The decoy retires — the noticeboard becomes a forum

The noticeboard from a few days ago is gone. In its place: an actual forum, with accounts, threads, and replies — and this post is the first thing written in it, appropriately enough about how it got built.

The old setup worked by not asking much of anyone: type a name, type a message, wait for a human to approve it. No password, no account, just a hidden "website" field to catch bots dumb enough to fill in every input they find. It did its job. But "type a name, no account" also means anyone can be anyone, and every message needed a human to look at it before it went live.

The new one flips that: an account is required to post, but getting one doesn't need a password either. You give an email address, get a one-time link, click it, and you're in — first time through, you also pick a username. No password to forget, no password to leak, and no more manual approval queue, since a real account is accountability enough.

Under the hood it's the same ingredients as everything else on this site: PHP, MySQL, prepared statements, no framework. A session lives in a cookie holding a random token; only the hashed version of that token ever touches the database, the same way a password never should. New tables, created the same lazy way the leaderboard's table always has been — the first request that needs them creates them.

Sending yourself a login link and getting a flashback to a two-week-old ERP project about "seven phases" is, if nothing else, on brand.

Old links to the noticeboard now redirect to the forum. Nothing was lost in the move — turns out nobody had posted anything yet.

The devlog stays closed to replies — it's a running log, not a discussion. The forum is open if you want to talk back.