@scottalanmiller said in Which is better NodeBB or Discourse?:

@Joykiller said in Which is better NodeBB or Discourse?:

I personally hate Discourse due to their docker wrapper. but thats me.

Oh gosh, that would pretty much turn me away right there. Docker is great for devs, but makes little sense for production operations. Tends to come from shops that are run by devs and have little operational knowledge or experience. We just had a discussion about that last week in our forum: https://mangolassi.it/topic/19577/docker-for-production-use-of-third-party-software/

Docker is for lamers who don't know how to be system admins

And, of course, rapid development. When Docker first started making it's appearance I embraced it but was later aghast when folks started routinely deploying to production, and predicted to some buddies that some security nightmares were just around the corner... And they were.

But enough Docker bashing. I looked at Discourse long, long ago, in a far away galaxy (well, in Internet time, anyways). Ruled it out right away for following (admittedly highly opinionated) reasons:

• Docker centric: Now that I am primarily only on my own projects, I am free to abandon Linux in favor of what I consider to be superior OS's like FreeBSD and SmartOS. Nothing personal but platform lockin equates to vendor lockin. And that just ain't freedom enough for me

• Rails vs. NodeJS: Are you kidding? Was an early adopter of Rails back, circa 2003/4 or so? It rocked at that time as an alternative to then php stuff sporting the serious security hole of the day/week. Or so it seemed - php was pretty sketchy for a while there. Fast forward a decade and a half and it's freakin' no contest! Rails is all but history/legacy, at least in my mind.

• Main Dev Heads: Cool vs kind arrogant asshats (sounds like that may have changed). This was immediately off putting and I was kind of surprised Discourse became so popular, but I guess that's one thing fame will help you with.

So... note to the NodeBB devs:

Please do keep doing what YOU do best and do not worry too much about feature parity w/what, in my view, is an inferior, non starter platform just because they've got a few extra bells, whistles, and/or mindshare. Popularity more oft than not does NOT equal technical superiority but rather merely demonstrates whos' the better con men. Err.. marketing team....

Now obviously I do not mean to preclude a bit of cross pollination when it makes sense. But I have been around long enough to observe FOSS project loose their vision in the quest for "Feature Parity" with some perceived competition. So, just weighing in w/my $0.02 to encourage you to stay true to your vision. Cuz it's been workin' pretty good fer' me ;D

And finally, in closing, the astute may have noticed I enjoy making tongue in cheek comments from time to time for the humor value. Don't get yer' beak too tweaked, eh? It's not a religion for me.

@rivalite said in nodebb allows users to change the skin and save this appearance?:

.. snip...

Hello, I just discover nodebb.
I have a few questions:
1.nodebb allows change the skin like Discourse?

Admin Control Panel -> Appearance -> Themes/Skins.

Four themes shipped. Sixteen or so skins.

2.Also, I just realize nodebb uploaded my image attached to this post, to imgur. I have to pay on imgur or somewhere for this feature?

No. You can host your images locally. Offloading to imgur is a possibility, but not necessity.

3. is there a free spanish translation?

No clue.

4.how many free skins are available?

No clue. Sixteen included w/default install. At least on 12.x

5. Is it possible migrate from xenforo 2.x ?

Probably. But likely to be a headache for the uninitiated. You may want to explore contracting some expertise.

6.I just signup here using an email from https://temp-mail.org/ . Is there a spam filter to don't allow users signup with https://temp-mail.org/ ? This spam filter is free?

No clue w.r.t. temp-mail.org. NodeBB does include some more generic protections. See e.g. nodebb-plugin-spam-be-gone.

Thanks so much!

You're welcome. Enjoy!

Just an update to note that I've bailed on SmartOS and PostgreSQL due to too many bumps in the road in favor of sticking with a well supported platform. Which pretty much translates to: "what the dev heads are using...".

I use fbsd for our in house stuff that I keep updated via build server and internal lan. When I need cloud scale smartos or linux are the best options. To wit I have not even tried fbsd and pgsql so cannot weigh in there.

Thanks for all the insights. I'll probably be back to bug ya' before too long.

o/

Spot on Julian. You have discovered something many have known for decades but lacked the discipline and/or capability to practice in ever increasingly hectic world full of deadlines, phb demands, etc. Be interesting case study to observe uptake now that it has a cool name. Seriously.

I shall echo your sentiments wholeheartedly. Wanna really bend yer' noodle? Go smart phone free for a few days. Then a week.... Semi retired here and not carried one for a few years now. Very liberating to be free and I have had more than a few confide that they envy me. Having recouped more time you now have time to make plans, think creatively, etc.

It has long been a personal mantra of mine to read some print material regularly. Internet only tends to make one's concentration a bit too hyper after a period. Yer' brain needs longer articles and chapter books.

Try it. You might like it.

Much thanks to @scottalanmiller for the advice and an embarrassing amount of hand holding. I'm now rocking an nginx tls proxied nodebb sporting Centos7, mongodb, and redis for session management.

I'm curious to know if any nodebb gurus are serving up nodebb via nginx https enabled reverse proxy and using modsecurity?

Awesome.

Thanks bunches for this.

I should clarify that by "core" I actually meant core supported modules/functionalities packaged and supported as part of the base release. Poor choice of wording on my part. I am happy a camper. This would be icing on the cake for me.

@djensen47 I did take a quick gander - looks like it drags in a bunch of Google depends. Not everybody is keen on the Goog these days.

Be that as it may; You did not actually answer my question. I don't have a big issue w/forum spam and the stuff I do have enabled seems to be coping. Knock on wood. The few addresses I did check were flagged by each, the bad was missed by each, although emailrep.io seems to be a fair bit more aggressive in giving somewhat dubious reps to known clean addresses. Hence my initial impression based on an admittedly very short look does not leave me particularly enthused as I'd prefer to risk false negatives than false positives.

So, I would be curious to know just what "niche" this targets. Not that having more options is not a good thing. I would be curious if you have done any compare/contrast evaluation on your end cuz I am open to new data. And if it's cool mostly because it's new and offers promise then that is okay too.

Edit: Heh, now I neglected your question and that you need to ask it pretty much answers mine about the testing on your end. I'll have to refresh my memory on that and get back to you, else probably some staff has it off the top of their head sooner...

@julian If so, please give me a knob for opting out of the additional stuff. Which seems to be nodebb's approach in general w.r.t. stuff like this and just dandy by me.

So rather than just bitch about it, I spun up a freshie SmartOS (18.3) instance and endeavored to install NodeBB as per explained via docs that are admittedly a bit dated here: https://docs.nodebb.org/installing/os/smartos/

Prior to 1.10.2 these worked dandy (adjusting fer' some updatin').

Alas, not any more. v1.10.1, enter, stage left, sharp:

./nodebb setup starts spewin' about sharp, wh/tracks back to libvips, wh/does not seem to exist in Joyent's SmartOS pkgsrc (used by smartos, netbsd, dragonflybsd, etc.) repos. So, uh, the fallback to build from src flails about, thrashing mesirably in futile efforts to resuscitate itself... but I digress.

Hence the wannabe NodeBB on SmartOS innocent must either do some crunchin' and a munchin' of libvips src else nag OhJoy's pkgsrc team, eh? Fun, fun, fun ;-/

I suppose I should investigate v1.10.2 on FreeBSD, eh?

Alrighty then! We now return you to your regularly scheduled programming.

Rock on o/

P.S.; I saved logs but as this appears to be a sharp/libvips/nodejs on SmartOS issue I didn't figure y'all would be too intrigued. Peace, out o/

@baris Have we given any thought to the havoc such could wreak on the Internet at large when an admin account becomes compromised? Maybe not such a bad idea to enforce some minimal delay?

@jag I have not used Ubuntu in some while and unfamiliar w/current defaults as I favor OpenBSD and pf for firewall/routing duties. Also do my own cloud stuff and no clues about Google Cloud so others will be better than I in those departments.

A couple suggestions:

1. Since you are using nginx, tune your config.json to limit nodebb to localhost. NodeBB Config Docs are your friend. Here is the snippet you want:

"bind_address": "127.0.0.1"

2. Although NodeBB does have some builtin protections, you may also want to explore implementing something like Fail2Ban to help keep the miscreants at bay.

Glad to hear you are up and running. Now the real adventure begins. Have fun.

@jag Let's rule out some low hanging fruit:

1. What happens if you bypass nginx and connect directly to port 4567?

   If this is running on a remote vm you (hopefully) need to tweak your firewall rules to allow connection to that port, which you should further limit to only the ip address you will be connecting from.

2. Check permissions and ownership on your nodebb directory. Did you create a dedicated nodebb user? Perchance did you install nodebb as root? Subsequently then try to launch as mortal user?

3. Presuming all of above is fine, login/su to your nodebb user and try rebuilding and (re)starting nodebb

    ./nodebb build && ./nodebb -l (re)start
   

4. The gurus here will likely inquire as to your nodebb's config.json so if none of above helps you may want to "sanitize" any private/sensitive bits and post that up. In particular, ensure the url in config.json matches your nginx server_name parameter.

Well looks like I was an ID10T on this one. npm install pulls the original Annihil version cuz that is where package.json tells it to grab it from.

1. Manual installation of Julian's/NodeBB 3rd Party forked version, available here: https://github.com/NodeBB-Community/nodebb-plugin-email-blacklist

2. Coupled with my URL query string update above and ... voila! Now works dandy w/both manually added addresses and istempmail.org API key.

The function isTempMail's path var needs to be thusly:

path: '/api/check/Your-API-Key-Here/' + email

Or maybe I neglected the trailing slash first time around. In any event, geronimo, there ya' go.

And maybe make a backup copy of your mongodb data dirs (while it is not running) and stash it somewhere safe before mucking about too much further.

@oplik0 This would be cool but those algos are still relatively untested by time and not seem to be percolating into much use/support. Been waiting on that to change for a while now.

Meanwhile back at the farm, I trust bcrypt pretty well because I have high regard for OpenBSD, wh/has used blf-crypt to hash /etc/password since... ever since I can remember. Not kept up w/any of this though so I may well stand corrected.

@Akito Holy, holy, guacamole! I guess I misread your initial post. Mea culpa!

I seem to recall bcrypt supports max rounds of 31. Since you got all that power to spare, maybe test with 31 that and see if it works, just as curiosity.

@Akito Well.... the devs had to pick something. And were likely on lappies sporting corei7's that did not notice it. As contrasted with a more minimally provisioned cloud vm? But thankfully cool enough to make it something you can tune to your needs rather than hard coded.

fwiw; Not something I have experienced but also not running on a minimally provisioned vm. Care to share details? Cuz if you have a lot of horsepower behind it them maybe I am out in left field here? Does setting it to lower (as contrasted with removing entirely as mentioned above) e.g. 7, help?

Not a cryptographer so unfamiliar off top of my head w/bcrypt default if left unspecified.

@sharonyue Ha! Was suspicious of the ipv6 stuff. But seems likely more to do with plugin's Solr version compatibility. Would be nice if someone more knowledgeable than I could help tease this out.

In any event, glad you got it sorted! And now that you have, I would be interested in follow up reports as to Solr's effectiveness, especially compared and contrasted with NodeBB's builtin search. I am guessing you are preferring Solr due to better multilingual support?

Enjoy!

@iclou said in Upload of pdf files not working:

I have configured "allow users to upload any file"

I might be wary of allowing users to upload any type of file. Might suggest you restrict this a bit more unless you have a real use case for any and all file types, sans any restrictions.