[Super]

Efficient code. HF manages its own servers at this point in time.

Are you guys using Docker + Kubernetes to auto scale, or are you deploying everything manually?

[Omniscient]

Are you guys using Docker + Kubernetes to auto scale, or are you deploying everything manually?

We are not going to provide exact details of implementation. It's not really your concern what's running on our backend you nosy fuck. Do you think we are assholes so you can start looking for exploits on our deployment?

FUCK YOU!

[Techie]

Well this for sure sounds awesome. Great work guys.

[SoulZeh]

I've just started a conversation with Xerotic has I have no friends :( but I have to say, it's fucking awesome!

[Xerotic]

You should receive notifications for this now. Look at the convos icon by the logout button (top right of page).

EDIT: Notifications aren't perfect yet for convos... they are a WIP.

[MavenGradle]

We are not going to provide exact details of implementation.  It's not really your concern what's running on our backend you nosy fugg.  Do you think we are assholes so you can start looking for exploits on our deployment?  

fugg YOU!

Asking those questions generally is out of curiosity. At least when I ask them. You wanted to attract programmers, well, here we are. We are effectively curious about the technologies that are being used in order to learn why or why not said technologies are being used.

In terms of the decision to move forward with NodeJS, I can applaud the efforts of both you and Xerotic. Node has so many things going for it, it's super easy and fun to work with and asynchronous programming is a breeze. Hence, this is why Node is gaining in popularity.

Make no mistake though, generally speaking Node performs worse than PHP does for basic things but because Node is so extensible and has a myriad of free and open source libraries available, you can litteraly make your own webshop and database model in no time (hell, why not even a MongoDB for large data collection). That's the advantage of using Node. Better productivity, guaranteed a better paying job and less development cost in exchange for some performance losses. Not to mention that Node is here to stay.

In theory, building a forum like MyBB is so much simpler now when using technologies like Spring Boot, JPA, NodeJS and ReactJS:
https://github.com/proshoumma/ReForum (about 6000 lines of code)

I'm just saying that with the right API and backend, you can truly build wonders. Thank you for disclosing that you'll be using Node though, that's kind of you. And honestly whether it'd be PHP, Node, Spring Boot,... exploits exist for all of them  🤝

Edit:

I think Xerotic deserves some fun as well, Node is the perfect environment to have fun while developing. I hope you'll like the time you spend on this project because it genuinly seems like a fun thing to make. Before you know it you guys will be running your own server park and CI machines to deliver builds automatically as soon as a developer commits to a release branch (gitflow) 😏 . Jenkins all the way!

[Diabolic]

That is pretty cold. Awesome feature.

[Omniscient]

Asking those questions generally is out of curiosity.

And generally our security is tested on a regular basis and I'm very guarded when it comes to prying about what technologies we deploy. 0days exist and can be used against the community.

Realistically using NodeJS has both advantages and disadvantages. We are a PHP based website and merging websockets is not going to be simple.

it's super easy and fun to work with and asynchronous programming is a breeze.

Less simple really when you're maintaining our high security standards and interacting with PHP/MYSQL.

Make no mistake though, generally speaking Node performs worse than PHP does for basic things

Correct. So we're mindful of that. Some things make sense to move to websockets but there is still a LOT of concern for security and also resources.

Big issue is that HF is MyBB and all sessions are PHP/MYSQL. We have to ensure that everything talks correctly with each other and we don't open ourselves up to security exploits. I'm almost sure we'll make a mistake and I just hope it's not devastating.

I'm not a fan of disclosing too much information about our backend technologies.

I’d put money on everything is manual.

We tend to build as much as possible for our needs. The less dependencies we have on libs the better imho. Custom designed strictly for HF needs is the goal.

[MavenGradle]

Completely understand your views on opening up security risks. They happen all the time and are quite common when using external libraries. I get about 2 to 3 security notifications on GitHub each day thanks to some external lib in a company project that has some kind of high severity flaw in it. They are fixed as soon as they are detected though. That is one of the advantages of using GitHub for business (it's automatic vulnerability detection). More on this feature here:
https://help.github.com/en/articles/abou...pendencies

You will probably also be interested in SonarQube. It has an entirely free variant that is really an amazing tool to use in an environment like this:
https://www.sonarqube.org/
https://www.sonarqube.org/features/security/

It's a bit of a setup of course but in the end it's totally worth it.

Would you perhaps be interested in a bug bounty of sorts? I'm sure a lot of talented people here would be interested in earning an award of some kind or perhaps a lifetime of ub3r award if a security flaw can be found in the new infrastructure and reported to you in a correct manner?

[Super]

We are not going to provide exact details of implementation.  It's not really your concern what's running on our backend you nosy fugg.  Do you think we are assholes so you can start looking for exploits on our deployment?  

fugg YOU!

I'm a full-stack developer for my work. I'm just interested in how you scale such a massive site.

I don't care that much.

[Dragosthethird]

Would you perhaps be interested in a bug bounty of sorts? I'm sure a lot of talented people here would be interested in earning an award of some kind or perhaps a lifetime of ub3r award if a security flaw can be found in the new infrastructure and reported to you in a correct manner?

Would just like to point out that there is already a bug bounty in place for HF.
https://hackforums.net/showthread.php?tid=5259373

[Omniscient]

That is one of the advantages of using GitHub for business (it's automatic vulnerability detection). More on this feature here:

Things like that are handy if indeed you are using a lot of libs from Github but again, that assumes it's reported and not a 0day.

I'll look into SonarQube.

Right now it's just Xerotic and myself that touch any HF code. We're not perfect but we do keep to some good standards and I do my best to review his code personally. So far so good.

Would you perhaps be interested in a bug bounty of sorts?

I already have one for $1000 that's open. And I have paid out lower amounts too for certain exploits.

https://hackforums.net/showthread.php?tid=5259373

I'm a full-stack developer for my work. I'm just interested in how you scale such a massive site.

Big expensive server with a buttload of resources. Current average CPU usage is about 5% and the MySQL (MariaDB) instance has a lot RAM dedicated to it. HF can easily handle 10 times our current load. I used to run separate servers for the HTTP and the MySQL but I decided to just rent one big dedicated and it does a lot better. Every few years I have to change servers usually because I can rent a better dedicated for the same price and I like having all the resources handy.