@ron_jeremy said:

As for the hosting, if you're hellbent on hosting it yourself, you're going to want to at least proxy the node.js stuff via Apache or nginx or some other reverse proxy webserver, but that still won't stop it from being easily DoS'ed .....

Here is your red flag. Everyone who doesn't know web development and design in the real world focuses on being DoS attacked. Why? Because it is the cool, scary word that they heard on TV. Wake up to the real world, only a handful of massive websites or really aggravating groups get DoS'd in the real world. This isn't a threat for normal people and normal websites. This is a completely naive thing to be concerned about for a forum of this nature. I run the tech site of the busiest NodeBB forum that we know of (tens of thousands of posts per thread, millions of views on a single thread, nearly a thousand daily posts, over 10K views an hour) and these concerns are quite simply, silly.

This is what a little kid trying to talk about IT sounds like. In the real world, being DoS attacked is not something that happens every day. That takes time and energy and requires someone with a goal. And if you want to protect against it, which I've needed to do, the platform that you run on isn't where that tooling is going to be.

I'd stop talking to this guy.

A little tooting of our own horn, but today is the fifth anniversary of the MangoLassi IT Pro Community which started in 2014 running on NodeBB since day one. Still growing after five years and a great partnership with NodeBB that has done so much to make it all possible for us.

@kinderjaje said:

@a_5mith "we charge $95 USD per hour" that is a quote from Julian, so freelancer i look cant cost that bro. With due respect for everyone works on nodebb and their own values, but for me that is sick price.

That's actually crazy low and I would recommend to the NodeBB guys that they reconsider working for anything so low. They are a unique resource and can do custom work at a rate and efficiency that no one else can touch. No one. I totally understand that you can't afford them, that's not cheap to a home user. But this is Node.js development we are talking about. At $95/hour these guys are literally doing work as a favor.

I work for a consulting firm and if you wanted us to look at this we'd be 50%-100% higher and we don't have the kinds of Node.js and certainly not the NodeBB skills that they have. That's just basic market price. Anyone capable of doing this work is going to be very expensive. Even if you live in a low cost area, Node.js skills are universal so people doing that work there can get paid to work in NYC, London or Toronto remotely or relocated to where the work is.

You can find cheaper people out there, sure. But you can't find better ROI or TCO, I guarantee it.

Up to date on all of ours and working well.

Is this the longest one? We have been waiting to hit the landmark 10K posts. And we just did it minutes ago. Not a very meaningful thread, but epic in length and views (but not the most viewed every, second as far as we know.)

10,000 posts in a single thread

Feel free to pop in and contribute? ML is a technical community so perfect place for NodeBB admins to hang out too! And a great place to push the performance limits of NodeBB.

@kenygamer said in Run two nodebb ionsame server:

@pichalite said in Run two nodebb ionsame server:

@kenygamer you don't know how to run 2 installs of NodeBB on the same server and you are offering installation and support for others for a fee?

Stop scamming people.

Ssshhhh, I'm not hosting two NodeBB's on the same server, that's stupid
I offer a VPS for every installation, i dont host two on the same

Stupid? That's very, very smart. Why would you split up the applications?

@kenygamer said in Run two nodebb ionsame server:

@AOKP Because i dont (yet) have money to afford a big vps

So.... what does that mean for your customers? It only takes a $5 VPS to have many NodeBB instances. Is it that your customers total revenue is under $5? I'm confused. You would have to be spending way too much money to have one VPS per instance, yet you say your are too poor. Those two things don't go together.

MangoLassi is still going strong, after 4.5 years on NodeBB; and they just announced their third annual conference for May. And they just hit a new volume of monthly traffic...

Just saying hey, as we've not been on here a lot for a while, as things have been running so smoothly.

We are nearing our fifth anniversary on NodeBB and we still constantly get compliments that the site is so screaming fast and responsive and makes interacting a pleasure. It's been a great journey so far and we just keep growing.

From a performance perspective, NodeBB is mind blowing. Everyone coming to our forum is always commenting on how screaming fast it is.

@omega said in DO's Firewalls:

Digitalocean offer firewall management. I am not sure how this compares to onboard,

It's an additional protection, not an alternative protection. DO's firewall is the same as any normal LAN edge firewall.

@Sandeep-Bhuiya said in node process CPU usage rises to 100:

This is because probably you're in ddos attack, kindly opt for good ddos protection or use nginx and configure and block those ddos.

This can't really be the issue. It has to be some process spinning trying to do some action for the dashboard.

@Cookie said in Reducing SPAM Posts, But Minimizing False Positives:

Disabled "About me" and "Signature" profile elements as the "Spam Be Gone" plugin does not check these

This, I feel, will help us a lot. We have a lot of bots using this vector and really see essentially no legitimate usage of it.

@crazycells said in Reducing SPAM Posts, But Minimizing False Positives:

@scottalanmiller we have turned "post queue" on for this purpose.

Settings > Post > New User Restrictions

we have set the reputation threshold to 1 , so when a real person joins in we can just give him one upvote and he should be cleared. If not, then we either block or delete them.

I have requested from @baris to add post queue option only for the first post of new users, I believe he already added to the next version. So, wait for it

Additionally, we have Spam-Be-Gone plugin and using actively Re-Captcha by Google at the registration. This might also help to you.

We also have "StopForumSpam" and "Honeypot" keys in Spam-Be-Gone plugin... but I cannot tell 100% if they are acting or not...

Good luck!

I like this idea, but because of the style forum that we are (technical peer review, which often means help in an emergency) we are very hesitant to add any form of delay as that could cause new members to turn away. My current stance is while spam sucks, losing new members sucks more. We clean up the spam very quickly and leave no trace, so the long term ramifications are pretty small.

@PitaJ said in Reducing SPAM Posts, But Minimizing False Positives:

What is your current setup?

Here the post queue is used for all new users. I think the spam-be-gone plugin provides a captcha as well.

We have SBG but are not using many features. Have been hesitant to be too heavy handed, but with our influx of spam, I have to start turning this up. We are doing a re-branding, however, and SBG breaks on the new domain and requires people to use our primary, which is a problem right now.

So, kind of a question about what others are doing. What plugins, settings, and procedures are people doing to reduce potential spam on their NodeBB communities? In the past, the spam rate for us was very low and not a big deal. Now we are under constant spamming and have to delete easily a dozen spam users per day. I know nothing will reduce it to zero, but there is some low hanging fruit that seems like we could discourage.

For us, the big bulk of the spam is automatically created accounts, posting once, without any attempt to look legitimate with nothing but straight links or nearly so going to things totally unrelated to the community (often, plumbing or carpet cleaning services in a different country than the community is based in!) Very odd. Our site's URL is in Europe, our host is in NYC, and the spam always targets Dallas or India! So weird.

Anyway, right now we aren't using any plugins to combat this. We just have moderators who nuke any blatant spam accounts instantly, and who delete spam posts when there is some potential of the person being "real". And we keep up, but there are so many created during the night (US time) that when people start posting in the morning, they tend to see the posts before the mods can eliminate them.

I don't want to go overboard on spam filtering, but would like to make it more difficult for the obviously automated garbage to slow down or stop. The human-backed, or really complex stuff is going to just require humans to filter out for now. Is there a good Captcha option that people like? I'm assuming that "at registration" is where we want to stop people. I know we are talking about how to modify the "About Me" stuff to make that less attractive to spammers, too.

What are others doing? What do you suggest? What hasn't worked? Thanks.

Email is email, so this has nothing to do with NodeBB specifically. So this answer is a pure "general IT" response...

At the end of the day, it is impossible to control email going into someone's spam folder, what does and doesn't go into that folder is at their discretion. It's like asking "how can I guarantee that someone will read my letter that I mail to them?" You can't. Once you deliver the letter, you have to just hope that they will open it and read it, you can't force them.

But there are many things that you can do to encourage email not being seen as spam. First, make sure you are using an enterprise email service. No amount of "good behaviour" from small time email services will get the delivery reliability of the big boys, and even those get marked as spam often.

You can ask your users to whitelist you. But that's just asking them not to let you go to spam, it's up to them.

Make sure you have proper SPF and DKIM records, and that your IP is not on any blacklists, and that you aren't sending any spam or anything that looks like spam from your system. Make sure your domain URL isn't blacklisted. Some incompetent shops check PTR records, too, which is total BS, but as some incompetent people do that, it can help to have a "proper as they incorrectly see it" PTR set for your email server, too.

That's about all that you can do, all anyone can do. For any email, for any purpose.

@psizzles said in Looking to create a simple voting application with a live audience:

Hi All,

I am looking to create a voting app. for a live demo. The audience will have three choices to pick from a bit.ly url from their phone.
Only I will be able to see the overall results submitted. Would it be possible to get the ip addresses of the people who have voted? Is there a sample app. I can reuse?

Thanks!

Inside of the forum?

@srinik said in How to Add rel="nofollow" to Links?:

But, you know as per SEO one should use nofollow tag for unnecessary links.

What's an unnecessary link? I think that the best approach is to eliminate unnecessary links, rather than linking and then trying to hurt their SEO after having utilized them as a reference.

@revir said in How to Add rel="nofollow" to Links?:

If you want to promote something, you should use the widget to add html code to that page, or write a template. Like what I did for my website, see the footer of the page, there are a lot of outgoing links, the crawler can index those.

Why link something that you don't want to promote? Seems like odd behaviour. Your are promoting it, but then get spiteful? I can understand some very specific moments that something might need to be linked quietly and there is no intent for people to visit the page. But by and large, if someone is promoting something, pretending that they are not is weird. If you truly don't want it to be promoted, just don't link it.