2020-04-01, 08:12 PM
Hi,
I just want to chime in here.
I understand where you are all coming from. A lot of you have invested considerable time, energy and money into your sites and the MyBB platform and are understandably concerned about the direction of the project as a whole. I know that we haven't done a great job in managing expectations or keeping you all updated with what's going on. I wish we could have done more to keep everyone up to date.
I want to address some points head on first:
I also just want to mention some of the other tasks that happen that may not be front and centre for most people from my perspective (these are all tasks I perform - I can't talk for other team members). Some people may look and believe the team aren't doing anything, when we're actually busy.
If anybody has any other specific concerns or questions that they feel I haven't answered or haven't answered sufficiently, please post them here or PM me. Any PMs will be posted here for a public response though, I must warn.
I want to be as open and public as possible. I too have invested a lot of time into this project. I might not have contributed as much financially a some others have, but I would be incredibly sad to see the project disappear.
I just want to chime in here.
I understand where you are all coming from. A lot of you have invested considerable time, energy and money into your sites and the MyBB platform and are understandably concerned about the direction of the project as a whole. I know that we haven't done a great job in managing expectations or keeping you all updated with what's going on. I wish we could have done more to keep everyone up to date.
I want to address some points head on first:
- MyBB should become paid software
MyBB prides itself upon being free and Open Source. I don't see this changing any time soon.
MyBB isn't current registered as a company or a non-profit or incorporated in any way whatsoever - it is a loose collection of individuals contributing their time and effort towards a common goal for no reward. If MyBB were to register as a company or non-profit (and there would certainly be advantages to doing so as I see it), it would require the project owner (Chris) to do so and in the past he has been reluctant to do so.
- MyBB should hire paid developers to work on the project
We've tried bringing in developers from outside the community before, and it's never ended well. Most may contribute a couple of times, then usually drop out. Some don't contribute at all.
The way I see it, the people best placed to contribute to the project are those who actively use the software - they know how it works, and they know which bits of it needs improving.
As such, one approach that we're considering approaching is the idea of bug bounties. There are several platforms that already exist to work with Bug Bounties, such as Bountysource.
The way this would work, is community members (including team members) would post monetary bounties on existing GitHub issues for the project. Developers could then tackle these issues, and claim the bounty after the contribution is merged into the core. This offers a financial incentive for contributing, and lets users "put their money where their mouth is" as it were.
Should this be considered a good idea, the next step for us would be to decide a common platform - ideally, all bounties would go through a single platform rather than being spread across multiple different platforms. We would need community input here for definite.
- If the new theme is done and the new template system is done, what are we waiting on?
The codebase for 1.9 is currently sitting at the same level in terms of bug fixes as 1.8.17. All bugs and security issues that have been patched since then are not patched in the 1.9 codebase yet. This is because we failed to keep the two trees in sync as we worked on the templates. When we talk about rebasing, we're talking about bringing the two branches in sync.
- I'm worried that after 1.9 is released, 1.8 will be abandoned
We've made a public commitment that after 1.9 is released, 1.8 will be supported for at least a year. This support will include back ported bug fixes and security patches.
- A new responsive theme is the TOP priority, we don't need a new template system
A new responsive theme is indeed the top priority. However, creating one required rewriting all of the templates anyway. Whilst doing so, we wanted to improve the templating system as much as we can. We chose to use Twig as an off the shelf product for multiple reasons:
- Built in filtering and escaping to prevent XSS vulnerabilities, which have been the most common types of vulnerabilities in the 1.8 series
- Built in support for conditionals and loops, replacing the need for plugins like Template Conditionals and PHP In Templates
- Built in support for loading templates from disk rather than from the database - we've had many theme developers request the ability to be able to edit templates from their own text editors that thy are already comfortable with that support features like syntax highlighting, find and replace, columns select, etc.
- Built in filtering and escaping to prevent XSS vulnerabilities, which have been the most common types of vulnerabilities in the 1.8 series
- MyBB 1.8 works great, why do we need an updated 1.9?
Yes, MyBB 1.8 works fine as it is, but there are plenty of problems. Here are just a few off the top of my head:
- Repeated reports of XSS issues, stemming from a lack of escaping of outputs - moving to Twig will all but eliminate this problem
- Weak password hashing - the built in password hashing scheme in 1.8 of
md5(md5(salt) + md5(password))
is trivially weak, especially in the modern era of GPU based cracking
- No responsive theme (obviously)
- Lack of support for modern systems and tools - one example I'm often asked about is the ability to use Redis as the cache system. 1.8 doesn't support Redis at all, but it does support eAccelerator - a project that is deprecated and hasn't been supported since PHP 5.3... We need to make sure we support modern tools and technologies, and drop support for old and abandoned tools and technology when they reach end of life
- Repeated reports of XSS issues, stemming from a lack of escaping of outputs - moving to Twig will all but eliminate this problem
- MyBB makes decisions behind the scenes and doesn't involve the community
Some decisions still happen behind the scenes, mostly related to moderation issues and server administration.
Any decisions on future direction, code, issues, etc. happen fully in the open. They are split across several locations though:
- GitHub - watch for new issues - and not just on the main mybb/mybb repository. We have a lot of repositories, including a public repository for blog post drafts that barely anybody from outside the team ever contributes to.
- The forums - threads such as this, the new pre-release threads for new versions, my original post suggesting 1.9 as the future direction, etc.
- Discord - I know many hate it, but it's a very useful tool for short form discussions. If people ping me on there, I get a near instant notification to my smartphone/tablet and (assuming I'm awake) I try to respond within minutes when possible.
I'm sure we could be more open, and that's something we're trying to improve as much as possible. If anybody sees something mentioned or happening that they believe has come out of nowhere as a behind the scenes decision, please call us out on it and we'll do what we can to make it more open.
- GitHub - watch for new issues - and not just on the main mybb/mybb repository. We have a lot of repositories, including a public repository for blog post drafts that barely anybody from outside the team ever contributes to.
I also just want to mention some of the other tasks that happen that may not be front and centre for most people from my perspective (these are all tasks I perform - I can't talk for other team members). Some people may look and believe the team aren't doing anything, when we're actually busy.
- Answering emails to [email protected] - these emails include support requests, general questions, requests for us to remove content from sites using MyBB or to remove sites entirely using MyBB. We also get emails requesting password changes. We usually get a couple of these every day and only 3 or 4 staff members receive the emails. I try to respond to these as quickly as possible.
- Answering questions and discussions on IRC - I always idle on the #mybb channel on free node (and am one of the few staff that does). I get a notification for every message sent to it, and try my best to respond to any questions/issues.
- Answering threads in Private Inquiries - these include username changes, community grievances, requests to remove content an account, etc. Only a few users have ACP privileges to handle some of these requests, myself included.
- Sever administration when something goes wrong - as happened just the other day - the whole community forum was down until I woke up and fixed the server.
If anybody has any other specific concerns or questions that they feel I haven't answered or haven't answered sufficiently, please post them here or PM me. Any PMs will be posted here for a public response though, I must warn.
I want to be as open and public as possible. I too have invested a lot of time into this project. I might not have contributed as much financially a some others have, but I would be incredibly sad to see the project disappear.