Whats the deal with MyArmory??

As far as I can tell, they are not taking new members, the forum software is outdated with all the mods they have added to it, it wouldn't run even if they updated the software, they would have to grab a different software suite, the Admin I haven't seen post in years, so to me I think it is on it's last legs and just barely surviving.

There was a recent thread over there where Chad (moderator) explained that because the software is old and customized, they had to disable the automated messaging and verification stuff for new members or resetting passwords. You can contact him directly from his website. There was also some discussion on what members want for the future of myArmoury, with overwhelming support for continuance of a forum platform. Chad mentioned that they're coming up with a plan for MA's future.

We haven't heard directly from Nathan (owner/founder) in quite some time, I'm not sure what's up with that. Chad says, or at least implies, that he's still in touch with Nathan, but no direct posts from him. Earlier this year the forum started hosting ads; like random ads, not even related to the forum content. Activity is way down. I check it once a week now and there are maybe like 30 new posts. It's definitely heading toward the grave unless action is taken sooner rather than later.

The same thing is going on over at the Sword Forum International (swords.com) site. The CAPTCHA for registering new members or even for searching their voluminous posts archives does not work. Some old forum members are still posting but new people are out of luck,

they have a link to donate and a page about buying upgraded memberships.

The last new member joined there in Nov 2020. One of the mods/admins is a member here, so it would be good if he could comment.

there have been discussions there on the future of MyArmoury. I think I first heard of them when there was a reference to a fundraising effort on a maker or dealer site (might have been A&A or KoA).

The forum software can be expensive for a small operation. A lot of forums are owned by big conglomerates (the similar looking gun/vehicle/etc forums). I would have joined at a higher tier to get the ability to post a larger gallery of the collection. Maybe someday.

Since I can't participate in discussions or spend all of my money there, I only drop by once or twice a month. I'm here nearly every day and I've spent a lot in the classifieds here. Their loss, SBG forum's gain.

If anybody ever wants to communicate with somebody on there or buy something they can get in touch with me as I have an account there before they closed new members.

Ok, so I'm a geek and this got me curious. Skip to end summary if TL;DR.

I've never tried visiting MyArmoury before, but here's what I'm seeing from the outside:

1) The site lacks a current and valid SSL certificate.
--This means that data traveling two and from the site is sent in-the-clear, making it vulnerable to man-in-the-middle attacks. Pretty much anything that requires username and password should use an SSL to wrap that data in encryption.
--This is a very fixable thing. You just purchase the certificate and update the server with the credentials. Maybe they lack the funds or anyone on staff with knowledge of or access to the hosting server?

2) There is a tracking pixel that passes data to an advertising service, quantserve, who ALSO do not have an SSL certificate on their domain.
--So, whatever data is being mined and kicked back to the advertising service likewise appears to be vulnerable to basic man-in-the-middle attacks and exposed to anyone curious.

3) I see most people saying the password recovery feature doesn't work, so I looked into that.
--Their forums are built on some version of PHPBB. For security reasons the version is never publically visible, so I don't know how current they are. Regardless I notice the recovery feature is designed to generate a new password for you and email it to you.
--For security reasons, I HATE this recovery method. I'd rather enter a new password of my choosing through an encrypted connection to be one-way encrypted and stored in a secure database. NOTE: To be fair, PHPBB does use one-way hashing to make a password secure before storing it in the DB.
--As for why this isn't working, I have a guess. In order to email you a new password the forum must be using a mailserver of some kind, typically SMTP Server. If that isn't up-to-date, IS up-to-date but the forum's code is using an outdated API, or is not longer being paid for (shut down), then it won't be sending any email.

4) About version mis-matching and version control...
--So, while not indicated by user reports and the fact that the forum still functions, another common cause of issues is a mismatch of incompatible versions of software running on the host server. For example, if the server updated to the latest version of PHP and some of the code used to build that version of PHPBB uses functions no longer allowed, there would be unexpected behaviors/errors.
--Apache and PHP versions ARE publically visible, but I still won't list them as they are so egregiously outdated at this point that calling them out could open them to cyberattacks.
--It is possible? the password reset method is broken because of this, or it is at least a contributing factor.

Summary:

The good news:
MyArmoury.com shows clear of any malware via some 3rd party tools. The domain does not appear on any blacklists currently, so third party security services do not currently see the site as malicious. The forum still functions in most ways for existing members. They have a great community of contributors.

The bad:
It appears all data sent to and from the site is unencrypted, including your username and password, which could be harvested anywhere along the way. I also suspect the SMTP server is broken, or none is currently paid for, so this may explain the password recovery issue.

The ugly:
The host's Apache and PHP versions are outdated by... years. There are some known vulnerabilities exposing the forum to risk. Also, I see no monitoring or WAF in place to help mitigate risk. Basically, it's still fine because nobody's bothered messing with them yet.

The unknown:
The forum is dona tor supported. It looks like they are using Paypal for their payment processing. This is fine. I do see they are using a webform they built to obtain info to be passed to the Paypal service. I have no visibility into how this works and if it is secure. I'm concerned about the lack of SSL certificate. If you can click the Paypal Icon and be sent directly to a form on Paypal.com, DO THAT to donate.

Any word on what's going on with Sword Forum International (swordforum.com)? It used to be the premier antique sword collector site and had such luminaries as Latham-Wilkenson and Matt Easton posting regularly. Now it's not accepting new members and the CAPTCHA for searches does not work--but some people are still posting.