At the same time there are valid reasons for folks to want to send a message to another board member without posting in public. Over at the phpBB2 Refugees site I got more immediate and vocal feedback. (Note: that link requires a login to the phpBB2 Refugees board.) As a result, the feature is in the process of being updated to include some new features. It has also been renamed from the “private” message system to the “personal” message system instead. Why is that?

Privacy Is A Myth

In general anything posted to the Internet is not private. (I am not going to consider encryption as an option for this discussion.) If you post on a message board, even in a private forum, someone else with access to that forum can read it and repost it elsewhere. If you send an email, someone can forward it to people you would rather not have read it. Basically the only way to ensure something stays completely private is to avoid posting it. Anywhere. Ever.

I frequently see topics at phpbb.com that ask questions along the lines of…

How can I read someone else’s private messages on my board?

Doesn’t the very question seem to contradict itself? How can I read a “private” message that belongs to someone else?

I see two questions that come from this. First, is it technically possible to do so. Second, is it ethically appropriate to do so. The answer to the first is clearly “yes” as there are several ways to approach the issue, and I will talk more about that in a moment. The answer to the second question is less clear. If someone has reported an issue with a PM and asks the board adminstrator to read it, then clearly it’s okay. But what if board member “Joe” reports to the administrator that board members “Jane” and “Jack” are using the PM system for inappropriate purposes. Is that enough to show “probable cause” and allow the board administrator to read those messages?

What if a board member hasn’t received any reports of abuse at all, but simply decides to go read all of the data stored in the privmsgs tables? Is that ethical? Is it legal?

I am not a lawyer, so I won’t try to answer the legal questions. I do, however, have a very strong feeling that it is not an ethical thing to do.

Why Remove It?

Ethical and legal questions aside, there was a very good reason why I removed the feature from my initial phpBB2 board. That board was a replacement for a mailing list. I was one of the most frequent contributors to the mailing list, and by definition my email address had to be public. It was, afterall, a mailing list. What happened was that people saw me answering a lot of questions (but not all) and therefore they assumed that they could send me a direct email rather than going through the list interface. I guess they assumed I had nothing better to do than read and answer their individual question. That assumption was wrong.

I had a standard reply to direct emails that went something like this:

Hi, I have a policy to not answer direct questions off of the list except for paying clients. By posting your question to the list you will get the attention of thousands of list members rather than just me. By answering questions on the list the entire community benefits rather than just one person. Thanks.

I had to send that message several times a month.

When we moved to the phpBB2 framework, I wanted to prevent that from happening again. I changed the default so that board member email addresses are hidden by default, and I completely removed the PM system. It didn’t seem appropriate to display the PM icon, only to present a board member with the “Private messaging has been disabled on this board.” message. At the time I was not smart enough to simply hide the PM button with a template switch, so I took it out altogether. As I mentioned in my opening paragraph, nobody complained until this year. I don’t think the community has missed the feature much.

How Can Private Messages Be Read?

I am not giving anything away here… these topics have been discussed quite often at phpbb.com from many different directions. There are several layers of access, starting from guest, then board member, then moderator, then board administrator, and finally server administrator. How can a guest read a private message? By having someone else post it in public. How can a board member read a private message? By having one sent directly to their account, or by having someone post something in public. Board moderators generally do not have access other than other board members, but board administrators do. If needed, a board administrator could change a user password, log in as that person, and read the messages direct from their inbox.

In most cases a board administrator is also the server administrator, with full access to the board database. At that point, all bets are off. Anyone with SQL access would be able to write SQL queries to retrieve any / all content from the phpBB2 board database. The table relationships are not that hard to figure out.

I have never seen a MOD that would allow board administrators or moderators to directly read the contents of the privmsgs tables, but it would not be hard to write.

All this means is there are both social and technical leaks in the so-called “private” message system. These leaks, along with my desire to avoid private requests for help on a public board, lead to my decision to remove the standard private message system altogether, rather than just disable it.

Personal Messages Are Not Private

Due to the requests from other members of the phpBB2 Refugees site I am bringing this feature back into the board code. However, the first thing I did was replace every occurrence of the word “private” with “personal” instead. Why take this approach?

In my opinion, when you call something “private” then board members would expect some level of privacy, despite all of the issues that I have already outlined. Since privacy is clearly not an option, I have changed the wording to attempt to circumvent any complaints. I have updated the privacy policy on the board to reflect this change. By default users are not allowed to receive PMs; they must opt-in by updating a setting in their profile. The privacy policy clearly states that the board administrators are able to read any / all messages sent through this system. Even the profile page has a nice read banner making it very clear that PMs are not private.

I just posted a brief note about this on the Refugees board today. It will be interesting to see where the discussion goes. Right now the only visible changes on the board are to the language files and to the user profile screen. I am going to watch for comments from other board members for input for the next few weeks, just to see how they feel about the change. Once I get a general feel for whether the community will accept it or not, I will complete the updates to the permsgs.php code. Yes, I am even going to change the name of the file.

Related Links

• Wiki on Probable Cause in US law

Our web site for continued support of phpBB2 reached 100 registered and activated users a few days ago. We also have several thousand posts. Based on the statistics I collect we have also seen a few days with more than two thousand page views.

We’ve had some interesting discussions that are not strictly limited to phpBB2, so you might want to check us out.

As promised, the support forums at phpbb.com for version 2.x were closed this month. The formal announcement is here if you want to read the full text. The important part is (in my opinion) this paragraph:

The phpBB2 support forums have been locked and will remain available in this “archived” state for a number of months, purely for reference purposes. Most phpBB2 resources have been removed from the Support Section of the site and further pruning will take place within the next few weeks. phpBB2 Knowledge Base articles will be reposted in the archived forum.

There is no specified end date for the 2.x support forums given, but the implication is quite clear: at some point even the locked forums will be dropped or at least hidden from public view.

The 2.x MOD Writers and MOD Requests forums were locked several months ago. The MOD Development 2.x forum remains open for replies to existing topics, but no new topics can be started. On February 1st even that forum will be closed. So where does that leave me?

I am in the process of porting the phpBB Doctor MOD Catalog over to phpBB2 Refugees and will be moving all of my MOD development and support to that site, at least for public MODs. Private MODs for paying clients will continue to be hosted on the board on this site. I am going to update each of my MOD topics (both dev and released) at .com to link to the new topics once I get them set up so people will know where to find me.

The Styles and MODs forums are guaranteed to remain visible until May 1, 2009, as stated in this topic. After that point they may (their words, emphasis added by me) be removed from public view.

If you aren’t subscribing to the podcast via iTunes (or other similar option) then you can listen to the discussion on their site.

It was not the first time I have been on the podcast, but it is the first time that something I have done was the subject of the podcast. That was fun.

Today we officially launch the phpBB2 Refugees site. The past few months have been used to test and tweak the code as well as set up some of the documentation and lay the groundwork for future growth. As mentioned previously, I got to talk about this project on the phpBB Weekly podcast last Saturday.

The site will open with a focus on building the community and setting up for support. The next phase will include special handling of MODs and Styles, and we hope to have those ready to go early next year.

So come on over and check us out, see if you like what you see.

Do you plan to create a “fork” of phpbb2?
At this time, no. That is something that the community will decide. A “fork” – for those that might not be aware of what that means – would be created if we take the most current release for phpBB2 (at this time 2.0.23) and release our own version. It would have to be something different that 2.0.24 at that point because it would not be an official phpBB Group release.

Aren’t you concerned about security in phpbb2?
Yes. More on that in another post.

Are you running on the phpbb.com server?
Nope. I have leased a dedicated server with a quad core CPU plus 4GB RAM and 250GB of disk space. The contract allows me to use up to 2TB of bandwidth each month. The site is completely separate and independent from phpbb.com.

Will there be ads on the new site?
Nope. The plan is to remain ad-free until we determine if the community needs more funds, at which point I will consider advertising. I don’t expect to have to even consider this until we reach somewhere in the neighborhood of several thousand members or 40-50GB of monthly bandwidth.

Without ads, how will you pay for the site?
I have another board that generates enough income to support this board as well. The other board also runs phpBB2.

Why do the site without advertisements? Are you concerned that it won’t be profitable?
That’s not the reason at all. I want to be sure that people realize that this community is being founded for the benefits of the members, not the benefits of me. I don’t have any problem with people having advertisements on their site. My largest board has banner advertisements, and that’s partially how I can fund the server for the Refugees board. While I don’t rule out the potential of having ads at some point in the future, until we need them we won’t have them.

What about donations?
I don’t have any plans to set up a donations page for the same reasons mentioned above.

Will you host the downloads for phpbb?
At this time, no. We will have a link to the sourceforge area where phpbb2 code is maintained. If at some point the phpbb2 code is removed by the phpBB Group, I have an archive of versions dating back several years that I can post. I don’t see any need to do that unless it’s required (see the notes on the “fork” question above).

Are you running phpBB2 on the new board?
Of course. It would be hypocritical not to do as much, wouldn’t you think?

Are you running a “vanilla” or unmodified board?
Nope. As stated above, I am combining what I believe are the best features from BOB – a phpBB2 board that has been in action for over six years – and this site into a modified board that has phpbb2 at the core. The point of the site run by phpbb.com was to show exactly what people would get if they download the phpbb2 software. The point of our site is to show what can be accomplished with some imagination and effort… to show there is life left in the phpBB2 core.

Will you provide the source for your board as a download?
No, the source for the Refugees site will not be available for download. There are reasons for that which I may go through in more detail in another post, but the main reason is that the Refugees site does not run on php alone. There are a number of perl scripts and cron jobs that help make the board more efficient or provide new features. I don’t intend to provide a download for the Refugees site because I don’t believe it can be supported in the same way that a pure php solution can be. If the source code was released, it would have to be as a “fork” (again, see above).

Will there be Berties?
I actually had someone ask this the other day. Jon has a supply of Berties and I don’t see any reason to try to start something else along those lines. So the answer is no Berties from me. If you want one (or more!) simply use the existing order page.

I am an enthusiast, what can I do to help?
This is my favorite question. Join the board (once it’s open) and help people. Help build the community. That is the best thing that anyone can do to help.

Many of these questions have been incorporated into the FAQ at the phpBB2 Refugees site, but I thought it would be worthwhile to post them here in advance of the site opening date. As stated at the beginning of the post, if you have other questions please feel free to post them in the comment form.

In the last few months there really hasn’t been too much said about the decision. I expect that might change once things actually close.

Based on my own analysis, I have decided to stay on phpBB2 for at least another year or two. At this point I believe I will be waiting for 3.2 to be released before I reconsider migrating forward. As a result I will remain involved and interested in phpBB2 matters for a while. I have long suspected that I am not alone in this situation, and recent conversations have not done anything to change my opinion. For that reason (and more) I am proud to make the pre-launch announcement of a new site. I give you: phpBB2 Refugees

Now if you click that link today, as I post this, you won’t be able to get in. Not just yet. The domain is active and the site is there but we (yes, I said “we”, more on that in a moment) are working on a few finishing touches before the site opens for registrations.

Why wasn’t this announced earlier? Since I am on the moderator team at phpbb.com I wanted to make sure that I did not step on any toes or upset any group policies by starting this site. It took a while to discuss, but ultimately I was told that as long as I made it very clear that this site was not official in any way (despite my position on the team) that it would be fine. I don’t have a problem with this at all. This is going to be my site and will be completely separate and distinct from anything going on at phpbb.com.

I got the domain back in July. I started a lease on a new server about two months ago. Since then I have been working at combining code from this site (phpbbdoctor) and my largest phpBB2 board (aka “BOB” that I often talk about) to take the best of both. While working on some styles issues (I like designing web sites, but graphics is not my strongest area) I passed a few questions by some other folks. Two things happened… first, I got help. Second, people got excited about the site, and I think that’s good too.

When I launched BOB we started with a core of about 5 folks at the beginning. For the next few months we sent out invitations to other folks on the mailing list that we were replacing asking them to join. The idea of starting out slow like this was to build the site based on input and feedback from the initial members. (Case in point: The “User Selectable Board Width” MOD I wrote about recently came about because of a suggestion from an early Refugeees member.) Before BOB launched we had spent a bit over two months doing an extended test run and had about 70 members by the time the site was officially launched. That model worked very well for us and I hope it will work for Refugees (albeit on a bit more compressed time frame) as well.

Frankly I am encouraged by the similarities that I see between the launch “BOB” and the Refugees site. Both were created because an existing resource (a mailing list in one case, the official forums in this case) was being retired. Both had existing user communities, meaning we’re not trying to create something from nothing, we’re simply trying to prepare a “continuation” site. For the record, “BOB” started our seventh year in August of 2008. While I don’t necessarily expect the Refugees site to last that long, if it does last, I will continue to support it.

Here is my committment to the community: I am starting this site because I believe there will be a use for it. I will keep the site active and support it with my own presense for a minimum of two years from the launch date. If at that point the site is not required because of any reason, we (the community) can decide if the site needs to be retired or what other steps should be taken. What I am trying to say is that I am definitely giving this site a minimum of two years to become successful. Don’t take that as an implication that I will shut it down after two years please, as that is not the intention. All I am saying is that if it’s not successful in the next two months … six months… or even the next year… it’s still not going to be shut down.

How successful will it become? Ultimately that is up to the community. If people join and help each other, it will become a success. It’s going to take more than one or two people to make this happen.

Now about this “we” I mentioned earlier…

I have already talked to Robert (aka Lumpy) about his site at phpbbusers.com. I am pleased we are going to be combining our efforts, with more details to be posted shortly. I have one of the members of the phpBB Styles team helping out with setting up the styles area, and I’m really excited about that since styles is my weakest area. A few of the folks from the bbProtection project are already on board and helping me test out the new site. Another team member from phpbb.com owns the domain “phpbb2support.com” and has volunteered to forward it to the Refugees site. All of these are positive developments in my opinion.

If you have an interest in phpBB2 and would like to participate in the “early release” efforts, please send me a PM at phpbb.com and I will get you more details.

The current plan is for the site to be completely open for public registrations and use in December 9th.

Can anyone think of why that date might have been selected?