MyBB, IPB, or vBulletin

Okay, this thread might get rather wordy, but I've wrestled with this issue for a week now, and I don't feel like I'm any closer to making a decision...

I currently run a smaller ~3,000 member forum for Christians. My average user is relatively technically illiterate and needs to keep it simple. We've run both IP.Board and vBulletin in the past, with the latter being the current choice. Our switch to IP.Board (after some vB support issues/treatment) was not heralded very well, though many members liked IPB. I actually still have an IPB license that needs to be renewed here soon, so I guess go ahead and include that in the matchup here.

(And yes, I know I have two paid software and one open source software here.) I've tried them all out, and had users experience all of them and tell me what they think.

Basically, my concerns are this:

vBulletin I'm worried about the future of this product. Obviously there are some issues with IB and I admittedly could see this product not doing as well if they keep it up. There has been a lot of anger generated, and I personally disagree with the treatment of some. I am most troubled by the former developers' comments and treatment. I'm mostly worried about customer service and having to deal with future licensing issues. Right now, money is not a concern with the upgrade. I don't make money from this site, though, so paying $250+ in the future is not really an option for me.

However, on the flip side, I have seen some changes and acknowledgment by IB/vB Solutions, so it does seem like they're listening to the users. Admittedly, I do feel like the new software is pretty much a glorified new skin, but I see the merits of a CMS and would like to use the blog feature. It seems like vB will retain the largest mod community, but I also don't know how much of a dent this will place in it.

MyBB My number one concern is security. I know about the recent professional audit and other details. I'm just worried that open source software is easier to attack in some ways. I'm an advocate of open source in virtually everything else I do; forums have been the one place where I've felt better off with the paid stuff. I'm also worried about the small mod community and lack of things like user blogs. I've theorized that I could program these, but I do need to finish up learning programming PHP first. I view this as sort of a positive, because it would force me to do that.

On the positive side, I like the idea of getting behind open source. While it may open security issues on some things, peer reviewed code also helps secure it on another. MyBB is an active project with committed developers from what I can see. I did a test use with the software, and my forum members actually found it more user-friendly. I can assume it's as good as or possibly better than vB for my users.

So, as you can see, I am stuck. I want a secure environment for my users to post. We have been "attacked" before through various methods because of our topic, but vBulletin has been solid up to date. (Knock on wood.) I'm worried that might change with free software. As much as I like the IPB developers and their openness, I'm just not sure about going back to the software. I think it's a possibility if we must, but at this point MyBB looks just as good.

Saving the money spent on vB would be nice, as it could be applied towards advertising or other things. I think I've covered a lot of my general thoughts, and I'm just looking for feedback on the conundrum. I'm not so much looking for a MyBB vs vB discussion (those already exist) as I am some experienced thoughts on going with a free/open source solution over a paid one that has worked. I mean one thing I've noticed in all of this is that very few large forums have jumped ship with vBulletin. I know that it takes time to move and all, but it just seems like most are content despite the outcry. I have the opportunity to move now, and my hand is forced by my leased license expiring later this month.

 

What about SMF2?

 

I've ruled out SMF 1 and 2 based on my user testing. Just not friendly enough for the non-tech crowd, I'm afraid.

 

It's odd, because some say SMF is to simple and user friendly, others the opposite.
I wonder how a forum software can be non user friendly. You basically make posts in the same way in any forum software, BBC works the same way, etc. The "Profile" section varies quite a lot from software to software, but most people don't go there a lot anyway.

 

You are leasing an IPB license.

Did you least the vb license as well or do you still have a purchased copy? If it was leased then is it still active?

 

I have the Community Suite license for IPB, it will expire the first part of next year.

vBulletin is leased; ironically I was planning to purchase an owned copy right about now. It will expire in a week or so.

 

There are many things I cannot possibly know such as how important the cms/blogs/articles would be to you. You may want to document favorite parts of your faith/bible, write a unique article, get feeds in from other sites, almost anything. The first thing I would do is really think about how those things may be of use to you, in concrete terms, not just lofty ideas that may or may not be implemented.

Regarding vb4 specifically there is no way to know how well the cms/blogs will work for your specific application/needs, even if it works perfectly for other peoples needs. The only impetus at this time is the expiring IPB license and your expiring vb license. You could have bought the suite for $130 last week I believe, I'm not sure if they will allow you to buy suite for $160 at this time.

I would sit down with a paper and pencil and write down your options from a $ point of view. Do some soul searching regarding how well the advanced features might be of use. And of course poll your members.

You have a low tech audience so assuming a 3rd software program you are somewhat leary of for security reasons would be a turn off for your membership (every software has nuances to learn) then I would focus on the other 2.


My take:

• If you can get vb4 suite for 160 that might be a good option
• Renewing you IPB license might reduce the confusion for your membership (I've got no idea what that would cost)
• Or possibly buy a vb v3 license used, they are extremely cheap at the moment, and my guess would be there will be people supporting v3 for a long time as a side business. Then skip v4 and go to v5, or if the blogs/articles do not need to be integrated use word press and stay with v3. I've got no idea how soon you want cms/blogs.
• Or even buy an IPB license used

Other aspects include how much tech support you need and how you like that for each.

 

I believe I mis read this part:

If you are currently using vb v3 forums and the lease is up next week, and you have no urgent need for blogs/cms, then buying a used license cheap would be attractive esp if you cannot buy v4 for $160.


Please note that up until this time there was absolutely no reason for anyone to support older versions of vb because people could get updates for a reasonable amount of $. I believe there will be a cottage industry supporting older versions of vb in the future for people that are happy with v3, v4, v5 and do not want to buy a new license. Of course that market would evaporate if they started offering significant discounts when going from v4 to v5. I'm not clear what the actual discounts would be - but either way you should be ok.

 

...this is insane. Open Source is the license, not the security model.

Repeat after me:
Every interpreted language has fully visible source. By definition.

vBulletin's source code is available to anyone who wants it, for a relatively low price. The same for IPB.

Likewise, something like Drupal has
1) Higher penetration than vBulletin
2) Higher profile penetration than vBulletin - the White House uses Drupal.
3) A far superior security record than vBulletin
4) Is far faster than vBulletin
5) Is Open Source

If vBulletin had the quality of coding that Drupal has behind it, I would have converted long ago. $200 is nothing. A price tag does not guarantee security.

 

Incorrect. Open source from google, the very first definition:

Open source has nothing to do with the actual "license" itself, but everything to do with how the code is distributed. Is the code (source) editable? Then it's an Open Source program

 

And err, I'm not suggesting you switch to Drupal by a longshot - its user friendliness problems are well known.

However, security is a process, not a destination. It does not stop at choosing decent software (MyBB is decent), it's also things like IPTables, Suhosin, etc. and keeping abreast of threats.

 

Rather than sourcing Google, you could source the actual definition:
The Open Source Definition | Open Source Initiative

vBulletin, IPB and SMF are all open source by your definition. Since that is quite obviously laughable, nearly every single word of your post is simply wrong.

 

Well right, I've talked about this many times. If you'll kindly noticed, I mentioned about peer reviewed code; I did a research project on this at my University, so again I'm very familiar with the positive sides of open source security. I did not neglect to mention them in the post, either.

While a pricetag does not guarantee security (and no software has absolute security), it's a significant deterrence to the "script kiddie" population out there that likes to exploit software like phpBB and Wordpress on practically a monthly basis (hyperbole). I find that paid software does reduce the number of exploits for widely-used software, generically speaking. In the forum arena, this seems to apply quite well.

This is a microcosm of the whole issue with open source. Folks are so quick to condescend to turn it into a "you don't know anything about open source security" debate before even thoroughly reading the argument and recognizing an ally when they have one.

The fact of the matter is open source depends on both the quality of the coders and the size of the community. MyBB seems to have good quality coders, but it doesn't have a large community and I have had a MyBB board I ran hacked a number of years ago prior to a security release. I worry about a "script kiddie" exploit, and with my site being a recurring target for that kind of crowd, it would be silly to pick an open source choice simply because it's open source. Security is a top two concern for me, so I've got to see that open source doesn't put me at risk here.

 

Because vBulletin has never had a worm hit it.

Fundamentally, despite all the hush-hush about it, the source code to vBulletin and IPB is effectively public for anyone who wishes to have it.

It is still visible source, and that is what I was getting at - you have every single risk associated with open source software. If someone really has a beef against you, you still operate from the position of them having access to your source code - but at least they can't tell if you're running Suhosin. Script kiddies don't care what the license is - they just want to bring you down.

If security is such an issue for you, I would suggest getting personally involved in whatever software you choose. You will have a far more secure platform in the end, simply for understanding the principles behind secure thinking.

 

Not every software is security perfect, so MyBB had it's fault then, as of now they fixed that fault.