As you've hopefully seen in other announcements, Xepher.net was hacked again last night. After much investigation, it looks quite likely that there was a backdoor left in place after the last hack, and they just used that to get back in again, despite any security enhancements I made in the interim. The problem here is that, while I think I've found and removed all backdoors and such, there's no way to be positive without a complete system wipe and reinstall. Now, if the machine was sitting here in my room, no problem. I'd take it offline for maybe 8 hours and do it. But it's in Chicago, and I'm in Steamboat. Between shipping both ways and the time to sort and test things, it'd probably mean a week of Xepher.net being completely offline. Also, it would cost me a couple hundred dollars in shipping, and I'd really hate my life because it would eat all my free time when I'm not at work.
Here's my current line of thinking. I think the hacker(s) weren't out to destroy the system, but just spread their viruses and such for other purposes. As such, I believe the damage they've actually done is rather limited, as evidence by everything still running and me still having control of the machine. Now, as I said, I can't "trust" the system, but if it's doing what it need to do... that is, serving your websites up properly, well, I think that's good enough... for now. I'm not going to pull and wipe the system just yet. I'll leave it running for a few more months until I have the time and money to redo it properly. What I ask though, is that since it's possible there's still a hacker with access to things, is that everyone make sure to keep backups of your own data as often as you feel is needed. I do keep system-wide backups, but I'm hesitent to run one of those because all I'd be doing is backing up possibly infected files. If the system is totally taken down, then I will possibly be restoring that backup as an emergency measure. But since it will be a couple months old, many of ya'll could lose newer data if you don't have your own backups. Please realize, I'm talking from paranoia here. This is a worst case scenario. I really don't think the hackers are trying to destroy things, just sneakly spread their worm. As such, I don't anticipate any major disaster, but I'd rather everyone was prepared, just in case.
Now, for future plans... I'm moving back to Texas in a few months. My current plan has me taking over some investment (rental) property, and if that goes well, I'll be getting enough income that I won't have to have a full time job just to get by. That will leave me more time to get Xepher.net sorted out properly. What I want to do is build a new server. The current one (Orca) is now several years in service... the drives have 30,000 hours of power-on time. That's 3.5 years at 24/7 and is definitely "mature" and not at all bad lifetime for something built from spare parts in a college dorm. For a new server, I want to actually drop some real cash on it, build with all new parts. I want a much faster server, with MUCH more storage in a raid array this time 'round. Currently, I'm aiming for about an athlon 64 3200+ with something close to a terabyte of storage. If I do that, I plan to seriously redesign the software side of things as well. The current server setup is pretty much as secure as I can make it while still giving everyone the amount of resources/freedom that I do. I thought it was going to be enough, and it was for several years while we were still small enough to be below the radar. It fended off thousands of "drive by" hacking attempts. The one that finally got through looks to be a concerted effort over many days (possibly weeks or months) by a very determined hacker or group. The new server... I plan to run virtual machines this time around. I'm going to have a master/host that's the actual operating system, but below/inside that I will run virtual machines with a completely seperate OS and everything, and those will run all the actual services. What this gives me is the option to actually wipe and rebuild those virtual machines by remote (using the host system.) So if/when another hacker does get though, I can build a second virtual machine, and switch services over to that one, then go back and wipe the infected machine out completely and rebuild it. I hate having to think this paranoid, but it seems to have become neccessary. The truth is that, no matter how good I design a system to be secure, I'm still at the mercy of the software I use. That means that, even if my design is perfect, a bug in something like the mail server could get the whole machine compromised, which is exactly what happend this last time.
While I'm rebuilding things, I'm going to revamp the hosting side of stuff as well. I'm going to try and implement "Phase 3" as I originally called it. For those wondering, that was the idea that was basically limited (non-machine) accounts specifically for comic hosting. It'd be a lot like keenspace... no applications, everyone gets in, but you can't really do much with it OTHER than host a comic. I also plan to add in some of the things I've been meaning to for a while. Mostly convinence things, like a web-based file manager, and some sort of statistics gathering that's a lot more detailed (and interactive) than the current stats system.
Now, I'd like to hear from ya'll on this, what you think. First off, just any general opinions on what I've mentioned. I have a couple of more specific questions though.
1. Do you think waiting to rebuild the system is a good enough option? Does it worry you undully that the server might be compromised in the meantime?
2. When I rebuild, I'm going to try and resecure things even more than now, but I don't want limit the useability too much. How many non-essential services here do you actually use? To clarify, here's the list of things people can or do use here. Please let me know which ones you actually use, which ones you'd like to use (or might in the future,) or ones I forgot or that you'd like to see
Webserver (essential)
SSH (essential... at least for me, shell/command line access)
SCP (secure file upload, used instead of FTP)
FTP (unsecure file upload... I may be getting rid of this anyway)
Email (username@xepher.net)
Webmail
IMAP (email access protocol)
IMAPS (secure version of above)
POP3 (email access protocol)
POP3S (secure version of above)
SMTP (Outgoing mail server)
Email forwarding
Spam filtering
Wildcard email (anything@username.xepher.net goes to your account here.)
Wildcard filtering (possible future addon... would let mail for address1@username.xepher.net get sorted into a different folder than address2@username.xepher.net. Would require use of email access that supports folders, either IMAP or Webmail.)
MySQL (Used for a lot of forums and similar software)
SQLite (similar to MySQL, but much lighter weight and more secure... used by this forum)
PHPMyAdmin (Web-based interface to for MySQL access/editing.)
HTTPS (Secure webserver)
Cron (process scheduling... run programs at certain time)
Virtual Domains (using a domain you purchased, EX: www.missmab.com rather than missmab.xepher.net)
PHP (scripting... used by lots of webscripts/forums/etc, including the XN newsbox)
Other CGI (Perl, python, and other CGI scripts)
Statistics ( http://xepher.net/stats/ and in the future, more advanced stuff)
Web-based file manger/upload (possible addon in the future)
3. Do you think I should prioritze security, or ease of use / convience, and to what degree? For example, would losing FTP and having only SCP be worth the added security? (WinSCP is just as easy as FTP for direct access, but a lot of editors (like dreamweaver) only support FTP for their builtin file upload.) On the other end, would having to do everything via web-interfaces be too restrictive? That is, having to upload and manage everything in a web-app, with no access to shell, FTP, or other such things. (This is the extreme option, but I believe it would've been secure enough to prevent the most recent hacking attempts, as they all relied on shell access.)
4. What other features or services would you like to see added?
5. How do you feel about the quality of service? By this, I mean how fast the server responds, how well it runs scripts, general performance stuff. This is not to rate MY service as an admin... which has been seriously neglectful when it comes to things like reviewing applications. I apologize for that, but what I'm considering is trying to find a new hosting service for the new server. I notice a decent amount of packet loss and wildly varying ping times with the current one. (On the other hand, it's REALLY affordable, and you get what you pay for.)
6. I want ideas here. I have a couple problems I'm trying to solve. First off, I want Xepher.net to grow, and I want to do so with quality, not just by becoming another geocities. Secondly, I'd like to find a way to get some small income for this thing. I'm looking at investing about a thousand bucks in a new server, and hosting is still costing another hundred a month. If I move to a better host, it could be even more. Right now, the only real income is from donations, and 90% of that is from DMFA ( http://missmab.com ) Still, it's been just over three years since I put the server in chicago and I've spent about 3800 bucks out of pocket for this, not counting hardware costs. I don't intend to forgo the free hosting, but I'm thinking options along the lines of maybe running a seperate "commercial" hosting area, perhaps with dedicated comic services like webcomicsnation.com, which wouldn't have to have a newsbox, or share revenue with donations like the free sites do. Another idea is to maybe offer dedicated game servers for things like counter-strike and such. Other options are maybe stick with the shared donation/ad revenue, but just work hard to get some good, quality content here. I mean, a couple more sites like DMFA is all that's needed. Question is, how to attract such sites? I mean, obviously I need to get one top of my game with applications and whatnot... Speaking of..
7. How can I redo the application system? I want some sort of quality "filter" on new members, but at the same time, I feel bad because the current "wait for Xepher the bevelant dictator to nod" method is leaving lots of worthy applications sitting in limbo because I don't have the time I need to take care of them. I was hoping that with them on the forum, there would be lot of peer review. Don't get me wrong, there are a few members that have been doing a lot of work looking at applications and giving good opinions and advice, and I thank them... but I need more than two or three opinions to let me feel comfortable rubber-stamping something. When I rebuild, should I make a system that requires current members to show up and vote on new people from time to time, or is that trying to force a community where there's not one? How else could I redo it? Do I deputize some trusted people to review and approve/deny applications?
I think that's about it for now, and I apologize for the length of this post, but it's stuff I need to sort out (and apologize for.)
1. Obviously if you don't have the time or resources to rebuild right now you shouldn't. I don't mind a little downtime if it means you have some leeway for happiness!
2. I think I am only using these features right now:
-Webserver
-FTP
-MySQL
-PHP
If I'm using anything else I don't know about it!
What is the statistics thing? I don't see my username on there so now I'm curious how I get that...
3. I am not familiar with SCP, but if I can use my FTP client to do it that would be fine by me. Or really just as long as someone can recommend something to use and it doesn't confuse me! I don't mind using web-interfaces too much as long as they aren't missing anything important.
4. Other than the statistics that I didn't know existed until now, I can't think of anything...
5. I don't know enough about this sort of thing to even notice. ^__^
6. I'm not really sure how to generate revenue. Other than what you mentioned where users could pay to remove the newsbox. I'm not really sure how big a demand there would be for that though, it's not the most restrictive thing in the world...
7. I wish I had as much time to read the applications as I used to... :( I don't think you should try to force it though, because if people really don't have an interest in it they probably won't take it seriously. It might speed things up if there were some kind of form or something, because a lot of people seem to read the rules, then still miss some things, then people who are reading the applications say, you need this and this and this, which leads to the person correcting it and continuing the application process, when they could just have all this done to begin with? So people could spend more time considering a completed application than just quoting the rules of the process.
1. It doesn't worry me personally, as I'm paranoid about backups m'self and have about fifty copies of my website files on various cd's, floppies, and two hard drives, going back two years. What I would worry about more is the downtime during such attacks; some sites like missmab might eventually lose readership if the server is consistently inconsistent. A single incident every few months though is hardly anything.
2. I use my aetre@xepher.net addy as a forwarding address to my gmail account, which is a much longer addy (aegelmaereaetre@gmail.com). This tends to help when my friends need an easy-to-remember addy to send stuff to. I'd like to be able to keep using both it and the forwarding option. FTP I can do without as long as whatever method is used to upload files can still upload all the same file types to all the same places--in other words, if it's as functional, it's fine by me. PHP is handy for comic sites, though right now I only use it for my newsbox. Lastly, stats are fun to look at sometimes. :)
3. Like I said above, if it's functional and more secure, go for it. I've never gotten Dreamweaver's FTP to work correctly anyway, so I use an independent program. I'd have no qualms with using something else if for us legit users it remains as useful. As for shell... I don't even know what that is. So I'm gonna move on...
4. I can't think of anything for this one...
5. My site's always loaded pretty quickly, even on 56k (such is the way of life when you have few images and mostly text). Speed of uploads and downloads has been pretty good, too.
6. I'm all for the gaming server idea, even though I'm not a gamer... it's a great way to attract audiences to xepher.net in general, and as a person who's spent a few years surrounded by the gaming crowd (been to Otakon three times, administered the VGC forums for a while), they aren't a bad market to attract. The traffic for gaming would no doubt dominate traffic for anything else if you're successful, but such is the way of the world, I guess.
7. Sorry I haven't gotten around to critiquing like I used to... It might help if you split the applications into subforums (Art Applications, Writing Applications, Music Applications, Comic Applications, Other Applications) and then put various people in charge of each section (reserving, of course, your own right to veto if necessary). I'd gladly volunteer for judging the writing entries if such subforums were implemented. This kind of organization would greatly help both judges and applicants compare and contrast similar applications, rejected and accepted alike, for reference and precedent in making current judgments.
Hope that helps. :)
I just don't get why anyone would coordinate to hit your service like that. It's not like messing with xepher.net is going to make them famous or something. And it's not interrupting a cash flow for you. Weird people.
Quote1. Do you think waiting to rebuild the system is a good enough option? Does it worry you undully that the server might be compromised in the meantime?
I'm not really all that worried...I've got back ups of everything, now that my personal CSV/SQL problem has been fixed. If they take my site, I feel sorry for them. It certainly isn't a trophy.
Quote2. Please let me know which ones you actually use, which ones you'd like to use (or might in the future,) or ones I forgot or that you'd like to see
Webserver, SCP, Email forwarding, MySQL, SQLite (I only use the forum though...dunno if that counts), PHPMyAdmin (sorry), Virtual Domains, PHP. I could see how adding web-based file uploading would be beneficial to some members, but I don't think I'd ever use it.
Quote3. Do you think I should prioritze security, or ease of use / convience, and to what degree?
I think security should come first, although since there aren't any credit card numbers or anything to steal (is there?), it shouldn't be like a maximum security prison.
Quote4. What other features or services would you like to see added?
I pretty much like things the way they are.... I can't think of anything else to add.
Quote5. How do you feel about the quality of service?
I think the quality of service is great. Xepher.net has its ups and downs, just like any other hosting service. I guess I'm kind of laid back about the whole server running/server dead thing.
Quote6. I want ideas here. I have a couple problems I'm trying to solve.
Personally, I favor just getting more attractive sites here. I think that the sites that generate the most revenue should not have the Xepher.net box on them so that they'll look like they're being commercially hosted. It should just be a Paypal thing, like what Miss Mab has. Of course, this means attracting those sites.... But I like the fact that people aren't separated by who pays and who doesn't. It's kind of disheartening to see a split section on some of those types of sites.
Quote7. How can I redo the application system? When I rebuild, should I make a system that requires current members to show up and vote on new people from time to time, or is that trying to force a community where there's not one? How else could I redo it? Do I deputize some trusted people to review and approve/deny applications?
I don't think requiring that people show up and vote is good. Making people do something may put them in a bad mood and vote nay on all applications, even if the application is spectacular. I'm going from the top of my head here, but what about limiting applications to a waiting pool of 10 or 20 at a time? Once they're approved or denied, there's a spot open for someone else to apply. While the applications are in the waiting pool, current members can give feedback and such. If you use the queue system, I think someone you know IRL or who has been a constant feedback writer should be entrusted to automatically deny sites that don't follow the format or are just spam, thus opening up the spot for applications that follow the format.
EDIT: I forgot to add...as for getting those spectacular sites...maybe, on some occasions, just going out there, presenting the Xepher.net package, and seeing if you can get them to hop on board. And of course, applications. But if there's a web comic out there that's awesome, but has ads or the owner is paying for it all, I think making a presentation isn't bad. Or is this not something done by website hosts?
1. I say wait until you're ready and you have the money. I'm not really worried about the security at the moment, I have more back ups in and around my computer than I can keep track of. >>;
2. The only things I use on this list are the webserver (obviously P: ), SQLite (same forum style as this one), a virtual domain (mystikskies.net is just so much more professional....and short :P), and FTP, though since I use a freeware program I'm willing to change over to SCP or whatever. Obviously I use PHP too, if only for the newsbox. I generally don't use xepher.net email since I have more email accounts than I know what to do with, and the rest of that list is pretty much greek to me. Personally I don't think I'd ever use a web-based file manager unless I absolutely had to, but if you think people would want/need it then go ahead.
3. I say you should go a little more half and half, as much security as possible without being too overbearing, though I'd trust any decision you made on the level of security you think xepher.net needs. Like I said though, I'd rather not use web-based uploading unless I absolutely had to.
4. I can't really think of anything that I'd actually use for this one. :
5. So far I haven't run into anything bad regarding service quality. My site, despite being "graphic intensive", managed to load easily even on my aunt's crappy dial-up service. I haven't had any problems with it, so I'd say the quality is fine.
6. I'm not really good with ideas involving money, sorry. : The commercial hosting might work, but it doesn't seem to have many perks that would make people go for it over the free hosting. Some people may be happier not having the newsbox or sharing the meager percentage XN gets from donations, but I'm not sure how many would actually go for it. I think that you should opt for attracting more DMFA-esque sites, though I have no idea how you would. You could always hint to other people on xepher.net to spread the word *winkwink*.
7. Heh....I've had my off and on moments of replying to applications I guess. XD I think both Aetre and griever have good ideas for this one, separating applications into different sections and limiting the amount of applications that can be up at any given time. If you ever go for deputizing people I'd be happy to help out in any way possible. :)
I probably forgot stuff that I wanted to say, but it's been a long day so I think I deserve some scatterbrained-ness. :P
2. FTP!!
1: While I don't think it's a bad thought to do this. Wait till you're ready to do it, not when we are, I'm getting a slight grasp on some of this stuff ever since I started ellipsis (RO game server). ;)
2: I don't even realyl touch FTP much anymore. If I can use SSH and SCP, that's the best. But perhaps restricting it a little more would help. Something like the requirement of public keys, which is waaaaaay more secure in SSH, as you can't simply try multiple passwords on viable account targets. Actually, you could probably set up something like this now and secure SSH a lot more, people who have the knowhow can even change their own keys if need be.
I use MySQL and PHP pretty often, but I've never made use of any sort of web tool or xepher webmail services. Probably wouldn't hurt to set up some sorta mail forwarding system that users can use and drop the full email support. Many people have primary account they use elsewhere anyhow. I also haven't touched SQLite or Cron. As for cron, not much need for anyone to really use it is there, other than maybe you.
I don't make use of SQLite because, while I've heard good things about it, I also hear it starts to have issues when processing large amounts of data. So I personnally haven't messed with it because I'm working on designing game servers. :P
I also make use of the virtual domain, with my domain name.. :P
3: Security with usability is my preferred choice. As I've pointed out, after it's set up, SSH can be just as easy to use as FTP apps. Tutorials are simply a matter of time to write, but not too difficult. Dropping FTP in favor for SCP would probably be to everyones benifit in time of hacking attempts.
4: I don't think there are a whole lot of other features that are really *needed* on a webserver that I know of. The image proccessing stuff (was an addon in PHP4, dunno about PHP5) would be nice to have. Esspecially if people plan on having generated things like anti-bot image keys on forums for registration.
5: I think that the current service is considerably fast in terms of most free web hosting services. Lack of banners/popups (something that ruins 90% of the web) and fast response are pretty good on the current service.
6: Sure, the commercial space sounds like a fantastic idea. As for a game server area... that would probably bog things down considerbally. Even on a new system. Which could cause response time issues with other things depending how widely/heavily used it is. Also note that while web servers are targets for hacking, game servers are even more so. Jeeze I have like maybe 20-25 registered members on EllipsisRO and I've had a few hack attempts... and it's not even widely known. lol
7: The rating system based on the users who are here and their responses doesn't sound like a bad idea. But in terms of deputizing people, that could be a tad risky depending on who. Unless you do it as a kinda majority vote thing over all those you "deputize"? There are a few things you could do there... not really sure what would be the best idea.
The services I use:
Webserver
FTP
Email
Webmail
POP3
SMTP
Spam filtering
Wildcard email
Virtual Domains
All these aside from the webmail are what I would call "essential", at least to me. I very much like having the webmail access as well.
I've always been quite happy with the service. A long while back, it used to be slow, but I haven't noticed any problems in a long time. Upload speed seems to be rather slow, but I don't know if that's on my end or what. Usually that isn't a problem for me, but rarely I'll upload something large and I'll notice.
I'm afraid I don't know much about server security. I would definitely feel the loss of FTP access, but I imagine I could adapt. I've never used SCP before. Being limited to a web-based upload system would be very unpleasent though. I hope it doesn't come to that.
I'm a bit sick and not in any mood to answer questions in great detail, but...
What I need: webserver, PHP, MySQL (though Mithandir is working on database abstraction to allow WillowCMS to work with other SQL descendents), FTP, SSH and maybe some libraries to support my Gallery installation although I'm thinking about phasing that out and moving the contents to WillowCMS. I don't use the email stuff currently supplied by Xepher at all.
I'm somewhat concerned by the idea of a backdoor being open and will take measures to back up my contents. One problem is that WillowCMS adds random strings to the names of images uploaded through it, so the database itself if useless without an exact copy of the images as they appear on the website. Hmmmm...
1. Do you think waiting to rebuild the system is a good enough option? Does it worry you undully that the server might be compromised in the meantime?
Whatever is the best option for you is a good enough option for me. All my stuff is backed up the wazoo anyway
2. When I rebuild, I'm going to try and resecure things even more than now, but I don't want limit the useability too much. How many non-essential services here do you actually use? To clarify, here's the list of things people can or do use here. Please let me know which ones you actually use, which ones you'd like to use (or might in the future,) or ones I forgot or that you'd like to see
Webserver (essential)
SSH (essential... at least for me, shell/command line access)
SCP (secure file upload, used instead of FTP)
FTP (unsecure file upload... I may be getting rid of this anyway)
Email (username@xepher.net)
Webmail --I plan to use it more once I get my act together, the thing is so full of spam though, I don't know what to do with it.
IMAP (email access protocol)
IMAPS (secure version of above)
POP3 (email access protocol)
POP3S (secure version of above)
SMTP (Outgoing mail server)
Email forwarding
Spam filtering
I don't use much of the e-mail now, I do plan to use it, but I wont lose any sleep if you get rid of it.
Wildcard email (anything@username.xepher.net goes to your account here.)--this would be cool
Wildcard filtering (possible future addon... would let mail for address1@username.xepher.net get sorted into a different folder than address2@username.xepher.net. Would require use of email access that supports folders, either IMAP or Webmail.)---also sounds very cool
Virtual Domains (using a domain you purchased, EX: www.missmab.com rather than missmab.xepher.net)--plan to use it soonish
Statistics ( http://xepher.net/stats/ and in the future, more advanced stuff)
Web-based file manger/upload (possible addon in the future)--would be sweet
3. Do you think I should prioritze security, or ease of use / convience, and to what degree? For example, would losing FTP and having only SCP be worth the added security? (WinSCP is just as easy as FTP for direct access, but a lot of editors (like dreamweaver) only support FTP for their builtin file upload.) On the other end, would having to do everything via web-interfaces be too restrictive? That is, having to upload and manage everything in a web-app, with no access to shell, FTP, or other such things. (This is the extreme option, but I believe it would've been secure enough to prevent the most recent hacking attempts, as they all relied on shell access.)
Whatever is more secure, and better for you, I have nothing aginst changing what I use to upload files. I've never used SCP but I'm sure it's not leaps over my tiny brain.
4. What other features or services would you like to see added?
I'm not sure but I'd be glad to discuss and offer my opinion on any ideas you have.
5. How do you feel about the quality of service? By this, I mean how fast the server responds, how well it runs scripts, general performance stuff. This is not to rate MY service as an admin... which has been seriously neglectful when it comes to things like reviewing applications. I apologize for that, but what I'm considering is trying to find a new hosting service for the new server. I notice a decent amount of packet loss and wildly varying ping times with the current one. (On the other hand, it's REALLY affordable, and you get what you pay for.)
I don't notice any problems, but my site isn't all that complicated anyway.
6. I want ideas here. I have a couple problems I'm trying to solve. First off, I want Xepher.net to grow, and I want to do so with quality, not just by becoming another geocities. Secondly, I'd like to find a way to get some small income for this thing. I'm looking at investing about a thousand bucks in a new server, and hosting is still costing another hundred a month. If I move to a better host, it could be even more. Right now, the only real income is from donations, and 90% of that is from DMFA ( http://missmab.com ) Still, it's been just over three years since I put the server in chicago and I've spent about 3800 bucks out of pocket for this, not counting hardware costs. I don't intend to forgo the free hosting, but I'm thinking options along the lines of maybe running a seperate "commercial" hosting area, perhaps with dedicated comic services like webcomicsnation.com, which wouldn't have to have a newsbox, or share revenue with donations like the free sites do. Another idea is to maybe offer dedicated game servers for things like counter-strike and such. Other options are maybe stick with the shared donation/ad revenue, but just work hard to get some good, quality content here. I mean, a couple more sites like DMFA is all that's needed. Question is, how to attract such sites? I mean, obviously I need to get one top of my game with applications and whatnot... Speaking of..
To get the thousand bucks for the new server, you could maybe have some sort of a "upgrade xepher.net" drive. I have some money sitting around for something like that if you ever needed it. I mean Canadian money but our dollar is totaly going up!
Other than that you could give sites that you host the option to put tasteful ads up, like google ads or like alot of webcomics do these days. If the site wants ads they can have them, but like donations you could get a percentage of the ad revenue. I don't think you should have to force anyone to have ads, just give them the option to allow decent ones.
I like the dedicated server for games idea. Not sure about the commercial hosting area, since that kinda ruins what you where going for in the first place.
I think you need some sort of logo, to show that we're a community kinda like how all the comics that form BlankLabel all carry the logo. We could also get some community projects on the go and have different websites for them.
7. How can I redo the application system? I want some sort of quality "filter" on new members, but at the same time, I feel bad because the current "wait for Xepher the bevelant dictator to nod" method is leaving lots of worthy applications sitting in limbo because I don't have the time I need to take care of them. I was hoping that with them on the forum, there would be lot of peer review. Don't get me wrong, there are a few members that have been doing a lot of work looking at applications and giving good opinions and advice, and I thank them... but I need more than two or three opinions to let me feel comfortable rubber-stamping something. When I rebuild, should I make a system that requires current members to show up and vote on new people from time to time, or is that trying to force a community where there's not one? How else could I redo it? Do I deputize some trusted people to review and approve/deny applications?
I liked when we could vote for them(I know you can't do that on this forum). Deputising sounds good but maybe combine that with the general publics thoughts and votes
I think that's about it for now, and I apologize for the length of this post, but it's stuff I need to sort out (and apologize for.)
It's all good
Okay, first off... thanks for all the feedback. Let me answer a couple things.
Gwyn: Wildcard email (anything@username.xepher.net) works already, try it if you want. As for spam, turn on the spam filtering under your account management! Also, tasteful ads (like google ads) already are allowed. So far though, I've only seen Reinder's site (www.rocr.net) using them.
Reinder: When I say I can't trust the server... I mean that in the paranoid sense, it was once infected, and until completely wiped, must be considered possibly infected still. In the practical sense, I think I did get all the bits of hackery out this time. The way things run here, there's not much room for hiding backdoors without altering files I have signatures for. In the practical sense, I'm not too worried. You bring up an interesting point about the backups though, as a lot of CMS (and other web-based stuff) do that random-filename thing, meaning it's tricky to restore a backup unless you recopy everything AFTER it's been put on the server. One of the ideas I forgot to mention for the new server will be an option for user-initiated backup. Basically let a user login and choose "backup my files" and the server will make a second copy of them.
I'm not particularly worried about the security issue; I have all my files backed up. I say do whatever works best for you. I'm not particularly fond of the web-only interface idea, but on the other hand, I'm all for security, so whatever you end up doing is good with me. And I've never had any complaints about the server; minor glitches every now and then come with the territory.
About revenue-- I think I'd have to agree with Gwyn that commercial hosting seems anti the XN ideal. Everything else sounds reasonable. Game servers-- I could see something like a pay-to-play MUD (are those even popular anymore?) or something in the realm of KoL (http://kingdomofloathing.com). Counterstrike and that ilk do have their advantages though, I suppose.
Things I use:
Webserver
FTP <--fine with adapting to SCP if you decide to get rid of this
Email
Webmail <--only when I'm not in the vicinity of my computer for several days, so: rarely
IMAP <--have been using this instead of POP as I recall that being the preferred option at one point. Either is ok with me.
SMTP <--rarely
Spam filtering <--although I still get a fair amount of spam every day
Wildcard email <--haven't played with that yet
Statistics
Web-based file manger/upload <--might be a nice alternative
I'm not sure if this is a related phenomena but I've been experiencing issues with the webmail interface as of recent.
Specifically outgoing messages provoke the following error
"ERROR : Bad or malformed request.
Server responded: Received: BAD Command unrecognized: FROM "
And, if they're delivered at all, have a tendency to be garbled into gibberish, although some still get through intact. The problem may be an isolated one, so I include it here in case it has not already been brought to your attention. Can't exactly e-mail the details, after all. ;)
Even with fairly regular updates to my own page, my contributions to this community have been, at best, sporadic, so I hope I don't seem like the sort of ingrate who only bothers to pop in when there's a problem.
Even if I don't seem like such an ingrate I do feel like one, as such weighing in on the potential course of this community at present is a little too awkward for me.
Xepher, I'm sure that whatever decision you come to make will be well thought out and executed. For a lone fellow running this whole shebang purely out of magnanimity you've always done an exceptionally good job.
So thanks for that, I appreciate it.
I'm getting several thousand "Undeliverable email" messages each week on my Xepher email adress. I see them because I don't have my spam filters on, but the fact that so many are sent to me in the first place (all of them in Portuguese, from email servers in Brazil, with the vast majority apparently warning me that the returned message has been flagged as spam) may be worth investigating.
Yeah, spam sucks... sounds like some spammer decided to use your email as a "from" in junk he's sending out. As such, the email servers that are rejecting it are sending a notice to your email. The only option (other than just filtering/ignoring it) would be to find whatever ISP owns those servers, and convince them to stop "returning" spam to you. I've seen this happen many times before, my own admin email here gets several hundred a day, and good chunk of those are "returned" messages like the ones you're getting. I'm sorry, but the only thing I can really do from this end is filter things. There's some manual options to blacklist certain emails, so if most of these are coming from one or two places, then I can setup the blacklist for you (or show you how to do it.)
Well, that is the most obvious explanation, except that I don't see forged "from" or "Reply-to" headers in the returned messages. It's still entirely possible that the messages were sent with a forged whatchamacallit - SMTP envelope? Or simply with a forged bang path leading back to orca.xepher.net, but while we're being paranoid... something doesn't match the pattern of what I've seen on other occasions when the same thing happened at other addresses. Mainly the short, sharp bursts in which those thousands of emails bounce back to my email address.
In short, while I don't think it's obviously the case that the spammers are using our email server and pretending to be me, I'm not 100% convinced that they're not. So could you keep an eye on that email server?
Sure thing... I try to keep an eye on it anyway. :-) But yeah, you say it's different then past events, so could you perhaps send me a copy of a couple of the exact messages you got so I can dig in the headers more and match stuff against log files? Alternatively, put them in an IMAP folder (if you use IMAP) and I can read them on the server. I don't want to go digging through your Inbox without permission.
Oh, while I'm here, I've got another thing I'll be implementing on the new server... incremental backups. This will let me make automated backups once a week (or maybe once a day, depending on the overhead) without fear of accidently grabbing corrupted data. It will let me (or users) roll back any file to any backup date. For example, if you corrupt a file by accident one day, then a week later corrupt another file, but don't notice either for a another week. You'll be able to "roll back" the first corrupted file by 2 weeks to the last uncorrupted version, but roll back the second file only one week, to it's last "good" version. I'll have to see how bad the overhead would be on this, but I imagine I'll be able to keep weekly backups for at least a few months worth of time. Older backups getting removed after that. It may be possible to even have daily backups. I'm doing some testing now with my own stuff, trying to see how bad the overhead is.
Glacier speed response as usual.
1. Waiting is fine by me if it's easier for you - I have back-ups.
2. I don't use that much, just FTP, webserver, email and stats.
3. Wish I knew a bit more about this, then I could actually say something helpful. I only know FTP, but I've got no problem with learning to use something different if it's needed for security. I don't use an editor, I just write everything myself - but I'm afraid I don't understand enough to know how the changes you're suggesting would effect me...
4. I'm fine with what's available.
5. I've never had any trouble with the site (actually, that's not true, but all the trouble was caused by me).
6. Gah. I'm rubbish at promotion, self or otherwise- so amno help here either. P.S. Still sorting out money Xepher, it wasn't all a lie! Living in two places at once and having your computer stolen makes online apps really fun (excuses, excuses - I'm sorry).
7. I think a queue and dividing apps into sections are both good ideas. Maybe if you did those, you could combine it with some kind of email alert for new apps? I guess it wouldn't work currently as you get so many, so it would just mean loads of mail. But if there were only 20 or so apps on the go at one time and they were sectioned up - people could say they want to be alerted by email when an app for a particular section they are interested in comes up? Then they could click a link in the mail to get to it, give it a read and see if they want to say anything? I don't know, I know I'm pathetic and lazy when it comes to looking at applications, and I really should go to the forum more often. But speaking as someone who IS pathetic and lazy, it's a bit duanting when you go in and there are so many - especially as the order changes and I can never remember what I have looked at and what I haven't.
Anyways. Sorry I can't be more help with ideas.
I haven't been here very long, I know, and I'm not "in" yet as far as hosting, but my input would be:
-I, personally, can wait for the new server before you start making decisions. I mean, you're the one offering the free service, so who can really complain?
- I think the separate web-comic service is a good idea, seeing as how it looks like a big chunk of the members have comics
- While I don't mind converting my comic to PHP (once again, that whole "begars can't be choosers" thing) if I end up on Xepher, I have it in ASP right now, and I was wondering if the new system(s) will be able to handle ASP?
1. Take your time. So far nothing has been affected on my site but the front page being backed up. I would like it to be safe, but realistically I don't want you to do anything you can't at this moment.
2. Webserver (essential)
FTP (unsecure file upload... I may be getting rid of this anyway)
Email (username@xepher.net)
POP3 (email access protocol)
Email forwarding
Spam filtering
PHP (scripting... used by lots of webscripts/forums/etc, including the XN newsbox)
Statistics ( http://xepher.net/stats/ and in the future, more advanced stuff)
Web-based file manger/upload (possible addon in the future)
3. I prefer using FTP because it makes it a million times easier to transfer my files and back them up. Its instant and I hardly have to locate them at all.
5. The server has always been reliable except during its down times. To be truthful, I've always used my own site as a 'Does my internet work right now?" check.
6. Unfortunately, I don't think my art is quite up there enough to bring in any money, but I'm trying to work on that. Once I do get out of this house and into college, I wouldnt mind trying to donate some spare money to the server. However, I'm not really sure how you could bring in others that coudl help earn money. marketing isnt really my thing.
7. Allowing a few trusted people might be of use to you. However, I wouldnt mind helping with the application process if I could. I don't have much time to myself these days but checking the forums once a week may not kill me.
good luck Xepher and I hope everythign runs smoothly.
Thanks ya'll, for understanding. I'm looking at options for what a new machine would cost, and considering if I want to stay with the current hosting center, or put it in a new place. Hopefully I can get to some applications and accept new people without having to wait for that to get into place, as it could be many months. Right now, I'm looking at a move back to Texas at the end of May, and I just don't know how smoothly all that's going to go. I'd ideally like to have a few weeks in May while I'm not working and before I move where I can go and take care of pending applications. I may get to them sooner, but can't promise anything.
Chow: You asked about ASP. The answer is that this site will likely never support ASP. The reason is that it's a Microsoft product, and requires both a license and a windows server to run on. Everything here runs on free, open-source software. I would _consider_ ASP if, at some point in the future, there was a way to run it for free, on apache under linux, but I doubt that will ever happen. I talk about replacing/upgrading the server as costing about $1000. If I were to buy and run the thing on windows, I would easily spend another $1000 in software alone. And probably have to rebuy/upgrade that every few years as new versions of things come out. Anyway, bottom line is it's not going to happen. I'd say take a look at http://asp2php.naken.cc/
Quote from: XepherChow: You asked about ASP...
... Anyway, bottom line is it's not going to happen. I'd say take a look at http://asp2php.naken.cc/
That's cool, I was just curious. Thanks for the site too. Way cool. PhP it is!
I may not be a website owning member, but nonetheless, I feel it is important to give feedback to such important questions. I hope this is not too presumptuous of me.
1) I have no problem with waiting for the server to be rebuilt. While it is important for there to be security, most people probably back up their sites, so data will not be lost (at least not much data). Take it at your own pace, that will ensure the best job.
2) I have no grounds to answer this question on, I'm not even sure what other services I might use in addition to the essential services... although if you keep the email, it would be a good idea to keep the spam filtering as well.
3) Some added security might be needed, especially with the newer viruses that hackers come up with that could be attached to picture files or otherwise (mostly a threat to those with Windows systems). Security should be about an equal priority to ease of use, with maybe a little more emphasis on security in my opinion.
4) No idea, honestly...
5) I have no problem thus far with service, but not having a website, I am not really an accurate judge of these things... By the way, I really do not mind the wait on the application, it allows me more time to build of a "buffer" of comics and refine my artwork, so no problem.
6) For the whole increased income thing, you could always give some of the site owners the option to donate 100% of their proceeds to Xepher.net through the Donate button on their website. I have no ideas for the other problem though...
7) The application system is fine for now at least, but it might be best to let some others approve the applications as well, or at least have them write a short recommendation for you to read and then decide from there.
Quote from: ChaosArchivist6) For the whole increased income thing, you could always give some of the site owners the option to donate 100% of their proceeds to Xepher.net through the Donate button on their website. I have no ideas for the other problem though...
Actually, that options already exists. ^_^ I use it, mostly because I don't need my site for money. Not like any visitors give any, except my friend, who was only using it to see if his Paypal account still worked. *grumbles*
Xepher, I don't use that inbox anyway, so you have my permission to look at it all you want. I'll try setting it up for IMAP as soon as I have a bit of time and energy to spare.
Right now, it's clean, with nothing new in there but cron reports. These tend to pile up but that's not a problem. I'll notify you when there's a new batch of suspect messages.
Hi. I just read the "Must See" post on the newsbox, so I'm here to give a few cents.
1. I'm okay with you rebuilding. I'm feeling that you're going to do what is right. Yoda.
2. I am not using that much. I've been using FTP but if you're getting rid of it I'll be willing to fiddle with SCP. I use PHP, will try CGI, but I haven't even tried to use an of the email thingies cus I am scared. Or easily frustrated. Whatever. MySQL and that is, I guess, it.
3. In the long run if using only SCP can prevent a hacking, it's better for you. I mean, it's your free time it'll eat up to undo the damage, right? So I for one won't say no. Its understandable that I'll have to learn a little more on computer stuff, but I'm a fast learner.
4. I have no idea. I'm content.
5. Compared to my attempts at other services like Tripod, FortuneCity, and Geocities this service is a walk in the park.
6. I think that the comic idea is genius. See, I can put comics that I have made in there to see if it'll create some revenue for you. I'll be happy to even make a new one for pay to see! Something with action and drama...
7. I don't think you should change a thing about the quality control for applications. I feel that if someone wants it bad enough, they wait. It's gruelling but a process. A panel of judges? Okay but I wouldn't want someone to talk tomatoes when all they know is onions...I find it hard for peers to judge when they have no idea what kind of work goes into it. If you select members based on their say, expertise on a subject, they can judge all they want - on that aspect alone. I say don't force members into judging, some people aren't so opinionated as others.
I've been reading a friends page here for several years now, all without ever noticing any sort of slowdown. Server seems to be running well..
I don't think getting rid of FTP access is going to solve your problem.. You'll most likely always have more trouble with people giving out thier passwords than anything else..
From the other post or two or three of yours I've read here you're a pretty bright person.. I think the idea of hosting a few game servers would be fine.. Most hosting companies run several servers on one box, so surely you could handle a couple as well as serve up webpages.. Besides, people pay $45+ all the time to host a single game server.. Surely you can find at least one person :)
I think the idea of using Xen or VMWare or whatever you'd use sounds fairly sound.. Nothing wrong with iscolating things a bit, and any performance loss would be fairly small and wouldn't matter a whole lot..
Going back to the idea of cutting features, if you really want the site to grow, it'd be silly to chop off things like mysql and such..
As far as peer reviews of applications, I didn't even know they got posted to the forums.. I might try to look at a couple every now and then..
Eesh, I am a very bad e-citizen. Haven't checked up on things here for a long time. Many apologies.
1 - Since I'm not paying anything for this hosting it seems silly of me demanding you drop everything now and fix the server, I'm also not that concerned. A secure system would be nice, though I'm not up sleep-less at night worying about someone yoinking my files. I've got my files backed up so whatever happens I'm set.
2 - Well I don't use much of the features but I do use-
webhosting
e-mail (channeling stuff from my xepher mail address to gmail)
FTP (however am willing it adjust my methods if need be)
PHP (newsbox, I'm also hoping to update my tech of page design so might be using this in future)
statistics option is nice
3 - Security is important. Ease of use is nice but I'm sure I can adjust, as long as things don't get too complicated.
4 - Really can't think of much, I'm happy with whats here now
5 - Never had much trouble with the site, except for the hacked times. Load time seems decent from my end, nothing to complain about.
6 - Raising revenue - The gaming server - while generating revenue seems like it would bog the rest down.
I'm not very good at promotion, though I'd say word of mouth would help. Actively going out and getting awareness out about the community might help pull some fund bringing people in.
Commericial hosting while sounds great doesn't really seem right to me, it seems like it'd set up a hierarchy in here which would go against the feel of the community. But do whatver you see fit, this is your baby.
The comic hosting idea might be a decent one, to raise funds set up a part that is pay for view, I'm sure that there are some artists here who wouldn't mind donating work for such thing. I know I wouldn't.
Having some people sell ad space on their site and use the proceeds to fund xepher might not be too bad as long as it's done tastefully and in moderation.
7 - The Application process right now doesn't strike me as too bad a system. Though I'm bad and need to visit that section and vote a bit more often. But a deputy system might make things go along abit smoother. And guilting people into do a minimum amount of voting might not be too bad, considering the fact that we are getting very decent free webhosting.
However as stated earlier by others, this is your time and effort mainly so do what you feel you can when you can. I'll not complain with whatever you decide.
Again, thanks for the feedback. Here's my current thoughts on things, based on what people have said.
I do plan to build a new server, and in the process rebuild the software end of things. I will likely use Xen or some other virtualization system to isolate components better.
I will likely be narrowing down the services that run on the machine. Mainly this means FTP will probably go away, as it's the easiest to hack. If someone's sitting on the same subnet as you, they can easily snoop packets, and FTP passwords are just plain text. If I do that, I will probably have to stop other plain-text services as well, and require SSL for email connections.
MySQL, while useful... is a royal headache to administer. My previous plans have been to drop it entirely, but seeing as a lot of you use it, (and a lot of software doesn't support SQLite yet) I don't know... Maybe I can find an easier way to integrate it with everything else.
With the possible exception of FTP going away, I don't think I'll need to do anything that alters the way people use services here. That is, despite the increased security, there shouldn't be any more difficulty for the end user.
Revenue: If I did the game server thing, I'd likely do a seperate machine. At the very least, it would be a seperate virtual machine, so it wouldn't bog down regular use here. As was pointed out, there are people that rent a single game server for 30-50 bucks a month. I could probably run four of those on a dedicated piece of hardware, and it would cover the cost for both itself and xepher.net. The commercial hosting... was mainly just an idea. As was mentioned, it seems counter to the main ideas here. I'll probably just continue what I've done in the past. That is, people (usually friends or people I know) have approached me to host commercial ideas. I usually think of it as "sponsorship" and give them space for a percent of their profits. To date, none of them have actually turned a profit. :-) But either way, know that commercial hosting would be entirely seperate from the free hosting here. If someone's paying me for a site, it's not gonna be in any of the same lists of users, the newsbox, or anything like that. In fact, I think you'd be hard pressed to know it exists. There are actually about 4 commercial sites here right now. None are really active, and most are failed ventures of friends of mine, but my point is that if I ever did do commercial service, I wouldn't let it interfere at all with how things run now.
As for applications... I think ya'll are right. I can't force people to do it, or they'd do it wrong. What I think I'll probably do is semi-automate things. I'll probably take it off the regular forums, and write some custom stuff for it. That way there will at least be a form to fill out, so people don't get screwed up by not putting the right info down. Originally I wanted that to happen, because when things were small, seeing people overlook directions was a good indicator that they weren't really paying much attention. Nowdays though... well, it's big enough that I find myself judging more on content alone, rather than personality and the dozens of other little details I used to. I just don't have time to really get to know everyone before deciding. As such, a form-based application is the way to go. I'll provide an area for basic info (username, site name, etc.) a box for a description of the _idea_ and another for the general "let me in because..." stuff. I'd also give an option for uploading a few images along with the application, so people don't have to go make cheap websites elsewhere to show off their stuff. I'll probably also integrate a voting box, and I'll probably deputize a few volunteers to tend things and answer the easy questions, point out obvious problems, etc. That would help me by weeding down things a bit. That way, when I get three or four deputys telling me "let this one in" I can be pretty confident that it's a good one to go for. I'll probably also draw up some written guidelines for what I look for in applications, so everyone can be on the same page when judging.
Think that's it for now... I'll add to things here as I work them out in my head. As always, ideas or comments are welcome.
Slower than a glacier, apparently :P
1. About the same response as everyone else here. My website's not the most anticipated thing on the web, anyways. I'm fine with it.
2. Webserver
SCP
Email (username@xepher.net)
Webmail
POP3
POP3S
SMTP
Spam filtering
SQLite (Later)
PHP
Other CGI (Working on it!!)
3. Quite honestly I'm pretty okay with anything you decide to do, cause I know you're not gonna be compromising too much of one for another (at least, I'll be fine with it). Go ahead Xeph!
4. I'm fine. Nothing's been too much for me.
5. It's great! I'm fine with the service I've been getting. Actually, I've found myself bragging about my luck of finding Xepher to other people looking for webhosts and complaining about costs. haha...
6. Sorry, I'm not much of a advertiser. Though, if we could, I'm sure a lot of us know a couple of peoples who fall under such a category. I'm sure we could round up some people who are tired of paying for web costs and wouldn't mind sharing the costs ^_^
7. I want the polls back, haha. Used to be active in the applications section but after they built up I kind of zoned out. I wouldn't mind a limit, either.
1. I'm really worried about the email bit, because I had several important messages saved and my xepher.net email is my life (all my modly notifications go there! *weeps*), but I'll live. Just cross my fingers that nothing there was lost. *whaps self for being a dumbass*
2. Webserver
SCP (occasionally)
FTP (if you get rid of it, I won't mind too much)
Email (OMG YES *cries*)
3. I wouldn't mind losing FTP and just having to use SCP. I use it occasionally (depeding on which icon I find on my desktop first, haha). As for the web access....muh. I've seen ok ones and I've used ones I really did not like. But I'd manage. Anything you need to do, go for it.
4. Maid service. I mean, er.
5. S'good.
6. Erk, I don't know. I've never been much of an advertiser. You go... do whatever it is you need to do to get more monies. Tally ho!
7. Polls were fun. I'll have to second (or is it third?) the whole "zoning out" thing after the applications built up, I'm sorry. Real life and fandom has sort of been kicking me in the ass lately. *resolves to try harder*
1. I trust you on this matter more than I trust myself. Websites are important, but if you have a lot going on and are going to be stressed if you rebuild it now, wait. We can backup or websites. I mean, it is the least we can do you give us free websites
2. Webserver
FTP
Email
Webmail
IMAP/IMAPS
POP3/POP3S
SMTP
Email forwarding
Spam filtering
PHP
3. I have neverused SCP, so my opinion doesn't matter.
4. N/A
5. There are days when it is dow or slow, but nothing that is bothersome. I'd give it an 9 out of 10 (take in mind that I only use the webmail right now, but I am thinking about when I use to update my site frequently).
6. If you offer a Counter Strike servers, I will change my service. As long as the ping is good, I will be more than glad to do that. I will probably be expanding soon, so I might even get two servers. Besides that, I can offer irregular donations, anything I get from people on my server I will send to you, soemthing like that. As for ideas, I think minor advertising would be good, or perhaps if you make a website like keenspace, you can make a "premium" account or something you pay for.
7. You can make a commity or somethin g with old and trusted members alike. They review the application, make their judgement and then talk to you. This is the best thing I can think of, not being present in any of the applications for months.
Also, I am sorry if I skipped over this, but is there any time when we know the email will be back up? Or will you just tell us?
Just throwing ideas...
1. Considering that Xepher has been hacked in twice, maybe some additional security would be helpful. It really depends though; if the hacks are pretty small and xepher can stand against something critical, then it probably wouldn't be needed. I don't have any knowledge of how a server is built though, so I can't really say.
2. I use:
The Webserver (essential)
FTP
Email/
Webmail
Spam filtering
some Php.
I wish I was saavy to use all those other features though :(
3. I'm really ftp dependant, but I guess I can adapt to the other.
4. Better better better better better webmail filters!!
5. I still love the service. I feel guilty complaining about it because I've benefitted so much from it without paying (I promise once I get a job, I'll be donating)
6. Hmmm, how about...
- setting a designer shop somehow 'a la cafepress (with the help of other users to promote it),
- gear the server towards hosting music and bands (kinda like Myspace)
- creating a commission system where people can browse artists on xepher (via one page of everyone), and then server takes a small percentage of a commission.
7. Maybe deputizing some trusted people will work, then have them give the final say will work. Or, for some kind of successful voting, maybe send a monthly e-mail newsletter to every xepher user displaying all applicants work instead (and so people can get in touch who has a website now). Of course, people with outstanding work can get the shoo-in I suppose.
As someone asked, the webmail will probably be down through saturday, when I return home. I'll try and work on it then. If someone has a suggestion for a better php-based webmail system (to replace squirrelmail) let me know. Just to clarify, email is NOT down, just the web interface for it is. You can still use a regular email client. Also, no mail is being "lost" or anything... as I said, the interface is just down for now.
I, personally won't mind if there is down time that results in a more secure server.
I'm kinda a computer dimwit on Xepher, I use Dreamweaver (and its FTP upload function) and a SSH file transfer program to update my site.
I'm happy to have been hosted for so long, so whatever changes need to happen, I'll roll with them.
I used to be a member and I'm looking to be again, so I'll throw my 2 cents in the pot as well...
I used to use ALOT of the FTP. I dont know what that other method is or even how to use it. 0_o
Email, Pop3, Spam Filtering... and mayhap someday even alittle PHP.
As for bringing in money,
1) Art community such as dA in which each member would pay a "joining contribution" of say 5-10 dollars for indefinate hosting (website hosting would be free on the side as it is now) this way if people want to be part of a community without knowing html they can, as well as have uniformal access to other artists.
2) this fuels #2, with a dedicated art site, produce community works such as calendars or semi-annual art books, with 50% proceeds going to the artists and 50% going to Xepher, after print costs are out of the way. I know not everyone has the same art style, so mayhap even make a couple different options such as one for "robots," one for "furry/anthromorphic," etc...
3) Throw a raffle! Mayhap invest in a academic edition (often times found for 1/2 the price as the regular version, and just as functional) of something like Photoshop or Painter or something (how bout even a tablet?!) like that as a prize. (or sometimes contacting the company, they might even throw in free promotional copies) Raffle off chances to win at $3-5 an e-ticket.
4) Like 3 but throw a contest! Whoever can pull in the most donations every 3 months would win something ..?
4) Contact well known comic/ art designers commonly found on the comic places and write them personally. Explain what a great site xepher is and what you'd like it to become. I'm sure many would even be flattered and want to join a site like this, which would in turn pull their following with them and bring them here = more donations.
There's got to be more, but I need to find them first. =)
I've actually thought about most of those ideas. The raffle... can't do that for the legal reasons. It qualifies as "gambling" most places, and that gets rather fuzzy. A fee to join I just don't feel right about. No matter what you call it, it still sounds like people pay to get in, and that's not what I want. The contest though, give away a tablet or some such, I have been thinking about that for a while. If I did get a more unified community going, like for art, then I'd definitely try and do something like that. And as for the last option, going out and asking people to come join, well... That's a tricky one. Most people that have good sites already have everything covered. Without something new to offer them (like revenue options or what-not) it'd be a hard sale. Now, for a dedicated art site thing, that's totally an option. "Hey, I love your work, and was wondering if you'd be willing to keep a gallery here..." That I could do. And probably will do if I ever get Artica written.
It's too bad it's not all that cost effective to offer a printing service. ...how bout an auction service of some kind?
*waves*
I don't think I've used anything but the FTP, being a rather simple horse.
I'm sure I could pick up something more secure, if it were needed however.
I'm heading over to the donation page to add to the kitty for an upgrade.
1.
Whenever you're ready to do it. I have many backups of my site
2.
Webserver
PHP
FTP (though i have used SCP with my last host and had no problems with it)
I think thats about it for what I use.
as for SQL, I was always afraid to use it, despite not having things like forums and oekakis on my site because they required that, but ive done well without it and would opt for SQLite or bust
3.
I'm easilly adaptable to anything as long as its not a one-file-per-upload thing. ;D
4.
Can't think of anything, really.
5.
I LOVE the service here. everything loads well, runs efficiently, and keeps running strong hack after hack, which of course does this well thanks to your adminship which you said not to rate