unpanyWoomy INSANITY brisenserioff

wewcoidsSwels P90X steeksbek
accogeGap P90X2 Serefientee
Immadrami INSANITY Aidetrete
UndotaCreanna TURBOFIRE diesinkkila

bispFoetweips Wrote:
-------------------------------------------------------
> wewcoidsSwels P90X steeksbek
> accogeGap P90X2 Serefientee
> Immadrami INSANITY Aidetrete
> UndotaCreanna TURBOFIRE diesinkkila


Can we stop this sort of rubbish? Please.

Forum posting should be limited to users that have made a deposit. For the extreme minority of cases where a potential depositor needs to ask a question they should be directed to the contact us page.
Having said that, I've only seen a few spam posts so perhaps the cost outweighs the benefit.

An alternative would be to make a few trustworthy members forum administrators (a common solution among online communities). This could save a small amount of administrator time - which appears to be stretched especially thinly at the moment.

ImNotPsychic Wrote:
-------------------------------------------------------
> Forum posting should be limited to users that have
> made a deposit. For the extreme minority of cases
> where a potential depositor needs to ask a
> question they should be directed to the contact us
> page.
> Having said that, I've only seen a few spam posts
> so perhaps the cost outweighs the benefit.
>
> An alternative would be to make a few trustworthy
> members forum administrators (a common solution
> among online communities). This could save a small
> amount of administrator time - which appears to be
> stretched especially thinly at the moment.


The problem is, it appears that the OP is not a member. So, if not a member how are they able to post and is there a way to stop occurring?

I see your point

Test Wrote:
-------------------------------------------------------
> I see your point


Thanks Test but the concern I have is, if the forum is on a secure server (https) then is there a similar vulnerability on the trading server?

ORACLE Wrote:
-------------------------------------------------------
> Test Wrote:
> --------------------------------------------------
> -----
> > I see your point
>
>
> Thanks Test but the concern I have is, if the
> forum is on a secure server (https) then is there
> a similar vulnerability on the trading server?

SSL (HTTPS) has little to do with app security. This is a common misconception.

All SSL does is prevent snooping on the connection between you and the server (so, for example, no one can steal your password or credit card number when you submit a form). It is about privacy, not security.

If someone has found a bug in Phorum that allows posting without an account, that would exist with or without SSL. The bug also likely has nothing to do with the trading application. I don't think you should be worried - except that it might be evidence sysadmins aren't keeping software patched and up-to-date.

Thanks eeyore, I really appreciate your help, as I think the best security is understanding a bit about what we use.

From the Phorum homepage: "...allow a webmaster to create modules for using external authentication"

By the looks of it, they haven't integrated the Membership provider for iPredict (the thing that handles logging in and out etc.) with Phorum.

So it's not a bug as such, it's probably just been left out to save resources.