what else?
Moderators: Flumminator, Zomis
what else?
just checking that the forum is still functioning despite whatever attack it's under...
Re: what else?
Everything should work fine as always, but you have to login with "guest" / "guest" for all "viewforum.php" pages (which are all forum section pages, but not the forum's main/start page, and not the topic pages -- even posting this post works without password).
So I hope the very low forum activity during the last few days is also just because of summer time and vacartions ...
So I hope the very low forum activity during the last few days is also just because of summer time and vacartions ...
Re: what else?
I was prompted to login at some point, several visits ago; have it guest/guest and it was satisfied; and haven't been re-prompted since then. So it's stored in a browser cookie and doesn't need to be redone? (I don't log out of the forum, so any further interactions that would happen if I did that, I don't know about... the forum login is clearly stored in a browser cookie and seems to have a months-long lifetime, which is fine with me for something at this level of security-need :)
The messaging about needing to login as guest/guest is a little confusing. I thought it meant I would need to login to the forum as 'guest', but it's apparently a completely separate site-login layer?
The messaging about needing to login as guest/guest is a little confusing. I thought it meant I would need to login to the forum as 'guest', but it's apparently a completely separate site-login layer?
Re: what else?
This is just a simple and stupid "Basic Auth" web site authentication, which is completely independent of the web site content and completely handled by the web browser. In fact, although this exists since 1994 or something (that is, since there is the WWW), it is not used that often nowadays. And -- unfortunately -- the information text which can also be configured (which is "www.artsoft.org - restricted area" in this case) is silently skipped by most browsers nowadays, which is a shame, as it means that no information can be given to the user anymore, why there is a username/password request etc. 
(Not that the "info text" just mentioned would be that helpful, I'm afraid...)
The password is not stored in a cookie, but directly by the web browser. Usually it will ask you to store it in its password vault (just like it does it for username/password forms inside web pages), to make it easier for you to login again when coming back later. Most browsers will keep these username/password combinations for the current session; that is, if you quit your browser, restart it and return to the forum, it will either ask again or suggests to use the username/password you have agreed to store the last time.
Regarding the reason why I added this password crap in the first place: It's the same as with "https://git.artsoft.org", which has the same "mechanism" since a few month now. And the reason are AI scrapers -- stupid AI scrapers, to be precise. Google is crawling web sites since the late 90's of the last century, and it did never hurt any web site, as far as I know (because Google is not stupid, in most cases at least). But these AI scraper scripts nowadays try to follow each and every link on a site, regardless of having just fetched it a few milliseconds ago from another page. That way, they bring many web sites to a halt that cannot handle thousands of requests (that also hit the database) per second.
Maybe it would help if these AI scraper scripts would be written by AIs -- or, wait, maybe they are written by AIs... :-/
And regarding the question (from your PM) if the username and password "guest" is too stupid: As soon as AI scraper scripts start reading the web pages they crawl, it won't make a difference anymore anyway -- so far that maximum stupid password possible works fine. Maybe I will even try to remove that password request again, but I can see from my site monitoring that the scrapers seem to try again at least once per day (generating a little peak of dubious requests).
Regarding my own web server, it was practically down (well, let's say unresponsive -- if you had a lot of time, the pages loaded after one or two minutes at last), for two or three days, so I added that password crap, although I hate it.
It seems that the end of the World Wide Web as we know it is coming nearer...
(Not that the "info text" just mentioned would be that helpful, I'm afraid...)The password is not stored in a cookie, but directly by the web browser. Usually it will ask you to store it in its password vault (just like it does it for username/password forms inside web pages), to make it easier for you to login again when coming back later. Most browsers will keep these username/password combinations for the current session; that is, if you quit your browser, restart it and return to the forum, it will either ask again or suggests to use the username/password you have agreed to store the last time.
Regarding the reason why I added this password crap in the first place: It's the same as with "https://git.artsoft.org", which has the same "mechanism" since a few month now. And the reason are AI scrapers -- stupid AI scrapers, to be precise. Google is crawling web sites since the late 90's of the last century, and it did never hurt any web site, as far as I know (because Google is not stupid, in most cases at least). But these AI scraper scripts nowadays try to follow each and every link on a site, regardless of having just fetched it a few milliseconds ago from another page. That way, they bring many web sites to a halt that cannot handle thousands of requests (that also hit the database) per second.
Maybe it would help if these AI scraper scripts would be written by AIs -- or, wait, maybe they are written by AIs... :-/
And regarding the question (from your PM) if the username and password "guest" is too stupid: As soon as AI scraper scripts start reading the web pages they crawl, it won't make a difference anymore anyway -- so far that maximum stupid password possible works fine. Maybe I will even try to remove that password request again, but I can see from my site monitoring that the scrapers seem to try again at least once per day (generating a little peak of dubious requests).
Regarding my own web server, it was practically down (well, let's say unresponsive -- if you had a lot of time, the pages loaded after one or two minutes at last), for two or three days, so I added that password crap, although I hate it.
It seems that the end of the World Wide Web as we know it is coming nearer...
Re: what else?
I have added a little announcement about this; hopefully it helps to minimize confusion... 