It would benifit the bbPress community as a whole if Matt or MDA (or anyone else with access to the repository) could put up some kind of notice on the Private Messaging plugin page that tells about the security risks.

I think a contact form which is send to the "hidden" user email address is a much better solution

That would indeed be an awesome feature to have.

I think a contact form which is send to the "hidden" user email address is a much better solution

I assume just the function from

function pm_new_message( $id_receiver, $id_sender, $pmtitle, $message ){

}

You replace just that section to the } with the CK rewrite?

PS thanks for this, security issue=bad

Closing this topic.

http://bbshowcase.org/plugins/freshly-baked-cookies.zip

Don't forget to copy over your settings at the top of the plugin and remember to set the AUTH_COOKIE_VERSION to 2 for WP 2.8

I have a hard time believing it's that simple to fix for WP 2.8 vs 2.7 but here's hoping.

Any changes you make to your templates to use it will remain compatible when upgrading to 1.0, users will only have to deactivate the plugin after upgrading.

(this is also a demonstration of how Voices should have been a plugin rather than in the core)

I also agree with _ck_'s points about core vs. plugins. From what I can gather, the original idea was to have a fast, secure, and plugin extensible system. Even as a user rather than a developer that makes a lot of sense to me. It means the core quickly becomes more and more stable, and anyone is free to develop whatever they want to hook into it. Brilliant. But putting various functions into the core means that any changes have to be redone by Sam et. al. and re-uploaded, hacked in the core by users, or redeveloped by hooking in a plugin to change the functionality. As everyone has differing needs and opinions, plugins for anything but basic core functions leave open far more options. Anything which is not essential to all users is not a core function. Gravatars, for example, are not required or even wanted by many users.

As to people remembering old versions with fondness, but having moved on with each bleeding edge version, I'd suggest that it's only those who keep moving on who voice their opinions most in these forums. There are huge numbers of users who've built forums with very old packages of all kinds, and when they build new ones they use the old software too. I think it's important that those who love bleeding edge, along with the challenges and time consuming re-uploading and fiddling around, don't forget that many people are perfectly happy with what works and see no need to keep reinventing the wheel. After all, how much better really, do all these new ideas and functions appearing all over the web make life? This is probably a point for a philosophical forum, but worth mentioning I think. We seem to spend so much time redoing and redoing, that often purpose is lost in the background noise of being so busy changing everything. We live in a, "Yippee, it's new!" culture, where anything which doesn't titillate the mind is ditched for whatever's next.

New functionality is great if it's genuinely useful, but I'm glad 0.9.0.5 exists and works so well, and the occasional security update will do fine. Incidentally, I'd quite like to see a separate 0.9 forum. It would save 0.9 users having to wade through all the 1.0 questions and allow us to quickly see what's relevant.

If it wasn't against the grain to open up a .9 legacy forum here specifically for supporting it, I'd say just do that and see who falls into it.

A majority of the audience of bbPress are people that want to be on the bleeding edge of WordPress development, and be part of a growing and maturing community. As such, people will remember .9 of bbPress as much as they remember .9 of WordPress (b2evo anyone?)

I personally think anything officially past the end of 2009 is a stretch, and is a very generous offer from Sam to not leave the early adopters on their own without patches and support.

Respectfully to all, just because the ABILITY to use a new feature is built into bbPress DOES NOT force one to use it. It's still totally up YOU. No one HAS to incorporate Gravatars or Voices into their site, but it is very cool for newbies to simply turn a core feature on or off rather than needing to download a plugin that is probably months or even a year old...praying it will work with the latest version.

Am I saying Sam should build an NES Emulator and a Weatherbug Widget into bbPress 1.2? HECK NO.

(Sam, start with the Atari emulator instead)

But things like Gravatars, (which Automattic owns) have tremendous potential use (goodbye individual avatar uploading for every single forum, hello universality). And the ABILITY to display voices makes sense to add in (being able to show the number of different people contributing to a topic certainly enhances bbPress).

Perhaps I am in the minority here, but I am hoping future versions of bbPress will continue to add these sorts of new features that make the bbPress experience more enjoyable for all users.

(I had written a whole thing here but I accidentally closed the tab and restoring it never brought the text back unfortunately.)

You should never adopt a program based on one person, especially if that person doesn't do it for a living and even more important since that person doesn't work for the company that made the program in the first place ;-)

To be clear I am not abandoning bbPress, at least not until I find something better and I am not actually looking for something else right now and what I have seen over the past year has not impressed me much. Besides, there are other talents around here and they are slowing releasing more and more impressive plugins or porting them from WP. A couple years from now people won't even remember me.

My biggest problem with 1.0 is how bbPress was on a course with 0.9 to correct many of the legacy mistakes that WordPress had made, and suddenly with a whim by Matt, bbPress has turned around 180 degrees and steered itself neck deep back into the muck and mire via BackPress. It's now burdened with many more layers and required compatibility and it will never be any more lightweight than it is now, which is not so fantastic anymore.

Another big problem growing with 1.0 is how instead of taking any feature that is outside of the API functionality and making it external as a plugin, it is being poured directly into the core, setting itself up for more legacy failure, like WordPress. Sam wrote some really great plugins as an independent but now as a core developer he can just slide it right into the core. It's far easier to modified the core to get new features done fast but it should be resisted at all costs. You'll notice that WordPress doesn't have any official plugins outside of akismet and "hello dolly", it's a very clear but invisible company policy - "we don't make plugins, put it into the core". bbPress is now headed down the same path and it's not necessary.

Things like:
gravatars
voices
topic page icons
should not be in the core. Instead any necessary action and filter hooks needed to accomplish such features should be carefully created and then the features should be made as plugins that can be enabled or disabled as desired. bbPress already comes with a "factory" plugin directory, it should be put to good use.

bbPress 0.9's greatest strength was as a lightweight framework.
1.0 is not just a framework anymore, it's starting to tell you how it should look and feel, and that is bad, because there are dozens of other forum programs out there that will do just that.

Reading this does make me more than a little concerned - WP integration is a key feature of bbPress, as can be seen from all the talk about it on these forums. 0.9 integration is almost impossible to get working (I was never able), and the bridge between the two will likely be developed solely with 1.0 in mind from here on (not that it ever worked properly in 0.9).

1.0 seems to the killer app for a WP/BB CMS integration, so for that reason alone it is an appealing upgrade - in my case essential, as I would not have otherwise been able to select bbPress at all. Providing a cohesive user experience is rather more important than worrying about a few CPU cycles in a case like this, as hardware is cheaper than lost page views and users.

However, reading _ck_'s comments here and elsewhere, it is obvious he loathes 1.0 or at least has almost no interest in it.

Since most of the rich functionality which is essential to a rounded forum is provided by _ck_'s superb plugins, it seems that for anyone dependent on them is going to be left waiting for a potentially long time, especially when _ck_ appears to have no interest in taking work, making it a matter of waiting for plugins to catch up - I am sure many users just couldn't upgrade without being able to carry forward their existing features, which rather renders the whole issue of supporting 0.9 moot.

I'd have to say, it would be a situation like this, and not any "heaviness", which would press me into looking at an alternative solution...

I definitely agree that it's not as seamless as it could be...

It should be possible to integrate version 0.9 with just about any version of WordPress

Yeah, but it's a lot easier with 1.0. I always found minor gremlins in the way it worked with 0.9, but with 1.0 it seems to function fairly seamlessly.

I generally help others with their forums, not build them for myself, so I need it to be fairly basic to do the integration. The way 1.0 does it natively is pretty slick IMO.

I never liked the 0.9 line, but it seems I'm not in the majority with that opinion. I guess I'm biased by requiring a working integration with WordPress.

People contributing peer support on these forums can make the choice personally whether or not they help out with 0.9 problems. I'll also provide a link to the latest 0.9 "legacy" release on the downloads page (with warnings about discontinuing support).

So, I'm thinking that support continues until 31 December, 2010. Anyone particularly unhappy about that?

Ending things at a year end is much more tidy than the middle when many more people are away.

Except I feel that more people are off on Winter vacation in December ;) But I'm not all that hung up on summer v. winter showdowns. I suspect the same volume of people will be away in December as July, so why not pull a GeoCities and shut down Oct 26th ;)

The only real reason I can see for stopping 0.9 support is that it's time consuming in a direction that's no longer being followed (see _ck_'s explanation). And that's fair, y'know :)

0.9 IS stable. It's more tested than 1.0. But I agree with johnhiler, in that this doesn't need to be a WarGames, zero-sum thing. There are always reasons to stay a couple revs back. Anyone who runs a server knows that. You want to upgrade to get new things, but you also end up holding off because it works as it, and you don't want to mess with what works. But. There's a point where holding off will cause you more pain when you have to upgrade.

Thankfully, we're not there yet!

Sez Sam:

As long as bbPress 0.9 is maintained some time will have to be spent maintaining the 0.9 branch, mostly with regards to security fixes. I don't see this as particularly burdensome, but I don't want to be doing it forever.

12 to 18 months is long enough, IMO, for that. Pick one, carry on. A set in stone date is good so people can't say they weren't warned :)

I will wait and see what Sam has to say about all this.

1.0 is NOT just 0.9 with more bug fixes. It is a 50% different program with a 90 degree change of direction made suddenly by Matt deciding to make bbPress use the WordPress core (ala BackPress) in January 2008. It was re-engineered in just a year after a massive amount of work mostly by Sam. The alpha, beta and RC stages for 1.0 were rushed, apparently on purpose in some cases.

Been casually following bbPress for the past year (WordPress is sooooo a Gateway drug to other Automattic projects) but the impending release of 1.0 and the various RCs pushed me to finally jump in and start really fooling around with the software. Couldn't be happier. God bless bbPress pioneers like _ck_, Sam, and everyone else for the plethora of killer plugins and themes.

Totally understand where people are coming from re: 1.0's stability compared to 0.9 but it would be much more productive for attention to be focused on 1.0 instead of 0.9. After all, folks using/testing/tweaking 1.0 is how all the bugs, plugin compatibility, and various stability issues will be worked out!

Exciting times are ahead for bbPress and 1.0 is the future. The more focus on 1.0 the better in the grand scheme of things. I'm going to get razzed but 6 months doesn't seem unreasonable (or even 3 months), especially since everyone has known for quite some time that 1.0 was going to be coming out. Let's embrace the future: 1.0!

In my opinion, people took the risk knowing they they were going to use a non-1.0 stable release in production ... regardless of how long 0.9 was out.

So Sam, please minimize the amount of support for 0.9 with the idea being for you to spend more time focusing on 1.0+.

Again, this would be totally different if 0.9 was a stable release, but IT WAS NOT.

Just my 2 cents

I'm going to be staying on 0.9 for now. I'm not sure what to do about the upgrade path... I'm going to try 1.0 on some test servers, but so far I haven't seen a reason to upgrade yet.

If you push people off 0.9 in a hurry against their will, I bet you the top 100 sites will considering switching to other forum software if they run into significant hassle switching to 1.0 (it's somewhat like the Windows Vista effect vs XP, the glossy interface to Vista does nothing over the functionality of XP, in fact it makes things run slower, so people waited until the next version)

While I think it's nice Sam is asking the masses, the reality is the most vocal people here "in a rush" are running small sites with just dozens of members and hundreds of posts. The people he should be really asking are the largest sites with tens of thousands of members and hundreds of thousands of posts. But you won't find them active here or voting because they typically have better things to do than constantly fiddle with the software.

All I am saying is if a security problem is found with 0.9 it should be addressed until the end of 2010. Based on WP and bbPress history that will probably happen once or twice a year. Otherwise feel free to let 0.9 gather dust.

Given the development speed of bbPress (slow) this is not unreasonable. We seem to be fairly split between 6 and 18 months, and I'd split the diff at 12 months, if it comes down too it.

No one is asking for a single new feature in 0.9, just if there is a security issue found, release a fix. Such fixes usually take a trivial amount of time to produce once a problem emerges.

Some people who make money charging by the hour enjoy the idea of constant changes, upgrades, rebuilding things from scratch, etc. because it keeps them busy and in business. Other people have better things to do, and having made a significant investment in time to setup a working forum with bbPress over the past few years or they don't have the extra performance required to run 1.0, can just give up all the new "features" in 1.0 and just keep using 0.9 while they plan a migration in their spare time.

All I am saying is if a security problem is found with 0.9 it should be addressed until the end of 2010. Based on WP and bbPress history that will probably happen once or twice a year. Otherwise feel free to let 0.9 gather dust.

Something else to consider is now that 1.0 is based on the WordPress core (ala BackPress) it is potentially vulnerable to any new attack vector that is found in WordPress (including at least one serious issue currently in the wild) while bbPress 0.9 might remain immune.