phpBB Forum Software

Your wrong Aldo.

To upgrade you just need the latest package, the new upgrade software does a nice job, so its not each step in-between now.

The only security problem I've ever had, was an old 2x board, which was about 5 versions outta date, back in the days of 2.0.19.

And giving admin to people who mucked about.

So phpBB is, in my opion, the biggest, best, and most widely supported, in the open source sense, Free Bulletin Board software out there.

And since it is open source, you can do what the hell you want with it.

Don't forget http://phpBB.com has been hacked once, and that was awestats fault, as they had a massive security hole.
Not phpBB related at all.

Also gotta love the independent security audit.
And most of the fixes of 3.0.0 to 3.0.2 were not security, more general bug fixes.

Bazza

After testing out phpBB on a small crash site, I am slightly impressed by phpBB.

The installation was fairly easy, if not enjoyable, and getting my forum up and running was easy. The default design looks beautiful, and there's nothing bad with that either. But there were a few cons.

Those cons were, well. If you wanted to use your time efficiently, phpBB would not be a good BB to use. It's for people who want to invest time into their site, and get a lot out of it. If you just want something easy to set up, phpBB is not for you.

Another con of phpBB is modifying the forum is so tiring. I nearly gave up on one modification, and sometimes it's exhausting.

But still, phpBB is a pretty famous bulletin board, and for good reason. It is powerful, secure, and easy to set up. You will get the most out of this program if you invest the time and knowledge in it.

More often than not, the most vocal critics of phpBB's security track record are those who know the least about security, in general. They hate phpBB because, so long as they're running phpBB, they'll feel like they always have to keep it up-to-date. So they use an alternative. So they don't have to stay up-to-date.

I can't even remember the last time phpBB had a vulnerability. In the runup to 3.0.0's release, phpBB even got a security audit from Stefen Esser:

http://www.sektioneins.de/content/en.4558.24.28502.content2.html

This is the same Stefan Esser that rsnake, of ha.ckers.org, said the following of:

"There aren’t many people on the Internet who I think could hack just about anything - but Stefan Esser is definitely one of them"

http://ha.ckers.org/blog/20070820/hackersorg-challenge-logic-flaw/

That, to me, suggests that phpBB really does care about security. More than any other open source project I know. When was the last time any of phpBB's competitors got Stefan Esser to do an audit for them?

And as for the fact that even phpBB3 has mentioned Security issues in their changelog... take a look at this:

http://secunia.com/advisories/graph/?type=cri&period=all&prod=17998

Two vulnerabilities of least critical kind since phpBB3 had its first beta almost three years ago. Contrast that with vBulletin:

http://secunia.com/advisories/graph/?type=cri&period=all&prod=3212

Twenty-three vulnerabilities, 9% of which have been highly critical, 35% of which have been less critical, and 43% of which have been less critical.

Or how about PunBB?:

http://secunia.com/advisories/graph/?type=cri&period=all&prod=3700

Fifteen vulnerabilities, of which 13% have been highly critical, 47% of which have been moderately critical, and 33% of which have been less critical.

And SMF:

http://secunia.com/advisories/graph/?type=cri&period=all&prod=5285

Twelve vulnerabilities, 8% of which have been highly critical, 33% of which have been moderatel critical, and 50% of which have been less critical.

If you're at all concerned about security, you should actually consider switching /to/ phpBB3 - not from it.

While phpBB is probably one of the worlds most used php powered forum. Its not the best choice.

phpBB has a history of security issues, and all the time are patches and fixes being released. If you get 1 patch/update behind, you have to go hunt for the link to update to the next, and then update to the next...

If you want a real forum system, try out SMF or something else.

phpBB is bloated, and while they do support a lot of database types, its nothing you should take over security.

And yes, phpBB3 is somewhat more secure, and they had a security audit, but already phpBB3 has had 2 or so patches with security issues.