BarryK Tuesday 15th August 2017, 19:15:43

Disappointed by lack of security

Really like the look of this blog. Easy to install, simple to use. I am evaluating it here:

http://easyos.info/forum/

My previous blog was a derivative of PPLOG, a perl script. Well, it still exists:
http://barryk.org/news/

About a year ago, I had to disable comments, as someone attacked my site, posting comments with pornographic links. We implemented various measures in the perl script, but the person persisted. He/she took the time to enter the captchas and got around other barriers.

Flatboard is like our original PPLOG script, just a simple captcha. But it did at least record a username and prevent anyone else from using it. That is quite easy to implement. Quite frankly, your system of username#password is ridiculous. If I post as BarryK#ajd74823e and someone else posts as BarryK#85436es, how are readers expected to remember my hash-code, they will think the second poster is me. So, ridiculous system. You could have just remembered the first poster to use "BarryK" and make that unique. I can then post with BarryK#mypassword, and only BarryK will display, and no one else will be able to use "BarryK".

However, the real problem is there is no protection against spammers. Yes, the captcha will deter auto-spamming, but there are many villains out there who will personally spam a site.
What they want is to get lots of links hidden away in your forum. If they post comments to old posts, will you see that on the front page?

There has to be some kind of identification of the sender. I recently evaluated HTMLy blog, which uses Google or Discus to handle the comments. That works quite well.

Or, implement email verification before accepting a post. Unfortunately, we did that with PPLOG, an automatic email verification system, with blacklisting of email addresses. However, the spammer used throw-away email addresses, a different one each time.
There would have to be manual verification.

Blocking by IP address also does not work, as that can be spoofed.

I will leave Flatboard on my site for as few days, but it has to go unfortunately, unless you have something under development that will improve security, or there is a plugin that I overlooked. Last modified: Tuesday 15th August 2017, 20:18:09