i would like to suggest to change this smf forum style , because its really simple as it calls itself also its just make u feel u r in the old ages of the forums (about 2009 or so).
so i have got an idea of changing it to another open source free one called discourse
our new discussion platform, a place where you can hang out and talk about Ubuntu.
Ask Ubuntu, the Ubuntu Forums, and project mailing lists are where we do our tech support. We recommend those sites for questions about how to configure and use Ubuntu. This is a place where you can share screenshots, talk about your favorite desktops and tools, and generally hang out with your Ubuntu friends in a friendly, relaxed environment.
So I am not sure it’s meant to be and/or capable to replace a tech support forum.
Now that Whonix smfforum is all set up…
Especially worry, that we still have proper categories.
Hey @Patrick, I’m curious – what are your thoughts on Discourse after 3 years of use?
usability: awesome
stability: good
antispam: awesome
javascript dependency: bad for security related project
security: no opinion
My org is looking at using Discourse, but I saw a huge red flag when skimming their install guide, which included the command:
wget -qO- https://get.docker.com/ | sh
Really bad indeed.
Many if not most popular webapps are similar to that. If you choose to
only use these with best security practices, you’ll be severely limiting
usability, thereby productivity, thereby the overall success.
There would be a command which makes it partially more secure.
^ After seeing a project say that, I’m tempted to discount any claims that they “take security very seriously” as mere security theater.
I’d very much like to hear the perspective of the security-focused Whonix team on the security (and other aspects) of self-hosting Discourse.
Package manager security, file verification security and other auxiliary
attack vectors such as clock related security issues are not on the
radar of many even security focused projects. For example hardened
gentoo goes serious about enabling security hardening compile flags but
then is sloppy about package manager security.
Should uncheck / remove / disable allow_username_in_share_links once that becomes available in the stable version of discourse so username isn’t added to the link when using the forum’s “share a link” feature.