Wedge

That's exactly why we're doing it here before we deploy it properly, because we can assess such things in a real environment - the BB integration was never tested on a live site prior to this deployment, for example.

Hmm, interesting.

This tells me there's potentially two separate bugs here :/

(Firstly, the debug information should not be shown to anyone except admins, and secondly why there is an uninitialised string offset)

Hmm, first glance would suggest a strange bug separately occurring in the bbc parser (in an area we haven't touched AFAIR), perhaps with cached content. Whatever, there's definitely an issue as indicated by the rate of stuff in the error log...

Anytime :)

You probably figured by now, though, a lot of the way the plugin system is developing is actually because I've been using it. The <actions> hook for example is because I was actively adding actions and figuring out how awkward it was. This is another example. I did also suggest something similar for adding menu items actually... haven't got round to that yet.

What do you mean 'this actually works'? :lol: Cheeky. Of course it works! :P (Never mind that as soon as I implemented it, I migrated all my simple plugins to use it, to prove it worked :P)

I'm not sure I want that in the core to be honest but I suspect it won't be too hard to make a plugin for it if that's what people want.

And, it probably won't speed things up, actually. The signature is still only processed once per user, you then have to have some logic to figure out whether to show it or not, which is an extra check per post, doubly so if you're doing it via a plugin because this is a little overhead there, followed up by the fact that it does actually limit what can be gzipped anyway. Needs testing but I doubt it would actually save bandwidth in the long run, and it may even end up costing more bandwidth in some cases.

Thing is, if you don't do that, you still have to be careful. If you do anything to give away the fact that the username exists vs that it doesn't, you are giving the miscreants a window, however small, into your data. If you keep displaying the log-in form ad infinitum, it isn't going to be hard for a miscreant to figure out what's a genuine username/email or not, it'll just take longer.

It's still a side issue in the fact that you don't know they're doing it: it's not recorded anywhere that an invalid username is used. I also know from experience that the number of times it happens is probably higher than you think.This already happens.I will not tie anything to Stop Spammer (which is ultimately Stop Forum Spam's database) out of the box, nor will I personally write a plugin for it. There are still way too many false positives in their database, though it has improved since the time when someone 'helpfully' decided to put my own details in there just to wind me up.Bad Behaviour is already part of the core, it has no API key. Stop Spammer I do not want in the core, neither do I want Akismet. Having used both extensively over time, I dislike the rather high number of false positives that both have. That said I will probably write an Akismet plugin to integrate with the moderation filters system (which means users have the flexibility to pass a post to Akismet and they can either moderate it or reject it outright to their heart's content)I do not want reCaptcha to be part of the core. I don't like it, I find it unreliable.[1] That said, I already made a reCaptcha plugin, which pushes its own language strings into play meaning that you can configure the strings much as you would configure anything else (i.e. the language editor) and do so per language; if you only have English installed, you'll get English regardless of anything else.

1.	Apart from the fact that about 1 in 5 times, I'll get some mathematical equation as one of the two words, the methodology is a touch flawed: they actually allow one letter per word to be wrong and still accept it. Mind you, reCaptcha has been broken by bots more than once now.

Screenshot says everything. Current Chrome beta branch for me.

That's the thing, nothing that I can recall has been changed that would make a difference, the changes in drafts are very minor and should not cause this to happen.