bbPress support forums Topic: TalkPress

bbPress support forums Topic: TalkPress http://bbpress.org/forums/ bbPress support forums Topic: TalkPress en Tue, 02 Dec 2008 15:00:59 +0000 sambauers on "TalkPress" http://bbpress.org/forums/topic/talkpress/page/2#post-20270 Mon, 27 Oct 2008 11:55:14 +0000 sambauers 20270@http://bbpress.org/forums/ @geldlening It is safe to use the stable version of 0.9.0.2 geldlening on "TalkPress" http://bbpress.org/forums/topic/talkpress/page/2#post-20265 Sun, 26 Oct 2008 22:24:59 +0000 geldlening 20265@http://bbpress.org/forums/ So is it safe to use or should one just know a lot about it? beernews on "TalkPress" http://bbpress.org/forums/topic/talkpress/page/2#post-20138 Thu, 23 Oct 2008 02:30:09 +0000 beernews 20138@http://bbpress.org/forums/ Been a few months. Where does one keep up with the developments (other than the trac/code stuff which I dont understand)? _ck_ on "TalkPress" http://bbpress.org/forums/topic/talkpress/page/2#post-19259 Tue, 16 Sep 2008 01:23:15 +0000 _ck_ 19259@http://bbpress.org/forums/ This topic is old - bbPress has not been hacked - there was an exploit for all of a day or two back in 0.8 that was quickly fixed. What's happening is that OTHER programs on the same account or server are being hacked and what they do is attach themselves to the bbPress templates though those other programs. In over 4000 sites, I've only detected 8 XSS hacks so it's obviously coming in through other programs and not directly (or the problem would be far more widespread). (And by the way, if you keep getting hacked, that means your server has been compromised and need to be wiped and re-configured. Just re-installing the PHP programs won't fix the issue if there is a a hidden backdoor elsewhere. ) hypotheekrente on "TalkPress" http://bbpress.org/forums/topic/talkpress/page/2#post-19225 Mon, 15 Sep 2008 10:30:39 +0000 hypotheekrente 19225@http://bbpress.org/forums/ @geld_lenen Could you explain what you were using? My personal experience with bbPress is really great and hackers tried to hack some websites i have, but dont manage to get in to it. So i really wonder. Regards, Bob sambauers on "TalkPress" http://bbpress.org/forums/topic/talkpress/page/2#post-17197 Fri, 11 Jul 2008 17:24:57 +0000 sambauers 17197@http://bbpress.org/forums/ bbPress is not a competitor to WordPress, it is a complimentary product. Anonymous on "TalkPress" http://bbpress.org/forums/topic/talkpress/page/2#post-17140 Wed, 09 Jul 2008 07:39:43 +0000 Anonymous 17140@http://bbpress.org/forums/ Why switch to bbpress? Wordpress is highly configurable and there are a lot of plugins. And if you want you can change the source code on your own server..... sambauers on "TalkPress" http://bbpress.org/forums/topic/talkpress#post-16739 Fri, 13 Jun 2008 06:25:03 +0000 sambauers 16739@http://bbpress.org/forums/ @geld_lenen That's a fairly serious accusation and warrants an investigation if true. Can you be more specific please? bbPress does a lot of filtering of user input to avoid these things. What part of bbPress was exploited? A topic, a profile? Code injection in bbPress installs is usually a symptom of insecure shared hosting, not bbPress itself. geld_lenen on "TalkPress" http://bbpress.org/forums/topic/talkpress#post-16730 Thu, 12 Jun 2008 19:42:08 +0000 geld_lenen 16730@http://bbpress.org/forums/ BBpres is extremely hackable for Iframe attacks and code injection. My BB was hacked 3 times, always used last version. Looking for another now.... 0aron Maya on "TalkPress" http://bbpress.org/forums/topic/talkpress#post-16358 Wed, 21 May 2008 01:35:56 +0000 0aron Maya 16358@http://bbpress.org/forums/ That sounds great. You know that the same framework, the same look and the same feel do drive us crazy. Forums should not be restricted but varied. beaulebens on "TalkPress" http://bbpress.org/forums/topic/talkpress#post-14411 Tue, 11 Mar 2008 19:08:00 +0000 beaulebens 14411@http://bbpress.org/forums/ Also, for people's interest -- here's Matt talking about BackPress at WordCamp 07; <a href="http://www.viddler.com/explore/cdevroe/videos/228/241.45/BackPress/" rel="nofollow">http://www.viddler.com/explore/cdevroe/videos/228/241.45/BackPress/</a> lenen on "TalkPress" http://bbpress.org/forums/topic/talkpress#post-13943 Tue, 19 Feb 2008 16:20:37 +0000 lenen 13943@http://bbpress.org/forums/ Looks like a lot of trouble to fix in the future. I never had any problems with bbPress, but that's probably because there aren't a lot of users active :) sambauers on "TalkPress" http://bbpress.org/forums/topic/talkpress#post-13625 Mon, 04 Feb 2008 13:43:29 +0000 sambauers 13625@http://bbpress.org/forums/ Also, BackPress may or may-not be incorporated into WordPress. bbPress is a testing ground for the concept. If it doesn't get incorporated into WordPress it doesn't really matter, hopefully we'll at least have a better structured core in bbPress as a result. sambauers on "TalkPress" http://bbpress.org/forums/topic/talkpress#post-13624 Mon, 04 Feb 2008 13:40:23 +0000 sambauers 13624@http://bbpress.org/forums/ I don't think the concept of upgrading plugins to met the new requirements of a version is unheard of or that big a deal. Most deprecated functions will probably be maintained via the deprecated.php include file, but we are actually considering clearing out most of that deprecated.php include when 1.0 is released. We have generally searched the current plugin repository for each of the few functions we have dropped so far during the BackPress migration. If we don't find it we have been reasonably confident that dropping the function won't cause any problems. We will attempt to work with the current plugin devs to get their plugins up to scratch when the time comes. _ck_ on "TalkPress" http://bbpress.org/forums/topic/talkpress#post-13622 Mon, 04 Feb 2008 06:08:27 +0000 _ck_ 13622@http://bbpress.org/forums/ As I was reverse integrating the WP trunk with the bbPress trunk this weekend I was thinking a lot more about this - and the more I think about it, the more I am getting confused about what is being planned. If WP and bbPress are being coded to use to a unified function library that would definitely break wordpress hooks. But Matt would never do that as it would break 1000's of plugins and themes for the far more popular WordPress. In some ways, bbPress's db/load process and hooks are slightly more thought out/evolved than WordPress because they came later and WordPress has to maintain some backward compatibility. So then it occurred to me that to leave the WP hooks alone, I hope you are not trying to replace the core of bbPress only with WP-like functions? I don't see how that could be done without breaking every single plugin and theme for bbPress? Will the next (non minor) release of bbPress have a nearly-unified WP core? In trac I see BB functions being renamed to their WP counterparts. But no wrapper functions for backward compatibility are being written. I see the backend of bbPress being hammered into backPress and I imagine the next bbPress as simply a front-end being re-written to only use the backPress, ie. wordpress, hooks. So I guess the final question is: is there a plan to write wrapper functions or is the general attitude just to abandon all third party work to date for the next bbPress release and just hope we go along for the ride? sambauers on "TalkPress" http://bbpress.org/forums/topic/talkpress#post-13477 Wed, 30 Jan 2008 01:24:26 +0000 sambauers 13477@http://bbpress.org/forums/ @ChgoGrrl99 We'll be attempting to make future upgrade processes as seamless as possible. fel64 on "TalkPress" http://bbpress.org/forums/topic/talkpress#post-13471 Tue, 29 Jan 2008 17:47:53 +0000 fel64 13471@http://bbpress.org/forums/ No, not really. It seems likely to me (as an outsider) that a regular upgrade process will continue to work for you. ChgoGrrl99 on "TalkPress" http://bbpress.org/forums/topic/talkpress#post-13465 Tue, 29 Jan 2008 14:51:11 +0000 ChgoGrrl99 13465@http://bbpress.org/forums/ I don't know exactly what you guys are talking about, but I fear it means I'll have to start all over, doesn't it? _ck_ on "TalkPress" http://bbpress.org/forums/topic/talkpress#post-13426 Sun, 27 Jan 2008 07:40:24 +0000 _ck_ 13426@http://bbpress.org/forums/ Whew, after a bit of debugging I found the cookie issue with builds >1008 - and it was all my fault - my apologies! I finally noticed in the changes from 1008 to 1009, that pluggable.php changed the functions that set the cookies. Then I had a sudden recall where I made an auto-load plugin to force year-long cookies (_cookie-year.php) which was now interfering with the function. Deleting the plugin allowed the logins to work. So anyone that happens to be using _cookie-year.php will have to replace it when I get time to make an update. _ck_ on "TalkPress" http://bbpress.org/forums/topic/talkpress#post-13425 Sun, 27 Jan 2008 06:20:29 +0000 _ck_ 13425@http://bbpress.org/forums/ Thanks for the background Sam. For a moment I panicked about the cookie hash vulnerability as I have legacy WP 2.1 (and bbpress 0.81) installs that are too customized to upgrade (I hack security fixes in manually) but then I read this: *If* an attacker can gain read access to the wp_user table, for example due to a publicly visible backup or SQL injection vulnerability, a valid cookie can be generated for any account. You've got bigger problems if an attacker can do a SQL injection or has access to your mysql backup. But I can definitely understand why they replaced it. Who the heck figures these vulnerabilities out though, wow. Since bbShowcase is stand alone bbPress (for now) I'll give the upgrade another shot later and try to understand what's going on with the cookies/login. I take it that 0.8.3.1 doesn't use the new cookies though? At some point you might need to release 1075 as 0.8.3.5 or something like that? sambauers on "TalkPress" http://bbpress.org/forums/topic/talkpress#post-13423 Sun, 27 Jan 2008 05:48:57 +0000 sambauers 13423@http://bbpress.org/forums/ @ fel64 BackPress is already a separate repository which is linked to externally within the bbPress trunk. For interests sake the BackPress repository is here: <a href="http://svn.automattic.com/backpress" rel="nofollow">http://svn.automattic.com/backpress</a> BackPress has no separate Trac though. sambauers on "TalkPress" http://bbpress.org/forums/topic/talkpress#post-13422 Sun, 27 Jan 2008 05:43:48 +0000 sambauers 13422@http://bbpress.org/forums/ @ chrishajer Whenever I have linked to trunk in the past I have always mentioned and or linked to specific revisions, so I don't think this is a major issue. I'll stick it to the top so that it is obvious to people anyway. sambauers on "TalkPress" http://bbpress.org/forums/topic/talkpress#post-13421 Sun, 27 Jan 2008 05:42:07 +0000 sambauers 13421@http://bbpress.org/forums/ @ _ck_ I suggest you try a new test install of both bbPress and WordPress integrated to see the way the auth and secrets are supposed to match up in a "clean" environment. You should be able to adjust things in your existing installation as a result. sambauers on "TalkPress" http://bbpress.org/forums/topic/talkpress#post-13420 Sun, 27 Jan 2008 05:39:16 +0000 sambauers 13420@http://bbpress.org/forums/ > so an existing forum with 1000 users will have to instruct every single one to clear their cookies Not necessarily, it just may be an issue if your cookies weren't expired already. > I wonder if this has to do with the hard coded hash I have set in bb-config.php > How does this affect a setup with a shared login from wordpress where you have to match the same hash it has? You will need to also run WordPress trunk to match the cookies and hash methods up. WordPress has also migrated their cookies and password hashes in trunk. > hope there was a good reason to fiddle with it Judge for yourself, we followed WordPress' lead: <a href="http://trac.wordpress.org/ticket/5367" rel="nofollow">http://trac.wordpress.org/ticket/5367</a> fel64 on "TalkPress" http://bbpress.org/forums/topic/talkpress#post-13416 Sat, 26 Jan 2008 17:02:31 +0000 fel64 13416@http://bbpress.org/forums/ XML-RPC sounds fairly interesting; I'd like to see what you'll do with it apart from pingbacks. Content aggregation sounds good too. Is there anything you can say about backPress, though? Do you have any idea for when you'll maybe be splitting it into BackPress and bbPress? (why does dev use a 1990's-style mailing list for it's own *forum* software?) Because while forum software is a communication medium it's not necessarily the right one for development talk. But you've brought it up many times now; maybe time to give it a rest? chrishajer on "TalkPress" http://bbpress.org/forums/topic/talkpress#post-13415 Sat, 26 Jan 2008 16:21:16 +0000 chrishajer 13415@http://bbpress.org/forums/ Sam, I think this should be made sticky. For a while, the conventional wisdom was to tell people to grab the latest trunk to fix the underscore plugin issue and the mysqli issue, but that's no longer true. There is no good reason for a non-developer to use trunk at this point, I don't think. Is the best advice for people who just want to install a working version of bbPress to use r980, as you posted about a month ago, or has that advice changed? Thanks, Chris _ck_ on "TalkPress" http://bbpress.org/forums/topic/talkpress#post-13413 Sat, 26 Jan 2008 15:54:09 +0000 _ck_ 13413@http://bbpress.org/forums/ Ugh, so an existing forum with 1000 users will have to instruct every single one to clear their cookies - meaning at least 50% won't understand and try to contact the forum operator personally. I think there is a better way - perhaps an upgrade plugin that can detect the out of date hash and instruct the client to delete the old cookie and redirect back to the login. Actually, wouldn't bbpress replace the hash data in the cookie upon login? None of this sounds right - I created a new user under 1075 and was still unable to login. I've gotten build 1006 to work properly so I guess I will try another investigation into the upgrade from there tonight. I wonder if this has to do with the hard coded hash I have set in bb-config.php How does this affect a setup with a shared login from wordpress where you have to match the same hash it has? I had the integration working just right, hope there was a good reason to fiddle with it. sambauers on "TalkPress" http://bbpress.org/forums/topic/talkpress#post-13406 Sat, 26 Jan 2008 09:23:47 +0000 sambauers 13406@http://bbpress.org/forums/ You know that both cookie and password hashing have changed? You may need to clear your old cookies manually to make way for the new ones. Send a mail to the dev list or hit us on IRC in the #bbpress channel and well work out what's going on. We're acutely aware of how spammers attempt to "fool" Akismet. There are steps being taken now to help improve the processes involved in combatting this. Remember that we are users of Akismet too, so have an interest in keeping it ahead of the game. The nature of Akismet's purpose means that back-end code needs to remain closed. If spammers knew how it worked, it would likely make it possible for them to game the system. Of course it is opt-in, so if you don't like it then you don't have to use it. Controlling the data that is passed to Akismet is controllable from the client end using plugins that can limit it's behaviour. These already exist for WordPress, bbPress ones could be easily developed too. If there are hooks missing to make that possible then we'll add them. _ck_ on "TalkPress" http://bbpress.org/forums/topic/talkpress#post-13405 Sat, 26 Jan 2008 06:12:51 +0000 _ck_ 13405@http://bbpress.org/forums/ I'll probably be forced to join the dev list to try to solve this but I just tried moving from 951 to 1075 and I cannot get the logins to "stick" (ie. logs in and then acts as if it is not logged in) Seems like the old cookie path issue but I've looked the cookies and the code and everything seems healthy. Even created a new user with 1075 and that user cannot login either. eta: 1006 does not exhibit the login issue ps. don't kid yourself with Akismet stopping spam. Spammers just escalate their deviousness on what they can get through it. My wordpress.com blog gets spam almost daily now, bleeding right through Akismet. And Akismet hasn't been given peer-review for privacy/security issues such as passing every single message entered on every single blog and bbpress through automattic - even for private posts and private sub-forums. Won't make for good headlines when people start to think about it. sambauers on "TalkPress" http://bbpress.org/forums/topic/talkpress#post-13404 Sat, 26 Jan 2008 05:39:09 +0000 sambauers 13404@http://bbpress.org/forums/ You are right, 1075 is probably the most stable release for "cutting-edge" users, but we would appreciate testing of trunk during integration of BackPress. We do intend to experiment with PingBacks and TrackBacks in topics via XML-RPC, and you could be right about spam, but we won't know until we try. We will build out the spam tools provided by Akismet to try and meet the challenge of spam at the same time. There are also other ways in which we can utilise XML-RPC besides those two features which you may not have considered, we already have some cool ideas about user integration and content aggregation that should be driven by the needs of the hosted project. I hope you don't leave us just for giving it a whirl :) The "Press" names are mostly about branding and the they need not be taken literally. We can leverage a lot of good-will by associating with WordPress, and we intend to create better ways to integrate the two projects, regardless of where they are installed or hosted.