isso-comments / isso

a Disqus alternative

Isso – a commenting server similar to Disqus

Isso – Ich schrei sonst – is a lightweight commenting server written in Python and JavaScript. It aims to be a drop-in replacement for Disqus.

Features

• Comments written in Markdown
  Users can edit or delete own comments (within 15 minutes by default). Comments in moderation queue are not publicly visible before activation.
• SQLite backend
  Because comments are not Big Data.
• Disqus & WordPress Import
  You can migrate your Disqus/WordPress comments without any hassle.
• Configurable JS client
  Embed a single JS file, 65kB (20kB gzipped) and you are done.

See isso-comments.de for a live demo, more details and documentation.

Screenshot

Getting started

Requirements

• Python 3.8+ (+ devel headers)
• SQLite 3.3.8 or later
• a working C compiler

Install Isso from PyPi:

pip install isso

Then, follow the Quickstart guide.

If you're stuck, follow the Install guide, see Troubleshooting and browse the the full documentation.

Docker

A Docker image with the latest stable release is provided at ghcr.io/isso-comments/isso:latest. See Using Docker.

Contributing

• Pull requests are very much welcome! These might be good first issues
• See Ways to Contribute
• Translate

Development

Refer to the docs for Installing from Source.

Help

• Join #isso via Matrix or via IRC on Libera.Chat
• Ask a question on GitHub Discussions.

License

MIT, see LICENSE.

isso's Issues

Javascript loading wrong url, adding a / where it maybe should not

Hi and thanks a lot for this software ! 

I tried to install isso and went through up to this point :

If you try to load this page for example :

http://politiquedunetz.sploing.be/2013/10/reconnaitre-la-valeur-des-haineux/

You can see in a debugger that the javascript is trying to load that url : http://politiquedunetz.sploing.be/isso/?uri=%2F2013%2F10%2Freconnaitre-la-valeur-des-haineux%2F while the correct one, resulting from an import of disqus, is http://politiquedunetz.sploing.be/isso/?uri=2013%2F10%2Freconnaitre-la-valeur-des-haineux%2F

I don't know how to correct that somewhere. If you take a look at the source of the page in question, you can see that I already tried to fix it via data-isso or isso-thread, without effect.

Do you think it may be link to a configuration file somewhere. My isso.conf reads : 

host = https://politiquedunetz.sploing.be/
http://politiquedunetz.sploing.be/

while my apache config is : 

<VirtualHost *:80>
 ServerAdmin [email protected]
 ServerName politiquedunetz.sploing.be
 VirtualDocumentRoot /var/www/politiquedunetz
 CustomLog ${APACHE_LOG_DIR}/politiquedunetz.log combined
<Location /isso>
        Allow from all
        ProxyPass http://localhost:1234
        ProxyPassReverse http://localhost:1234
</Location>
</VirtualHost>

Thanks a lot for your remarks !

Isso client configuration, e.g. disable CSS, specify prefix (and future options)

admin interface

[feature] Sort by newest/highest votes

auto-refresh comments every N minutes

The client should ask the server for new/updated comments (with a Last-Modified: ... header to reduce overhead when nothing has changed) every N minutes.

third-party libraries

Third-party libraries essential for Isso (and unlikely to be rewritten from scratch):

Build dependencies

• Jade, precompile templates to JS for client execution.
• Almond – create a single file JS
• RequireJS – AMD file loader and build system
• RequireJS' Text – compile non-Js resources into JS

Runtime dependencies

• Jade – tiny runtime.js for precompiled templates
• werkzeug – WSGI toolkit
• itsdangerous – store signed data on untrusted clients
• misaka – fast Markdown processor written in C
• html5lib – HTML(5) parser and sanitizer

Optional

• passlib – PBKDF2 implementation fallback if werkzeug 0.8

Python 2

• ipaddr
• configparser

+1 on comments

Recommeded deployment method

Hi,
What is the recommended deployment method: built-in or WSGI server?
On https://github.com/posativ/isso/blob/master/docs/uWSGI.md it reads:
"Use uWSGI if you think that the builtin WSGI server is a bad choice or slow (hint: it's both)."
(The question is relevant for the Debian packaging of Isso)

Also, is there a plan to support multiple websites using one configuration file/process? Configuring and running many instances might look a bit unpractical compared to web servers that support "sites-enabled" directories.

Thanks

unittests for the JS client

Animate insertion/deletion of comments, decide upon a lightweight animation library

serve WSGI on a socket

@jgraichen wants a zero-conf socket server: http://stackoverflow.com/a/7738689

docs for integrating with django

Hello there,

I was wondering if there were any docs explaining how to integrate isso with django.
Isso seems great - would like to try it within django!

John J

Improve socket handling

I've experienced some issues with sockets and have some ideas how to improve it:

First problem is that isso tries to unlink an existing socket when starting even if it would have enough rights and it does not have a privilege drop function. That makes it impossible to e.g. use /var/run/isso.sock as a socket when isso is not running as root, because /var/run is only writable by root. Even if I manually create a socket and give it to the isso user, isso will delete it and cannot create a new one.

I would expect isso to use an existing socket if it has read and write permissions.

Second problem is missing chmod option for the socket. This way only the isso user can use socket and e.g. nginx running another user cannot connect to the socket.

It would be incredible if I could specify chmod and user for the socket and user and group for isso, and isso would create socket as root and do a privilege drop to specified user and group before starting to function.

Example:

[server]
bind = unix:///var/run/isso.sock?chmod=660&user=www-data
user = isso
group = www-data

Missing tag for version 0.4

I've noticed that the latest version of isso available on pypi is 0.4, but there is no tag for the release on the git repository, so I was going to miss it.

Could you please add the tag?

Thanks in advance

add demo site

Show a simple HTML site when accessing /demo.

Supervisor configuration file

I suggest you this Supervisor configuration file to add to the init scripts :
N.B.: The environment line is optional, I had to add it because of UnicodeEncodeError (as @posativ suggested on IRC mar. 27 2014).

[program:isso]
command = /usr/local/bin/isso -c /etc/isso.conf run
directory = /var/lib/isso
user = isso
autostart = true
autorestart = true
stdout_logfile = /var/log/supervisor/isso.log
stderr_logfile = /var/log/supervisor/isso_err.log
environment = LANG="fr_FR.UTF-8"

I'm not a git Guru, do as you please to add it.

prohibit headings in Markdown

Feature request : Integration with github.io

I host my static site ( I use pelican, if it matters) on github.io - The development happens on my machine- generated pages are then "committed/pushed" to github.io

disqus lets me use their system with my setup.
Based on the isso documentation - it seems like will need my own server to use isso.

Are there plans to integrate w/ github.io ?

running Isso on a different domain: cookie detection fails

Workaround: don't send Set-Cookie, because it is not readable by the user due cross-origin policy. Instead of Set-Cookie, send a different header and save with JS for the current domain.

cache popular requests

Currently, Markdown is generated per request. This is essentially an issue with > 400 comments per page (needs over 11 seconds to populate the request).

• uWSGI: http://uwsgi-docs.readthedocs.org/en/latest/Caching.html
• w/o use LRU (and the backport for Python 2.X) per thread

usability minors

• email address is actually only a private identifier to generate the same identicon again
• blank identicon changes to identicon from IP address changes to identicon from mail address -> not really intuitive on first evaluation
• remove comment but still hovering the button reverts to original state after ~1 second
• when replied to a comment, scrollIntoView doesn't work as expected (scrolled half page after document end)
• when you vote multiple times on a comment, you should get a appropriate error message

new?uri and check-ip issues

Hi,

Here is the situation : I am testing isso on my local computer with acrylamid.

When I try to input my comment and submit it nothing happens and I have two errors in the console log :

[Error] Failed to load resource: the server responded with a status of 404 (Not Found) (check-ip, line 0) > http://localhost:8000/check-ip
[Error] Failed to load resource: the server responded with a status of 501 (Not Implemented) (new, line 0) http://localhost:8000/new?uri=NameOfMyPage

There must be something wrong in my installation or configuration but I do not understand what. Could you help me?

Thanks.

XMPP notifications

administration CLI

A tiny command-line application to administrate more than just comment activation and deletion (preferably written in Python to use the isso.db module). Administration tools:

• comment deletion and activation
• follow redirects, manually edit thread url/id
• remove all comments from a given field (e.g. IP address)
• remove thread and comments when web page is gone (error 404 or 410)
• Disqus/WordPress/... import and export (if possible), Disqus import from Isso can be removed then

Anything else?

PHP-like setup on first-run to configure Isso

identicons

remove cleared, but not fully deleted if any child is deleted

uwsgi say Internal Server Error

not what is the error .. my configuration is:

[uwsgi]
http = :2710
master = true
processes = 1
cache2 = name=hash,items=10240,blocksize=32
spooler = %d/mail
module = isso
virtualenv = %d
env = ISSO_SETTINGS=%d/isso.conf

Y isso.conf

[general]
dbpath = /www/distopico.info/isso/isso.db

host = https://ardervegan.info/blog/

#max-age = 15m
#session-key = ... ; python: binascii.b2a_hex(os.urandom(24))
#notify = smtp

#[server]
#listen = http://127.0.0.1:2705
#reload = off
#profile = off

[moderation]
enabled = true

URL: http://habla.ardervegan.info

Isso breaks with python-html5lib (0.95-1)

Seems isso breaks at least with the html5lib shipped on wheezy (0.95-1).

Running the tests on wheezy results in http://paste.posativ.org/2fdcae1761.

At least you may need to increase the version constraint but that would make the packaging harder. Maybe there is a way to work-around it or monkey patch it?

Maybe related: html5lib/html5lib-python#52

Isso as service [Debian 7]

Hi,

I have used the script https://github.com/jgraichen/debian-isso/blob/master/debian/isso.init to create a new service in /etc/init.d/.

I chmoded +x it, I added it to the service list with chkconfig and checked that it was on.

isso 0:off 1:off 2:on 3:on 4:on 5:on 6:off

But nevertheless it seems not to be started. I have to manually type isso -c /path/ run to make it starts.

Any idea?

GET URI should try HTTP_ORIGIN's hostname first

CSRF on upvotes/downvotes

It looks like there's a CSRF on upvotes/downvotes. In fact I was able to downvote a comment using the following command (I got it from Chrome Developer Tools):

curl 'http://posativ.org/isso/api/id/1/dislike' -X POST -H 'Origin: http://posativ.org' -H 'Accept-Encoding: gzip,deflate,sdch' -H 'Host: posativ.org' -H 'Accept-Language: en-US,en;q=0.8,fr;q=0.6' -H 'User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/30.0.1567.0 Safari/537.36' -H 'Accept: */*' -H 'Referer: http://posativ.org/isso/' -H 'Connection: keep-alive' -H 'Content-Length: 0' --compressed

I'm pretty sure it'd be possible to make a simple PoC with JS that would force a client to trigger a vote.

check browser compatibility and fail gracefully

spam guard slighty broken

Currently, the spam guard prevents a /24 IP from posting more than three comments directly as a response to a post for all threads (not per thread). As a current workaround, disable the spam guard: [guard] -> enabled = false.

confirm comment removal

language selection not working?

Thank you for this wonderful software and the good documentation! This is what I was looking for for a long time. I'll use it together with Jekyll for blogging R-code. The only problem I could not solve so far is the language: the plugin has the default de GUI and does not switch to en despite the following code.

<script data-isso="http://isso.bioinformatix.org"
        data-isso-css="true"
        data-isso-lang="en"
        data-isso-reply-toself="false"
        src="http://isso.bioinformatix.org/js/embed.min.js">
</script>

<section id="isso-thread"></section>

See my test-page http://jekyll.bioinformatix.org/lessons/2014/01/06/knitr-jekyll/.

Probably this is not a bug but a miss-configuration on my side? Anyway I'd appreciate any hint how to solve this very much!

Best regards, Felix

Comment form on mobile phones / small screens

The form doesn't scale responsively as the screen size reduces a lot. Submit button text goes on reducing and only displays Sub. It should go on next line. Needs minor hack in css files. I might look into it and submit a patch.

moderation queue and remote activation

• activation via (unique) email token
• delete comments in queue when older than 30 days

App für Isso ?

Hey,

wird es auch eine App für isso geben ? Bin jetzt schon ein großer Fan und finde isso auch gut :)

Regards ;),
Jan

Pingback/TrackBack™/WebMention support and integration

db normalization

in case SQLite does not hash/compress the primary key, main.threads should feature a path -> id mapping and all relating DBs should use id instead of path.

i18n

Use a JS library (such as Jed) to handle i18n and allow users to create custom messages (e.g. formal vs. informal speak) during build process.

Include german and english messages by default, add instructions on how to add new languages when Isso reaches beta status.

Missing Date in Mail Header

In Mailheader the date field is missing.

Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: base64
From: <from>
To: <mail>
Subject: <subject>

store page title in database

In the admin interface (and shortly also in email) Isso can only show the path for a comment, not the actual title.

Instead of AJAXing all page titles, it is more efficient to store these in the database.

override thread discovery with custom data-attributes

Provide a full feature commented .ini file in the source or the documentation

title says it all, this would avoid one to copy and paste numerous bits of the documentation.

pagination, load more on demand

Around 1000 comments per thread result in 11 second response time from the server and > 30 second rendering time in the browser. Better fetch only e.g. 20 comments and load more during scrolling (or on "show more" click).

spam filtering

It's surprisingly difficult to find a usable general spam filter software. That's currently available:

• DSPAM – requires a daemon, dafuq?
• CRM114 – bloated, but there's a stripped down, abandoned ANSI C implementation with Python support, but doesn't compile on my system.
• bayes classifier – most are > 4 years old, don't have a test suite etc.

Probably DIY: http://crm114.sourceforge.net/docs/classify_details.txt

Hide avatars

I've a minimalist style on a static blog, and I would like to hide the avatars without a display:none in CSS. Is there some kind of "data-isso-avatars="false"" we could use ?

sendmail for notification and approval of new comments