5 ms·
vB's biggest problem is that it's a horribly convoluted rat's nest. If you've ever seen the actual code, you can see why it's just not possible to lockdown ever
by eksith 13y ago
vB's biggest problem is that it's a horribly convoluted rat's nest. If you've ever seen the actual code, you can see why it's just not possible to lockdown everything since there's so much legacy code that would break as a result.
- GuiA 13y agoTo my knowledge, that's sadly true of any PHP based message board (phpBB, SMF, etc).
- eksith 13y agoI think this is very much a cultural problem within the PHP community. phpBB in particular is notorious for its unsustainable code and I think I figured out the reasons. There are better ways of doing things (despite PHP's inherent warts) that some other projects have used quite successfully, and more importantly sustainably, but there's a very long history of doing things "because that's just the way it's always been done" and I don't see that changing anytime soon, I'm afraid. I mean if you look at some of the tutorials out there, a lot of it is just appalling in terms of maintainability, efficiency and security (and that includes some very popular frameworks). There are a lot of cases where short-term, and often short-sighted, convenience trumps long-term goals.
- jordanthoms 13y agoI can remember setting up a osCommerce site years ago, and the _official_ way of installing 'extensions' was literally to follow instructions telling you to open XYZ file and add this code at this line number, etc.
- krapp 13y agoSounds like a call to action to me. Sooner than later someone needs to make a PHP based forum that isn't crap.
- eksith 13y agoI've yet to see a single, practical, simple end-to-end tutorial published for free (like the vast majority of the "rubbish" ones) that even uses SPL. Of course, I see snippets here and there of the iterator et al. But nothing comprehensive. Forget a full on forum, if someone took the time to use best practices to build a MVC/P app as a reference, there would be plenty adopters. I don't mean something that "hides" work, I.E. A framework like Code Igniter. These just introduce more magic into code that doesn't actually teach the why and how.
- mkr-hn 13y agoAlready done: http://vanillaforums.org/ http://vanillaforums.org/
- sesqu 13y agoThere have been a number of attempts at that. Unfortunately, most of them seem to also try to solve the problems of "PHP based" and "forum".
- mikevm 13y agoI think XenForo uses bcrypt: http://xenforo.com/ http://xenforo.com/
- Zarel 13y agoXenforo overall takes security more seriously than phpBB, vBulletin, and IPB, possibly because they don't have as much legacy cruft to worry about. For instance, vBulletin knows about (and doesn't plan to fix) a vulnerability that allows any moderator to privilege escalate to take over a server (and steal passwords) under default settings. They don't consider it a big deal because moderators should be considered trusted users. Unfortunately, it's significantly harder to ensure that every moderator won't get their password stolen than it is to ensure that every admin won't get their password stolen. Recently, @rootinabox exploited that (and possibly other vulnerabilities) to hack a bunch of Pokemon sites that were running vBulletin.