4 ms·

I guess you still need to manage accounts ? Also under GDPR IP address retention can fall under that in your logs depending on how you manage the info, same wa

I guess you still need to manage accounts ? Also under GDPR IP address retention can fall under that in your logs depending on how you manage the info, same way analytics would need attention. It should really be more simple, and I wish we'd have more people just building small sites here and there without having to care much about these details.

AshamedCaptain 3y ago
Why on earth would you need to retain IP address or have analytics at all? This scaremongering about GPDR always conveniently forgets that the stuff the GPDR makes scary to do is stuff you should not be doing anyway.
- chipsa 3y ago
  For regular forums, you need the IP address for helping to protect against SPAM and making sure banned users stay banned. Analytics can help see if you're having issues with the server, or if someone is putting unnecessary load (client-side analytics staying flat, but server-side rapidly increasing, or similar).
  - AshamedCaptain 3y ago
    Or you can just rely on manually approving all of the new accounts. It's not like you need to cater to the bunch of new users that have an inmediate need to post _today_ and just cannot wait 1 week for a mod to approve their initial posts. Collecting IP address will not reduce the need for manual moderation, nor even reduce bot spam... (I do admin a topic-specialized technical web forum which has been running for over 20 years, which doesn't even need to ask for cookie consent.. but of course, has never been legally tested, so YMMV)
    - chipsa 3y ago
      You have a problem user, named Aragorn. You ban him. Two months later, he makes a new account named Estel. How do you associate his new account with his old account, so you know not to approve it? I've done moderating of an phpBB forum and having the IP address and being able to see who else was posting from that IP address was helpful (because you can look at the writing style and decide they're doing ban evasion).
      - AshamedCaptain 3y ago
        First, for at least this past decade, I have found it impossible that the same user will keep the same IP address for over two months. Storing the IP address _does not help at all_. Second, the new user is subject to approval and all his messages are moderated until a couple of posts. If he starts posting decent material, why would you care he was banned 2 months ago -- are you really that punitative? And if he just posts decent, insightful material for his 5 messages, gets approved and then descends back immediately into trolling, well, at least it's been a couple of months and then the couple of weeks he was under moderation of total silence, plus you have gained whatever contributions he made under moderation. I am yet to see a troll that will repeat this process (which requires insightful contributions in-between each iteration of trolling) for more than a year. That's way less moderating effort that it takes to handle new users at all...
        makeitdouble 3y ago
        IP is still a super valuable info, even as it changes every so often. You'll see strangely repetitive user coming from different AWS's IP blocks. User showing constant sessions from 5 or 6 IP blocks that seem to belong to different countries. Or users having a pretty consitent IP but asks for help right after a new login happened on a different IP. It can be replaced with other info, but it's still a simple and pretty powerful bit to know about your users.
rightbyte 3y ago
If you require logins you don't need to store the IP address for preventing abuse. The user gives you the identifier on login. The IP is a quite bad id anyways since it changes alot.
- makeitdouble 3y ago
  Yes, that feels simple enough, and would work for a small at home BBS. It gets messy when you have a number of users and need to know why a specific user is sending you 150 requests per min for 3 hours: you'll insta ban that user, but still need to understand what happened. Did they get their login info leak and the whole internet is having a field day with it ? Is it an issue with your system and their browser is stuck in a weird loop ? Are you session management backend going bust and they're actually all different logged users ? You'll only know if you have the IP, parts of the headers and some more debugging info, and activating the debug after the fact is often not good enough.

AshamedCaptain 3y ago

Why on earth would you need to retain IP address or have analytics at all? This scaremongering about GPDR always conveniently forgets that the stuff the GPDR makes scary to do is stuff you should not be doing anyway.

chipsa 3y ago
For regular forums, you need the IP address for helping to protect against SPAM and making sure banned users stay banned. Analytics can help see if you're having issues with the server, or if someone is putting unnecessary load (client-side analytics staying flat, but server-side rapidly increasing, or similar).
- AshamedCaptain 3y ago
  Or you can just rely on manually approving all of the new accounts. It's not like you need to cater to the bunch of new users that have an inmediate need to post _today_ and just cannot wait 1 week for a mod to approve their initial posts. Collecting IP address will not reduce the need for manual moderation, nor even reduce bot spam... (I do admin a topic-specialized technical web forum which has been running for over 20 years, which doesn't even need to ask for cookie consent.. but of course, has never been legally tested, so YMMV)
  - chipsa 3y ago
    You have a problem user, named Aragorn. You ban him. Two months later, he makes a new account named Estel. How do you associate his new account with his old account, so you know not to approve it? I've done moderating of an phpBB forum and having the IP address and being able to see who else was posting from that IP address was helpful (because you can look at the writing style and decide they're doing ban evasion).
    - AshamedCaptain 3y ago
      First, for at least this past decade, I have found it impossible that the same user will keep the same IP address for over two months. Storing the IP address _does not help at all_. Second, the new user is subject to approval and all his messages are moderated until a couple of posts. If he starts posting decent material, why would you care he was banned 2 months ago -- are you really that punitative? And if he just posts decent, insightful material for his 5 messages, gets approved and then descends back immediately into trolling, well, at least it's been a couple of months and then the couple of weeks he was under moderation of total silence, plus you have gained whatever contributions he made under moderation. I am yet to see a troll that will repeat this process (which requires insightful contributions in-between each iteration of trolling) for more than a year. That's way less moderating effort that it takes to handle new users at all...
      - makeitdouble 3y ago
        IP is still a super valuable info, even as it changes every so often. You'll see strangely repetitive user coming from different AWS's IP blocks. User showing constant sessions from 5 or 6 IP blocks that seem to belong to different countries. Or users having a pretty consitent IP but asks for help right after a new login happened on a different IP. It can be replaced with other info, but it's still a simple and pretty powerful bit to know about your users.

rightbyte 3y ago

If you require logins you don't need to store the IP address for preventing abuse. The user gives you the identifier on login. The IP is a quite bad id anyways since it changes alot.

makeitdouble 3y ago
Yes, that feels simple enough, and would work for a small at home BBS. It gets messy when you have a number of users and need to know why a specific user is sending you 150 requests per min for 3 hours: you'll insta ban that user, but still need to understand what happened. Did they get their login info leak and the whole internet is having a field day with it ? Is it an issue with your system and their browser is stuck in a weird loop ? Are you session management backend going bust and they're actually all different logged users ? You'll only know if you have the IP, parts of the headers and some more debugging info, and activating the debug after the fact is often not good enough.