Forum risks

[mr_nabo]

Hi,

I work for a charity that wants a forum for young people either integrated into the main site (which is a Plone-based CMS) or hosted independently. I've been asked to come up with risks and complications of both options and wanted to get some ideas from you guys if you'd be so kind.

There are the obvious ones such as monitoring comments, spam and restricting signatures and code that can be posted, but are there others I should be aware of?

Thanks

[piatkow]

Hosting the forum yourself you will require the technical skills and time to install and maintain it. It will, of course, add to your bandwidth and disc usage.

Indpendently hosted should be pretty well plug and play. While you can get "free" options which involve the supplier displaying ads there is a real risk of embarassingly inappropriate copy being displayed. There is also the risk of the supplier suspending the forum if you do not moderate and remove posts that breach their terms of service.

[mr_nabo]

Thanks piatkow,

I'm not up-to-speed with Plone and the site has been developed (and is hosted) outside of the charity's premises, so we would have to pay to get them to integrate a forum into Plone.

I develop websites as a freelance, so could set up a forum on an independent hosting plan, I just want to know if I'll be setting myself up for a nightmare with maintenance and security issues...

Cheers

[piatkow]

My personal choice in such a situation would be to use a hosted forum service. The web site maintenance would be restricted to adding a link, the forum service provider would deal with account maintenance and keeping out the spam bots.

I don't know what the maintenance overhead on keeping a forum in-house on a different server would be. With either route do make sure that everything is in the charity's name. (I am currently helping a small voluntary orgianisation untangle their affairs after the webmaster, who owns the site, was admitted to hostpital - probably terminally)

The end user department should take ownership of the forum once open and look after moderation and banning abusers.

As I said before you can get "free" forums but you are likely to get ads for gambling and some dubious looking dating services which would not sit well something targeted at under eighteens.

[mr_nabo]

Thanks for your help piatkow, I'll look into a hosted forum.

[thecoalman]

For phpbb3 update maintenance is really a snap unless you make modifications to the php files. First get on the mialing list so you'll get a email when an update is available. Download it, unzip and FTP the new files to the server overwriting the old ones then point your browser at the database update script. Literally takes a few minutes, they even have update packages that only include updated files.

If you go with a hosted forum make sure you have access to the database backup utility within phpbb3 or they'll give you a copy of it somehow. Besides the obvious reasons of wanting a backup you won't be able to move the forum elsewhere if you ever decide to change it to your own server without a backup.

Personally I'm not sure I'd want to trust the data of my users with a free host. Be sure to read the fine print

[martinibuster]

How young are the people? There are laws in the U.S. about minors that should be looked into, like COPPA. If minors are outside of the U.S., then look into applicable online privacy and safety laws.

Then there are the issues of minors being contacted privately via other members who may or may not be what they claim to be.

Has the charity thoroughly considered what they want to accomplish with a forum?

phpBB, vBulletin, Invision Power Board and other forum software can be integrated into the current domain by installing it into it's own directory folder (example.com/forum/). Then you can simply link to the forum from the main site. May be worth it to inquire with the paid forum software to see if there are discounts for charitable organizations.

[mr_nabo]

@martinibuster: Thanks for raising those points about COPPA - we're in the UK but the forum is intended for anyone from the age of around 12 upwards according to senior management.

I'm actually very wary of the idea, but they are sure they want it so I've got to think of a solution. With phpBB, is it possible to disable private messaging between members and other features to make it easier to identify malicious users?

I've been thinking that a Wordpress blog may be an easier way forward considering the charity only wants the opinions of young people in discussions about campaigns ideas. Problem is, they want to have sections for parents and young people and I don't think a blogging platform would suffice for that.

[thecoalman]

PM's can be disabled board wide on phpbb3, on a group basis or even enabled or disabled for single users. Having said that you can even change what's allowed in PM's.

The permission settings for phpbb3 are quite extensive, moreso that any other forum software from my understanding but I really have never run any other software. That's just what I hear. If anything it's over complicated but with that complication comes a lot of possibilities for different configurations. They probably should have included a simplified version for the permission settings. Once you learn your way around its not that bad but can be alittle daunting at first. they do have an easy way to check them because you as the admin can switch to someones permissions without having to switch to a test account.

If you go with phpbb3 here's a quick tip for setting up forum permissions, set up a single forum for the public and adjust all your settings there, use this as the master permission set for the public. When you create a new forum you can copy the permissions from that.