Live data from Hacker News

Show HN: Orange Forum – Web 1.0 style forum written in Go

goodoldweb.com

41–50 of 178 posts

Re: Show HN: Orange Forum – Web 1.0 style forum written in Go

#42
The term "Web 2.0" is an unfortunate choice and as a consequence it has been rarely used correctly. Funny enough I've been to a Web 2.0 Conference about 10 years ago where almost every speaker used it incorrectly.

Web 2.0 has nothing to do with a technical revision or change in the Web. It was used by Tim O'Reilly back in 2004 (and became popular) and refers to the rapid change in the way the web is used, more specifically the switch from static web to user generated content.

I'm sorry but your forum is all about UGC, and AJAX has nothing to do with Web 2.0.

Re: Show HN: Orange Forum – Web 1.0 style forum written in Go

#43

I built a forum from scratch once and it is a comical amount of work. The initial CRUD weekend-ware is straight forward. LIMIT/OFFSET for pagination. Throw in some Markdown support. Seems easy enough. But the devil is in all the individual features that make a forum usable. Like getting notified when someone @mentions or replies to you, marking threads that you've posted in, tracking the high watermark per user per t…

I've had certain forum software sometimes as a side project, sometimes as my man full time project, during the last 7 years. So yes there's lots of work. But in my case lots of time was "lost", in learning web development / React.js / Angular / Dart / other stuff, and porting from the-wrong-technology, to another the-wrong-technology, and building the wrong things that no one wanted.

I think the Discourse (forum software) team were a few people, like, 3? and they spent some year(s) developing the initial version of Discourse. So ... yes some weeks/weekend? for the initial version, and ... >= 3 years ? for a "real" version :- P

Is your software anywhere online, e.g. GitHub?

Re: Show HN: Orange Forum – Web 1.0 style forum written in Go

#44
post #21
post #13

I'd recommend you to use Argon2 instead of bcrypt for storing password. It has won the Password Hashing Competition last year and is the recommended way to store passwords. Bcrypt is not bad but it could be used with insecure parameters while Argon2 does not have insecure parameters. The way you create cookies is also insecure, you should be using crypto/rand instead of math/rand AND rather hex.EncodeToString() the r…

The math/random point is well taken. The hex.EncodeToString() point is a nit. Generate 128 bits of randomness, and then encode it however you'd like. The track record of people trying to get "generate random numbers in the alphanumeric range" isn't great; it's an opportunity to reintroduce bias. Start with a random token of sufficient size, then encode. The Argon2 vs. bcrypt thing is unhelpful. It does not matter wha…

Where do you think Argon2 should be present before it is considered to have good library support? AFAIK, it is in libsodium, debian, ubuntu, and other distros.

And I think one can also make mistakes with scrypt when choosing parameters which Colin himself acknowledged. So isn't it time to go ahead with Argon2?

Re: Show HN: Orange Forum – Web 1.0 style forum written in Go

#46
post #44
post #21

Earlier quoted context omitted.

The math/random point is well taken. The hex.EncodeToString() point is a nit. Generate 128 bits of randomness, and then encode it however you'd like. The track record of people trying to get "generate random numbers in the alphanumeric range" isn't great; it's an opportunity to reintroduce bias. Start with a random token of sufficient size, then encode. The Argon2 vs. bcrypt thing is unhelpful. It does not matter wha…

Where do you think Argon2 should be present before it is considered to have good library support? AFAIK, it is in libsodium, debian, ubuntu, and other distros. And I think one can also make mistakes with scrypt when choosing parameters which Colin himself acknowledged. So isn't it time to go ahead with Argon2?

No. Use Argon2 if it's convenient to do so. Not using Argon2 isn't a security flaw.

People have weird ideas about the importance of picking password hashes. It's important not to use non-password-hashes. Other than that, which password hash you use? Not so important.

Re: Show HN: Orange Forum – Web 1.0 style forum written in Go

#47

The old style forums are showing their age and need to be modernized but not abandoned. See the Archlinux forums based on Fluxbb. It's fast and effective. The newer ones led by Discourse, Nodebb and Flarum have completely gone in another direction in reinventing how discussion forums should be and perhaps gone too far. They feel strangely 'rootless' and completely lack the 'community feel' of user forums. This looks…

The UIs on those three should be dialed back (animation, JS), but Discourse is pretty good otherwise.

I've looked at all three:

* Flarum had nausea-inducing animation, and now it overrides natural scroll behavior. (Please never do that to users.)

* NodeBB had some problems when I was using it. If JS is disabled, even the homepage links don't work. Forums should be server-rendered.

* Discourse could be improved by removing most of the animation and Material Design creep (bad for motion accessibility), but other than that, it's the best at the moment. It would also be nice to have easier, full theme customization. Maybe it's in there somewhere, but I haven't found it yet.

I would like to see forum software that has the feel of classic forum software (like Flux), not in PHP, that is server-rendered, with a very minimal default theme (no animation) and minimal JavaScript, and that has many of the modern features of Discourse.

Re: Show HN: Orange Forum – Web 1.0 style forum written in Go

#48

The old style forums are showing their age and need to be modernized but not abandoned. See the Archlinux forums based on Fluxbb. It's fast and effective. The newer ones led by Discourse, Nodebb and Flarum have completely gone in another direction in reinventing how discussion forums should be and perhaps gone too far. They feel strangely 'rootless' and completely lack the 'community feel' of user forums. This looks…

The UIs on those three should be dialed back (animation, JS), but Discourse is pretty good otherwise. I've looked at all three: * Flarum had nausea-inducing animation, and now it overrides natural scroll behavior. (Please never do that to users.) * NodeBB had some problems when I was using it. If JS is disabled, even the homepage links don't work. Forums should be server-rendered. * Discourse could be improved by rem…

I guess this is as good a time as any to mention that something like that exists (and to toot our team's work over the years):

I started the project years ago and in the last few have gotten really great support from glebm and some others to get it to the point where it's a really lovely, stable, and fast piece of work.

We consider it the best Ruby/Rails-based alternative to Discourse out there (as an aside - wewere honored that Ryan Bigg would point people our way when he stopped maintaining Forem[1])

You said:

  √ I would like to see forum software that has the feel of classic forum software (like Flux)  
  √ not in PHP  
  √ that is server-rendered  
  √ with a very minimal default theme (no animation)  
  √ and minimal JavaScript  
  √ and that has many of the modern features of Discourse.
I think those check out. In any case I suggest you check out the website[2], the repo[3], and the demo[4].

[1]: https://github.com/rubysherpas/forem#no-longer-maintained

[2]: https://thredded.org

[3]: https://github.com/thredded/thredded

[4]: https://thredded.org/thredded/

Post reply on HN