Secure environment community

Hey guys; need some help. My wife is part of a Writer's Co-op (group). They have been using Yahoo Groups for mailing list and sending files, etc. When my wife joined I wouldn't let her send chapter's of her novel in progress via their mailing list--only post emails to the yahoo group. :.edit.: Correction, they don't send files through yahoo, they're doing it through a mailing list hosted by a non-member.

I'm suggesting they move to a forum setup, most likely with a tightly controlled membership / confirmation.

1) What opensource forum software is recommended?

2) What should I propose for a more secure way to send out work to be critiqued? I don't know the 'puter aptitude of the group, ie. if they could handle a secure/login FTP environment. Or should I just put together another mailing list server for them?

Thanks in advance...

~Dan

Forums are a good idea, that way they can just upload their work straight through a forum upload system. Pretty much any forum program out there is secure, for the money, go vB, for free, PHPBB or Invision. Good luck.

The weak links are a. transfer (most times it's always thru an unencrypted channel, like http or ftp, etc.) b. where the files are stored if they aren't secure enough.

Opensource forum software: phpBB, IPB, and there is another, which I cannot remember. Those are the bigger ones.

You can set up secure ftp (SFTP) to transfer files. You used to have to "piggy back" on an ssh client (like Putty) to do it, but now it's becoming common in ftp clients and IDE's, but haven't messed with it in a while.

You can use SSL and encrypt email to send attachments. You can make your own cert or buy one. Then you would have to have the public key(s) available to the group.

There are probably others out there as well....

Forums unfortunately are not secure until it gets on the server. When you submit a form you use plain old http to transfer and a packet sniffer would pick up whatever you type in any form as plain text. Transfer is via ftp, which is another unsecure source. If you are concerned about someone getting their hands on the information while it's being submitted. If the host is well secure, once the info is on the server, then you are fine. But shared hosting is not a secure way to host if you have data that you are concerned about. Anyone can easily navigate their way into other hostees on a share server. So it really comes down to what part do you want to lock down.

I would look at something like MaxWebPortal (http://www.maxwebportal.com) which allow you to post documents (such as rights-protected PDFs, Word documents, Group IV TIFFs). Then they would have a forum, a place to post non-form items if they so desire.

I'm there are a number of PHP apps also, but that's beyond me.

Thanks guys. All helpful. That portal is interesting Mattboy. All the implementations are BUTTUGLY... but that's not the developers fault.

See if you can implement a section of the portal using https:// That way when people login and view those pages they are at least encrypted. Dunno.

The reseller services I use have a 'shared' SSL key on the server I can use that would probably be good enough for what these guys want. I like the looks of http://www.xoops.org I'm gonna play with that for a while.