Just an update to note that I've bailed on SmartOS and PostgreSQL due to too many bumps in the road in favor of sticking with a well supported platform. Which pretty much translates to: "what the dev heads are using...".

I use fbsd for our in house stuff that I keep updated via build server and internal lan. When I need cloud scale smartos or linux are the best options. To wit I have not even tried fbsd and pgsql so cannot weigh in there.

Thanks for all the insights. I'll probably be back to bug ya' before too long.

o/

@scottalanmiller said in Which is better NodeBB or Discourse?:

@Joykiller said in Which is better NodeBB or Discourse?:

I personally hate Discourse due to their docker wrapper. but thats me.

Oh gosh, that would pretty much turn me away right there. Docker is great for devs, but makes little sense for production operations. Tends to come from shops that are run by devs and have little operational knowledge or experience. We just had a discussion about that last week in our forum: https://mangolassi.it/topic/19577/docker-for-production-use-of-third-party-software/

Docker is for lamers who don't know how to be system admins

And, of course, rapid development. When Docker first started making it's appearance I embraced it but was later aghast when folks started routinely deploying to production, and predicted to some buddies that some security nightmares were just around the corner... And they were.

But enough Docker bashing. I looked at Discourse long, long ago, in a far away galaxy (well, in Internet time, anyways). Ruled it out right away for following (admittedly highly opinionated) reasons:

• Docker centric: Now that I am primarily only on my own projects, I am free to abandon Linux in favor of what I consider to be superior OS's like FreeBSD and SmartOS. Nothing personal but platform lockin equates to vendor lockin. And that just ain't freedom enough for me

• Rails vs. NodeJS: Are you kidding? Was an early adopter of Rails back, circa 2003/4 or so? It rocked at that time as an alternative to then php stuff sporting the serious security hole of the day/week. Or so it seemed - php was pretty sketchy for a while there. Fast forward a decade and a half and it's freakin' no contest! Rails is all but history/legacy, at least in my mind.

• Main Dev Heads: Cool vs kind arrogant asshats (sounds like that may have changed). This was immediately off putting and I was kind of surprised Discourse became so popular, but I guess that's one thing fame will help you with.

So... note to the NodeBB devs:

Please do keep doing what YOU do best and do not worry too much about feature parity w/what, in my view, is an inferior, non starter platform just because they've got a few extra bells, whistles, and/or mindshare. Popularity more oft than not does NOT equal technical superiority but rather merely demonstrates whos' the better con men. Err.. marketing team....

Now obviously I do not mean to preclude a bit of cross pollination when it makes sense. But I have been around long enough to observe FOSS project loose their vision in the quest for "Feature Parity" with some perceived competition. So, just weighing in w/my $0.02 to encourage you to stay true to your vision. Cuz it's been workin' pretty good fer' me ;D

And finally, in closing, the astute may have noticed I enjoy making tongue in cheek comments from time to time for the humor value. Don't get yer' beak too tweaked, eh? It's not a religion for me.

Much thanks to @scottalanmiller for the advice and an embarrassing amount of hand holding. I'm now rocking an nginx tls proxied nodebb sporting Centos7, mongodb, and redis for session management.

I'm curious to know if any nodebb gurus are serving up nodebb via nginx https enabled reverse proxy and using modsecurity?

@crazycells

Although I cannot imaging running NodeBB on one of their $5/mo. rigs Maybe for ten users?

@zaasmi said in Which is better NodeBB or Discourse?:

With vastly more people becoming aware of privacy concerns, ever more increasing numbers of people transitioning to VPN's, along with the plethora of free VPN providers coming online nowadays, one take any such stats with a large dose of salt, eh?

One reason I put little to no stock in "analytics". These days.

So rather than just bitch about it, I spun up a freshie SmartOS (18.3) instance and endeavored to install NodeBB as per explained via docs that are admittedly a bit dated here: https://docs.nodebb.org/installing/os/smartos/

Prior to 1.10.2 these worked dandy (adjusting fer' some updatin').

Alas, not any more. v1.10.1, enter, stage left, sharp:

./nodebb setup starts spewin' about sharp, wh/tracks back to libvips, wh/does not seem to exist in Joyent's SmartOS pkgsrc (used by smartos, netbsd, dragonflybsd, etc.) repos. So, uh, the fallback to build from src flails about, thrashing mesirably in futile efforts to resuscitate itself... but I digress.

Hence the wannabe NodeBB on SmartOS innocent must either do some crunchin' and a munchin' of libvips src else nag OhJoy's pkgsrc team, eh? Fun, fun, fun ;-/

I suppose I should investigate v1.10.2 on FreeBSD, eh?

Alrighty then! We now return you to your regularly scheduled programming.

Rock on o/

P.S.; I saved logs but as this appears to be a sharp/libvips/nodejs on SmartOS issue I didn't figure y'all would be too intrigued. Peace, out o/

Heh, evidently I stand corrected about DO and NodeBB. Used DO stuff early on (but not for NodeBB). They then became very popular and I saw significant increases in cpu usage without any commensurate increases in load. Boosted a couple droplets up a notch. Didn't do much. Spun up a virgin node and saw cpu loads into 2.x to low 3.x's just idling on my ssh connection. I bailed to a different provider and have not checked in with them in years. Maybe a scale/infrastructure growing too fast issue?

In any case, good that you can get it sorted for minimal costs.

@scottalanmiller said in Which is better NodeBB or Discourse?:

But there is an ecosystem of being behind the times, and not thinking through how the technology is going to play out once you actually want to deploy.

Indubitably. Hitting the nail square on the head here.

fwiw:

For the few, the brave, who may be interested, I built libvips pkgsrc port for SmartOS. It works in my testing and I expect it will be merged upstream so binaries should be coming.

So now I can install nodejs sharp dependency and run nodebb again.

Nice ;D

P.S.; This is w/nodejs-10.11.0, and yes, it does also need zlib.

@julian Yeah, I was thinking more of the Nginx Plux vs. Nginx Open Source duality. Too often such results in major split personality disorders wh/end up essentially forcing extortion to even get access to any reasonable docs or support.

Nginx woes are still unclear. My concern is that if the bad actors succeed in their claims, then the license itself may be declared null and void. I can imagine this then leading to a scenario where "might makes right" and any forks then become their next targets. Crazy stuff happens in the US Federal Courts these days, particularly a certain district court in Texas, which has a well earned reputation for being very pro corporation in its rulings. Some towns thrive on industry, others eco tourism, etc. That TX town's niche is rich corporate lawyers dumping buckets of cash into the local economy.

Anyways, I am still curious as to community reports regarding Apache deployments, as I have not used it in many years now.

NodeBB rocks and is one of the best pieces of FOSS this ol' dinosaur had the pleasure of using. Keep up the great work.

Received a bit of a perplexing email recently from Nginx:

We always strive to be transparent with you, our valued customers, and we are committed to keeping you updated on relevant business developments. While this is a developing situation, and we are currently trying to ascertain what prompted it, we wanted to share with you the facts we have.

On December 12, law enforcement officials came to the Moscow office of NGINX (acquired by F5 Networks earlier this year) apparently seeking evidence related to an intellectual property dispute, to which F5 is currently not a party. The officers had a warrant, and we are still working to confirm the full
nature of the investigation. NGINX cofounders Igor Sysoev and Maxim Konovalov were interviewed by law enforcement officials, but no employees have been arrested or are currently detained. F5 fully supports our employees and we believe these claims against them do not have merit.

Promptly following the event we took measures to ensure the security of our master software builds for NGINX, NGINX Plus, NGINX WAF and NGINX Unit—all of which are stored on servers outside of Russia. No other products are developed within Russia. F5 remains committed to innovating with NGINX,
NGINX Plus, NGINX WAF and NGINX Unit, and we will continue to provide the best-in-class support you’ve come to expect.

We will keep you updated on developments, as appropriate, and please reach out if you have further questions.

We deeply appreciate your continued support of F5.

After my initial WTF? I did a bit of digging and found a ZDnet article here:

Russian police raid NGINX Moscow office

tl;dr- This seems to ultimately be a patent/intellectual property lawsuit wherein new owners claim they own all of Nginx code.

I have used Apache alternatives for decades now and embraced Nginx early on. Dual licensed FOSS projects have always been cause for concern for me, as they all to often result in somewhat sordid histories resulting from losing control to the bean counters and various sociopath CEO types bending others to their will.

Rather than speculate on just what is really going on from a less than forthcoming commercial operation I am thinking maybe it is time to switch back to a real FOSS, no strings attached webserver like Apache.

Interested in hearing others' thoughts, particularly those who are presently using Apache.

Also, docs.nodebb.org is your friend

Running NodeBB - NodeBB Documentation

@evgenymagata said in May Docker Discussion:

I can't believe you guys are having this discussion in 2019. You do realize that virtualization and containerization have become a standard tool nowadays, right? A lot of you sound if you got stuck somewhere in 2010 technology.

Well, seeing how unix technologies are a decade or two ahead of Linux, I guess we still got a pretty comfortable lead...

Put something other than Docker thru it's paces and then come back and talk. But most of the arguments have been made already above.

@julian said in May Docker Discussion:

Is it worth the overhead? That's up to you... I like tinkering with my servers, personally. Pretty soon it'll be a lost art.

Yep. And those of us who still have a clue or two will smile with quiet confidence because we actually understand wtf is going on with our stuff.

@evgenymagata Maybe the person who built your prefab Dockerized container knew what they were doing. Maybe "quick and dirty", management needed it yesterday and doesn't give a *#@ is the reality at hand. Maybe not.

Different itches need different scratchin'..... By all means, enjoy your Docker but please, please, please don't fool yourself into think that it's some kind of superior master ring to rule them all, eh? Cuz until you outline your priorities and use case it's all just a religious war.

@djensen47 I did take a quick gander - looks like it drags in a bunch of Google depends. Not everybody is keen on the Goog these days.

Be that as it may; You did not actually answer my question. I don't have a big issue w/forum spam and the stuff I do have enabled seems to be coping. Knock on wood. The few addresses I did check were flagged by each, the bad was missed by each, although emailrep.io seems to be a fair bit more aggressive in giving somewhat dubious reps to known clean addresses. Hence my initial impression based on an admittedly very short look does not leave me particularly enthused as I'd prefer to risk false negatives than false positives.

So, I would be curious to know just what "niche" this targets. Not that having more options is not a good thing. I would be curious if you have done any compare/contrast evaluation on your end cuz I am open to new data. And if it's cool mostly because it's new and offers promise then that is okay too.

Edit: Heh, now I neglected your question and that you need to ask it pretty much answers mine about the testing on your end. I'll have to refresh my memory on that and get back to you, else probably some staff has it off the top of their head sooner...

@julian If so, please give me a knob for opting out of the additional stuff. Which seems to be nodebb's approach in general w.r.t. stuff like this and just dandy by me.

@djensen47

Could be useful. But... one must remember that whenever anything is automated via AI that one is also opening up potential for that AI to be gamed.

I would be opposed to any automatic reputation points. Reputation should be earned via feedback from the community at large, wh/imo is generally the best vetting.

I've not done much with the "Stop Forum Spam" nor "Honeypot" plugins. What would emailrep.io bring to the party?

@roy-miller

Well, maybe you don't get precisely the option you prefer baked in but you may want to explore the alternatives, wh/at the least provide something rather than a blank "No one has replied". I favor the "Last - Show the latest post, including original post, if no replies" variant, wh/displays a leadin teaser snippet from the original post if no replies. Teaser is aptly named as provides a "taste" of what the thread may be about.

Otherwise... I gots nothin' for ya.... Good luck!

Maybe not a lot of interest in this due to complexity of deploying/configuring ModSecurity, combined w/absence of nodebb stack specific rulesets. Security is difficult so not much can be done about the deploy/config aspects but ModSecurity devs are starting to focus some efforts on the latter.

For those interested, and willing to roll up their sleeves, development of node.js targeted attack ruleset is slated for next release of OWASP CRS, scheduled for Sept. 2019. More info here:

https://github.com/SpiderLabs/owasp-modsecurity-crs/pull/1487#issuecomment-519071541

P.S.; Obviously ModSecurity can be deployed on Apache setups as well but my sense is that Nginx is the overwhelming favorite w/the nodebb community and I didn't want to start a new thread.

lifeforms created this issue in SpiderLabs/owasp-modsecurity-crs

closed some node.js unserialization + javascript RCE snippets #1487

@roy-miller

Not sure about the first. Did you do a "nodebb update" prior to the restart?

As for the second: ACP -> Settings -> Post. Set "Teaser" to suit.

Good luck!

Caught a Netflix Original Red Sea Diving Resort recently. Based on true story. Besides that you pretty much got to check out anything Ben Kingsley. Pretty good.