Since the community's launch, there have been periodic inquiries about the security of information within the platform. These inquiries often express confusion or concern. Therefore, I would like to summarize and answer these questions. I believe this is a positive development, indicating that everyone is increasingly aware of the importance of information security. Information security is an enduring need in the information age, and it is essential for protecting information.
Q&A
Why do I need a phone number to post?
According to regulations:《Regulations on the Management of Internet Forum Community Services》
Article 8: Internet forum service providers shall require users to register accounts after authenticating their identities using real personal information, adhering to the principle of "backend verification, frontend voluntary." They must also register and regularly verify the identities of those who initiate and manage forums. Service providers shall not provide information publishing services for users who do not provide real personal information.
According to regulations:《Regulations on the Management of Internet User Account Information》
Article 9: Internet information service providers that provide services such as information publishing and instant messaging to internet users shall verify the real identity of applicants requesting registration by using methods such as mobile phone numbers, ID card numbers, or unified social credit codes. If users do not provide real identity information or register falsely using the names of organizations or individuals, the provider shall not provide them with related services.
According to regulations:《Regulations for the Management of Internet Comment and Review Services》
(1) In accordance with the principle of "verified real identity in the backend and voluntary self-declaration in the frontend," users who have registered must undergo authentication based on methods such as mobile phone number, ID card number, or unified social credit code to verify their real identity information. It is prohibited to provide comment services to users whose real identity information has not been verified or those using false organizational or personal identities.
Why does my personal page display the location?
According to regulations:《Regulations on the Management of Internet User Account Information》
Article 12: Internet information service providers shall display the internet protocol of internet users within a reasonable scope on the internet user account information page.（IP）Address ownership information, to facilitate public oversight for the common good.
Why is a license/certification required?
Internal operation certificate and license verification are self-service functions and not mandatory. Verified users will have corresponding badges displayed on the front desk, as well as access to more services and interface permissions.
How is individual certification reviewed?
The entire credential verification process is automated by the system and does not involve any manual intervention.
The certification process is overseen by @BG5UWQ @venzo @YofoaStudio Completed jointly.
Public announcement of newly appointed personnel responsible for license review within the community. https://forum.hamcq.cn/d/6596
Why is a community organized as a company?
To establish a forum or community platform, company accreditation is required.
This website has already completed the required ICP registration and public security registration, and it is placed at the bottom of the site as required.
Will the data be shared with third parties?
Please refer to this website:Privacy Policy
The community will strictly protect your personal information and other data, and will handle your personal information in accordance with relevant laws and regulations of the People's Republic of China. We will collect, use, store, share, and transfer your personal information based on your consent and other legal grounds that allow us to do so.
Why are posts subject to review? Why are images the only type of content allowed?
To ensure the safety of community content, this site uses content security detection services provided by Alibaba Cloud Computing Co., Ltd. Every piece of content undergoes a "pre-review and then publish" process.
To prevent issues such as copyright and information security from arising within the platform, currently, users are only allowed to post images; uploading files such as PDFs, ZIP archives, or binary files is not permitted.
Why are I not allowed to edit my post after it has been published?
The posts are formatted using Markdown, and users are allowed to preview their posts before publishing. Therefore, please review your content carefully before posting.
After posting, the community provides a 10-minute editing window. After 10 minutes, the original content will be fixed, and new content can be added in the comment section.
This design aims to ensure that everyone takes responsibility for the content they publish.
Has this system been implemented for cybersecurity protection?
Based on 《Information Security Technology – Network Security Level Protection Grading Guide GB/T 22240-2020》Mentioned:
4. Principles and Procedures for Leveling
4.1 Safety Protection Level
Based on the importance of the protected object in national security, economic construction, and social life, as well as the extent to which its destruction, loss of function, or alteration, leakage, loss, or damage would affect national security, social order, public interests, and the legitimate rights of citizens, legal persons, and other organizations, the level of protection for protected objects is divided into five levels:
a) Level 1: If a protected object is damaged, it may cause harm to the legitimate rights and interests of relevant citizens, legal persons, and other organizations, but does not endanger national security, social order, or public interests.
b) Level 2: If a protected object of the second level is damaged, it will cause serious or particularly serious damage to the legitimate rights and interests of relevant citizens, legal persons, and other organizations, or endanger social order and public interests without endangering national security.
c) Level 3: If a protected object of this level is damaged, it will cause serious harm to social order and public interests, or endanger national security.
d) Level four, if the protected object is damaged, it will cause particularly serious harm to social order and public interests, or seriously endanger national security.
e) Level 5: If a protected object of this level is damaged, it will pose a particularly serious threat to national security.
4.4 Grading Process
The initial security protection level has been preliminarily determined to be Level 1, and the network operator can determine the final security protection level based on this standard. They are not required to conduct expert reviews, obtain approval from the relevant authorities, or file for registration.
This community system currently classifies itself as a Level 1 protected object.
*Note: For the second-level security assessment, the one-time fee in the Xiamen area (which needs to be performed every two years) is currently quoted by Xiamen Xinwang An Detection Technology Co., Ltd. as follows: Level classification registration: ¥8200, Assessment cost: ¥45000, Expert fees: ¥1800 (for three experts).
The entire community uses SSL digital certificates to encrypt communications, and all sensitive data is encrypted and stored. The community's information security work will be continuously adjusted based on different operating states, and we make every effort to protect user information within our limited capabilities.
Taking the recent example, the Flarum framework used by the community was upgraded from version 1.6.3 to 1.8.3 and incorporated WAF protection. After upgrading the Flarum framework, issues were discovered with username validation and middleware validation, so the Flarum storage mechanism was abandoned to reduce risks. All sensitive information across the entire site was then stored separately from the Flarum framework.
The following provides a simple overview of the recent changes to sensitive data storage: It's okay if encryption keys are leaked, it's also okay if the database is leaked, and it's also okay if the code is leaked. The problem only arises when all three are leaked simultaneously. None of the developers who may be added in the future will have the ability to obtain all the elements.
[upl-image-preview url=https://storage.hamcq.cn/2023-12-03/1701584311-764603-image.png]
The work we do on this site represents only a small fraction of the efforts in the information security industry. There is no absolute "highest level" or perfectly secure system in information security. In the information age, various types of security incidents occur every year. To achieve complete information security, one would have to completely disconnect from the internet. From the moment you connect to the internet, you should be prepared.
Thank you for your support and trust. 73.
闽ICP备2021006864号-7
闽公网安备35020602002794号
互联网举报中心