Disadvantages Of Installing Extension On Flarum

Henryson

If I may ask is they any disadvantages of installing extension on your flarum (will the extension creator be able to have access to your Forum in any way, or be able to spam your forum with the extension he/she created) and also, if you install too many extension will it affect your flarum.

Kakifrucht

Flarum is highly extension driven. The core of the Forum only contains the most basic functionality, whereas any added functionality, even stuff you would expect from any forum, is added as an extension. For example, the Tags extension is added as a bundled extension with Flarum that can be disabled.

There are really no disadvantages to adding your features this way. From a development standpoint it allows the forum to stay lean and performant, as functionality is added in a very modular manner via extensions. Performance for most extensions is not an issue, but of course it depends what the extension does. Extension developers get no access to your forum, as long as you do not install shady extensions. As a forum administrator you will have to look into what you install, but same thing applies on your local machine.

Henryson

Thanks for your quick reply.

What do you mean by

Kakifrucht bundled extension

And how can you check and extension before installing

clarkwinkelmann

To avoid "shady" extensions as said by Kakifrucht or just keep a quality Flarum install you could follow something like this:

Only install extensions via an official method. Right now all extensions are published to the Packagist repository and installed via the official Composer client. Using Bazaar as a client is also a valid option, if you trust Flagrow ?
Only install extensions from trusted developers. Official/bundled extensions should probably be trusted the most. You should also be able to trust our large developer groups here (though as I'm in one of these groups what else would I say ?). Extension discussions are usually a good place to see whether anybody has something to report about an extension/developer. If an extension is coming from a new developer, let more experienced users try it first before installing it on your own production forum
Check the extension support covers your needs. There are multiple extensions marked as "abandoned" or "proof of concept" that will never be updated for future Flarum versions, so you should probably avoid those. Also some developer / developer groups have committed to provide updates to their extensions, those are the safest to install in the long run
If you're installing many extensions, make sure to check for conflicts between them. Often developers will list conflicts in their extension discussions. The best solution is to have a "test" Flarum install separate from your production Forum (locally or at another url) where you can test extensions before installing them in production

I would say the most important thing to keep in mind is that the more extensions you have on your forum, the harder it will be to update to a later beta (or even stable). Having many extensions installed shouldn't be an issue in itself.

If you want to check the code yourself, you could review each extension source code. You can find the link to the source from the Packagist page. You can also check the code in your vendor folder. Though if you're worried about security, you shouldn't install the extension at all before checking it, as a malicious extension could run code as soon as it's installed, even if it isn't enabled inside Flarum !

SHC

By bundled extension, he means that the extension is installed by default and comes prepackaged along with the Flarum installation. Some extensions such as Tags, Akismet, etc, are bundled along with Flarum.

Henryson

SHC Thanks

Henryson

clarkwinkelmann Wow Thanks Alot