UseBB Community

As a result of recent attacks on the registration system, it has come to my mind that the security on this part could be much better. Therefore, I introduce rProtect, a system/project that should make UseBB more secure, similar to YaBB's Guardian.

Especially on the registration and anonymous posting part, this implicits:

- save the IP address upon registering (using a central logging functionality);
- reject more than one registration attempt from the same IP in x minutes/hours;
- blacklisted open proxies should be banned by default;
- captcha (visual confirmation) enabled for registering and anonymous posting.

All these should at least be available in the first public version of UseBB 2. Additionally, some of these features could become available for UseBB 1.0 or a later 1.x version (thus we might make an exception on the roadmap). As security is important, these features have a higher priority than others.

Note: we are not saying UseBB is insecure in general, but it is, just as other forum softwares, vulnerable to abuse (without any hacking or cracking involved). That's what we want to prevent with this project.

Any comments, suggestions, additions, etc are welcome.

The following security features have been implemented into 1.0 RC1:

- DNSBL powered banning (*nix only);
- Registration logging (logs username, email address, IP address, hostname, browser, session start and number of pages);
- Never activated members can be hidden from the member list and statistics;
- Email address validation by looking for DNS MX records on the domain name (*nix only);

All these features can be disabled seperately.

Have you checked your weblog? I have linked my idea there. Please feel free to implement my mod_rewrite-based protection system.

If you haven't read it yet, you can also check-out my: My Weblog. Search for the "Comments Post Rewriter Plugin". :-)

Sorry for the late update, an answer was given on my blog. I suppose you have noticed it already.

I cannot open ur blog . Its so slowly .

Since Askimet has an API available what do you think about that being integrated to usebb Dietrich?

Akismet is on the TODO list for 2.0.0.

Cool, I guess i should have looked, sorry

More updated information on rProtect can be found in the introduction PDF document on the development mailing list.