FluxBB VS recaptcha

There are no passwords stored plain. The platform that powers the bbs is open source and tiny. You can check in <5 min that it's not doing anything shady here.

FluxBB [1], the PHP based forum that powers the Archlinux wiki works fine without JS, and IMHO looks fine too.

If you are looking for something minimal with threading support, fossil scm [2] includes a forum. You can checkout the forum for fossil itself which is powered by fossil.

[1] https://fluxbb.org

[2] https://fossil-scm.org/

[3] https://fossil-scm.org/forum/forummain

Also quick suggestion maybe you should look at https://fluxbb.org/ I found it on Arch Linux forums and it seems to work well

I know Google has a ReCAPTCHA service, and I think it’s free up to scales I would probably never use up. Still, I’d prefer something than can be self hosted so is totally free. And where you don't have to register your domain with a 3rd party, you can just use it on any domain.

The traditional way of using "I am not a robot" Recpatcha seems to be with a

## Step 1: Obtaining reCAPTCHA Keys Go to the Google reCAPTCHA website (https://www.google.com/recaptcha) and sign in with your Google account. Click the + sign and fill in the details as follows:

* https://www.google.com/recaptcha/ * allow * https://www.gstatic.com/recaptcha/ * allow * https://www.google.com/js/ * allow * captcha.com * allow * recaptcha.net * allow

https://www.google.com/recaptcha/ * allow

Depends on what you mean by "proxying". Everything you do (serving a Single-Page Application or requesting HN by backend, processing it's HTML and sending the content to your own frontend) will take traffic away from news.ycombinator.com and to another domain - which comes with it's own set of dreadful scenarios.

There used to be (and still are) things like https://mreidsma.github.io/bookmarklets/jquerify.html which allow to inject JS on click (and thus would make it possible to transform that site), but I gave it a shot and HN is set up to disallow this:

  Refused to load the script 'https://code.jquery.com/jquery.min.js' because it violates the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' https://www.google.com/recaptcha/ https://www.gstatic.com/recaptcha/ https://cdnjs.cloudflare.com/". Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback.