Quite a while ago I came by this web forum called Avalon. It was a roleplaying forum, where your board account was your character and you’d be able to collaboratively write a story with other members. You’re only allowed to control your own character or NPCs and there were other restrictions such as having to purchase an item form the shops before you can use it.
Invisionfree (now Zetaboards) provided the board that I joined, which was actually the case for a significant amount of similar sites. There were so many that IF had a separate section in their board directory just for them. The development forum was also full of little javascript snippets that could be used on sites to add profile fields (class, race and others) or display the amount of gold a user had (in our case, 5 x post_count) and many other functions.
One day when trying to access the site, members discovered that the board was no more. The ‘owner’ had deleted it because she no longer had time to run it properly, but one of the ex-members decided to start it up again and we reconstructed the site as best we could. I helped out in the reconstruction because I had some basic knowledge of html and javascript at the time. My help eventually earned me the position of Admin and that is when I came to realise exactly how much time it actually took to run a board like this.
You see, everything that happens on the board is a manual process. Every time a user wants to buy something from a shop, someone with the appropriate privileges has to alter the user’s post count in order to remove their gold and then place the item image in their signature. The same manual process must be done for name changes, gold transfers between characters, custom item requests and so on. Then you get the inevitable disagreements and reported posts that have to be policed and eventually you find that you don’t post any roleplays because all of your time is spent just running the site.
That is when I came up with the idea for Alphonse. It was to be a bot written entirely in Perl and built upon my experiences of coding MSN, Yahoo, AIM and IRC bots. It would have administrator privileges and could be commanded via private message. The bot could take care of almost everything that would otherwise be left to the admins and mods. You could message it with a set of instructions and it would perform specific actions. Alphonse overall seemed to be a good idea and reasonably well executed. There were some hiccups but on the whole it performed as desired. Unfortunately some posts have been removed from the board but the bot grew to encompass almost the entire functionality set of the admin panel for the board. It could prune the member list of inactive members, detect spam and then flag the topic and all contributors. Some contributors could reply with a safe word to de-flag the post otherwise the poster would be permanently ip-banned and the topic removed. It even sent out a mass PM of a survey that some admins had come up with and anonymously logged the responses to provide statistics.
All of this automation was in some ways quite scary. Alphonse was editing a live website after all and if something went wrong, it could be a disaster. This did occur and led to the demise of the bot, but I’ll get to that later. Along the way, some small hiccups also came to light. One such was when changing people’s usernames. It should be common knowledge to developers that you can never trust any input provided by the client. Client-side checks are simple to bypass and if they are the only things verifying your data then you have designed your system very wrong. That point was apparently lost on the Invisionfree developers who would accept name change requests after only client-side validation. The trouble Alphonse faced was that it didn’t have any client-side validation. It could (and did) send empty strings as the new name and since Invision were trusting the client to ensure the name was valid and Alphonse was trusting the server with the same task, the user ended up without a name.
Thinking back on the code for Alphonse, I am actually quite surprised myself at how well it worked. The idea was simple – http requests are very straightforward in Perl, but with all of the string matching and regexs in order to pull messages from the html, so much could have gone wrong. With that being the case I actually opened a support ticket with IF and explained the bot, then asked for their permission to continue running it. The response I got said that they were certain I couldn’t create such a thing, but if I could then it was okay to use. That moment was a proud one for me. These developers working on production quality code said it wasn’t possible but I’d already created it. Thinking back on that moment, I don’t actually know why they claimed it wasn’t possible. With a basic understanding of sockets, anyone could have done the same.
I suppose you can’t quite make out the ascii art title there, but it says “Alphonse v2″.
Now we get to the unfortunate part. One terrible morning Alphonse went down and there was major trouble. Part of the code had somehow been corrupted and I hadn’t made a backup, so I had to code it again from memory. That took roughly 2-3 weeks but during that time people had sent it requests and then got frustrated when they hadn’t worked. Subsequently they had got the moderators to perform their request manually. When Alphonse was fixed I could have done a very simple thing and just cleared the inbox before starting it again, but I neglected to do so and the result was that 2 or 3 weeks worth of requests were all processed twice – once by the mods and once by the bot. It caused no end of trouble and unfortunately signaled the end of Alphonse.
At least I thought it was the end, but it wasn’t. First though, let us diverge a little.
Some time after the end of Alponse I started up a new roleplaying forum of my own. Avalon was nice, but I’m not a great fan of fantasy; I prefer science fiction. I’d had this idea for a Sci-Fi site that I had seen nowhere else. It was to be as limited as your imagination, or the combined imagination of all its members. There would be no set weapons, there would be modules that you can use to craft a weapon, with rules governing the structure but otherwise left to the user. If you couldn’t find a module you wanted, you could invent one. Your character was customisable and, since it was set in the future, that included replacement body parts that were more durable or enhanced in some other way, like night vision eyes. The setting was a dystopia where a walled-in city kept its inhabitants captive and oppressed, save for those few who rebelled. Each section of the city could be controlled by enforcers or rebels and fought over for control at any time. The city had rules that dictated whether a citizen could be in any one zone at a time. For example, the commercial zones were all out of bounds during the night. Any citizen caught in this zone during restrictions should be prepared for a fight.
In some ways it was a complicated idea but I was much younger and more creative back then. The reception to the idea was very positive, but I had given myself a heck of a burden. This site was even more interactive than Avalon and there was no Alphonse to relieve any of that. As such, it fell into neglect and eventually closed down.
Meanwhile, the legend of Alphonse was not dead. A member of Avalon had proposed creating a new version of the bot (this was some time after the original) and the project went ahead. The administrators were not as pleased about the idea of a bot now as they had been originally. Here is a quote from one:
Lantana
To be honest, one of the only problems I had with Alphonse back then was the sheer fact that his existence meant I, as a then-admin, didn’t… really have anything to do anymore. So I’m behind the “but we don’t really need it” argument.
In some way this is the ultimate praise for Alphonse. The fact that after its creation the admins had no tasks to do is a huge statement about the ability that the bot had. Unfortunately after numerous attempts, the successor to Alphonse never appeared and the board continued to be manually administered.
That is how things stayed for many years. One day, though, the admins decided to make a new board. It would be phpBB based and because they would have full source access, a lot of the boring manual process could be automated. The board could also be more feature-rich and interactive than the IF/Zetaboard setup that is presently in use. So the new board was created and some development began, but the project was never finished and eventually became abandoned.
After I completed the TeeFury app that I described in my last post I was looking for something else to do, and I had a suggestion to remake my old roleplaying site. I probably wouldn’t use the site myself, but I asked a lot of old members and they all agreed that they liked the idea and would probably join it if it existed again. I went back to Avalon for some ideas and noticed the discussion about creating their own custom board. I’d planned to do that for my site, so I offered a partnership. We would work together on a core board and would branch the project into our own individual sites. That would allow Avalon to have the custom board they wanted whilst also relieving some of the coding burden from me. The deal was done, some code was laid down and features planned out. The whole project will be created from scratch, because phpBB is GPL licensed and we want to avoid that.
This is the natural progression of Alphonse. Once it took over all admin duties for Avalon, it could only either die or evolve into a board of its own. In actual fact it did both. The new board will be as automated as possible so that the site can be run by very few staff members. It will be modular in nature, containing a core board and an event system that modules can register with. A module will be invoked when any event occurs that it wants to know about, and it can then affect the board as it needs to. The client and server code are loosely coupled, so that the server never tells the client how to display anything. The aim is for a board that can be very easily extended with self-contained modules, which will allow me to have the territory system that exists on my roleplaying site but some other system entirely (or no system) on Avalon. To add or remove the system is as simple as placing the code in the plugins directory. It will be a little bit like WordPress for forums.
There is a large feature list to work through, which will probably be announced when the project is more complete. What is working at present is the ability to register and create board sections and forums. Development is happening quite slowly, because much research is being done into security best practices for a forum.
This has been a nice stroll down memory lane. I was going to post some things about CSRF attacks that I recently researched and verified as an issue for Zetaboards, but the post didn’t really go toward that subject. I’ll save that for a later post about how Alphonse all works together and what it does to protect against this and other types of attack. As for Alphonse, I hope we live up to its legend.

















