Compare Forums - Part 2 - phpBB3Part 1 - SMF review - Forum Reviews: Start page
Part 2 - [this page] phpBB3 review
Part 3 - FireBoard for Joomla review
More tech info and expert user feedback on popular website applications. Make sure to check out the Start page in this section, and our review criteria. This page describes more experiences with well-known webapps that reside on your server and enable a forum, aka bulletin board, for visitors.
You should also note that the reviews are only accurate at the review date - software is constantly updated.
>> please note the statements in the disclaimer at the end <<
phpBB 3.0 Review
review date: 2008-03-15
Please note this is an old review of the first 3.0 version and is likely to be substantially out of date.
This forum software is well-known and widely used. There is a debate whether phpBB or SMF is the most popular. It is known for stability under heavy load and for extensive and capable ACL.
Installation
We trialed the new version, phpBB3, for a couple of days on this site. Like many it is a free OSS application. Note that this is a new version and support in various forms is not optimal yet; but this will no doubt improve to a much higher level.
It has an easy install routine which is very smooth and professional - and one of the most impressive things about phpBB.
It is of course a PHP - MySQL app, meaning that it will run on virtually any server, and can be installed remotely. It requires a database, or can be made to share with another application if necessary by using a DB table prefix, like ph_ for instance.
Documentation
The score here is 2 ex 10, and is as poor as the numbers indicate. The strange thing is that the documentation initially looks very smooth and professional - but on detailed inspection it will be found that topics only receive a quick overview, with none of the detail that is required.
It is only available as numerous individual web pages, which is not the best format, though one of the easiest to provide. It looks great on first inspection: clean, well-drafted, nicely organised, well written - but in fact it is a very sketchy treatment and most of the info you need is missing. Because of the volume of missing information, various FAQs and tutes are scattered around piecemeal. They are hard to find, but you won't get anywhere till you've found them.
In total, it is difficult to locate vital information required; which is aggravated by the fact there is no one-shot PDF version. Clicking through dozens of web pages to try and locate the hard tech info you need - and then having to give up because it isn't there - is a frustrating experience.
Templates
Changing templates (or 'styles' in this project) is not straightforward and involves FTP. This is poor now, as today that is a clunky procedure.
The new 3.0 version has very few templates available, in any case - the community seem to be still working mainly with the 2.0 series, for which there are many more resources.
Plugins
The new 3.0 version does not have plugins - which are called 'mods' here - but instead the core files must be hacked. No, this is not a misprint.
Amazingly, there is no plugin procedure at all. It is not unfair to say this must be the worst extension system of any dynamic application around - because there isn't one. Mods consist of raw code files that are pasted piece by piece into the core files. Unbelievable? Perhaps so, but it's true.
There are hundreds of forum posts at the central site with requests on how to hack the files, or mods that don't work (maybe due to incorrect file hacks of course). Make the tiniest mistake and they are unlikely to work.
SEO
A very low score both for the basic app, and also with 'plugins' (there are few mods in any case). The worst thing of all is that it allocates session IDs (SIDs) to unregistered visitors, and therefore spiders - an absolute no-no for SEO, one of the worst possible sins. There is a mod that may help to fix this for the 2.0 version, but not 3.0.
Why an SID would be needed for guests is a mystery anyway; the most important thing they could do for phpBB is to turn this off. You might need SIDs in an ecommerce backend, but certainly not in a forum. Even for an ecommerce site it is perfectly acceptable and efficient to identify visitors by a combination of IP and cookies; session IDs are unnecessary.* Why a SID would be required in a forum when it is unnecessary even for financial transactions is a mystery.
There is the usual boilerplate metadata, something of a standard feature in forums, so we should expect that by now. It means you can't have unique metadata per page - just the same identical meta sitewide. Aarghh!
There are meta and URL mods, but the best way to describe these would be 'crude, hard to apply, very basic, incomplete'. Perhaps one day developers will realise that website success depends on at least some basic search optimising.
*SID explanation
A session ID is a way of identifying a visitor in their progress through the site, from page to page. The most common use of this is for login purposes, so that even when you change page, you are still recognised as being logged-in. The next most frequent use is within a checkout, in order to identify a customer properly.
Note that a SID comes in two forms: a cookie (and often, the server also uses your IP), or an URL + cookie. A cookie (only) is an acceptable form of SID as it can be refused if you wish; and search engine spiders don't accept them (this has been debated, but whether or not it is a fact, that is certainly the effect in practice).
An URL that includes a session ID (the long chain of numbers and letters at the end) is nowadays unacceptable for a long list of reasons, first among which is that search engines hate them since they can't be avoided - they cannot simply be refused like a cookie. And SIDs, like JavaScript, are a prime way of attacking them and thus often used by black-hat developers. SIDs can be used to track a spider round a site and send it into a 'spider trap', an endless loop where it finds thousands of pages optimised for whatever search terms a BH dev wants to position for; which of course don't really exist (for visitors). These pages are gibberish stuffed with keywords, but look OK to bots.
The URL will be different every time; and it is normally also a massively long raw dynamic URL.
If you want to do well in search results, about the first thing you need to do is get rid of any session IDs in the URLs.
Admin
There are a whole bunch of major usability issues in the admin backend - which looks impressive, but has the worst usability rating we have ever given to any webapp. Partly this is due to some heavily-flawed default settings, partly the lack of documentation, partly the layout and procedural methodology; but mainly because of the way almost everything derives from some form of ACL setting, resulting in the most amazing complexity.
Our rating for the admin in phpBB - especially from a usability point of view - is 1 ex 10.
ACL
OK: the ACL in phpBB is brilliant. Just about any possible permutation of permissions for anyone, anywhere, on any board, is achievable. There is only one way to describe this level of granular ACL: outstanding.
However, there is a drawback. In order to achieve this very comprehensive system of permissions and roles, it seems that just about everything (and we're not kidding here) derives in some way from an ACL setting. To say this makes things complicated would be the understatement of the century. The incredibly complex and Machiavellian deviousness of the admin procedures is something we never saw anywhere outside of the life story of the Borgias. Do not even consider venturing in here for the first time unless you have taken half a dozen Valliums - and make sure to hide all sharp objects first.
Of course, there is no default working forum after installation, or
even after creating a forum - no one can post to it, no moderators can
work with it, and so on. Working out how to fix all that is
the first of a long line of tests you will face. After that it gets
worse, when you find that to enable even basic 21st century features
you will have to hack the core files. The very nice-looking but merely
outline documentation makes all this a lot worse.
Security
The security in phpBB3 looks good, but we haven't tested this hypothesis as it isn't our field. There are multiple ways this now looks like a more robust application than most.
This has not always been the case: phpBB2 (like Invision Powerboard) had serious vulnerabilities. Exploits could be used to attack the host site and then other sites on the server, causing major problems and in some cases turning the server into a malware farm. These exploits are well documented by Google (search: 'malware provos.pdf'). It does explain why phpBB3 was so hastily written, with such poor SEO levels, no doubt as a rush job.
There are a large number of bot probes for phpBB URLs. This refers to the frequent 'testing' attacks that automated software will make on your site once you publish any pages with URLs or references to phpBB. It is probably safe to say this doesn't happen much if the application has had no vulnerabilities; and that it happens more if there are more exploits (paths to attack an application and gain access). The frequent probe attacks indicate the application had vulnerabilities in the past.
Unfortunately, a bad sign is that the probes now specifically target phpBB3 URLs. Again, this doesn't happen unless there are now, or have been, exploits. If phpBB3 also has exploits, despite the hard lessons learnt from phpBB2, this isn't good news.
Forum templates
Like most if not all forum software, the templates are are years behind the times. There are no menus or module positions available. You can't have anything on the page except the forum index, threads or other standard info. This seems to be common to all forum applications and simply shows how far behind everybody else forum software authors are.
The visitor experience
The forum is good from the visitors' side, with reasonable usability and an attractive appearance. Because forum developers don't employ proper usability testing, they aren't aware that you need extra menus to make life easier for visitors. To make like easier for webmasters the first thing you'd do would be to add module positions to the pages. If you install this forum you will need a commercial template with some on-page assets. Some old versions of IE6 can play up on some templates.
Conclusion
It looks as if most of the community development work is still going into the old series, phpBB2.0. As an example, the 3.0 mods (plugins) page on the central site has very little in it; the 2.0 series has plenty - and more being input all the time. The 3.0 series template page is completely empty (when we wrote this); the 2.0 series section has many pages, with more templates being added all the time.
PhpBB3 has the best ACL we have seen in forum apps: very fine granular ACL control, which unfortunately wrecks the the usability of the application since it makes it so hard to set up correctly. They don't seem to have heard of SEO or usability, as both of these factors are Stone Age level.
Awful extensions method - hacking files, FTP and so on was OK in the 90s - but this is the 21st century. This application would fit well with Windows 95 and the Frontpage web author - everything else has moved on a long way since then.
We cannot understand why the new series, which is obviously a whole new version as it is incompatible with the old series in every way, was not built from the ground up to be search engine friendly and plugin-capable. Why on earth would you start a new version line except to do that? The answer has to be that the 3.0 series was a rush job due to the serious vulnerabilities in phpBB2.
Very professional install routine - excellent ACL - the worst plugin system we know (there isn't one) - very poor SEO - and terrible usability problems for the admin. If you can get a phpBB dev to run it for you - fine. Otherwise you may be better off looking elsewhere, with the sole exception being if you need very comprehensive ACL and the large number of other drawbacks doesn't matter.
Therefore this forum would suit private inter-office enterprise use where they don't need to worry about search engines - with several boards, each kept separate for discrete departments of the business, for instance. Even then we can think of easier ways to do it.
The only excuse that could be offered here is that this is the new version of the app, and a complete break from the v2.0 version line. Since it always takes a year or two for a new version to settle in, we suggest that you try the v2.0 line (which is still being developed) if you need a practical working modern web application - because in our opinion there is no way the 3.0 series complies with that description right now (February 2008).
We replaced an SMF forum with phpBB3 as it seemed on first inspection to be a step forward. After 2 days we ripped it out and scuttled back to SMF...
There are some very sophisticated highly-modded forums out there, run by phpBB experts and devs. The pages are starting to resemble CMS pages in that module positions are there, and so on. This functionality is not available to ordinary users, even with the new 3.0 series - it requires developer input. However, if this assistance is available to you, then phpBB is highly customisable, very capable, and probably very extensible - judging by some of the highly-modded sites we looked at running on Morpheus templates for example.
For the rest of us, those capabilities are not there. It is something of a pointer to the difference between a CMS and a forum application: the average CMS user expects to be able to extend their application easily, as that is what it's all about. The average forum user, though, seems to have to put up with a plain vanilla forum unless they can pay up for more. The only example we had time to find of a forum run by an ordinary person, using a different layout from the usual vanilla templates (ie with some module positions etc), was a train wreck in one version of IE.
Final word
PhpBB3 is hard to work with for the sysadmin. It has no plugin system at all and generally seems to be about a hundred years out of date, in this and other respects such as SEO. It's got great ACL but that hardly matters, given the scale of the drawbacks. If we seriously needed good ACL on a forum, beyond what SMF could offer for instance, we would think hard about using multiple instances of SMF to get around it (or use vBulletin).
An important reason we tried phpBB is because Joomla.org have switched to it, for their main site forum. Their traffic is immense, with 50 or so boards, thousands online at any one time, millions of uniques per month, and 1,300 posts per day. We figured they must know something; but that is looking like a very strange decision right now, especially since the Joomla forum has numerous issues since the changeover. However these might simply be due to migration problems, considering the huge scale of the task - hundreds of thousands of pages and millions of posts to transfer, no doubt.
At the end of the day, phpBB3 is probably the same as other complex webapps: if it is set up by one of the core dev team; and run by one of the core dev team; and problems are solved by one of the core team; then it's probably going to be fine. For the rest of us it doesn't seem like a good bet.
Date of review: March '08. All information applies at that specific time. Later software versions are likely to be different. Please tell us about changes.
Forum Application: Tech Spec
cost: free
type: PHP - MySQL
version reviewed: phpBB3
zip installer size: 2.14MB
choice of templates: few
number of plugins (estimate): few - but these consist of raw code hacks, there is no plugin system
central site: www.phpbb.com
example sites: start from the central site's forum members
[tags: phpBB3 review, phpBB comparison, compare phpBB]
Please note:
1.
The reviews can only be accurate at the review date. Software is
constantly being updated (or should be), so one month later some
details may have changed.
2. These forum reviews are the personal opinion of the
reviewer. They are an honest appraisal from that person's point of view
- but you might disagree entirely. Different people have different
expectations and viewpoints. Where we have criticised, you may disagree
completely. Where we approve, you might not. We only give a viewpoint,
which may or may not be factually correct. There will inevitably be
those who completely disagree with our interpretation - and you should
consider this fact. Please be aware that there are substantial numbers
of users of any given application for which we provide reviews, who
would probably disagree with comments made in the reviews.
YOU MUST TRIAL THE SOFTWARE YOURSELF IN ORDER TO COME TO YOUR OWN CONCLUSION.
|
|
Compare Forums - 2
