You bring up many valid points. Ill hit you with some answers.
1. Release your source code on Github or Gitlain (preferably gitlain)https://github.com/fallenPineapple/vichan
What is there is what is running here
2. State your IP logging policy, and preferably do away with all IP logging, and switch to a hash-based system.
3. Tell us what data you keep, if any, and for how long that data is kept. Preferably stop all data collection wherever possible, except for error logs, and prune those error logs.
IPs are not currently hashed, they are stored in the database attached to the post associated with them. Once a thread or post is removed by any means that info is deleted. The exception being bans, that info sticks around till someone clears it out. We are hoping to move to a hashed system soon.
4. Tell us where the server is hosted
5. Tell us what OS is the server is running
6. How is the OS configured? Does it get security updates automatically?
7. Where did you buy the server from? Did you buy it in bitcoins, a giftcard, paypal? (this is relevant because this tells us if an adversary who got in touch with the server company would be able to quickly trace the transaction back to the administrator)
10. Is there *any* proprietary software installed on the server?
11. What hardware is the server running on (relevant because Intel has had some privacy concerns with their management engine)
The server is from soyoustart a division of OVH, It is in NA but leaf territory. AMD Opteron system running a bare bones install of Ubuntu 16.04.2 LTS. Just running a LEMP stack. Security updates are auto installed. I assume the server is payed through CC or Paypal.
8. Release your congiruation files for NGINX if you use it, or Apache.https://ghostbin.com/paste/gvwug
9. How is your SSHD configured? Do you use passwords, or do you use keys?
Currently passwords (yes insecure I know) This will be changed to keys very soon.
12. Who in the staff team has administrative access to the server, and why do they have it?
Me: I am the one who set everything up on this server and the one that has to fix things related to it.
Atlas: He is the owner
I will try and get a page up that goes into more detail. But a post here is better then nothing at the moment.