>>123

Noted. I've been struggling with that same problem for naming things internally in the code, and obviously it distracted me from noticing the same problem in the GUI.

> Pruning set to furthest-back instead of oldest.

I don't like this one. You just have to continually age a topic (until it hits the permasage treshold) in order for it so survive a long time. Normal users might have good reason to ignore simply it, though...

> Size limit instead of post number limit, maybe?

Sounds good.

> I was thinking of setting the default behaviour to never permasage or close threads.

I guess I don't have a strong opinion on this one. As long as the values will be customizable, I don't really care, I suppose.
Also: I just noticed that "¦" in tripcodes will work correctly but turn into "�U" through the cookie on /soc/ but not on the sandbox.

　　　∧∧
　　（　 ･ω･） 　 　It's late
　 ＿|　⊃／(＿＿_
／　└-(＿＿＿_／

　　　∧∧
　　（ ･ω･ ） 　 　Good night!
　 ＿|　⊃／(＿＿_
／　└-(＿＿＿_／

　 ＜⌒／ヽ-、_＿_
／＜_/＿＿＿＿／
￣￣

>Most admins probably don't get point of the secret string anyway, and asking them to put in several is just too annoying. In retrospect, I'd like to add a second layer of hashing to these, but that'd mean breaking secure trips AGAIN.

You could take the route that MrVB (I think?) did and generate the strings on first run? openssl, /dev/random, perl's random as last resort. In almost every case you are going to get a better random string than most people will supply, and if they want to change it they can. Or only have them generated if they are not supplied.

Honestly, when people care so much about anonymity they can put up with the changes required to ensure it.

The problem reported in >>143 is still present.

If you want to have a look at what the code actually does to dig out flaws, here is the current version:

sub sanitize_html($%)
{
	my ($html,%tags)=@_;
	my (@stack,$clean);
	my $entity_re=qr/&(?!\#[0-9]+;|\#x[0-9a-fA-F]+;|amp;)/;

	while($html=~/(?:([^<]+)|<([^<>]*)>?)/g)
	{
		my ($text,$tag)=($1,$2);

		if($text)
		{
			$text=~s/$entity_re/&amp;/g;
			$text=~s/>/&gt;/g;
			$clean.=$text;
		}
		else
		{
			if($tag=~m!^\s*(/?)\s*([a-z0-9_:\-\.]+)(?:\s+(.*?)|)\s*(/?)\s*$!si)
			{
				my ($closing,$name,$args,$implicit)=($1,lc($2),$3,$4);

				if($tags{$name})
				{
					if($closing)
					{
						if(grep { $_ eq $name } @stack)
						{
							my $entry;

							do {
								$entry=pop @stack;
								$clean.="</$entry>";
							} until $entry eq $name;
						}
					}
					else
					{
						my %args;

						$args=~s/\s/ /sg;

						while($args=~/([a-z0-9_:\-\.]+)(?:\s*=\s*(?:'([^']*?)'|"([^"]*?)"|['"]?([^'" ]*))|)/gi)
						{
							my ($arg,$value)=(lc($1),defined($2)?$2:defined($3)?$3:$4);
							$value=$arg unless defined($value);

							my $type=$tags{$name}{args}{$arg};

							if($type)
							{
								my $passes=1;

								if($type=~/url/i) { $passes=0 unless $value=~/(?:^$protocol_re:|^[^:]+$)/ }
								if($type=~/number/i) { $passes=0 unless $value=~/^[0-9]+$/  }

								if($passes)
								{
									$value=~s/$entity_re/&amp;/g;

									if($value=~/"/) { $value="'$value'" }
									else { $value="\"$value\"" }

									$args{$arg}=$value;
								}
							}
						}

						my $cleanargs=join " ",map { "$_=$args{$_}" } keys %args;

						$implicit="/" if($tags{$name}{empty});

						push @stack,$name unless $implicit;

						$clean.="<$name";
						$clean.=" $cleanargs" if $cleanargs;
						$clean.=" $implicit" if $implicit;
						$clean.=">";
					}
				}
			}
		}
	}

	my $entry;
	while($entry=pop @stack) { $clean.="</$entry>" }

	return $clean;
}

How come this is now the by far biggest thread on this board?

Maybe it's because I'm posting useless replies like this one!

>>20
"|" is not "¦"

rel=nofollow for internal links as discussed in http://wakaba.c3.cx/sup/kareha.pl/1127092367/

Too late! Already released!

I vote yes, but that is obvious isn't it?

I think it'd be a better idea to have some kind of load-balancing/distributed server cluster approach, like what dmpk2k was working on for Wakaba.

ugh "More options..."

too much clickable elements! and it doesn't even do anything (Firefox 1.0.7 here)!

out! out!

| stays |

Wow, >>243 sure looks like shit in Safari. What the hell? Looks right in Firefox, though.

Hmm, looks like my ISP fails at keeping my IP secret.

It's also more markup when even the existing one isn't working as well as it should.

That would be a bother too.

>>55
I'm not complaining about the current system, just throwing around some new ideas for a change (instead of blindly following whatever new thing comes along on 2ch).

Nothing specific, just protecting against any possible future ones.

How about adding a link to 2ch in footer.html called "2ch mode"?

I've been meaning to change some of the defaults away from Futaba-style to saner behaviours. Any suggestions for what to change are welcome. So far:

• Pruning set to furthest-back instead of oldest.
• Size limit instead of post number limit, maybe?
• I'll add thread closing to Kareha, but I was thinking of setting the default behaviour to never permasage or close threads.

At least i got 350

RENZOKU are the flood detection things... even if they are useless MAX_POSTS_PER_MINUTE makes a lot more sense than RENZOKU2

3) was about a string to trigger ID:Heaven, not a constant for the Heaven part (which is already configurable)

Re: email/link field

Just because it works one way on 2ch/whatever does not mean it is the best way. Having 'fusianasan' as the only way to trigger the effect is just narrow-minded. Functions should have descriptive names to the people using them; should we keep the field names in Japanese because the Japanese have them in Japanese? Having all of the applicable things configurable is something that makes sense, and you can easily have both 'fusianasan' and 'show_ip' that work at the same time. Frankly, the combinations of many things into unrelated fields is a design flaw. What if you want to use a name/trip and fusianasan? What if your email address contains the string 'sage'? What if you want to sage a thread, but have an ID still?
I think the confusion of existing users is worth reducing the learning curve and improving the intuitiveness.

I'm not saying that the default behaviour needs to change, but being able to easily configure the strings used allows for easier localization.

I probably misspelled fusianasan too, why should I have to remember something so foreign?

http://wakaba.c3.cx/sup/kareha.pl/1114201493/l50

Or use some sort of filter to replace them characters with underscores on upload.
This offcourse for files that keep their original filename.

What about a(n) (optional) preview page? It would be nice, especially with the multiple formating options. It also allows most of the benefits of being able to edit posts, without being able to edit posts. I don't know how often I've screw up a quote because it didn't look like multiple lines but it was.

Is there a reason why the post box is so small and pushed to the side?

Forced fusianasan would be fine I think, if they had advanced warning.