At bitcoincashresearch.org we are looking to offer a certain level of decentralization of the forum, including the possibility that anyone who considers it necessary could rebuild a given instance of the forum in another domain. For that to be possible, we should publish DB’s backups periodically. …

That’s a pretty wacky edge case! Do you’d want to remove IPs and email addresses? Without email addresses, there would be no way for users to reclaim their accounts (if they used a password, they could log in, but then they would not be able to put their email address back in, as there would be no …

Here are public SQL dumps of a Discourse forum: Index: if-archive/info/intficforum You could get some ideas from there.

I agree that it could seem like a wacky edge case. But the idea behind it doesn’t seem so much since it works towards avoiding forum’s centralization. I understand that this may not be very important for some forums, but it may be for others. I also agree that removing users and passwords (among o…

I would like to add some context. There is a very specific need / use case. There is an operational discourse that has important content and the content will become more important over time. Because of the nature of the ecosystem that uses it, avoiding central points of failure is something we have…

Also these changes are obviously very non-trivial. It would be good to hear feedback, issues and alternatives. Maybe resources can be pulled together on our ecosystem side to create a fork that implements the idea.

[이미지] emergent_reasons: Therefore I think what Leandro needs is a feature in discourse that allows users to login through cryptographic challenges rather than traditional account/password schemes. That can be done by adding support for webauthn as a passwordless authentication method like exp…

That’s another solution to login. Oh, and regular users don’t have to approve email address changes if they’re logged in, so a dump with email addresses removed would be ok for all users who should log in using whatever credentials are in the database (password is the easiest). A plugin that eithe…

@Falco and @pfaffman thanks a lot for your feedback and advice. We will investigate Webauthn to see if we can follow that path, same for your plugin @pfaffman . I will get back to you in a couple of days with some comments, questions, or conclusions.

Another possibility on the horizon is the use of a Augmented PAKE (Password-Authenticated Key Exchange), so that the password is both practically unrecoverable from the database and never touches the wire. Unfortunately, they’re all still solidly in the realm of experimental cryptography, and not r…

If you want to keep the email/password login, but in a way that anyone can enter the account of any user in the backup’ed database, you may achieve that generating an email based on the username for every user, like <username>@email.invalid. For passwords and logins, assuming that discourse uses en…

개인 정보 노출 없이 DB 백업 공개하기

제품 지원

Falco (Falco) 1월 26, 2021, 3:00오전 7

Webauthn support에 설명된 대로 webauthn을 비밀번호 없는 인증 방식으로 지원하도록 추가하면 가능합니다.

그리고 노출하지 않으려는 필드에서 백업 파일을 정리하는 서비스를 추가하면 됩니다.

글		댓글	조회수
What to do if your Discourse is compromised Self-Hosting reference	0	10491	2월 24, 2016
Restore backup to a local instance in a safe/anonymized way Product Support	10	1150	5월 22, 2021
Archiving the public data of a forum Product Support	3	1973	3월 17, 2019
How to encrypt the email addresses for compliance with privacy and PII laws? Feature privacy	4	1910	2월 12, 2015
Create, download, and restore a backup of your Discourse database Self-Hosting backups , how-to	25	25536	5월 29, 2026

개인 정보 노출 없이 DB 백업 공개하기

Related topics