Okay, for those who have no idea what the heck YaBB is, I put up a Sport Pilot / LSA Forum using open-source forum software called YaBB (Yet another Bulletin Board). I've grown weary of phpBB and am lukewarm on SMF. Jesse wants me to go with vBulletin, but I like to support open-source (read: I'm a tightwad).
YaBB has some decent security features, it seems, including the ability to block individual functions when referred from outside the domain. Another standard function that's included is the ability to require users to authenticate their accounts by clicking on a link in an email after they pre-register.
So after two spammers got in (oddly encouraging, actually; at least someone has found the forum), I enabled the activation requirement, which is disabled by default. I didn't bother testing it because it's such a standard feature that I didn't imagine there would be a problem. I was wrong.
For some bizarre reason, by default, the ability to activate an account from outside the domain is also disabled by default. Now think about that: The activation is by clicking a link in an email, so it's always going to happen from outside the domain, isn't it?
I was looking through the server logs and found several failed activation attempts, which is how I found out there was a problem. Otherwise I wouldn't have known.
And by the way, the thread on the YaBB support forum about this issue doesn't even mention that you have to enable the activation function from outside the domain in a separate panel from the one enabling activation. The suggestion on the forum was to copy and paste the link. (That's what gave me the clue, though, to what the problem was.)
In any case, the fix took about a second once I realized what the problem was.
Overall, the YaBB software seems to work pretty well, but it's about the quirkiest forum software I've come across, and the docs can use major improvement. I'll probably wait and see what the next revision is like (there are supposed to be major improvements), though, before deciding whether to migrate to something else -- maybe even something that's not free.
Rich
YaBB has some decent security features, it seems, including the ability to block individual functions when referred from outside the domain. Another standard function that's included is the ability to require users to authenticate their accounts by clicking on a link in an email after they pre-register.
So after two spammers got in (oddly encouraging, actually; at least someone has found the forum), I enabled the activation requirement, which is disabled by default. I didn't bother testing it because it's such a standard feature that I didn't imagine there would be a problem. I was wrong.
For some bizarre reason, by default, the ability to activate an account from outside the domain is also disabled by default. Now think about that: The activation is by clicking a link in an email, so it's always going to happen from outside the domain, isn't it?
I was looking through the server logs and found several failed activation attempts, which is how I found out there was a problem. Otherwise I wouldn't have known.
And by the way, the thread on the YaBB support forum about this issue doesn't even mention that you have to enable the activation function from outside the domain in a separate panel from the one enabling activation. The suggestion on the forum was to copy and paste the link. (That's what gave me the clue, though, to what the problem was.)
In any case, the fix took about a second once I realized what the problem was.
Overall, the YaBB software seems to work pretty well, but it's about the quirkiest forum software I've come across, and the docs can use major improvement. I'll probably wait and see what the next revision is like (there are supposed to be major improvements), though, before deciding whether to migrate to something else -- maybe even something that's not free.
Rich
