[Unknown]

  • Posts: 77
Re: Unknown's thoughts on Wedge
« Reply #60, on July 4th, 2011, 07:01 AM »
Ah, I see.  Well, there's ups and downs of that.  A reasonably easy workaround is to include a (small) file on loadSettings or what have you, and then from there load additional file(s) as necessary.  This won't have a huge perf impact.  But yes, specifying a file makes more sense.

-[Unknown]

Arantor

  • As powerful as possible, as complex as necessary.
  • Posts: 14,278
Re: Unknown's thoughts on Wedge
« Reply #61, on July 4th, 2011, 08:41 AM »
There's a lot of stuff in there for me to digest, but what live is saying is that you have to include a file every single runtime, or everywhere in the admin panel in order for it to be called. While that might not be bad if you have a few things that run every page, it's a bit excessive.

You have to load a file to add an action, for example, which defeats the nature of the action loader loading other files.
Re: Unknown's thoughts on Wedge
« Reply #62, on July 4th, 2011, 10:02 AM »
Quote
Or try a diff between the two release trees, which probably wouldn't apply cleanly in most cases.
If you don't have any modifications, of course, this isn't a problem. The only trouble is, the diff is enormous since the RC5->final patch modified every single PHP without exception.
Quote
It means your stuff is wrong and has to be rewritten now, no matter what.
Yes, if the API changes in some fashion. That's the single biggest factor in migrating SMF 1.1.x mods to SMF 2.0, in fact.
Quote
then I don't think there's generally any good reason for a theme ever to change the meat of an administrative section.
Let me explain what exactly my edits did, and I'll let you judge for yourself. FWIW, I'm of the view that these are acceptable, not necessarily desirable.

I just checked, there are three template edits being made in SimpleDesk 2.0:
* manage attachments
* package manager
* track IP

Manage Attachments is one of those necessary edits. For a variety of reasons, we had SimpleDesk take SMF's attachments and modify the core code, specifically so that if attachments worked normally, SD's would too. All that we do is store the SD-specific metadata in its own table, and don't attach a topic id to the normal attachments (and yes, I did account for that in the maintenance... I think I did, anyway... have to check that now, it's been a year since I wrote it)

All the template edit has to do is add to the 'Browse attachments' / 'Browse thumbnails' links in the browse files area, to add 'Browse helpdesk attachments' / 'Browse helpdesk thumbnails'. Since it's injecting two links directly into the template, I wasn't uncomfortable with it.

Package Manager... well, SD has a form of plugin manager (which is to say, it has an interface for managing hooks that other things might use). For convenience I used SMF's package manager to get the plugins onto the server and files in the right places, then SD's code deals with activation and making them work.

Since that was already the case, I moved SD plugins into their own block of the package manager which is a template edit to expand. (Were I in charge of this, I wouldn't have it as a template edit, I wouldn't require one, I'd have the setup of the $context variables specifically to avoid needing any kind of edit, but that's me.)

There are only a handful of mods for the package manager, one of which I wrote, and I knew full well that it wouldn't be a problem to integrate this in with it.

Lastly, track IP. Underneath the 'list of posts from this IP', we add 'list of helpdesk posts from this IP'. It's not commonly modified, and it's just another call to the generic list template, really, so that's a not a problem either - it's just that if the template weren't a single monolith but a list of templates, it would be trivial to add another.
Quote
but potentially they could be used for hooks (e.g. instead of something liek query_see_board.)
I actually made is substantially easier for a mod to declare such things, and add them to the query; it's now possible to define your own without having to modify the DB code itself - which is the sort of thing I meant when I said that hooks weren't the only thing to contend with.
Quote
Well, I agree with designing in a way that this is not necessary to think about.  Just like security; anything that can be made automatic is better that way, as long as it doesn't have other downsides
That's really what I'm trying to do, is to make it possible to automate as much as possible without having to make mod authors and/or mod users deal with it.
Quote
Sure.  Although that can't do everything.  Imagine if the recycle bin functionality were to be made a mod (in fact, I'm fairly sure it was at first.)
Something like that would have to be done as manual edits, I don't think there's any way around that - but on the other hand, something like that should be in the core anyway.
Quote
Then you need to at least do code review.
There is an informal code review going on with commits.
Quote
So you're screwed that way too, even without the package manager needing things writable.
*nods* But it was still hitting and enveloping instances that weren't running suexec, too, because of elevated permissions. Most people do not modify their permissions back after the event, because it's convenient for them not to have to do so.
Quote
Not true.  Two plugins hooking the same hook can also cause issues
Sure they can, but it's far more common when it's file editing going on. Looking at the sorts of stuff that was emerging in SMF's ecosystem, the vast majority was additive rather than anything else, such that the order of installation for most things wouldn't be an issue at all in most cases. And usually, where order of installation is important for some reason, it's either documented by the mod author (who can also deal with support), or they deal with it in the mod itself (e.g. SlammedDime's SimpleSEF periodically makes sure it is the last hook called - though I recognise that it's possible a second mod will attempt to do the same and cause issues that way, but I gotta say that's very much an edge case there, order of execution is not that much of an issue for the *majority* of mods)
Quote
That doesn't seem wrong to me, in any case.  That said, if it's becoming necessary, that seems bad.
I don't think it's becoming necessary. But it is becoming far more common, that people seem to feel it is becoming more necessary because there is a hurdle for them to overcome. The majority of admins want it to just work and become very upset/flustered when it doesn't, especially when it goes wrong and really breaks something.
Quote
Well, unless major changes happen again, as did with SMF 2.0.  What if they separate out the core, and now all the syntax for everything has to change again?  Are these "maintenance" areas really big problems between e.g. 1.1.1 and 1.1.2, etc.?
When you have any big jump, that's going to be expected. With a big jump you expect to have to do stuff like that. But between small version jumps, you shouldn't have to do much, if anything. Yet there are a great many mods that interfere with version updates and vice versa.

SMF is really a bad case to discuss this sort of thing. SimpleDesk now has less maintenance and editing in the really key areas - and they're the key areas that are high-maintenance: actions, admin menu, permissions, plus it has less maintenance by using a hook for one of the display template functions too.

Yes, when 2.1 rolls around it will need to be modified, of course. But for the meantime I can rest easy in that mods and updates shouldn't affect those parts of SimpleDesk - at all.

If anything, it's going to be less hassle than developing alongside the RCs was, because each RC brought new things with it that weren't bug fixes (RC3, 4, 5 and final all brought style specific changes, RC4, 5 and final all brought hook related changes)
Quote
Yeah, I know it was there, initially it wiped out installed.list IIRC.  I think we moved to a database to remove the requirement of that file being writable, and may never have fully moved everything over.
That's the problem: it's all in the database, and the upgrader doesn't deal with it properly. The file is still present, though, it just contains the timestamp of the last install. Quite *why* it does that, I have no idea.
Quote
Which means, in other words, that they were betas.  And if the last RC and the final and major behavioral changes (which I gather it did), then basically a release candidate was never made.
That's pretty much the story of 2.0 from RC1 onwards. Each release brought changes that were ultimately non trivial.
Quote
This sounds like a bad idea.  I would rather just say "hey, this version says it won't work, want to try it anyway?"  I even thought it did that.... but I guess it probably doesn't.
You can't do it that way: remember we talked about multiple versions being handled in the same package? There's your reason not to do it that way. Imagine you have a mod that states it supports 1.1.13 and 2.0 RC5, and you're on 1.1.14. Which set of instructions should it use as a 'default' fallback?
Quote
This always felt like a hack to me, actually, and I never felt completely comfortable with the way board specific permissions kinda shook out.  They still confuse me, which is a bad sign.
Board permissions confuse a lot of people and 2.0's move to using profiles for boards is even more confusing. I know the entire setup needs to change but I'm not yet sure which way to go for the best.
Quote
At least we're not (or at least I hope I'm not) arguing about the color of the bikeshed.
I don't think we are, and that's not what I meant by my comment either. We agree there are issues with the current state of play, and we agree on how some of those issues may be resolved, and disagree on others - but really, our ground is not that uncommon, we're seeing the same issues with different coloured glasses. You're coming at it from your point of view, wherein maintenance and bugfixes - and practical measures that apply - are more important, while I'm coming from trying to make it as easy to use and possible for users, to minimise their hassle. Call it glass-half-full vs glass-half-empty at this point, because that's what it is, really.
Quote
Does SMF's system yet allow for multiple subtemplates to be used on the same page?  Example: "poll", "poll", "calendar", "post_list"?  I think I mentioned on SMF I have since moved to this system (and TOX-G uses it too.)
No, it doesn't. It can do template layers and a single inner-most template. Wedge does not have that limitation and we already use it in this fashion in a few places - though not nearly enough.
Quote
Actually, a reason not to have things in the core also is attack surface.
I can see that as an argument, it's entirely valid. And to your last point here in particular about file permissions... most users really do not want to have to do that. They want it to work as simply and cleanly as possible - and juggling file permissions is not part of that, IMHO.

From my perspective, the calendar as it stands is not that useful, so having it in core is not necessarily the smartest move, but if it were to be more useful, there would be more reason for it to be present.
Quote
Sure, except it can narrow the mindset.
I don't think there's any way to avoid that, though. Every time someone writes some code and releases it, it adds to the total substance of what's available - and every time that happens, there's one or more people out there who won't roll their own version of the same. From my POV, I see it as priming the pump for the most part, because I know others out there will think of ways to expand on what we come up with, and I know I won't be writing every possible permutation of mod either, so others who want it differently will invariably come up with their own spin on it.
When we unite against a common enemy that attacks our ethos, it nurtures group solidarity. Trolls are sensational, yes, but we keep everyone honest. | Game Memorial

[Unknown]

  • Posts: 77
Re: Unknown's thoughts on Wedge
« Reply #63, on July 4th, 2011, 11:11 AM »
Quote from Arantor on July 4th, 2011, 10:02 AM
Let me explain what exactly my edits did, and I'll let you judge for yourself. FWIW, I'm of the view that these are acceptable, not necessarily desirable.
I think they're fine an all "hookable" in some fashion, although whether hooks would necessarily be forethought for all these areas is uncertain.  Th only area I see a theme potentially wanting to touch is the IP one, and probably not.
Quote from Arantor on July 4th, 2011, 10:02 AM
(and yes, I did account for that in the maintenance... I think I did, anyway... have to check that now, it's been a year since I wrote it)
Ah, good.  While I think no one uses that feature (at least they didn't used to), I think it's a good feature.  It came from YaBB SE and probably even YaBB, originally.
Quote from Arantor on July 4th, 2011, 10:02 AM
Something like that would have to be done as manual edits, I don't think there's any way around that - but on the other hand, something like that should be in the core anyway.
Still don't agree that the core should have a working kitchen sink that churns out boiling hot and cold water, but I do agree with the decisions that led to that particular mod being integrated (I didn't do that one but liked it after the fact.)  I think it was a popular YaBB SE mod.
Quote from Arantor on July 4th, 2011, 10:02 AM
(e.g. SlammedDime's SimpleSEF periodically makes sure it is the last hook called - though I recognise that it's possible a second mod will attempt to do the same and cause issues that way, but I gotta say that's very much an edge case there, order of execution is not that much of an issue for the *majority* of mods)
Well, edge cases are important.  Even if just knowing about them and documenting them.  People are professionals not because they don't make mistakes, but because they prepare for them in advance.  I'd rather know what can go wrong and know when it goes wrong than just be confused.

In this case, I think I've seen before a "hook weight" where you can basically say "I want to be first", "I want to be last" and sometimes even "I don't care [so put me in the middle]."  Even DOM events work in this way, with capture and bubble phases.

In practice, most people (especially people using jQuery, which likes to rename everything) only use bubbling.  But the DOM has both models.  AFAIK, no one has proposed taking it out even though almost no one uses capturing (the "I want to be first" one.)  In fact, jQuery doesn't even expose an interface for capturing, neither does Prototype, nor Dojo.  Basically only Closure does, and no one uses it.

Of course, it doesn't help that IE doesn't support capturing.

Still, with some people going on the warpath on things like XHTML that no one uses or uses properly, because IE doesn't support them anyway, and wanting to remove them from the web, capturing has been left untouched.  Because it is necessary, even if only 1% of the time.
Quote from Arantor on July 4th, 2011, 10:02 AM
Yet there are a great many mods that interfere with version updates and vice versa.
Well, I don't remember the minor version updates being that major.  A mod has to touch, what, like less than 6% of the code base at most, on average?  It's surprising to me if the majority of minor version updates interfere with mods (not because they interfere with each other, but the actual updated parts.)

For contention areas, like new permissions, yes... there's really potentially no way around those without hooks.  That said, in most of my mods, rather than adding an index to an array, I'd add code afterward that would do e.g. $actionArray['x'] = array('y', 'z');.  While "ruining" the style, this didn't ever break and my mods were fairly low maintenance.

In fact, I can't remember ever having to make major changes to my wikilinks mod, for example.

So my point is that it shouldn't be that there are "high maintenance" areas where it's hard.  Those areas, if they exist, should certainly be hooks.  I know this was something, when I was around, we just hadn't gotten to yet.
Quote from Arantor on July 4th, 2011, 10:02 AM
That's the problem: it's all in the database, and the upgrader doesn't deal with it properly. The file is still present, though, it just contains the timestamp of the last install. Quite *why* it does that, I have no idea.
Oh, I remember.  Originally we set out to move to the DB and that was it.  Then we got concerned about the issue of someone uploading an upgrade package, and we wanted the installed.list in there for some reason.  I can't remember the details.
Quote from Arantor on July 4th, 2011, 10:02 AM
You can't do it that way: remember we talked about multiple versions being handled in the same package? There's your reason not to do it that way. Imagine you have a mod that states it supports 1.1.13 and 2.0 RC5, and you're on 1.1.14. Which set of instructions should it use as a 'default' fallback?
Well, you can pick the one that is most similar.  Starts with the most same characters, or matches the "lower than this" check but not "higher", or else matches the "higher" and is the lowest.  I don't see the point of picking a specific version to emulate when it seems as if the software can figure this out itself.

Especially when I do expect most mods will always be just a single version [range].
Quote from Arantor on July 4th, 2011, 10:02 AM
Board permissions confuse a lot of people and 2.0's move to using profiles for boards is even more confusing. I know the entire setup needs to change but I'm not yet sure which way to go for the best.
I'm not sure either, but I'm certain it involves impersonation or in other words "sudo."  Bugzilla, for example, does this and they only have like 7 permissions.  That said, its permissions also confuse me (because there are all sorts of overlaps, I feel like really it would be easier if there were more permissions or something...), but at least I can see what they do by impersonating someone.

And as much as I hate UAC the way it works in Windows, I like the concept of opting in to having lower privileges for a period of time.  It's something I probably would use, especially e.g. on a forum like Yourasoft, where I might not want to have moderation privileges or be able to see all boards (both were issues there, and we eventually used a shared admin account, which is a horrible idea from a security perspective.)
Quote from Arantor on July 4th, 2011, 10:02 AM
From my perspective, the calendar as it stands is not that useful, so having it in core is not necessarily the smartest move, but if it were to be more useful, there would be more reason for it to be present.
I would still take it out (if I ran a forum) and just drop a link in my menu to a Google Apps calendar (if I even needed a calendar.)  I would also remove PayPal / any payment stuff (in fact, that would be the very first thing I'd do) and if that HiveMail or whatever mod got integrated I'd remove it too.  I'd remove the moderation center, dumpdatabase, any friendly theme editing features (and especially the viewfile thing in the error log viewer), and definitely the "block me from logging in whenever a hacker wants to spam my account to lock me out" feature which has inevitably been added in order to compromise my security.  I would use none of these things, and they could only possibly reduce my security at worst, and insignificantly decrease my forum's performance at best.
Quote from Arantor on July 4th, 2011, 10:02 AM
I don't think there's any way to avoid that, though. Every time someone writes some code and releases it, it adds to the total substance of what's available - and every time that happens, there's one or more people out there who won't roll their own version of the same. From my POV, I see it as priming the pump for the most part, because I know others out there will think of ways to expand on what we come up with, and I know I won't be writing every possible permutation of mod either, so others who want it differently will invariably come up with their own spin on it.
Well, it's not necessarily always a bad thing.  I'm just more of a "wait and see" kind of guy for things I don't want.  I love building things I do.

I think a great example is WikiLinks.  I liked that mod, and I thought the feature rocked.  Ultimately, I didn't feel it was right for release, and there were a few complications with it... but it seemed like a perfect mod to me.

-[Unknown]

Arantor

  • As powerful as possible, as complex as necessary.
  • Posts: 14,278
Re: Unknown's thoughts on Wedge
« Reply #64, on July 4th, 2011, 11:37 AM »
Quote
I think they're fine an all "hookable" in some fashion, although whether hooks would necessarily be forethought for all these areas is uncertain.  Th only area I see a theme potentially wanting to touch is the IP one, and probably not.
Well, each page of key areas (like the profile) should have some kind of hook to it, then combine that with the template list and you're done. I don't think having a hook for each area of things like the profile, or even the admin panel, is that onerous, really.
Quote
Ah, good.  While I think no one uses that feature (at least they didn't used to), I think it's a good feature.  It came from YaBB SE and probably even YaBB, originally.
It is recommended periodically by the SMF support team, but honestly I suspect that's more because it's "find and repair errors" as if it's some magic tool, without understanding what it does.
Quote
Still don't agree that the core should have a working kitchen sink that churns out boiling hot and cold water
Interesting analogy, and one I can see the merits of, even if in this particular case I don't agree. To me, if you're going to have a kitchen sink, while all it *needs* is cold water, its power is greatly increased with hot water too. In this case, it's having a safety net of people removing posts without really removing them - prevents people abusing the system too much, IMO.
Quote
Well, edge cases are important.  Even if just knowing about them and documenting them.
*nods* I try to take such things into account.
Quote
In this case, I think I've seen before a "hook weight" where you can basically say "I want to be first"
I did think about that, but even then I can still see cases of two hooks requesting to go last, and I ultimately considered that the times it occurred were sufficiently rare in most cases that it could be dealt with by the mod's author where necessary.

Though if I do resurrect the stuff I was working on, it might not be a bad idea to have some kind of facility for this.
Quote
I don't see the point of picking a specific version to emulate when it seems as if the software can figure this out itself.
Well, you could do it that way, I guess, but right now it can't actually do it. All it can do is search through the package for any versions which match and if it doesn't find any, bail. But there are still some abuses of the system going on, like specifying 2.0 - 2.0.99 which worked even for release candidates...
Quote
Originally we set out to move to the DB and that was it.
I don't think the upgrader looks at it, though... been a while since I looked, and it was more a curiosity and something of a bug, but one I was never that interested to investigate.
Quote
And as much as I hate UAC the way it works in Windows, I like the concept of opting in to having lower privileges for a period of time.
Interesting. I always felt the opposite, that what is in SMF and Wedge with the secondary validation, that you're practically doing exactly what UAC does: a secondary confirmation that you do indeed want to go into the administrative areas.

I still wonder about my methodology from SimpleDesk, which turned it into role-based permissions which could be attached to groups - but still effectively separating permissions from groups directly for the most part. (Then, mix in role templates, and you get all kinds of interesting scenarios)

http://www.simpledesk.net/community/simpledesk_team_blog/the_new_permissions_system_simpledesk_1.1_709.0.html if you're curious. Admittedly, it is helpdesk-centric and it's more complex now than it was when I implemented it and discussed it there (namely, departments support, which is similar to tickets in boards but slightly more complex in other ways), but I'm sure there's something of consideration there. The implementation, though, I probably would do differently now.
Quote
I would still take it out (if I ran a forum) and just drop a link in my menu to a Google Apps calendar (if I even needed a calendar.)  I would also remove PayPal / any payment stuff (in fact, that would be the very first thing I'd do) and if that HiveMail or whatever mod got integrated I'd remove it too.  I'd remove the moderation center, dumpdatabase, any friendly theme editing features (and especially the viewfile thing in the error log viewer)
I understand where you're coming from, but OTOH, I have arguments that encourage me to keep some of them too:
* calendar, because I think it can be made more useful and worth keeping around as a consequence
* PayPal, because I take the view (much, as I think the team did at the time) that anything payment related, I'd rather have that in the core than a possibly unmaintained mod, for security purposes
* HiveMail... not sure what you mean? Certainly there aren't any mods named that on sm.org.
* Moderation center... I suspect that was implemented in response to how vB did things. It's not ideal and needs reworking, but removing it entirely, down to the concept of it, is not really where I think we want to go: managing a busy and active forum through just email-to-all-moderator notifications means that things do get forgotten and unresolved.
* DumpDatabase - agreed.
* Theme editing - I think we already got rid of them, and if we didn't, we're in favour of doing that.
* ViewFile thing... hmm. I can't see any huge reason to get rid of it, and I can see a smallish reason for keeping it: people *do* post its output when things are broken, because when you have file edits, it can show what's broken. Though for the most part I'd probably argue it doesn't help, but that doesn't mean it hurts to keep it either. (Curious, what about it don't you like?)
Quote
block me from logging in whenever a hacker wants to spam my account to lock me out
That has actually been removed even in SMF.


:edit: Oh, I missed this one:
Quote
I'd add code afterward that would do e.g. $actionArray['x'] = array('y', 'z');.  While "ruining" the style, this didn't ever break and my mods were fairly low maintenance.
Until you have half a dozen mods that all do the same thing, all attached to the same comment and none of which can be uninstalled unless you remember the order of installation because of the way find/replace is done in packman.

snoopy-virtual

  • Posts: 152
Re: Unknown's thoughts on Wedge
« Reply #65, on July 4th, 2011, 04:13 PM »
Quote
ViewFile thing... hmm. I can't see any huge reason to get rid of it, and I can see a smallish reason for keeping it: people *do* post its output when things are broken, because when you have file edits, it can show what's broken. Though for the most part I'd probably argue it doesn't help, but that doesn't mean it hurts to keep it either.
In all the time I have been giving support, I have seen some people in cheap servers with no FTP access nor a good control panel, so the only way they have, if they ever need to edit a file, is using this feature.

If file edits are going to be ever needed I would even suggest you could extend that feature to all the files (not only the Theme files) for that people without FTP.

[Unknown]

  • Posts: 77
Re: Unknown's thoughts on Wedge
« Reply #66, on July 4th, 2011, 10:09 PM »
UAC: Well, no.  UAC is very different from, say, sudo or etc.

UAC hits you with a heavy hammer.  Unlike sudo and most other systems, it asks you *every time*, resulting in user training.  It's also for anything that isn't something a standard user can do: for example, UAC would require a password prior to moderation.

SMF does require the password (mostly as a last-effort against CSRF or session fixation), but only for logical administrative functions - editing profiles, the admin center, etc.  At least it used to.

But, I don't need to type a password or confirm a prompt to go into an admin-only board, or post a reply to a locked topic, or etc.  That's what UAC does, and I don't agree with it or like it.  That said, being able to opt into that situation seems interesting.

Permissions:

I think I've talked about this before, and how roles make more sense.  Looking briefly at that super long post, it seems like you're doing the right thing: create "groups" of permissions, aka roles, and assign users (or groups) to these roles.

It's really how I meant for groups to be used, but ultimately, it's confusing.  When you start with "Guest", "Member", and "Administrator" it is not natural to think of creating an "Attachment Poster" or "Poll Starter" group.  It's the same context problem I was talking about before.

If mods created default roles on installation, and SMF/Wedge came with a healthy set, this could be a good thing.  I know I posted at length about this on SMF somewhere, and I can't remember some of the details of the system I tried to think out.  But in general it's a lot clearer than "additional groups."

It looks like that's what you have.  Also the own/any/all thing, dropdowns make sense.  I wasn't sure about the UI ever, and was initially trying to go with checkboxes with deny.  I wanted to expose the option to allow people to, e.g., lock any topics but their own (which can be done with deny) because there were interesting use cases people had asked for that required this (even though it was a <1% type of thing.)  Probably this was a mistake, because deny is something that users just don't generally understand well.

I think instead of board permissions, you might have roles be "global" always, and when you assign roles to a group or user, make the board-specific association there.  For example, when editing "Global Moderator" (a group), I might set them to be in "Standard Users" for all boards, and "Attachment Posters" for only boards (or departments or galleries) x, y, and z.  And I might put them in some other role for all boards except a, b, and c.

In fact, denying them a role may make more sense than having permission-level denies, and may work for users in their heads.  I'd have to talk to a few users to figure that one out.

The interface could offer roles for board-specifity based on them having board permissions.   Same with gallery or departments.

Then once you've "built" the group, and tested it by impersonating the group, it's much easier to assign and understand what will happen, because that group is all on one page.

Ultimately, in the same token as file editing, I think that "additional" groups should be something most people almost never use, if possible.  Having seen users try to use them, they are only confusing to them, *especially* with the whole Regular Members/Ungrouped Members conundrum, which needs to be gone yesterday.
Quote
* PayPal, because I take the view (much, as I think the team did at the time) that anything payment related, I'd rather have that in the core than a possibly unmaintained mod, for security purposes
I'm not saying whether I'd take them out of the distribution (although, this I would, but probably for legal/liability related reasons), but that I would remove them from my own install, where I'd never use them - as a general clarification.

I understand and agree, to a point, with your argument that it's better if it's more strongly maintained, since it's an important feature.  That said, I've never been to or used a forum that requires payment for anything or in any way related to the forum, aside from simplemachines.org.  I've used forums related to paid products (such as hardware or software or physical goods or even services), but none of these seem to "fit" with the payment features in SMF as I understand them.

So to me, in this particular case it just seems like additional risk for, what, adult content forums?  Those were like specifically what I didn't want to cater to.  If I could add a feature that would make those sites less likely to use my software, I'd consider that a big plus under the "reasons to add this feature" column.

I'm also not sure it's a benefit to end users, since I would assume it can only encourage making them pay for access in situations where that may not make sense.  But ultimately, that's a problem for the free market, so not a big deal.
Quote
* HiveMail... not sure what you mean? Certainly there aren't any mods named that on sm.org.
HiveMail was a mod to integrate some web based mail solution into SMF.  I may be remembering its name wrong.  It was actually one of the first paid mods.  I thought it made it so you could give each and every user of your forum an email address, automatically IIRC.  Or something like that.  I never looked hard at it, and I think just helped the author some?  Memory is very fuzzy.

ViewFile: it makes my security hairs stand up on the back of my neck.
Quote from snoopy-virtual on July 4th, 2011, 04:13 PM
In all the time I have been giving support, I have seen some people in cheap servers with no FTP access nor a good control panel, so the only way they have, if they ever need to edit a file, is using this feature.

If file edits are going to be ever needed I would even suggest you could extend that feature to all the files (not only the Theme files) for that people without FTP.
I realize there's a "thriving" community of forum-only hosting.  That said, I personally feel that if the host doesn't want to give them any access to the files, we shouldn't either.  Especially if the host is doing something like BoardNation was, with a shared sourcedir setup.  Then it could even be dangerous.

-[Unknown]

snoopy-virtual

  • Posts: 152
Re: Unknown's thoughts on Wedge
« Reply #67, on July 4th, 2011, 11:36 PM »
I didn't know there was hostings sharing the same sourcedir between a few forums. It would be very dangerous indeed if they could edit the files there.

Well ... My first advise when somebody comes with that problem has always been: "Change your hosting", so I suppose I will stick with that one.

One thing is sure, I would never use one of those hostings.

live627

  • Should five per cent appear too small / Be thankful I don't take it all / 'Cause I'm the taxman, yeah I'm the taxman
  • Posts: 1,670
Re: Unknown's thoughts on Wedge
« Reply #68, on July 5th, 2011, 12:24 AM »
Quote
UAC hits you with a heavy hammer.  Unlike sudo and most other systems, it asks you *every time*, resulting in user training.  It's also for anything that isn't something a standard user can do: for example, UAC would require a password prior to moderation.
UAC was notorious for that in Vista. It has been tweaked in 7 where it doesn't pop up so often but I was always an administrator so for standard users where it requires a password, it;s probably still bad.
A confident man keeps quiet.whereas a frightened man keeps talking, hiding his fear.

Re: Unknown's thoughts on Wedge
« Reply #69, on July 12th, 2011, 03:20 AM »
Quote from Eros on June 28th, 2011, 04:27 AM
I figured I'd toss my two cents in, as someone who more or less, has always intended to go around SMF (except for bridging authentication) as much as possible. That, and I'm not a web developer, so it is easier for me to work that way and fix my own mistakes without affecting an adequate solution. I also have a tendency to react without thinking things through simply because of some of the things I've seen in my limited experience .

File edits are a pain in the ass to maintain between versions and so are hooks. I don't think either is going to change developer behavior sufficiently to be worth picking one or the other solely for that reason.

If you provide Hooks, you need to also provide File Edits to avoid Unknown's concern of people causing trouble that way.

If the real, and only concern, is the size and quality of mods...you are probably better off coming up with positive incentives to create certain types, and a certain quality, of mods rather than relying on the method of modifying Wedge to do it for you. I've got no good idea how to go about that simply because I've never tried to foster a developer community around a project outside of a situation where everyone is being paid to care about said project.
I'm glad you did toss your tuppence in, actually, as I'm no web developer either, but one of those people who has gotten into repeated trouble with file edits (but after days of cussin' & fussin', it eventually all worked out and stuff was exactly the way I wanted it, and it's why I've stuck with SMF stuff, and why I'm interested in testing out Wedge when it's available).

As a person who knows only enough code language to get my face slapped, please pardon this next question...what the heck is a hook, and if I fiddle with hooks, would that make me a hooker? (okay, so that second half wasn't serious.  Insert LAUGH here).

Seriously don't know what "hook" refers to and I'm dying of curiosity.
I shall continue to be an impossible person as long as those who are now possible remain possible

live627

  • Should five per cent appear too small / Be thankful I don't take it all / 'Cause I'm the taxman, yeah I'm the taxman
  • Posts: 1,670


Nao

  • Dadman with a boy
  • Posts: 16,082

Re: Unknown's thoughts on Wedge
« Reply #73, on July 12th, 2011, 04:46 PM »
So I gather, from what I've read on this board. Can't wait to try it out.

Norodo

  • Oh you Baidu, so randumb. (60 sites being indexed at once? Jeez)
  • Posts: 469
Re: Unknown's thoughts on Wedge
« Reply #74, on July 12th, 2011, 04:58 PM »
A problem for SMF is that it actually has quite a few hooks, but people don't really use them as much as they should, from what I can see.