Mr. SmartyPants wrote:I think a CAA Irc room would be a great idea! No offense to oldphil or anything, but an IRC chatroom > CAA chat room. I mean.... you can trade files... play mafia.... and best of all... slap each other with a large trout!
Give me a full risk analysis and show me how this adds to our community while simultaneously supporting CAA's mission to be a safe haven for Christian fans of anime. I mean it. FULL analysis. As for your "reasons" above, if you can't exchange a file on the main forum, it's probably either not legal, not ethical, or of a file type that could contain viruses etc and should be banned from IRC exchange anyway. I'm not opening up a major set of security flaws for that. Based on what we ACTUALLY do here, I'm afraid I disagree completely with your notion that "an IRC chatroom > CAA chat room" for us. But then... You wouldn't understand that. I don't normally care, but I'm getting tired of seeing this specific idea show up.
I'm about to do something I don't normally do. Usually, I just take everyone's desires into account and do what I think is best. I don't usually explain things]I want you to see where I'm coming from so that you can better understand my decisions.[/I] I'm looking at this site from a long-term sustainability, ease of use, and efficient point of view.
A CAA IRC channel would exist outside of the standard site. Everything that's currently on this site uses a VERY simple to run, simple to maintain format. It’s called HBAB planning. If I get Hit By A Bus, things can be run by someone with only a moderate level of intelligence and technical prowess. They might not be able to add lots of features securely, but they COULD keep us running more or less as we currently are.
The fact of the matter is, this site has a large number of minors. I don't want someone popping into our IRC channel and feeding Trojan Horses (or worse) to children. I also don't want to deal with the headaches of explaining to every 2nd user how to setup their firewall to allow the IRC to work right (or worse, tell them they can't use the chat because their school/employer blocks IRC). I don't want to deal with staying on top of exploit issues. Perhaps most importantly, I don't want the rest of the users of this site to have to know anything about computer security to use our community. The CAA chat can be used from nearly any computer with nearly any browser, and can now even be used with any skin. All data is sent over port 80, so all the organizations who are blocking IRC to keep their users (and network) safe don't keep our users from legitimate use of our site. You can't get a virus from the chat unless you click on a link to go to someone else's website and download something.
As for the two people here who always tell me that IRC is "safe" because so many other people use it, I'm going to once again totally ignore that argument - but I'm going to do you a favor and TRY to help you understand the Information Security world a little better. You've either never taken a system security class or you took it from a really messed up school; a system administrator should understand the concept of security through obscurity and how it's NOT a good way to protect your users. Do me a favor and google the following queries:
IRC security issue
IRC security flaw
IRC security bug
IRC security problem
Better yet, write your own IRC server using only LAMP tools, complete with a secure, efficient web interface that is cross-platform and cross-browser supported. It should be documented well enough that someone else could support it. Still with me? Great! Next, login to some of the hacker IRC channels and invite people to hack your server or send another user a virus. Next, fix those bugs. Repeat the process until there are no security flaws left in the package. I’ll see you in 20 years.
Of course, everyone is entitled to their own opinion. To be perfectly honest, in my line of work, you quickly get used to people grumbling about how your assessment of any given technology or situation doesn't make everyone happy. But it's not my job to make as many people as possible happy. My job is to allow as much community as we can moderate, while keeping as many people as possible safe. And for those of you who keep asking: No… I do not get paid for this. XD
Well, I guess I better end this post. I hope at least one person understands a little better why we've made some of the choices we have. It's not about being lazy or not having time to do stuff as much as it is about maintaining a very delicate balance between usability of the system and security for our users.