@scottalanmiller said in Which is better NodeBB or Discourse?:

@Joykiller said in Which is better NodeBB or Discourse?:

I personally hate Discourse due to their docker wrapper. but thats me.

Oh gosh, that would pretty much turn me away right there. Docker is great for devs, but makes little sense for production operations. Tends to come from shops that are run by devs and have little operational knowledge or experience. We just had a discussion about that last week in our forum: https://mangolassi.it/topic/19577/docker-for-production-use-of-third-party-software/

Docker is for lamers who don't know how to be system admins

And, of course, rapid development. When Docker first started making it's appearance I embraced it but was later aghast when folks started routinely deploying to production, and predicted to some buddies that some security nightmares were just around the corner... And they were.

But enough Docker bashing. I looked at Discourse long, long ago, in a far away galaxy (well, in Internet time, anyways). Ruled it out right away for following (admittedly highly opinionated) reasons:

• Docker centric: Now that I am primarily only on my own projects, I am free to abandon Linux in favor of what I consider to be superior OS's like FreeBSD and SmartOS. Nothing personal but platform lockin equates to vendor lockin. And that just ain't freedom enough for me

• Rails vs. NodeJS: Are you kidding? Was an early adopter of Rails back, circa 2003/4 or so? It rocked at that time as an alternative to then php stuff sporting the serious security hole of the day/week. Or so it seemed - php was pretty sketchy for a while there. Fast forward a decade and a half and it's freakin' no contest! Rails is all but history/legacy, at least in my mind.

• Main Dev Heads: Cool vs kind arrogant asshats (sounds like that may have changed). This was immediately off putting and I was kind of surprised Discourse became so popular, but I guess that's one thing fame will help you with.

So... note to the NodeBB devs:

Please do keep doing what YOU do best and do not worry too much about feature parity w/what, in my view, is an inferior, non starter platform just because they've got a few extra bells, whistles, and/or mindshare. Popularity more oft than not does NOT equal technical superiority but rather merely demonstrates whos' the better con men. Err.. marketing team....

Now obviously I do not mean to preclude a bit of cross pollination when it makes sense. But I have been around long enough to observe FOSS project loose their vision in the quest for "Feature Parity" with some perceived competition. So, just weighing in w/my $0.02 to encourage you to stay true to your vision. Cuz it's been workin' pretty good fer' me ;D

And finally, in closing, the astute may have noticed I enjoy making tongue in cheek comments from time to time for the humor value. Don't get yer' beak too tweaked, eh? It's not a religion for me.

@rivalite said in nodebb allows users to change the skin and save this appearance?:

.. snip...

Hello, I just discover nodebb.
I have a few questions:
1.nodebb allows change the skin like Discourse?

Admin Control Panel -> Appearance -> Themes/Skins.

Four themes shipped. Sixteen or so skins.

2.Also, I just realize nodebb uploaded my image attached to this post, to imgur. I have to pay on imgur or somewhere for this feature?

No. You can host your images locally. Offloading to imgur is a possibility, but not necessity.

3. is there a free spanish translation?

No clue.

4.how many free skins are available?

No clue. Sixteen included w/default install. At least on 12.x

5. Is it possible migrate from xenforo 2.x ?

Probably. But likely to be a headache for the uninitiated. You may want to explore contracting some expertise.

6.I just signup here using an email from https://temp-mail.org/ . Is there a spam filter to don't allow users signup with https://temp-mail.org/ ? This spam filter is free?

No clue w.r.t. temp-mail.org. NodeBB does include some more generic protections. See e.g. nodebb-plugin-spam-be-gone.

Thanks so much!

You're welcome. Enjoy!

Spot on Julian. You have discovered something many have known for decades but lacked the discipline and/or capability to practice in ever increasingly hectic world full of deadlines, phb demands, etc. Be interesting case study to observe uptake now that it has a cool name. Seriously.

I shall echo your sentiments wholeheartedly. Wanna really bend yer' noodle? Go smart phone free for a few days. Then a week.... Semi retired here and not carried one for a few years now. Very liberating to be free and I have had more than a few confide that they envy me. Having recouped more time you now have time to make plans, think creatively, etc.

It has long been a personal mantra of mine to read some print material regularly. Internet only tends to make one's concentration a bit too hyper after a period. Yer' brain needs longer articles and chapter books.

Try it. You might like it.

Initial draft for gotwf nodebb email how-to two cents worth. Confusion over email seems to be a recurring issue so I thought I'd take a stab at culling and consolidating the salient bits. Caveat emptor.

tl;dr: NodeBB recommends using a third party emailer like Sendgrid because they have better deliverability. And so do I. At least if you're coming at this looking to get NodeBB sending email with the least amount of effort.

NodeBB Email Options

NodeBB Offers Several Ways to Send Email:

1. Emailer plugins: There are a few plugins like the MailChimp plugin which operate directly with various email providers. I'll leave configuration of such to their respective plugin documentation.

2. SMTP transport: NodeBB has built-in support for SMTP, so you can use a Gmail account for instance to email your users. This is pretty self explanatory. Season details to scratch your provider's itches.

3. Sendmail: NodeBB supports using sendmail on Linux to send emails. To do this you just turn off the SMTP transport and make sure no email plugins are enabled.

   sendmail, the executable, will send mail via a variety of transports.

   man sendmail(8) speaketh thusly:

   Sendmail sends a message to one or more recipients, routing the message over whatever networks are necessary. Sendmail does internetwork forwarding as necessary to deliver the message to the correct place.
   .....
   ..... snip, snip.....
   .....
   With no flags, sendmail reads its standard input up to an end-of-file or a line consisting only of a single dot and sends a copy of the message found there to all of the addresses listed. It determines the network(s) to use based on the syntax and contents of the addresses.

   If the recipient is not known locally, i.e. a local user/domain, then the server's resolver subsystem should, (contingent upon configuration) return the MX record for the domain at hand and attempt a delivery. Whether or not that MX accepts your mail is at the mercy of their assessment of your server's legitimacy. At minimum you will need matching forward and reverse DNS enteries, and likely an SPF record, for example. Others will automatically put you on their blacklist even if your stuff is squeaky clean and require a near act of god to be removed.

   Handling of refused, bounced, etc. mail is, once again, contingent upon configuration. One should ensure their mail queues do not become constipated to the extent undeliverable mail exhausts disk space, thereby effectively creating a DOS.

4. One may also run a MX daemon such as Postfix on their NodeBB host. Running as a daemon has advantages for certain use cases. In which case, I recommend deploying Postifx as a Null Client. Quoting from preceeding:

   A null client is a machine that can only send mail. It receives no mail from the network, and it does not deliver any mail locally.

   One must therefore have some OTHER, supplementary MX that will receive mail for your domain. Else opt for a more complex Postfix configuration.

   Example screenshot NodeBB side utilizing Postfix Null Client running on the local host and listening on port 25:

   

   Selecting the Custom Service pull down may seem counter intuitive but this is the option you need to populate parameters for your localhost null client.

   Connection security should be None. Else if you invoke STARTTLS NodeBB side then of course Postfix will endeavor to oblige (depending on config). I am of the opinion that if you need TLS for the localhost to talk to itself then you likely have much larger concerns. Username and Password should not be necessary for local submission.

   Conversely, it is highly advisable to use TLS when talking to external SMTP servers. Free certificates are available thru Let's Encrypt. Numerous Acme Clients are available. I favor Dehydrated Boulders

   This approach also requires configuration of additional cogs and widgets such as matching forward and reverse DNS enteries and likely an SPF record, for example, that are beyond scope of the present discussion.

Note: Postfix was designed to be a drop in replacement for Sendmail and many Linux distributions include it as part of their default installs. In which case the sendmail executable mentioned above may be Postfix's version, or perhaps be a symlink. This can cause confusion with Options 3 and 4 above so if you're running into issues please clarify when running as a daemon.

Something seemingly simple at first blush can pose more than a few sticky wickets and why I recommend following @julian et.al.'s advice and opt for the low hanging fruits offered by the first two options. Unless you have a clear use case not to. Learning how to do all of this stuff is a legitmate use case. Just be forewarned that you may experience a bit of trial by fire if you are learning the zen of email administration on a production system.

@omega said in automatic temporary ban of a troll user with minus X votes:

@gotwf said in automatic temporary ban of a troll user with minus X votes:

First off: Lot of good discourse in this thread. Lame pun intended.

@omega said in automatic temporary ban of a troll user with minus X votes:

....

Disagree w/above though. Too much added complexity. KISS.

Tough crowd, always with the tomatoes... try this one:

Let the Mods be Mods, let the Users be Users and Admins be King & Queen, forum developers could be Heros!

Granted it's more BOWIE than KISS but you get the point right?

Oooh, la, la!!! Good one. Yeah, I'll take Bowie. Had the good fortune to see Bowie live way back in the day. Spectacular showman. Indeed. Followed Stevie Nicks. But I digress....

Maybe you missed that I got your point. At least w.r.t. the root causes of the issue. My point is that AI is not the solution for all things because AI, by its very nature, lends itself to becoming gamified and one consequently finds themselves in a never ending bot arms race.

A community needs to behave like an actual community and help the good guys do their jobs policing the bad guys. We need the human factor because we need the human touch and human oversight. And hopefully some human hard won wisdom as well.

The larger the community the more mods, etc. required. We all get that many lurk, fewer post, fewer yet are active contributors..... But hopefully.... on a prayer and one wing... good mods and helpers emerge. And it seems they will, in my experience, but it takes time - needs to develop organically and no real short cuts.

In the meanwhile... are we able to make a knob that actually works for that? With us rather than against us? Tough cookie, for sure.

Oh and can we have a better grammar-typo bots for my posts...

No.

Okay, I'll play...

Wishing You & Yours All The Best

Rock on!

P.S.; Happy Ray Troll Thursday. Wear 'em if ya' got 'em.

Just an update to note that I've bailed on SmartOS and PostgreSQL due to too many bumps in the road in favor of sticking with a well supported platform. Which pretty much translates to: "what the dev heads are using...".

I use fbsd for our in house stuff that I keep updated via build server and internal lan. When I need cloud scale smartos or linux are the best options. To wit I have not even tried fbsd and pgsql so cannot weigh in there.

Thanks for all the insights. I'll probably be back to bug ya' before too long.

o/

@esha Might also want to take a gander here:

https://community.nodebb.org/topic/15259/1-17-0-breaking-changes?_=1619018509427

Have fun!

Much thanks to @scottalanmiller for the advice and an embarrassing amount of hand holding. I'm now rocking an nginx tls proxied nodebb sporting Centos7, mongodb, and redis for session management.

Closely related to this thread https://community.nodebb.org/topic/15966/non-stop-spammer-sign-ups but I'll post some thoughts here rather than scattering about.

@zandertrek Admittedly, I also have many "inactive" accounts. Always made me wonder. Some of these never ever return. Some do return every once in a blue moon. Others return more frequently. I have reached out to a couple other forum "owners". Seems eighty to ninety percent plus accounts being inactive is pretty much de'rigeur modern times.

I've discussed this with few folks that I know personally "in the real" who fall w/in these groups. Their answers:

• Big Data & Privacy Concerns. These folks no longer participate in any "social media" sites due to big data and privacy concerns. Primarily stemming from awareness of just how bad the "Big Three" are in this regard. These folks tend to be older professionals, highly knowledgeable and aware of stuff like the Snowden Documents.

• Big Government. Closely related to above but slightly different spin. Many jobs in IT nowadays involve intensive background checks and/or some level of security clearance. These folks are savvy enough to know that their electronic communications, both professional and personal may be subject to "continued and ongoing monitoring". Indeed, I took a pass on a pretty sweet gig once because those clauses hidden w/in the small print of a thirty plus page background check agreement. So don't laugh: Big Brother is watching. And he's got one hell of view.

So why then, register at all?

1. Access to search functionality. Just got to be this way to protect against abuse by bots. This, I suspect, is the main one. I do this myself at various site: I passively consume but need search to research. Nothing nefarious here but yeah, sometimes I use temp email addresses cuz, let's face it, many, many sites are poorly managed and compromised w/o the site owners' awareness.

2. Access to private chat functionality. Again, closely related to the first two points above. Some folks like chatting w/their friends privately. They don't use other sites for this because they trust me. They're also savvy enough to know that the moment any third party scripts are involved that the notions of any sense of privacy and/or confidentiality is delusional. Yes, I can still be served up with a warrant. Ditto my cloud provider. Not a silver bullet but at least raises the bar a bit. At least in this country.

Granted these represent a minority. So what to do about the rest? Well, I suspect most fall under one of @julian umbrellas:

@julian said in How to manage stalker accounts (users with no posts):

I think a great many people register on this forum just to see what the registration flow is like, or maybe to see if they get access to new things once they are registered.

Okay, where and what, precisely is the threat? Hmm.....

I suppose some of those private chats could be used for nefarious purposes. I sometimes wonder if Admin accounts should have access to user's private chats but feel this would be a betrayal of confidences of the community at large and I don't want to throw the baby out with the bath water. So I just "endure" until actual problems are reported. I've not had this happen.

As for actual stalkers, I've only had one such occurrence reported. I was always suspect of this particular user from the get go so I perma banned them.

So what is left? All those inactive accounts, some greater than a year. I've thought about nuking accounts older than a year sans any logins but then I ask myself what harm they really cause? I've had accounts that were dormant for long periods, sometimes over a year, others that pop in to post only once or twice a year. Indeed, I have fallen into this category myself: There's a couple sites I used to be quite active on but nowadays it may be a year or two between logins. Nuke one of these and then you've set yourself up as "the bad guy", oppressive overlord, etc. Maybe this is what some are looking for? A reason to bitch and/or defame you? Whatever. Bottom line is that I see little downside to the live and let live approach while there is potential downside to pruning.

Just some thoughts. It is a sticky wicket to be sure.

@evgeny-kurt Email from this forum does not go to any of my "junk" folders so I am going to suggest you may have a client side issue there? I avoid all things goog to the extent possible so no insights as to how to rectify but there should be a "not spam" button, or some kind of filter that needs tuning so it does not trigger on nobebb's community robot.

@boston-stanley said in NodeBB cannot start in Centos:

@gotwf
Thank you. I just tried that script from Mangolass on CentOS 7 and i have the same error, but on Centos 8, it will run successufully. My only problem is with the managing MongoDB (creation of DB and DB user).

Here is @scottalanmiller's CentOS 7 How To

Thanks

You're welcome.

Too much is never enough, eh?

We now return you to your regularly scheduled programming.

@boston-stanley Might also want to take a gander at your config.json and ensure there are no errors, eh?

fwiw; others have found this tutorial by community rep @scottalanmiller useful:

Jan 28, 2020  /  IT Discussion

Deploying NodeBB 1.13 on CentOS 8 with MongoDB 4.2

NodeBB is a powerful, open source package for building online communities and forums. We usually recommend running it on CentOS 8, primarily because of the need for MongoDB deployment support. The current NodeBB release is 1.13.1. By default, NodeBB uses ...

Have fun!

@bejan The nodebb recommended nginx.conf works dandy. Should you want/need more w.r.t. nginx security related concepts, I recommend raymii.org:

Strong SSL Security on nginx

There are a number of relevant articles there relating to various web server security knobs and tweaks. Apache included.

Have fun down the rabbit hole!

@zandertrek said in Is the PICTURE button outdated in the EDITOR MENU?:

@gotwf said

[The icons] could perhaps use better mouse hover labels?

I've noted for quite some time that PICTURE doesn't accurately describe that button's function. I offer DISPLAY WEB IMAGE as more meaningful.

I concur. Maybe "External Image Link" would be descriptive? Maybe a bit on the long side so maybe edit that down to "Image Link"? Cuz I also guess that said image link may well be to some other image already uploaded.

My $0.02. Ymmv. Peace.

@baris Interesting. I was obviously out in left field, misunderstood the query. Oh well, perhaps not a total fail, @julian ought to get a kick out of that first one...

@zandertrek There exists both the option to upload from users local file system and/or provide a link to something external.

The copy/paste/drag/drop from local filesystem uses the "Upload Image" feature/function while the "Picture" icon employs the link feature. So both are complimentary.

Given the above: No, the icons are not redundant, but could perhaps use better mouse hover labels?

Here is an example resulting from "Upload image" from my local file system:

Here is an example using a link via "Picture", wh/requires a link and optional "alt text":

Clear as mud? Hovering over the images above may help clarify.

Edit: Need to clarify the above a bit: Seems the copy/paste image link also automagically employs the "Picture" function, wh/is same as "Link" chain only it prepends an exclamation point (!) to denote markdown image link.

@aleksei Iirc, there are separate knobs which make certain file extensions private while also outright forbidding others. Which are you tweaking in your screenshot?

@sadaszewski Cool! I do not code js though so no comment as to vetting of such but hey, seems op is into fbsd so must be smarter than the average bear, boo boo!! Now about those picnic baskets...

@phenomlab said in [nodebb-tools] CLI tools for NodeBB management:

I'm going to check these out.

Let us know, eh? Rock on!

P.S.; Obligatory link to Neal Stephenson's In the Beginning Was the Command Line essay. Yes, this is old and dated but still well worth the read for those who have not.