[@foxly Participant 16 years, 1 month ago]

BP Album+ now has it’s own dedicated forum, located here:

https://buddypress.org/community/groups/bp-album/forum/

QUESTIONS ON THIS THREAD WILL NO LONGER BE RESPONDED TO
QUESTIONS ON THIS THREAD WILL NO LONGER BE RESPONDED TO
QUESTIONS ON THIS THREAD WILL NO LONGER BE RESPONDED TO

[@foxly Participant 16 years, 1 month ago]

Probably within the next week.

We’ve both got our new code finished, and we should be doing our merge shortly.

^F^

[@foxly Participant 16 years, 1 month ago]

I think, overall, the core devs have approached BP development in the most effective order possible.

There really isn’t much point in adding spam protection to a platform nobody uses, and nobody would be using BP if the core developers had spent the past two years hardening it with spam protection instead of adding member-centric features.

But we’ve hit “critical mass” now …and we have to deal with the spam problem before BP is ready to move from a science experiment people use on hobby sites to a “platform” that developers can use for serious commercial endeavors. And I’m willing to throw a sizable chunk of dev time at it to help make that happen.

Anyhow, at this point I’ve written the first draft of the proposed changes to the forum, and what I need now is everyone to read through it and post their feedback.

Seriously.

Because if something in the proposal doesn’t work for your application …or you can think of a better way to do it… you’d better get a post up NOW before we start writing code.

Thanks!

^F^

[@foxly Participant 16 years, 1 month ago]

PART 3 – STRONG -vs- WEAK METHODS

When it comes to spam on BP sites, you’ll see all sorts of stuff posted on blogs saying “change [whatever] on your site and your spam problem will disappear”.

Truthfully, a lot of these tricks will actually work …for a while… but eventually, the spammer makes a minor change to their bot, and they’re back in business. In fact, many of the leading blog spamming packages include sophisticated logging features to catch the errors that “uniquely configured” blogs generate and help the spammer quickly fix the “problem”.

If we’re going to have a reliable anti-spam solution for BuddyPress, we should probably focus on “Mathematically Strong” methods, not on “Obfuscation” and “Moving Things Around”. That way, we won’t have to constantly change our spam protection methods.

Changing Page Slugs

Many people recommend changing the page slugs on BP installations to reduce spam. While this is certainly easy to do, you of course need to give your users *links* to those page slugs somewhere on your site so they can actually visit the pages. And if users can follow the links, so can a spam bot.

Changing page slugs is kind of like boarding-up the front door of your house, installing a new door in the side of your house, and then attaching a piece of string from the front door to the side door of so everyone can find the new door.

The “change your page slugs” approach seems to come from the “change your admin menu URL” technique. Changing your admin menu URL is actually a *strong* protection technique. Since there is no link to it anywhere on the site and you’re the only one that knows the URL, it’s like having two passwords on your admin login. An attacker would have to try billions of URL’s to find it.

Not so with all the other URL’s on your site. They have to be linked off other pages so your users can find them.

Adding Fake Form Fields

Many people recommend adding a few extra fields to forms throughout your site (sign-up, login, post to group, etc) and “hiding” these fields using CSS. If any of the “trap” fields are filled out, in theory, you’ve just detected a bot, because a normal user would never see the fields and fill them out.

This approach *might* defeat a very simple bot that searches every web page it can find for forms, and fills every field in every form with random spam; but it will not defeat a bot that understands CSS or is specifically targeted at BuddyPress, especially considering that BuddyPress is *open source*.

Don’t think bots can analyze CSS? Read this: http://www.google.com/support/webmasters/bin/answer.py?answer=66353

A bot designer can simply read through the BP source code and discover the names of the fields that should be filled in and the names of the fields that should be left empty.

To use our “house” analogy, adding extra form fields is like installing 3 front doors on your house and rigging two of them with grenades …then hanging a big red “out of order” sign on the the two rigged doors so your friends don’t use them.

Obviously if your friends can read the signs, so can your enemies.

JavaScript Proof of Work

Javascript proof of work (Wp Hashcash) defeats spammers by making visitor’s web browsers solve a math problem in JavaScript before they are allowed to post.

Because everyone knows spam bots can’t run JavaScript.

http://forums.digitalpoint.com/showthread.php?t=1124949
http://www.scrapebox.com/
http://blogcommentdemon.com/
http://www.senuke.com
http://www.botmasternet.com/more1/

Except when they can.

There’s also the issue of what to do with visitors that don’t have JavaScript enabled.

The WordPress and BuddyPress development teams have put an epic amount of work into ensuring both platforms will work reliably when JavaScript isn’t available. Requiring users to have JavaScript to post any kind of content to the site nullifies much of this work.

Proof-of-work was a great idea back in 1997 when spammers ran hundreds of attack threads from a single server and solving the JavaScript math problems slowed it to a crawl.

In 1997, we’d be dealing with a single spammer running 1000 attack threads against the site. Because the spammer was running 1000 threads, each of which would have to solve the JavaScript problem, they would effectively be penalized 1000 fold over a normal user. The end result is they would only be able to run a few threads before their computer slowed to a crawl and their spamming abilities would be sharply limited.

Epic win for site.

Unfortunately, things are different in 2010.

Spam bots have become the tool of choice for basement SEO marketers. Instead of a few members of the “spam elite”, we’re dealing with tens of thousands of “do it yourself” spammers each running 1 attack thread using the new “automatic backlink software” they just picked up for $29.00 off some random SEO website. Instead of fighting one spammer splitting their resources across a thousand threads, we’re fighting a thousand spammers running a single thread dedicated *just to our site*.

Skipping a ton of math, what this means, is that in order to cause a spammer a 1-second delay while their computer solves our JavaScript challenge, we have to cause each of our *legitimate users* a 1 second delay while *their* computer solves our JavaScript challenge. And, considering the 3 to 5 second database lag I see on 90% of the BP sites I visit, the challenge would need to take much longer than a second to have any merit at all …otherwise page refresh time would be the limiting factor, not the JS challenge.

So what happens when a user visits the site using a computer that is much slower than a typical desktop …say a mobile phone or an old laptop? The challenge would take proportionally longer to complete. A challenge that requires 5 seconds to solve on a desktop PC, could take 30 seconds on an iphone …and 30 second response times would not make for an enjoyable user experience.

Overall, proof-of-work challenges are probably not a good choice in the 2010 Internet landscape.

Mathematically Strong Methods

In the next post, I’ll cover the specific details of the methods I’ve proposed for the BP spam solution, and why they will defeat most spam attacks.

^F^

[@foxly Participant 16 years, 1 month ago]

@Erich73

Add a “refresh” button beside the captcha that allows the user to flip through multiple captchas until they find one they like.

^F^

[@foxly Participant 16 years, 1 month ago]

@thekmen

Last I heard, BuddyPress does not run activity stream posts, or anything else, through Aksmet …it’s wide-open and that’s what’s causing the problem!

If you install the WP Akismet plugin, it runs *blog comments* through Akismet, but that’s it.

See why I’m really concerned and am putting work into this?

^F^

[@foxly Participant 16 years, 1 month ago]

PART 2 – DEFEATING SPAMMERS

In the last post I covered why and how spammers attack BP installations. This post will cover how I propose to counter them.

Fast Attacks -vs- Slow Attacks

There are two basic kinds of spam attacks that get run on social networks: “fast” or “flood” attacks, and “slow” attacks.

In a fast attack, the spammer signs up for an account on the site, then sends thousands of messages as quickly as possible.

Obviously, the site admin will be deluged with complaints about the spam user and quickly delete their account …but in the hours (or days) it takes the admin to respond, hundreds and hundreds of people will read the spam messages. Then the spammer signs up for another account, and repeats the process.

In a “slow” attack, the spammer signs up for *hundreds* of accounts on the system, often over a period of many months, and only sends out spam messages one at a time …often days, weeks, or months apart.

“Slow” attacks are very difficult to counter using automation …at least without annoying legitimate users.

The best way people have come up with so far is just a “report spam” button which, when clicked, reports the member to an admin so they can investigate it and if necessary delete the account. This will be implemented as part of @francescolaffi ‘s BP content moderation plugin in a couple of months.

Unfortunately, a “report spam” button doesn’t work well against “fast” attacks.

This is because:

a) There is a delay while the admin responds to manually submitted spam reports, or,
b) When a consensus scheme is used (if X users report a member their account gets suspended), there is a delay while enough votes are accumulated to flag the member as a spammer.

During that time, people are reading the spam messages and the spammer is winning.

Goals of Proposed BP Core Anti-Spam Mods

The goal of the proposed core modifications is to counter “fast” attacks by the following means:

1) To make it difficult for a spammer to create large numbers of member accounts using automated means.

2) To make it difficult for a spammer that already has a member account to use automated means to:
a) send large volumes of PM’s
b) send large numbers of friend requests
c) create large numbers of groups
d) create large numbers of group posts
e) post large numbers of comments
f) post large numbers of status updates

3) To accomplish 1) and 2) without being annoying to legitimate users.

4) To make the system configurable, so it can be adapted to the needs of the site …for example: visually impaired users, or display on mobile phones.

5) To make the system “on by default” and “secure by default”

How We Can Accomplish This

1) New User Sign-up

a) Add a captcha on the new account sign-up screen.
b) If the “user” gets the captcha wrong on the first try, require *TWO* captchas to be solved before they can proceed. (If the odds of a bot solving ONE captcha with OCR are 1 in 100, the odds of the bot solving TWO captchas with OCR are 1 in 10,000. This is a technique Gmail uses.)

…set X to be a random number on each installation between 3 and 7…

c) If the user gets X captchas wrong in a row, block their IP for a random amount of time (15 minutes to 2 hours). (This is what Craigslist does)
d) If the user fails X captchas *again* after being blocked, permanently ban their IP and post it to akismet.
e) If a locally banned IP tries to sign-up, don’t throw an “error page”. Completely ignore the request and don’t send anything.
f) If an akismet banned IP tries to sign up, require *TWO* captchas to be solved on the first try, and if they get X captchas wrong in a row, permanently ban their IP and repost it to akismet.
g) Add an option field to the admin menu that limits the number of accounts that can be created per IP address. By default, set it at 2.

2) Existing User Sign-In

a) Use a “normal” password box on first sign-in attempt.
b) If the member gets their password wrong on the first try, require them to solve a captcha on the second try. Offer password recovery option.
c) If the member gets their password wrong on the second try, require *TWO* captchas to be solved before they can proceed. Offer password recovery option.

…set X to be a random number on each installation between 3 and 7…

d) If the user gets X logins / captchas wrong in a row, block the visitor’s IP for a random amount of time (15 minutes to 2 hours).

3) Private Messages

a) Add a field to the user table that allows PM limiting to be bypassed or set to a unique value on a user-per-user basis.
b) Add three option fields on the admin menu: allow “X” messages to be sent every 24 hours, averaged over the past “Y” hours with “Z” hysteresis
…when BP is installed, randomly set X, Y, and Z to allow a daily maximum of between 18 and 24 messages, averaged over between 2 and 24 hours, +/- 3 messages.
c) If the maximum is exceeded, require the member to solve a captcha before they can send another PM.
d) If they get the first captcha wrong, require them to solve two captchas before they can send another PM.

…set R to be a random number on each installation between 3 and 7…

e) If the user gets R captchas wrong in a row, block their IP for a random amount of time (15 minutes to 2 hours). (This is what Craigslist does)
f) If the user fails R captchas *again* after being blocked, permanently ban their IP and post it to akismet.
g) If a locally banned IP tries to visit the site, don’t throw an “error page”. Completely ignore the request and don’t send anything.

Consider how difficult the algorithm above makes it to send automated messages. A spammer can’t just send “12 messages a day” or “1 message an hour” and avoid triggering the system. Every BP installation will have a unique combination that will cause it to trip. Yet for a “normal” user, the system will hardly ever trip, and if it does, it takes all of 5 seconds to enter a captcha and continue. And the system can be bypassed entirely for edge cases, like paid advertisers or site news.

3) Friend Requests

a) Create a config option in BuddyPress that allows the admin to remove the member’s directory with one click. Disable the member directory by “default” on new installs. In my experience, the only people that use the member’s directory (in its default state, on a socially oriented site) are Spammers, Marketers, and Competitors. There’s a reason Facebook, MySpace, LinkedIn, and Twitter do not have “global” member directories.
b) Implement same scheme as private messages.

4) Group Creation

a) Add a field to the user table that allows Group limiting to be bypassed or set to a unique value on a user-per-user basis.
b) Add an option field on the admin menu that sets a maximum number of groups that can be created by a user. By default, set it at 5.

5) Group Posts

a) Add a field to the user table that allows group post limiting to be bypassed or set to a unique value on a user-per-user basis.
b) Create a “whitelist” field on the admin page that allows “trusted” media sharing URL’s like YouTube, Revver, Flickr, etc to be bypassed in spam protection.
c) Create an option that automatically “scrubs” URL’s and email addresses from group posts if they are not on the whitelist. Not just “nofollow” …complete removal. This will stop 90% of abuse dead in its tracks, because most spammers are just trying to get traffic to a site or replies to an email.
d) If the system detects a URL or email address embedded in a message, and it’s not on the whitelist, require a captcha to be solved before allowing the post.
e) If they get the first captcha wrong, require them to solve two captchas before approving the post.

…set R to be a random number on each installation between 3 and 7…

f) If the user gets R captchas wrong in a row, block their IP for a random amount of time (15 minutes to 2 hours).
g) If the user fails R captchas *again* after being blocked, permanently ban their IP and post it to akismet.
h) If a locally banned IP tries to visit the site, don’t throw an “error page”. Completely ignore the request and don’t send anything.

i) For posts that do not contain a URL or email address, run the post through akismet. If it passes, approve the post. If it fails, require a captcha to be solved before allowing the post.
j) If they get the first captcha wrong, require them to solve two captchas before approving the post.
k) If the user gets R captchas wrong in a row, block their IP for a random amount of time (15 minutes to 2 hours).
l) If the user fails R captchas *again* after being blocked, permanently ban their IP and post it to akismet.
m) If a locally banned IP tries to visit the site, don’t throw an “error page”. Completely ignore the request and don’t send anything.

6) Comments

a) Create an admin option that only allows users to comment on their *friend’s* items. Activate it by default on new BP installations.

7) Status Updates

a) Add a field to the user table that allows status update limiting to be bypassed or set to a unique value on a user-per-user basis.
b) Create a “whitelist” field on the admin page that allows “trusted” media sharing URL’s like YouTube, Revver, Flickr, etc to be bypassed in spam protection.
c) Create an option that automatically “scrubs” URL’s and email addresses from status updates if they are not on the whitelist. Not just “nofollow” …complete removal. This will stop 90% of abuse dead in its tracks, because most spammers are just trying to get traffic to a site or replies to an email.
d) If the system detects a URL or email address embedded in a message, and it’s not on the whitelist, require a captcha to be solved before allowing the activity stream post.
e) If they get the first captcha wrong, require them to solve two captchas before approving the activity stream post.

…set R to be a random number on each installation between 3 and 7…

f) If the user gets R captchas wrong in a row, block their IP for a random amount of time (15 minutes to 2 hours).
g) If the user fails R captchas *again* after being blocked, permanently ban their IP and post it to akismet.
h) If a locally banned IP tries to visit the site, don’t throw an “error page”. Completely ignore the request and don’t send anything.

i) For activity stream posts that do not contain a URL or email address, run the post through akismet. If it passes, approve the post. If it fails, require a captcha to be solved before allowing the post.
j) If they get the first captcha wrong, require them to solve two captchas before approving the post.
k) If the user gets R captchas wrong in a row, block their IP for a random amount of time (15 minutes to 2 hours).
l) If the user fails R captchas *again* after being blocked, permanently ban their IP and post it to akismet.
m) If a locally banned IP tries to visit the site, don’t throw an “error page”. Completely ignore the request and don’t send anything.

8 ) In All Cases

a) When a member account is banned, or repeatedly triggers spam protection measures, send an alert to the site administrator.
b) Allow admin alerts to be disabled if necessary, example: DDOS attack against the site.

9) CONCLUSION

While the list of modifications above may look incredibly complicated, really, it’s not.

I’d say “worst case” it’s about a week of work to research and make these modifications. Then we can push it out into beta testing with all the other new code to give it a proper shakedown.

I’m sure there are plenty of ways the algorithms above could be improved, so please go ahead and post your feedback!

Thanks!

^F^

[@foxly Participant 16 years, 1 month ago]

All About BuddyPress Spam

From what I’ve seen over the past few days, the range of knowledge about spam in the BP community ranges from zero to PhD research project. So, to get this thread off to a productive start, I’m going to give everyone some background info on why spammers target our installations, how they do it, and what we can do to reduce or eliminate these kinds of attacks.

1) Why do spammers attack BP communities?

-> Spam is 100% economically motivated. Spammers do what they do because it’s very profitable. Even if only 1 out of a million messages the spammer sends actually reaches somebody, if it cost $2 to send out those million messages and the spammer makes $50 by tricking one person into giving them a credit card number, the spammer is going to throw every resource they have into sending out more messages …because they’re getting a 2500% return on their investment.

-> Given the choice between multiple sites, a spammer will pick the one that gives the largest payout.

Gmail is a “hard” target, with users that are experienced with spam. If a spammer sent a billion spam messages to accounts on Gmail, 99.9% of them would be probably be deleted by automated filters at other ISP’s along the way before even arriving at Gmail. The first thousand messages that arrived at gmail would likely be delivered but would be put in user’s spam folders; and the remaining 999,000 messages would be flat-out refused by Gmail’s servers.

Because anyone with an email account is familiar with spam, probably 999 of those 1000 users would ignore the spam message and 1 user might act on it. So if it cost $20 to send those billion messages and the spammer made $50 by tricking the one person into giving them a credit card number, they’ve only made $30 for all that work.

BP communities are usually “soft” targets that are inexperienced with spam.

Once a spammer gets into a BP community, every single message they send is delivered to a member, and most members are NOT expecting to be attacked by other users on the site.

If a user called “site_news” sends everyone a message that says: “Our site just got featured on Oprah! check out the video! http://www.youtube.com/watch/dQw4w9WgXcQ.cn” every single member is going to get that message, and probably half of them are going to click on the link. (did anyone notice what’s wrong with that “YouTube video” … )

Then, assuming there are 50,000 members on the BP site, half of them click on the link, half of those people are using Internet Explorer, and the attack site the link points to installs a backdoor on computers running IE …at $2 / install the spammer has just made $25,000!

Now, if *you* were a spammer, which site would you attack?

2) How do spammers find BP communities?

Using Google.

Example: http://www.google.ca/search?hl=en&q=%2B”is+proudly+powered+by+WordPress+and+BuddyPress” (front page of every BP site on the net)
Example: http://www.google.ca/search?hl=en&q=inurl:%22/community/members/%22+%2Bbuddypress (members page of every BP site on the net)

3) How do spammers attack websites?

-> Most spam attacks are done using robots, because sheer volume of posts is usually the winning factor. In situations where there is a “captcha wall” or other defense blocking registration to a “high value” site (hint: yours), spammers will use people in low-wage countries to break the captcha and sign up on the site. The going rate is about $2 per 1000 captchas.

http://www.decaptcher.com/client/

Once inside the site, they will then use bots to post spam to all the members on the site.

-> There are literally *thousands* of different programs available that spam websites, and they all have *different* venerabilities.

For example, this program: http://forums.digitalpoint.com/showthread.php?t=1124949

a) Will DEFEAT a “hidden fields” challenge,
b) Will DEFEAT a “javascript proof of work” challenge,
c) Will FAIL a “captcha” challenge
d) Will FAIL an “Akismet” challenge
e) Will FAIL a “Hashed Form Field ID” challenge

But this program: http://www.botmasternet.com/more1/ , wikipedia: http://en.wikipedia.org/wiki/XRumer , video of it running: http://www.youtube.com/watch?v=AL2i4SNPJmg

a) Will DEFEAT a “hidden fields” challenge,
b) Will DEFEAT a “javascript proof of work” challenge,
c) Will DEFEAT a “captcha” challenge
d) Will DEFEAT an “Akismet” challenge (uses proxy networks, never sends the same message twice)
e) Will DEFEAT a “Hashed Form Field ID” challenge
f) Will FAIL a “enter the numbers with a triangle over them” challenge (as used by PlentyOfFish.com)
g) Will FAIL a “click on the photos of cats but not the photos of dogs” challenge

4) How do we stop spammers from attacking BP communities?

-> By making it frustrating and unprofitable (but not necessarily impossible) for spammers to target us; while making these tactics invisible to normal users.

I will cover how I propose to do this in the next post.

^F^

[@foxly Participant 16 years, 1 month ago]

@Andrea_r

The goal is to limit:

1) Spam PM’s
2) Spam friend requests
3) Spam comments
4) Spam group creation
5) Spam group posts

Once a spammer / troll / hostile has created a member account on the system.

The goal is NOT to stop:

6) Spam comments on blog posts from non-members.
-> Already handled by dozens of plugins

7) Spam in profile fields
-> Limited damage. Will be handled by @francescolaffi ‘s GSoC project

8 ) Spam blog creation
-> Limited damage. Will be handled by @francescolaffi ‘s GSoC project

9) Spam sign-ups
-> Impossibly hard target. The only effective countermeasure is phone verification + geo IP + proxy blacklist; as implemented by Craigslist, eBay, PayPal, Elance, and many others.

Full background on all this stuff in about an hour.

Thanks!

^F^

[@foxly Participant 16 years, 1 month ago]

Sounds good to me. Give me a day or so to put some thought into it, then I’ll post a more structured proposal.

^F^

[@foxly Participant 16 years, 2 months ago]

@paulhastings0

Just use version 0.1.7, currently on the WordPress plugin repo. It’s reasonably stable and thousands of people are using it on their sites.

As for when version 0.1.9 will be ready for full scale distribution, that’s difficult to predict.

Software development is a nonlinear process. It’s not like we compile a list of features, know exactly how many lines of code each one will take, and then work through them at exactly X lines of code a day. Some days we make huge process, and other days we don’t get anything written because we’re researching something that isn’t working correctly.

Still, we have two programmers working all day every day on this plugin, and we’ve gone from zero to “pretty darned good” in less than 5 weeks. So if we can hold that rate of progress, we should have something “epic” reasonably soon.

I’ll see if I can post some screen caps later to show you guys what we’re working on.

^F^

[@foxly Participant 16 years, 2 months ago]

@bplove

It’s not that we’re ignoring your request, it’s that the current beta we’re discussing in the thread *already does* what you are requesting…

Start on the first page of the thread and follow the discussion.

https://buddypress.org/community/groups/third-party-components-plugins/forum/topic/bp-album-new-features-requests-and-discussion/?topic_page=1&num=15

^F^

[@foxly Participant 16 years, 2 months ago]

###############################################################################
REMINDER * REMINDER * REMINDER * REMINDER* REMINDER * REMINDER
###############################################################################

Just a reminder to everyone on the thread, that the current beta we are now discussing is
version 0.1.9.2 which you can download here:

https://plugins.svn.wordpress.org/bp-album/branches/foxly/0.1.9.1/bp-album-BETA-0-1-9-2.zip

It’s *hugely* different from the 0.1.7 version currently being distributed on the wp plugin site.

###############################################################################

[@foxly Participant 16 years, 2 months ago]

@tosh

Yes. The plugin will be fully “wired” for other programmers to be able to work with it.

^F^

[@foxly Participant 16 years, 2 months ago]

BREAKING NEWS:

Google has accepted our GSOC funding proposal!

That means we now have TWO full time coders (myself and francescolaffi) , plus Boon Gorges and Andy Peatling as our tech mentors.

Let the good times roll …

^F^

[@foxly Participant 16 years, 2 months ago]

@bplove

Basically, use version 0.1.7 from the WordPress plugin repo. It works properly, is reasonably reliable, and it will update properly at the next release.

Do not use the 0.1.8 beta, because it doesn’t use the new file storage scheme and we’re not writing an updater for 0.1.8 because you’re not supposed to be using it on an actual site.

We should have another official release out in a week or two that adds everything you see in the 0.1.8 beta and a much more.

Thanks!

^F^

[@foxly Participant 16 years, 2 months ago]

@hotforwords

Please see the PM that I sent you, regarding the implications of using this beta release on a site with 300 million pageviews and 55,000 members.

^F^

[@foxly Participant 16 years, 2 months ago]

From our mailbox…

Not a big deal as this is a dev env but I thought I’d show you something I am observing in case it happens to others.

bp-album v 0.1.9, bp v 1.2.3, wpmu 2.9.2

You can see it in action at http://[redacted]

You’ll notice my test user ‘Sam Witwicky’ uploaded a pic yesterday (note time since) but somehow the action grabbed a reply from last week. If the streams got crossed and I have a corrupt activity table that’s fine. It keeps happening as I load test images though. Happy to delete entries in tables but i can’t figure out why this is occurring. Just started with 0.1.9.

Also notice that the urls for the images and title in the activity stream are wrong.

for ex http://[redacted]/members/test19/photos/single-media/7/ instead of

http://[redacted]/members/test19/photos/single-album/3/single-media/7/O/

so clicking does a redirect back to the root

I’m guessing it’s all related.

On a side note, I really appreciate your work on this and willingness to work with everyone. I’m pretty much ready to release my site to prod once bp-album is ready for prime time. I have held off doing any major styling to bp-album areas until you give the go ahead that core html tags and arrangements are all set.

===========================

You are experiencing two known defects in the BP Album+ 0.1.9.2 beta.

The first problem is happening because the “Album Item” and the “Media Item” classes do not yet generate globally unique ID’s for activity stream posts, so occasionally they collide, causing the plugin to retrieve the wrong media item.

The second problem is happening because we haven’t finished updating the URL generation code that creates the thumbnail link to activity stream items. WordPress then catches the resulting 404 error and throws the browser back to the home page.

Fear not!

All of this will be fixed in the next beta. We thought it was more important to demonstrate albums capability than to have everything working perfectly. You should NEVER install one of these “community feedback” betas on a live site. They are only intended to get the community’s feedback on how we are implementing features.

Thanks!

^F^

[@foxly Participant 16 years, 2 months ago]

@Gpo1, @Mike Pratt

Normal, yes.

Correct behavior, no.

It’s a defect in the current beta, and we’ll have it fixed in the next release.

^F^

[@foxly Participant 16 years, 2 months ago]

BP Album+ will have this functionality in the near future.

https://buddypress.org/forums/topic/bp-album-new-features-requests-and-discussion/page/10#post-49507

^F^

[@foxly Participant 16 years, 2 months ago]

@Xevo

We’ll certainly try.

But remember, we are *not* adding “embed content from fifty different free streaming video sites” type functionality.

More like the top 5 sites, and that’s it.

Depending on free sites to host your media content is BAD …because every time the other site changes something, it breaks the plugin, and then *we* have to figure out how to fix it for the changes the other site has made.

We can do that for a few sites, but not all of them; otherwise we’d never get any work done on other features. This is why Facebook only allows embeds from a few selected sites, and hosts most of their content themselves.

If you’re running even a moderate sized social community, eventually you will have to do the same, start hosting your own media files.

^F^

[@foxly Participant 16 years, 2 months ago]

@gian-ava

Okay, well clearly you’re smart and you’ve put some effort into debugging your system.

I will add a config option to the next BP Album+ beta that lets users set a custom path for activity stream items. But… it will not fix your existing activity stream items, and if you ever change your directory structure after using the option, you’ll lose all your activity stream items again.

Remember, this is a limitation in BuddyPress, not BP Album+

Still, your best options are:

1) To put your WP installation at the HTML root, which will give you the best compatibility with plugins.

2) If you’re running multiple installs in a single HTML root, use virtual hosts.

3) And if you don’t want to learn how to use virtual hosts, you can probably use a redirect in your .htaccess file as you described (that’s what cPANEL does). Note that there could be SEO implications with using a redirect.

Thanks!

^F^

[@foxly Participant 16 years, 2 months ago]

@gibbyesl

RE: “can I help test ? I would love to see this working asap “

Sure.

Just try-out every feature in the plugin, and give a detailed report of any problems you find and how to reproduce them.

^F^

[@foxly Participant 16 years, 2 months ago]

@gibbyesl

RE: “testing the new beta. can’t remove someone who tagged themselves I click remove but nothing happens”

Defect has been confirmed on my dev system. We will add it to the queue.

Thanks!

^F^

[@foxly Participant 16 years, 2 months ago]

@gian-ava

1) You can’t just “switch” from version 0.1.7 to 0.1.9.2, because 0.1.9.2 doesn’t have an upgrade routine (because its a beta). If you install it on a server that already has a 0.1.7 install, all sorts of strange things will happen.

If you really, really want to upgrade to 0.1.9.2, you’ll have to delete all of your user’s uploaded images, delete all of 0.1.7’s database tables, then install 0.1.9.2; but for systems with existing users that have uploaded a lot of media, it’s probably just better to wait until we put out the next release version.

2) BP Album+ works just fine when you install WP in a subfolder. The reason it doesn’t work properly on *your* installation is because you’ve used some “hack” posted on the Internet to modify your installation to hide the subfolder from the URL displayed in the browser.

Guys, there is a lot of VERY BAD advice posted on the Internet about how you can cut and paste code into WordPress to do various things, and a lot of this advice is incomplete or wrong. The hack you’re using only handles *one* way plugins get the base URI, and as you install more plugins you will start to get all sorts of problems.

If you want to install WordPress in a subdirectory, the correct way to do it is to set it up as a virtual host in your apache config file, or using a redirect:

Redirect: (OK) http://www.youtube.com/watch?v=pC_HNbly6mI

Virtual host: (Best) http://www.youtube.com/watch?v=HW2xWJpjKQk

3) It’s relatively easy for us to make the URI’s to media items in BP Album+ configurable, no matter how somebody sets up a WP installation, if that’s what you guys want.

…but based on my research so far, we *cannot* fix the problem with images not showing up in the activity stream on WP installs that are a) in a subdirectory and b) not using a redirect or virtual host method of URL shortening, because of the way *BuddyPress* stores activity stream attachments.

How BP Album+ stores an image URI:

[$offset] + [ / album / 04 / kittens_15.jpg]

How the BuddyPress activity stream stores an image URI (last I checked…. I will research this more when I have time):

[ http://www.example.com/wp-content/blogs.dir/01/album/04/kittens_15.jpg ]

So when you use a hack to dynamically change your base URI, BP Album+ can handle it (because we dynamically generate the full URI), the BuddyPress activity stream cannot handle it (because it uses a static URI) and the activity stream post items break.

But the bottom line is, all of this is happening because you haven’t set up your WP installation properly and are using “hacks” off the Internet to mess with your site.

Set up your WP install properly, and you won’t have problems.

Thanks!

^F^