Spot on Julian. You have discovered something many have known for decades but lacked the discipline and/or capability to practice in ever increasingly hectic world full of deadlines, phb demands, etc. Be interesting case study to observe uptake now that it has a cool name. Seriously.

I shall echo your sentiments wholeheartedly. Wanna really bend yer' noodle? Go smart phone free for a few days. Then a week.... Semi retired here and not carried one for a few years now. Very liberating to be free and I have had more than a few confide that they envy me. Having recouped more time you now have time to make plans, think creatively, etc.

It has long been a personal mantra of mine to read some print material regularly. Internet only tends to make one's concentration a bit too hyper after a period. Yer' brain needs longer articles and chapter books.

Try it. You might like it.

@scottalanmiller said in Which is better NodeBB or Discourse?:

@Joykiller said in Which is better NodeBB or Discourse?:

I personally hate Discourse due to their docker wrapper. but thats me.

Oh gosh, that would pretty much turn me away right there. Docker is great for devs, but makes little sense for production operations. Tends to come from shops that are run by devs and have little operational knowledge or experience. We just had a discussion about that last week in our forum: https://mangolassi.it/topic/19577/docker-for-production-use-of-third-party-software/

Docker is for lamers who don't know how to be system admins

And, of course, rapid development. When Docker first started making it's appearance I embraced it but was later aghast when folks started routinely deploying to production, and predicted to some buddies that some security nightmares were just around the corner... And they were.

But enough Docker bashing. I looked at Discourse long, long ago, in a far away galaxy (well, in Internet time, anyways). Ruled it out right away for following (admittedly highly opinionated) reasons:

• Docker centric: Now that I am primarily only on my own projects, I am free to abandon Linux in favor of what I consider to be superior OS's like FreeBSD and SmartOS. Nothing personal but platform lockin equates to vendor lockin. And that just ain't freedom enough for me

• Rails vs. NodeJS: Are you kidding? Was an early adopter of Rails back, circa 2003/4 or so? It rocked at that time as an alternative to then php stuff sporting the serious security hole of the day/week. Or so it seemed - php was pretty sketchy for a while there. Fast forward a decade and a half and it's freakin' no contest! Rails is all but history/legacy, at least in my mind.

• Main Dev Heads: Cool vs kind arrogant asshats (sounds like that may have changed). This was immediately off putting and I was kind of surprised Discourse became so popular, but I guess that's one thing fame will help you with.

So... note to the NodeBB devs:

Please do keep doing what YOU do best and do not worry too much about feature parity w/what, in my view, is an inferior, non starter platform just because they've got a few extra bells, whistles, and/or mindshare. Popularity more oft than not does NOT equal technical superiority but rather merely demonstrates whos' the better con men. Err.. marketing team....

Now obviously I do not mean to preclude a bit of cross pollination when it makes sense. But I have been around long enough to observe FOSS project loose their vision in the quest for "Feature Parity" with some perceived competition. So, just weighing in w/my $0.02 to encourage you to stay true to your vision. Cuz it's been workin' pretty good fer' me ;D

And finally, in closing, the astute may have noticed I enjoy making tongue in cheek comments from time to time for the humor value. Don't get yer' beak too tweaked, eh? It's not a religion for me.

Just an update to note that I've bailed on SmartOS and PostgreSQL due to too many bumps in the road in favor of sticking with a well supported platform. Which pretty much translates to: "what the dev heads are using...".

I use fbsd for our in house stuff that I keep updated via build server and internal lan. When I need cloud scale smartos or linux are the best options. To wit I have not even tried fbsd and pgsql so cannot weigh in there.

Thanks for all the insights. I'll probably be back to bug ya' before too long.

o/

Much thanks to @scottalanmiller for the advice and an embarrassing amount of hand holding. I'm now rocking an nginx tls proxied nodebb sporting Centos7, mongodb, and redis for session management.

I'm curious to know if any nodebb gurus are serving up nodebb via nginx https enabled reverse proxy and using modsecurity?

@julian

Excellent and very well composed, Julian. I have been out of managing community spaces for a while and took a pass on social engineering, errr.. I mean networking, sites in general. Hence a bit out of the modern loop, so to speak. Your blog post was timely - elaborates and illuminates a related discussion I was having on irc just last night (private chan, not nodebb).

Good stuff, particularly w.r.t. the ephemeral. Another fall out I am noticing that I ascribe to sites like NitWit and Facebark is that folks no longer seem capable and/or willing to even post up actual sentences, much less string them together into coherent thoughts. Serial "post whoring" seems to be more the order of the day. I don't think these people realize such, but has actual coherent conversation and discussion become a lost "art", displaced by what essentially amount to click bait posts?

This forum obviously attracts a more technical audience so, no, I am not dissing anybody here.

Deserves a Hooray!

@djensen47 I did take a quick gander - looks like it drags in a bunch of Google depends. Not everybody is keen on the Goog these days.

Be that as it may; You did not actually answer my question. I don't have a big issue w/forum spam and the stuff I do have enabled seems to be coping. Knock on wood. The few addresses I did check were flagged by each, the bad was missed by each, although emailrep.io seems to be a fair bit more aggressive in giving somewhat dubious reps to known clean addresses. Hence my initial impression based on an admittedly very short look does not leave me particularly enthused as I'd prefer to risk false negatives than false positives.

So, I would be curious to know just what "niche" this targets. Not that having more options is not a good thing. I would be curious if you have done any compare/contrast evaluation on your end cuz I am open to new data. And if it's cool mostly because it's new and offers promise then that is okay too.

Edit: Heh, now I neglected your question and that you need to ask it pretty much answers mine about the testing on your end. I'll have to refresh my memory on that and get back to you, else probably some staff has it off the top of their head sooner...

@julian If so, please give me a knob for opting out of the additional stuff. Which seems to be nodebb's approach in general w.r.t. stuff like this and just dandy by me.

@zaasmi said in Which is better NodeBB or Discourse?:

With vastly more people becoming aware of privacy concerns, ever more increasing numbers of people transitioning to VPN's, along with the plethora of free VPN providers coming online nowadays, one take any such stats with a large dose of salt, eh?

One reason I put little to no stock in "analytics". These days.

So rather than just bitch about it, I spun up a freshie SmartOS (18.3) instance and endeavored to install NodeBB as per explained via docs that are admittedly a bit dated here: https://docs.nodebb.org/installing/os/smartos/

Prior to 1.10.2 these worked dandy (adjusting fer' some updatin').

Alas, not any more. v1.10.1, enter, stage left, sharp:

./nodebb setup starts spewin' about sharp, wh/tracks back to libvips, wh/does not seem to exist in Joyent's SmartOS pkgsrc (used by smartos, netbsd, dragonflybsd, etc.) repos. So, uh, the fallback to build from src flails about, thrashing mesirably in futile efforts to resuscitate itself... but I digress.

Hence the wannabe NodeBB on SmartOS innocent must either do some crunchin' and a munchin' of libvips src else nag OhJoy's pkgsrc team, eh? Fun, fun, fun ;-/

I suppose I should investigate v1.10.2 on FreeBSD, eh?

Alrighty then! We now return you to your regularly scheduled programming.

Rock on o/

P.S.; I saved logs but as this appears to be a sharp/libvips/nodejs on SmartOS issue I didn't figure y'all would be too intrigued. Peace, out o/

I should clarify that by "core" I actually meant core supported modules/functionalities packaged and supported as part of the base release. Poor choice of wording on my part. I am happy a camper. This would be icing on the cake for me.

Uhh.... just use emacs??

Write on, Julian!

Glad you are feeling inspired.

@oplik0 +1 on the Jitsi stuff. Don't know jack about the code. I have been following that project since its very early days. Impressive and sustained progress, it makes. No flash in the pan, one or two shot wonder preceding an exit strategy, were they. Impressive.

I try not to succumb to the Chicken Little Syndrome but the situation is pretty bad. I know folks managing forums (using other offerings) who have had to resort to an "admin approval" step for new user sign up. They do revel in identity politics though, and hence a juicy target.

Cutting to the chase: You are at least aware, so you are already one step ahead of many. Analyze your pro/cons accordingly for your use case. NodeBB rocks. I've got some tricks up my sleeve out in front of it but NodeBB has thus far served me quite well. I rate it as one of the best FOSS projects I have used. Especially in recent memory. Hence, you've already got it eighty percent correct. Now yer' just tweakin' knobs...

Alright. Okay. I know what I said before. But there is one other thing. Drum roll, please....

The visitor and use graph on the Admin landing page is useful to me. Some nice presets that cover most everything I'd be interested in. But I do find myself oft times pining for an hourly X-Axis spanning more days, e.g. 72 hour axis scaled in one hour increments.

Damn. This is a slimline the cruft and tech debt announcement and I've now added two feature requests. Mea culpa!

Thanks and keep up the great work!

@eileen I think you should be running that command in your nodebb installation directory as your nodebb user. Then activate in NodeBB control panel or via cli.

Be wary of old plugins (generally, not any indictment of the plugin above, of which I have zero familiarity.)

@glassdimly Just for my own clarification:

• You are skipping the email validation all together then?
• After registration users remain parked at sign up and not redirected to the page from which they initially hit reply?

Okay. I was not referencing spam so much as sock puppet bots. Maybe watch The Great Hack documentary if you've not already.

• Wikipedia synopsis
• IMDb

This is more along the lines of the kind of stuff I am referencing. It's pretty rampant. But I also come to this from a systems background, reviled far and wide for mercilessly spoiling developers' bliss.... Regular Bastard Operators From Hell, we are.

Apologies for my feeble reading comprehension. Have fun and good luck!

Not sure. I have some pretty low tech members but they manage to figure it out well enough to get by. I think key success points are having clearly outlined processes in a prominently displayed FAQ, coupled with good helpers, who may not necessarily be overly technical themselves, but are long on patience and kindness. IOW, the unsung heros of many communities, both online and in the real.

It is important to understand what your use case is, and admittedly I do not. I do know that community and social sites are being targeted at unprecedented levels by state sponsored cyber warfare. Keeping the onslaught of bots at bay requires concerted effort and the bar keeps needing to be raised.

The use case you desire is only a small variance from what presently is the case (at least to my reading): Removal of the email verification step. Definitely lowers the bar for the more easily befuddled. But in so doing you have also essentially removed the bar for bot accounts. How now, will you verify/vett new user accounts? A few possibilities:

0. No vetting. This is already accommodated in the admin UI.
1. Parse input and presume that if it looks like an email address then it is a legitimate email address.
2. Verify email is able to be sent to said address.
3. Verify email is able to be received at said address.

Even #4 , which is where you are at now, will still result in bots and sock puppet accounts. NodeBB has some plugin modules designed to help mitigate such but even still, these pesky buggers are persistent and AI is advancing rapidly.

It is also important to understand what kind of scale you are anticipating. Oversight of a small site of twenty or thirty closely knit members is easy to manage. Up the ante to a couple thousand and those tactics become untenable.

Be that as it may, only you can judge and assess best for your use case. I am just tossin' out some considerations that may or may not apply.

@glassdimly I dummo. One thing for sure is such a workflow facilitates bot hacker types exploiting your site. Of course there are captcha modules and such to mitigate this to some degree. I was just thinking, however, that sometimes offering the lowest hanging fruit for new user signup and posting is not always all it is cracked up to be.... Particularly if you reside somewhere that may be having an election any time soon.

@PitaJ said in New node processes spawning on EC2:

I think you're just seeting processes that are spun up as part of normal operation: for instance, a short-lived process is spun up every time a password is hashed.

You wouldn't see them under low load because they aren't used much there.

But I would expect to still see them there lower in the top listing, depending on sort option being used (man top is yer' friend). That the OP indicated new processes were spawned threw me. Good catch!