The tor project lacks web forums. this is an easy way to interact with users. talking to someone on the phone was great, but not wasting time and being able to read a forum would be helpful.
I'm re-opening this after some feedback from a few people who really think we should try this forum thing. I'd like to simply host this somewhere else, see how it grows, and worry about a migration plan when the time comes. duckduckgo likes zoho, https://duck.co/, i'll ask them how it's going and make a plan from there.
Trac: Status: closed to reopened Resolution: wontfix toN/A
I've wanted to give it a try too so I'd be happy to help. Doubt it's useful but I still have the phpbb instance I set up for this somewhere around a year ago...
http://forum.atagar.com/
I'm kinda partial to those topics so hoping so see something similar if we go with zoho. Cheers! -Damian
I've wanted to give it a try too so I'd be happy to help. Doubt it's useful but I still have the phpbb instance I set up for this somewhere around a year ago...
http://forum.atagar.com/
I'm kinda partial to those topics so hoping so see something similar if we go with zoho. Cheers! -Damian
How much do you feel like running the forums? I'm happy to go with you rather than others. Does more traffic cost you money? Can we buy a cert to make it https all the time? What else is needed to make it a valid beta test? hidden service access? phpbb attack attempts?
The reason that both the forum and arm's site lacks ssl is that Dreamhost has a fee for getting a static ip, and that's a requirement for their ssl setup. It isn't much so I should stop being lazy and just do that and get a cert.
What else is needed to make it a valid beta test?
The only steps that come to mind are...
Make it look nicer. I didn't do anything more than set up a stock phpbb instance so I should dig into the themes...
Figure out who on tor-assistants@ is interested in moderating. I'll ping the list tomorrow.
Send a notice to tor-talk@ when we're ready.
Maybe add a link to the site? I have mixed feelings - we want this to be an experiment where we can trivially pull the plug but on the other hand its primary worth is as a support forum so it needs to be discoverable by first time users. Thoughts?
hidden service access?
This would be problematic since dreamhost doesn't allow tor on its shared hosting (you need to buy a vps). If we get ssl set up then wouldn't the only advantage to a HS be avoiding the certificate chain of trust or are there other benefits?
phpbb attack attempts?
I'm under no illusion that phpbb has anything but a horrible security record. Given the option I'd opt for different forum software on a dedicated VM somewhere. However, for a beta this should be fine (it's the quickest/easiest thing to set up and the most mature forum option). If it really takes off then we can look into investing effort into a better setup.
I'm kinda hoping that Dreamhost does a sane job sandboxing this from the rest of the virtual host, thought I wouldn't bet on it.
Also, would atagar want jeremy to work up a design and branding that is more tor less phpbb-stock setup?
Sure. I'll see what I can do over the next couple days to make it look a bit less awful, and if jeremy has any experience with phpbb themes I'd be glad for the help.
The reason that both the forum and arm's site lacks ssl is that Dreamhost has a fee for getting a static ip, and that's a requirement for their ssl setup. It isn't much so I should stop being lazy and just do that and get a cert.
Anything where we ask people to make accounts and log in should use https by default. Otherwise we're setting ourselves up for a bad experience.
Maybe add a link to the site? I have mixed feelings - we want this to be an experiment where we can trivially pull the plug but on the other hand its primary worth is as a support forum so it needs to be discoverable by first time users. Thoughts?
We should consider giving it a more official sounding domain name, if we want it to have a chance of succeeding. Say, forum.torproject.org. There are a bunch of alleged Tor forums out there -- what makes this one different from the others if it has an unrelated domain name?
I'm under no illusion that phpbb has anything but a horrible security record. Given the option I'd opt for different forum software on a dedicated VM somewhere.
Well, we do have the option. We can also set up a dedicated VM for it without much trouble. Would that change your plan? If the goal is to see if we can build a community, and the plan is that we if we succeeed then we will tell them all to start over in some other place... that sounds non-ideal. :)
Figure out who on tor-assistants@ is interested in moderating. I'll ping the list tomorrow.
I don't know much about the conventions of forums (e.g. when to merge threads, what posts to make sticky, etc etc), but I will commit to helping to answer technical and other Tor questions (like I've been doing for the blog the past weeks) and helping to assess which people are being correct.
Maybe add a link to the site? I have mixed feelings - we want this to be an experiment where we can trivially pull the plug but on the other hand its primary worth is as a support forum so it needs to be discoverable by first time users. Thoughts?
Unless someone can commit to replying to support requests on the forum, we should not make the forum an official support channel. I have enough support channels to keep track of as it is.
We should consider giving it a more official sounding domain name, if we want it to have a chance of succeeding. Say, forum.torproject.org...
Agreed, making a real go of this will give it the best shot at succeeding. It seems like there's a couple routes we could take...
Clearly label this as an experimental, unofficial forum to just test the waters. From earlier discussions this is what I thought that we were going for, in which case the focus is more on a low setup effort to simply test the theory of "build it and they will come". They probably won't.
Invest some effort into an official forum, hopefully with a tpo vm, url, and with Jeremy helping to make it look nice.
I'm all for the second option - I just threw up forum.atagar.com to get the ball rolling and, besides the topic breakdown, there's nothing there that's worth keeping.
After looking around a bit I'm actually kinda in favor of us sticking with phpbb in either case. Yes, it's php. Yes, it's security track record is miserable. But it seems to be the most mature open source option out there and after a few black eyes its developers are, at the very least, making an effort to do better. If Jake or others have ideas for sandboxing then it would be great to get their input.
On the plus side, going with phpbb means that it will be far easier to find documentation, addons, and themes to make it function and act the way we want (pretty example: http://www.spacetrace.com/forum/). It would be great if we could somehow make use of the blog.torproject.org styling... Jeremy: do you have any experience or interest in phpbb theming? :)
If we go with this then I'd like for us to make a tor-forum@ list that's attached to a m2f instance (http://mail2forum.com/). For all practical purposes this would make it another tor-talk@ list that happens to have a forum frontend too, making it easier to manage (yea, I prefer email lists over forums too). In the future we might be able to merge it with tor-talk@, but we should initially keep them separate to see what sort of audience and spam it gets.
Unless someone can commit to replying to support requests on the forum, we should not make the forum an official support channel. I have enough support channels to keep track of as it is.
Ok, now I'm a little confused. I thought that this support channel would be a replacement for blog comments, and a community support channel that's like tor-talk@ but more visible. From what I understand rt.tpo and tor-support@ are closed channels for help via dedicated support people.
Unless someone can commit to replying to support requests on the forum, we should not make the forum an official support channel. I have enough support channels to keep track of as it is.
Ok, now I'm a little confused. I thought that this support channel would be a replacement for blog comments, and a community support channel that's like tor-talk@ but more visible. From what I understand rt.tpo and tor-support@ are closed channels for help via dedicated support people.
I think what Runa means is that the closed channels are already enough for her, so we shouldn't expect her to additionally pick up the Forum.
Unless someone can commit to replying to support requests on the forum, we should not make the forum an official support channel. I have enough support channels to keep track of as it is.
Ok, now I'm a little confused. I thought that this support channel would be a replacement for blog comments, and a community support channel that's like tor-talk@ but more visible. From what I understand rt.tpo and tor-support@ are closed channels for help via dedicated support people.
I think what Runa means is that the closed channels are already enough for her, so we shouldn't expect her to additionally pick up the Forum.
Bingo. I'm all for having a forum and seeing users try to help each other, but users should not expect official support from Tor developers. If they need help with anything and require answers rather quickly, they should contact the Tor help desk.
Agreed that this is separate from the more business-like closed support channel you're planning. I'd be weary of saying that they should expect less in terms of developer support or responsiveness though. For better or worse this will probably become an extension of tor-talk@ with no funded support but more eyeballs than a dedicated support channel could provide. :)
While this discussion continues, zoho setup a sample forum
Neat, and certainly tempting. If we want integration with the website then seems like a good option, though does it support m2f or something similar? I have a bias toward open source options like phpbb but besides that email list integration is, imho, mandatory. As you've said in the past our current development community uses (and prefers) email so anything that requires us to keep an eye on a web page isn't likely to fare well.
Just to be clear (so everyone doesn't think that this is waiting on someone else) this ticket is pending the following...
Anyone:
Does zoho support email list integration? Quick glance seems to indicate that they have their own webmail thing it probably works with, but that doesn't help. Preferences on zoho verses hosting our own?
Other forum options that we should consider? I hope no one says vBulletin.
Someone officialish (phobos, arma, nickm, etc):
Are we fine with making this an official forum? If so and we go with phpbb, should I file a separate ticket for the vm?
Jeremy:
Any experience or interest in phpbb themes? Suggestions to proceed for making it look nice?
Yay. (I've been trying to build a community on the blogs, but it's hard when everybody but me is named anonymous.)
I promise to be sporadically quite useful in helping manage the forums.
We should continue to allow people to be anonymous on the forums, so naming shouldn't be a concern. And sporadically helpful isn't how you grow a community. We need someone dedicated to growing it. It's great that you'll jump in, but it's the jump out part that's the issue.
While this discussion continues, zoho setup a sample forum
Neat, and certainly tempting. If we want integration with the website then seems like a good option, though does it support m2f or something similar? I have a bias toward open source options like phpbb but besides that email list integration is, imho, mandatory. As you've said in the past our current development community uses (and prefers) email so anything that requires us to keep an eye on a web page isn't likely to fare well.
I argue that email integration is exactly what we do not want. The irc community is different from the tor- mailing list community, will be different from the forum community. The people who call in for support or questions is different from irc and email. The forum community should stand on its own. I prefer free software solutions as well, but my preference for one less thing to maintain is stronger right now.