Sitephyre WIP thread

[MadGypsy]

I have been working on this for months. I have let this consume all of my free time since it's conception. I have a retarded amount of finished, stable code... I would say that at this point I have accomplished so much that I can easily call this a WIP without anyone being skeptical as to whether it will ever be finished. At this point, if I was to stop, it would result in me chalking the last 3 months of my life up to a complete waste of time writing almost 10,000 lines of unfinished code. I'm not willing to chalk any of my life up to being a waste of anything.

All that being said, I believe I am at a point where I can start sharing the product of my efforts. No, there is nothing to download and that's not really what I mean. What I mean by share (at this point) is to lay it down right here as features get completed and allow everyone to see concrete progress, as well as allow others to include their opinions/knowledge on the various workings of my CMS.

So, what is actually finished:

1) post /reply to /edit / delete text articles
2) upload ANYTHING/ edit its information/ display it or a link to it (depending on what it is)
3) simple editor with a bbcode system and some fancy javascript features
4) recent media display
5) pagination
6) ranks
7) media library (unfinished but close)
8_) views
9) sign in/out/up
10) full and complete database install script (including user permissions)
11) mod rewritten urls to path style
12) complete site/database destroy script (mostly to make my life easier while testing)
13) many things (completed and not) already displayed with css & html

That's about the gist for the major stuff. It doesn't sound like a lot until you realize all that I had to do in order to make that stuff happen. Let's just take ranks for example. Below is a little flow chart on all the stuff necessary to just allow someone to increment a rank counter.

1) a user database
2) a rank database
3) sign-up / log-in ability
4) the ability to post something rankable (so a media database)
5) all the SQL that manages the above
6) is the user logged in
7) did the user already vote
8_) if 6&7 are yes and no - store rank in rank database to record the users vote
9) increment the media rank_totals (and rank_up columns if an up vote)
10) increment the user rank_totals (and rank_up columns if an up vote)

All of that crap just to add 1 to a count. I assure you it only gets more ridiculous if we start to look at the other stuff. My gameplan is to finish the media library functionality and tie it into the media center, then I need to make my video editor (not exactly what you think it is) and my playlist editor. This will put me in a position where all of the core client-side functionality of the site is complete.

From there I will move on to creating the definitive sitephyre media player. This will basically wrap up the entire project from a "for bluntz" standpoint. However, that will just begin the project from a "by me" standpoint.

I will then move on to really complicated shit

1) cache'd pages
2) style/theme builder
3) page builder
4) never-ending templates
5) adding massive config vars to the config table and their "switch" to the pages
6) implementing oembed
7) implementing ffmpeg (watch out youTube I know how you did all this shit)

That's starting to sound like a lot, right? Nope. I mean, yes it is a lot, but ALL of this crap is setting the stage for me to bring all of this to yet another level. We aren't gonna discuss that right now.

Anyway, just like parsing delimiters (which is not dead) I intend to let this thread serve as my progress thread as well as a place for me to "talk out loud" til this project is 100% finished, which will actually be never. Understand, I am a programmer. Actually I am a bad ass programmer. This current idea will allow me to work on one project for the rest of my life while still giving me ample room to develop across multiple platforms and in many directons. If you notice, one of my completions above says "upload ANYTHING.." This is not gonna be a youTube clone or even a respectful nod. I intend to turn this into an entire software company of sorts. This is just the "foundation" for me to expose "my lifes work".

Anyhoo, I'll be posting images and stuff in the near future. When I get to "bluntz complete" I'll post even better than that.

[MadGypsy]

Oh I forgot something. I have not used one single solitary piece of code written by someone else. I have not used any example code to base my work on (I actually did once but its gone). The systems that are implemented (ex managing the database) were all invented by me. I took everything I know, "forgot it" and invented a totally new way.

Now, why do I tell you this? I tell you this because there are "standards" and I didn't use them. I tell you this because it sets me up for huge success or failure. Now, when I release this 1 of 2 things can happen.

1) my stuff works awesome and secure and the standards become "curious"
2) everything epically fails

I'm willing to bet the farm on my method vs "whats the point of building the same thing as everyone else". My system is becoming more refined too. As I add stuff I realize little frayed edges and I tighten them up - further defining MY standard.

I did implement one standard though. I actually implemented it to a ridiculous degree. I don't trust you or anything you can write into any one of my boxes. I'm not even sure I want you typing in my boxes. Therefore I have created an army surrounding those boxes and if you even look at it crooked you get shot in the head at point blank range. True story. I looked at it crooked today and there was blood everywhere.

So, there ya go. I stood on top of the mountain, put my hands on my hips and said "fuck your standards", now we just have to wait and see if I get to stay on top of the mountain. Honestly, if I do get knocked off the mountain it will just make me pissed and I will come back with something even more intense because of it. There is not a way for me to truly fail cause I decided a while back that I will not be accepting any failures and I know all about this stuff to boot.

[Chip]

You need a web site to advertise it, you need a nice landing page, you need a demo.

I could test it for you if you want, I'm a PHP/MySQL programmer. I could also include you in my project management application so I can review your CMS and offer feedback.

[Guest]

MadGyver... Jump on that ^ ^ ^ ^ ^

I seen 2 funny things here... #1 your avatar (didn't realised the Q logo... nice) and #2 remembering your very 1st discussion about your project (I will provide you a Player).

I can't wait to see it in action and also will always take care what is (I) involve with you... always (cause you get so serious... no fokin joking hey).

[Spirit]

So, how do you store passwords?

[Syluxguy28O3]

nice! glad to see this moving along.

[MadGypsy]

1) @chip - no doubt, I will take you up on all of that
2) @Mom - don't judge me entirely by some bad days I was having, bro.
3) @spirit - not in a cookie *
4) @sylux - thanks

*My current system makes your password basically irrelevant. An identity is created for you and whatever you think your info is is basically ignored (past sign-in). That data also expires and is recreated anew constantly. I doubt you are asking me how I store passwords in the database, but if you are the answer is standard MD5 with a

if(md5(password) == user_pass){ yadda yadda

not every possible standard was ignored, simple things like a password don't need to be revolutionized. When I said I didn't use standards I was referring more to things like prepared statements and other such core programming.

@Mom - my logo is me being as cheesy as possible. The dragon tail finishes the S and the entire right side of the quake logo is a P

SitePhyre

I know that's dumb. I was goofing off with a "Sitephyre Quake Edition" (LOL) and that's what I drew, Also sitephyre is actually just one word, so basically it doesn't make any sense no matter how you look at it.

[MadGypsy]

Let me give you an example of "standard" vs my method:

Most sites you sign in and if you are (ex) a mod - YOU ARE A MOD. In other words you have the ability to mod on every page. That is stupid to me.

My method - if you sign-in and you are a mod - you are nothing but a user (like everyone else) until you are on a mod page that users have no access to. There aren't a bunch of mod/admin things programmed into user pages, this means a user could never even see them by accident, cause they aren't there.

Now, you may say, if you are a user even if you are a mod how do you get to the mod pages. That's a good question and you have to understand something. No individual has personal permissions. There are 5 static user permission types (guest,user.mod.admin,owner) and those types build upon one another.

For instance, if you had ONLY Mod permissions you wouldn't be able to even read the database. I stated this elsewhere on Quakeone but database read is a guest level permission. An (ex) Mod inherits all the permissions equal to and below mod. I guess what Im trying to say is as your level goes up you are allowed more permissions and none of those permission levels have overlapping permissions. Each one is a set of new liberties.

So, back to the question - everyone is given a level number. THAT is the key. Your level number determines what functionality will appear for you and level is constantly being compared and checked as you navigate from page to page. So, you get to a mod page by having a sufficient level. All this level does is add to your navigation menu. If you want to do mod stuff their is a page for that and you will be vetted upon opening it.

Im rambling so I'm gonna try to tie this up.

Everything is based on least necessary permissions. If you are a mod watching a video, you are a mod utilizing guest privileges to do so. Even the OWNER is viewing media as a guest, cause that is the least necessary permission to complete that action.

I hope that wasn't too confusing. Its hard fr me to type this cause I don't think about this in the term of words. I think of a bunch of boxes and lines of various colors and my brain understands what it all means.

[MadGypsy]

I want to thank you guys for your interest and feedback. It puts extra fire in me to give it my all and create something unique and excellent.

[Spirit]

Yes, I was in fact asking about how you store the authentication details in the database.

MD5 is broken. Horribly so. You should be using something modern like SHA1 (salted, for heaven's sake) or better yet bcrypt. At the very least use SHA1 with salts. Unsalted MD5 is so broken you could store the passwords themselves unhashed with no security loss in comparison. Salted MD5 is just a fun little room heating for the aspiring cracker.

If you are writing new software in 2013 and you are using MD5 to hash passwords then you should take a step back, re-evaluate your competence about security and realise that you probably should check out what the other hip web programmers are up to.

Sorry. Honestly, I feel a bit like an ass but this is important and I cannot let someone do something like this without saying anything.

Btw, be aware that == is kind of a weird operator in PHP and you usually want to use === instead.

[Spike]

sha1(password + accountname + specialmagicvaluepreferablyrandomlygenerated) == "plaintextvalue"
oh, and hash it with some random different string each time they connect.

including the accountname in the hash means that if someone hacks your server, they can't just see people X, Y, Z all have the same password (and if they hacked a different server, they might already have Y's password and you don't want to let them know that its equal to X's password...)
including the specialmagicvaluepreferablyrandomlygenerated value means that they can't use rainbow tables (you can probably just run some weird pseudo random number generator on the account name just to come up with some random string that you know isn't going to be found elsewhere, or meh, hard code it to your domain name or whatever). If they want to find that user's origional password, they're going to have to do a lot more work to find it. This basically ensures that other sites are never going to have the same hash for the same user account so one compromised site (not specifically yours) doesn't leave others open to attack.
Hashing it on the wire with a server-supplied magic cookie ensures that a mitm attacker cannot just reply the same password back to your server, because it changes for each login/whatever.
and yes, md5 has been cracked. use sha1 or better.

The great thing about standards is not just that there are so many to choose from, but also that other people have already found the bugs in their implementation and the standards they have created from that implementation ensure that compatible implementations will not suffer from the same mistakes as the standard's creator.
Or in other words, you can learn a lot from standards, even if you don't implement them.

Anyway, its a satisfying feeling to be able to say 'its all my work', just make sure you're aware of certain best practises even if you don't aim for compatibility/standards.

[MadGypsy]

Sorry. Honestly, I feel a bit like an ass

DONT! I'm not a noob but I certainly don't know everything. Especially in a situation where I am isolating myself from standards and re-inventing the wheel, it can be expected that I am going to make a mistake or use something that is dated. Your input is VALID and I respect it. I am aware of just about every kind of encryption available for php and I will be taking your advice and reconsidering how I encrypt my data. Thank you.

@==

I actually do use absolutely equal (===). When I write little examples I don't go to a lot of trouble to make every little nuance identical to my code.

aside: I'm a "brutal truth" type of individual. Honestly I think I get some sick satisfaction from telling people truths that suck. However, when the tables are turned and the truth is something that sucks for me, I tend to make an example of the situation and instead of crying about it or giving up...I just fix it.

That being said - your blatant honesty was well received. Telling me "everything is going to be OK" is the last thing I want to hear. Especially if it is bullshit.

[MadGypsy]

@Spike - I like that. I'm going to work on that concept a bit and see if more can be accomplished with it.

[bluntz]

SHA2 is better still.Using the SHA-256 variant of it is even faster than SHA1 to boot.SHA1 was broken several years back.2007

[Mindf!3ldzX]

I recommend whatever can't be brute-force cracked via GPU,hee hee

25 GPUs brute force 348 billion hashes per second to crack your passwords

PHDays ? Positive Hack Days. Forgot Your Password? Hash Hacking at PHDays 2012