nothing inherently in-secure either in the W2K OS or IE6 as a browser. FF, Opera, IE etc all have security issues, depending very much on how you run and use them.

What we shouldn't be arguing about is the need to produce good standards compliant HTML that modern, popular browsers like IE6 can render successfully.

I think any punbb forum/ style developer would do well to read the Yahoo guidelines on graded browser support here:
http://developer.yahoo.com/yui/articles/gbs/

IE6 is still considered a Grade A browser that web developers should still certainly aim to support.

136

(8 replies, posted in PunBB 1.2 show off)

Since they are only a few IP's away from your site, they are probably sharing a rack with you. They have a few services active. I'd be checking the cabling and network infrastructure very carefully if I was managing that data centre smile

137

(8 replies, posted in PunBB 1.2 show off)

Interesting. I found it impossible to register using IE6 though - clicking on register.php off the forum menu generated a blank page. Doing the same in FF2 successfully generated a visible page though. Something is amiss there.

Also best of luck running a security site on a /C IP address range shared with sites like muslimhackers.com. Any site anywhere in the neighbourhood of that is likely going to attract (TLA) attention in this day and age.

I suggest that you be on your best behaviour...   smile

138

(2 replies, posted in PunBB 1.2 troubleshooting)

While changing passwords regularly is probably a good idea, I don't think bad passwords are the problem here. It seems a vulnerability somewhere in the LAMP stack is being exploited - most likely at the PHP layer.

Can you tell from any of your logs (web, ftp, ssh etc) how the attacker arrived on your system and perhaps what script they threw at your site to gain access to your server?

Given the number of hacked sites, I don't think this guy would have done them all manually, so there is probably a footprint left behind somewhere, perhaps from the initial, scouting part of the script - eg when they search for a vulnerable PHP script with known weaknesses (eg I've seen a lot of scans recently for various PHP calendar scripts with known vulnerabilities, and searches for PHPMyAdmin are also common) that then allows them to compromise the system and get the ability to - for example - run shell commands or include remote scripts.

139

(2 replies, posted in PunBB 1.2 show off)

Nice default forum style. But the style switcher at the bottom of the forum index page didn't work for me.

Also while the home page of the site looks very attractive, it was slow to load due to all the graphics, all your many many javascripts, and all the Flash stuff. :-(

And what is the site anyhow? It just looks like a cute front-end onto various travel affiliate schemes. Where's the original content :-)

140

(11 replies, posted in PunBB 1.2 show off)

Smartys wrote:

It's fairly simple, well-written code that you need to audit once and forget it. And it's probably the easiest way to get a fancy typeface dynamically.

Still... I don't want to think about the consequences for the server if - for example - someone remotely threw a 1,000,000 word dictionary at the dynatext script, and asked for the font size of each requested word to be 10000 pt, for example. smile

I don't know if it is possible, but that's just one example of what I'd be worried about.

141

(5 replies, posted in PunBB 1.2 show off)

pedrotuga wrote:

awesome!
What do you use for the rest of the site? wordpress?

He seems to be using snews as his CMS - http://www.snewscms.com

142

(11 replies, posted in PunBB 1.2 show off)

You are right Smartys. I should have researched the dynatext a little further.

But still, it seems a too-fancy solution, IMHO, for a relatively simple web design problem.

More code to go wrong. And more code to audit for potential vulnerabilities too, which you don't always want on a high-profile site...

143

(5 replies, posted in PunBB 1.2 show off)

I forgot to mention: I also like the one-eyed cow in the header image smile

144

(11 replies, posted in PunBB 1.2 show off)

Looks like they make use of dynatext:

http://www.alistapart.com/articles/dynatext
http://www.artypapers.com/csshelppile/pcdtr/

on their forum index page to generate the nice font images for forum topics.

It's an interesting approach but if you turn images off you don't see the forum names and it also means search engines don't see the forum names either off the home page.

I imagine it would also add a bit to server load making those images dynamically - and mean generating a dozen more http requests than you really need too on the forum index.

Interestingly, you can also use the dynatext remotely off Jamies site: eg

http://www.jamieoliver.com/fonts/dynate … HelloWorld smile

And they still have userlist.php floating around in the forum root too.

145

(11 replies, posted in PunBB 1.2 show off)

That's a very nice punbb implementation. The emphasis on trying to make the forum user friendly with the simplified index page and the flat forum structure is cool.

I also like the custom header image that appears on a per-forum basis. Is there a mod for that?

Don't like the site background image though, and the default font size is too small.

The forum footer also behaves a bit erraticly. When browsing the forums or reading a topic in IE6 the 'copyright -terms of use' etc links sometimes sit right over the top of the cover image of his book, or sometimes also jump up off the bottom of the page and sit amongst the Facebook etc logos. Must be an open CSS { somewhere in the style-sheet or something.

That's a nice style - very attractive, very simple and fast.

I'm not sure about that [Vanilla forum style] one forum index view though. Personally I find that sort of forum index page too confusing and un-structured, particularly when the topic list grows long.

It would also be nice if the forum width was fluid, not fixed.

147

(5 replies, posted in PunBB 1.2 show off)

Very nicely done, particularly the forum. Good, simple colour scheme of complementary and subtle colours. It's also nice and fast.

The site also looks very cute and friendly, which is great and something I like a lot in web design but don't see enough of.

Menu's across the site need work though - ideally you'd have one consistent menu across all areas of the site. But there are about 3 different top level menus evident on the site - in the forum, in the blog, and in the directory - that look different and work differently too. That's visually messy and navigationally confusing.

It was also navigationally unclear to me how to exit the forum and return to the site home page because there is no link in the forum menu to 'home', just to 'blog'.

I also don't think it is necessary to have the forum link in the main blog menu open the forum up in a new browser window. Why bother with a new window.

Sitemap also turned up a blank page for me initially and then appeared fully only after a page refresh. Don't know why.

I'm not sure if this matches up with what you are trying to do, but have you had a look at this example code?:

http://wiki.punres.org/Add_a_login_form_over_the_header

Yes, it's an interesting challenge you have set yourself.

But lots of punbb forum owners will no doubt appreciate any work you do to help defeat spammers and further improve this mod.

Questions I have made up are careful not to feature any answers that might contain text from anywhere else on the page. Each question is also phrased uniquely - there are no sets of three similar questions, for example, as there are in the default set. And if a question requires a numeric response, the answer is always at least 4 digits long smile

Furthermore, I also recommend that anyone who deploys this mod take a few extra measures:

(a) place the human test question in a slightly different location in the HTML code of register.php than the default (ie place the question above or below it's default location in the example register.php supplied in the mod);

(b) rename the two-pairs of publicly visible form response variables in the HTML of the supplied register.php ( ie name="human_test" ) to something unique to your forum;

(c) rename the human test question legend in the HTML code of the supplied register.php from "Human Test" to something unique to your forum too.

By making each deployment of this mod unique, these measures may make it harder for scripted bot attacks against this mod in future. At least in theory.

Brute force detection could be a useful feature to add. It could be a classic 'three-strikes and you are out' type of system, which can sometimes be tricky to build. Or perhaps you could use something similar to the post-flood control that is already in punbb that just sets and enforces a (variable) throttle on the allowed time between form responses. That might also be effective.

It works well. Pity there is no admin control panel to modify the challenge/response pair though.

Just remember not to script multiple questions that all have simple answers like 1, 2 or 3. smile

Complex questions that have simple answers - no matter the actual number of questions - can defeat the purpose of this mod. A bot (or scripted browser...) could easily break through a run of 10 randomised complex questions if they all have simple answers like 1, 2 or 3.