Context: I'm still on the search for a replacement for bbs on def4, which is:
-low resource
-stable (as in: mature code)
-not written in php
-working without js
The point here is to have a lightweight fallback solution which is not written in the same language as all the other nodes (which is php), can read nntp from a local or remote server, and displays it on a website.
Extra points are given for easy installation (including no db should be needed) and easy maintenance.
I have now looked at and played with several different codes, and I see two basic ways which could be fun to explore:
1) take one the existing news clients in python, and just plug the output into one of the python forum libs (guess flask would do it). I guess that would be minimal coding effort, as most of the heavy lifting was done and exists as libs. And as always, I find python code very concise, the code for an overboard was about 6 lines.

2) take a screenbased newsreader and webify the output with a webshell or terminal emulator of some kind. In the researches I stumbled (among many others) across lynx, which has a perfectly straightforward newsreader interface (just tried it out before on rslight.i2p, and yes, I knew lynx before, but I had never used it as a newsclient). lynx is completely scriptable, so it would be quite simple to have predefined calls for each purpose (so that the webshell does not really need to be interactive).
I think I like the second way most, it would be fun to have a retro page like that.

cheers

trw

I can just use
# lynx -dump
and have a nice and tidy output of text and links (which I could again format to some html, without the usage of a webshell). Very nice.

--
Posted on def2

and this is the code that fetches a newsgroup with lynx and rewrites all the links displays as html:

function forum()
{ lynx -source nntp://$server_ip:$server_port/$Group_id | sed -r 's,(newspost|nntp)://,http://,g' | sed -e "s,$server_ip:$server_port/,$node_address/?1=,g"
return
}

>>295536fd9877e562d2
http://acmsrfsbsogtuhvk.onion/bbs/alpha/

To do:
-add and debug navigation elements
-registration
-posting
-images: decoding, display or link
-attachments: decoding, link
-caching of groups and messages

I decided that I will make def4 without threading, and with mandatory, captcha secured registration (no anonymous posting), once I roll out bbx.

trw

Anonymous wrote:

>>>295536fd9877e562d2
> http://acmsrfsbsogtuhvk.onion/bbs/alpha/

That looks awesome! Back to the green screen :)

Is the formatting done by lynx, or yourself?

--
Posted on Rocksolid Light
dkzerogt6z6ybhcj.onion

>>e84a2244ffea6ec06f
thanks for the nice feedback.
lynx (with the -source switch) delivers the html which it would normally display on its own screen, (mostly this means taking care of the links in group view, the messages are actually just text snippets).
Then the green design of the site as such (the font, background pic and the effects), this is something for which I found bits and pieces on the internet and adapted them to my needs (it's all in the css, so it's simple to transfer).
using lynx to fetch the actual news content reduced my code by at least half, maybe even more (and it was the less good half of the code that went :-) ).
I think that (smaller and better) codebase is something that could be maintained also over a longer period without issue, so guess I will release it as a replacement for bbs. The look and feel will always be basic compared to more complex forum software, but so be it (at least the design is reflecting this as well now :-) ).

trw

--
Posted on def2

On Wed, 16 Dec 2020 03:33:10 -0800
Anonymous <poster@anon.com> wrote:

> snippets). Then the green design of the site as such (the font,
> background pic and the effects), this is something for which I found
> bits and pieces on the internet and adapted them to my needs (it's

I'm pretty impressed with the font etc. Nice css work!

> all in the css, so it's simple to transfer). using lynx to fetch the
> actual news content reduced my code by at least half, maybe even more
> (and it was the less good half of the code that went :-) ). I think

I added lynx as a door a few years ago in synchronet and it worked
great, but one thing I found I had to be careful with and disable was
that by default lynx would allow shell escapes, which I really didn't
want users doing :)

I don't know how commands will be sent to lynx with bbx, but it's
something to consider to make sure it's not possible to do this.

> that (smaller and better) codebase is something that could be
> maintained also over a longer period without issue, so guess I will
> release it as a replacement for bbs. The look and feel will always be
> basic compared to more complex forum software, but so be it (at
> least the design is reflecting this as well now :-) ).

It's a very unique design (in 2020). Kind of a fun interface.

>>9c7631636504114e50
>I added lynx as a door a few years ago in synchronet and it worked great,

what does that mean: "as a door" ?
>that by default lynx would allow shell escapes,

I checked for that, was not the case for me (unless I checked the wrong things). At least I was not able to inject any commands that way (over the webui).
Can you give an example of a successful attack string ?

For the design: I have to say that the hard work in this was done by somebody else (for free, as in free beer). I just adapted some sources to my needs. And yes, I am quite pleased with the outcome myself. I can also see that it is already used, although half the functionality is missing yet. :-)

--
Posted on def2

>>9c7631636504114e50
thanks for highlighting this, a quick search bŕought me to this page:
http://www.math.utah.edu/lab/man/lynx.html
and so I added
-restrictions=shell,suspend,editor,exec,exec-frozen
to the call of Lynx.
I have tried to break into my box with this way before, and did not succeed. If you know of any possible exploits here, it would be highly appreciated.

--
Posted on def2

On Wed, 16 Dec 2020 16:26:05 -0800
Anonymous <poster@anon.com> wrote:

> >>9c7631636504114e50
> thanks for highlighting this, a quick search bŕought me to this page:
> http://www.math.utah.edu/lab/man/lynx.html
> and so I added
> -restrictions=shell,suspend,editor,exec,exec-frozen
> to the call of Lynx.

Ah, you already found it, nice!

On Wed, 16 Dec 2020 16:05:14 -0800
Anonymous <poster@anon.com> wrote:

> >>9c7631636504114e50
> >I added lynx as a door a few years ago in synchronet and it worked
> >great,
>
> what does that mean: "as a door" ?

A door is like a portal to an external program for a bbs. Mostly used
for games (commonly called 'door games'). I set up Synchronet to have a
menu option to browse the web, and it then provided you a lynx
interface (by actually running lynx and letting you use it).

> >that by default lynx would allow shell escapes,
>
> I checked for that, was not the case for me (unless I checked the
> wrong things). At least I was not able to inject any commands that
> way (over the webui). Can you give an example of a successful attack
> string ?

It's not really an attack string, but when I had it running in
Synchronet, a user could (no one ever did), just use the built in
command in lynx to jump to a shell prompt. I didn't want that, so I
specifically disabled that feature in the command string to run lynx.

I'm guessing that a bbx user can't really issue a lynx command
directly, but just wanted to mention that I believe lynx supports such.

Retro Guy

https://insecure.org/sploits/lynx.download.html
Report is from 1997, maybe this is fixed by now ? Or maybe not...I will play a little with that.

--
Posted on def2

>>cef79e59c453b34000
I understand that you describe the interactive mode of Lynx, so this does not concern my setup (I use predefined calls where the hostname and everything is fixed, and the user input is used as a group or message. My concern here was that separate commands could be injected this way, but I have not managed to do this). Still good to know, thanks.

A little research shows that Lynx has a pretty good track record:
https://www.cvedetails.com/vulnerability-list.php?vendor_id=5836&product_id=9869&version_id=0&page=1&hasexp=0&opdos=0&opec=0&opov=0&opcsrf=0&opgpriv=0&opsqli=0&opxss=0&opdirt=0&opmemc=0&ophttprs=0&opbyp=0&opfileinc=0&opginf=0&cvssscoremin=0&cvssscoremax=0&year=0&cweid=0&order=1&trc=5&sha=3f93be2ac58707975914133ab453aee7b2962f26

Of course somebody could probably still worm their way in, we will see :-)

--
Posted on def2

>>a55e5ab21cc1bd63aa
Added some navigation elements. When in message view mode, you can now do:

TAB+ENTER --> previous article in newsgroup
2xTAB+ENTER --> next article in newsgroup
3xTAB+ENTER --> reply to message
4xTAB+ENTER --> go to newsgroup overview

The reply is not working yet (as posting is not working yet), and the whole thing needs a little more attention.
But I like the concept.

--
Posted on def2

>>fff88d7f44d4364155
The whole site can be navigated with TAB + Enter now.
From the landingpage:
1x TAB goes to the first group from the top,
2x TAB to the second group and so on.
From a groupview:
1x TAB goes to earliest article on the page
2x TAB goes to the latest article on the page
From the articleview:
1xTAB --> previous article in newsgroup
2xTAB --> next article in newsgroup
3xTAB --> go to first reference of article (thread upstream, if existing)
4x TAB --> reply to message
5x TAB --> go back to groupview

I am actually faster with this navigation than with my mousepad.

Open for feedback here...

--
Posted on def2

>>a55e5ab21cc1bd63aa

To do:
-registration
-posting

Done
-add and debug navigation elements
-images: decoding, display or link
-attachments: decoding, link
-caching of groups and messages

As a test a little text file attached.

On Fri, 18 Dec 2020 13:44:53 -0800
Anonymous <poster@anon.com> wrote:

> >>a55e5ab21cc1bd63aa
>
> To do:
> -registration
> -posting
>
> Done
> -add and debug navigation elements
> -images: decoding, display or link
> -attachments: decoding, link
> -caching of groups and messages
>
> As a test a little text file attached.

I should have read this first :) I posted on the site and it's very
easy to work with. It looks great, I really like it :)

Looking forward to interacting with it further.

>>a863426172a4dfc911
yeah, registration and post have been last on the list, I have the code laying around, so it is just to implement the functions (I will even take the accounts from bbs over). but first i wanted it to be usable for reading, and at least for me it is now (and seems to you as well, thanks for the testing and feedback). In fact, I like the navigation by keyboard a lot now.

When I was playing with the code for the attachments, I had one more idea:
following the concept from here:
http://z5bqfv5v75kxy7pj.onion/soc/res/96.html
where the user always attaches a signed version of the message as an asc file, it would be rather simple to validate the signature server side and show some kind of icon to the user (validated or not validated).
Most of the code to do that I have already written for boxs...and I guess in php it would not be too hard either (thinking about fudforum, rslight and vichan here).
If we would roll that out on all nodes, we would have indeed an identity management fully independent from platform or code, just like described in the original post (of course, each node could still handle local accounts in any way they want).
Would be neat, I think. What do you think, Retro ?

cheers

trw

Registration works.
All the accounts made on def4 are valid as well, and will stay valid.
Posting works, not sure about attachments yet.

--
Posted on def4

A little cleaning up here and there, then I will switch def4 to bbx.

--
Posted on def4

On Sat, 19 Dec 2020 12:26:11 -0800
Anonymous <poster@anon.com> wrote:

> When I was playing with the code for the attachments, I had one more
> idea: following the concept from here:
> http://z5bqfv5v75kxy7pj.onion/soc/res/96.html
> where the user always attaches a signed version of the message as an
> asc file, it would be rather simple to validate the signature server
> side and show some kind of icon to the user (validated or not
> validated). Most of the code to do that I have already written for
> boxs...and I guess in php it would not be too hard either (thinking
> about fudforum, rslight and vichan here). If we would roll that out
> on all nodes, we would have indeed an identity management fully
> independent from platform or code, just like described in the
> original post (of course, each node could still handle local accounts
> in any way they want). Would be neat, I think. What do you think,
> Retro ?

I like the idea. We may have discussed similar before, or maybe that
was some conversation that took place inside my head, lol.

A currently undocumented 'feature' of rslight is to display when a post
was made from the site you're viewing on. The point was to keep people
from posting from elsewhere and impersonating a user on the site. Right
now, it simply displays the poster's username in italics, so if you see
that on my sites, it means it was really posted here. This is done with
a hash based on the message itself, and an internal site key.

It wouldn't be hard to make it specific to a user and not just the
site. rslight users already have a 'key' that can be used, or we can
use another method. If we can come up with a standardized method for
nodes, I'm all for it.

Retro Guy

Just posting on this site from the past (green screen lol)

Retro Guy

--
Posted on def4

RetroGuy wrote:

> Just posting on this site from the past (green screen lol)

Well, that works nicely!

--
Posted on Rocksolid Light
news.novabbs.org

>It wouldn't be hard to make it specific to a user and not
>just the site. rslight users already have a 'key' that can be
>used, or we can use another method.
>If we can come up with a standardized method for nodes, I'm
>all for it.

If we take valid pgp signatures as credentials, we are fully interoperable, and get rid of a whole lot of problems that other methods would pose (like how to securely exchange account data between nodes and such), with this method every authentication is public and contained in the message itself.
And yes, I remember similar discussions between us from before, but this solution would have some big advantages imo.

--
Posted on def4

....and so are the screens :-)

I am quite pleased with the outcome so far, just have to implement proper uudecoding for embedded attachments and proper checks if an attachment is actually encoded or not (some nodes don't encode text files, some do). Also some work left to do on the code to make postings to remote servers with lynx, and finally to clean up.

The handling on bbx is different to rslight or vichan, where you have all the latest news on one glance, using the respective overboards. On bbx it takes much longer to check all the groups individually. This makes it more inviting to scroll through older messages as well (least for me). So it is a slower way to use the forums, and it is kind of nice if have the time (if you just want to spent two minutes checking for the latest, the other nodes are better).
It is also nice to have one node where posting is only possible with credentials. Anonymous posting certainly has its merits and advantages, but so does posting with an identity (average quality of published content is usually higher imo).
So in the future, it will be like:
def2 --> forced anonymous
def3 --> choice between anonymous (guest) and account
def4 --> mandatory account

--
Posted on def4