Under the Hood: The Plugins We Built for This Forum

[Blythex]

Hey everyone

A forum is more than a place to post – for a project like AntiQua it has to be safe, private and usable for people from all over the world. Off-the-shelf plugins only got us part of the way there, so we built our own. This post walks you through every plugin we developed ourselves: why it exists and what it does for you.

Everything below runs on our own server. No tracking services, no third-party translation APIs, no data brokers.

---

1. Seed Protection

Why we built it
The number one way people lose crypto in communities is not a hack – it's a moment of panic. Someone's wallet won't sync, they ask for help and paste their recovery words into a post. Or a "support agent" sends a friendly DM asking for them. We wanted the forum itself to step in before that happens.

What it does

• Blocks recovery phrases in posts – topics, replies, edits and titles are checked before anything is saved. It understands our own post-quantum AIP-39 standard (24, 36 and 48 words, including checksum verification) as well as classic BIP-39 phrases, in all ten official wordlist languages.
• Blocks post-quantum private keys – ML-DSA and ML-KEM secret keys are recognised by their standardised size, whether pasted as hex or Base64. Transaction hashes and public keys are not affected.
• Protects your chats – without reading them. Before a chat message leaves your device, your own browser checks it and asks "Are you sure?" if it looks like a seed phrase or key. Nothing about this check is ever sent to our server. We do not scan, log or monitor private messages. Period.
• Scam warnings – if a message or post asks for your recovery phrase, pushes remote-access tools like AnyDesk, or promises to "double your coins", you'll see a warning right above it. This also runs only in your browser, and it speaks 12 languages.
• Impersonation protection – nobody can register or rename themselves to something that looks like a team member (think BIythex with a capital I, lookalike characters from other alphabets, or names like "Official Support").

Reminder: The AntiQua team will never ask for your recovery phrase, your private key or remote access to your computer. Anyone who does is a scammer.

---

2. Translate Button

Why we built it
Post-quantum security is a global topic, and good ideas shouldn't get lost because they were written in a different language. At the same time, we didn't want to ship your posts off to Google or DeepL.

What it does

• Every post has a translate button (next to Reply). One click translates the post – and the topic title for the first post – into your language. One more click shows the original again.
• Translation runs on LibreTranslate, self-hosted in its own container on our server. Your text never leaves AntiQua infrastructure.
• Supported languages: English, German, Spanish, French, Italian, Dutch, Polish, Portuguese, Russian, Turkish, Ukrainian and Chinese.
• Smart target language – your chosen forum language wins; if you never set one, your browser's language is used.
• Code stays code – code blocks, @mentions and links are left untouched, so commands and addresses are never "translated" into nonsense.
• Translations are cached, so popular posts load instantly for the next reader.

Honest note: this is machine translation. It's great for understanding a post, not for publishing a legal contract.

---

3. Legal Pages

Why we built it
A serious project needs a serious foundation. We wanted a legal notice, a privacy policy and community guidelines that describe what this forum actually does – not a generic template copied from somewhere.

What it does

• Adds the Legal notice, the Privacy policy and the Community guidelines – linked in the footer of every page.
• Every page is available in German and English with a one-click language toggle.
• The privacy policy documents the real data flows of this installation: self-hosted translation, local-only chat checks, what we store and for how long.
• You can withdraw your reCAPTCHA consent directly on the privacy page at any time.

---

4. Identicons

Why we built it
Rows of identical grey default avatars make it hard to tell who is who. We wanted every member to have a recognisable face from day one.

What it does

• Generates a unique, crisp 512 px identicon for every member who hasn't uploaded a picture.
• Your own uploads and your GitHub avatar are never overwritten – the identicon only fills the gap.

---

5. Emoji Packs

Why we built it
Emojis are half of how a community talks. We wanted full control over which packs are loaded and an easy way to add our own.

What it does

• Admins get a clear overview of every loaded emoji pack, including attribution and licence.
• Custom packs can be added simply by dropping images into a folder – no code required.
• Adds the emoji button to Quick Reply, so you don't have to open the full editor just to send a

---

Also under the hood

Besides our own plugins, we maintain fixes for several community plugins we rely on – for example reCAPTCHA v3 support that only loads after you give consent, a cleaner admin view for two-factor authentication, and a fully translated mentions admin panel. Every change is version-controlled on our own Git server, so updates never silently undo them.

---

Our principles in one line

Self-hosted. Privacy first. Built for a global post-quantum community.

We'll keep posting updates like this here in Development. Replies are very welcome: bugs, ideas, wishes – let us hear them

Cheers,
Blythex

[Blythex]

Update — Telegram notifications are live

September 2026 · a new plugin joins the list above

You can now get your forum notifications on Telegram — if you want to. Nothing changes for anyone who doesn't: email and the bell keep working exactly as before, and this is off until you switch it on yourself.

Our bot is @AntiQua_Blockchain_Bot.

---

Connecting takes about ten seconds

1. Go to Settings in your profile and find the Telegram section.
2. Press Connect Telegram. A link appears — open it.
3. Press Start in Telegram. Come back; the page has already updated itself.

That's it. And notice what you didn't do: you never looked up a chat ID and never typed one anywhere.

That's deliberate, and it's the most important design decision in this plugin. If there were a field for your Telegram ID, someone could type in yours. Their forum notifications would then land on your phone — and since notification texts contain post content, whoever did it could choose the text. The forum would become a delivery channel for messages from a bot you trust. That is exactly how a good phishing message gets made.

So instead: you get a one-time link, you press Start, and Telegram itself tells the bot who you are. Entering someone else's ID isn't hard in this design — it's impossible, because the ID never passes through anyone's hands. The link works once, expires after ten minutes, and only its hash is stored in our database, never the link itself.

---

What will never arrive on Telegram

Password resets. Email confirmations. Two-factor codes. Those stay on email, permanently, with no setting to change it.

The reason is simple: if a password reset could be delivered to a messenger, then whoever controls your Telegram controls your forum account — and the email confirmation that your account is built on would be bypassed entirely. Convenience isn't worth that trade, so we didn't build the switch.

---

You choose what arrives

Each kind of notification has its own toggle:

• when someone mentions you
• replies in topics you follow
• new topics in categories you watch
• private messages
• new followers, votes on your posts, group invitations
• everything else

On top of that there's one master switch for Telegram delivery, and Disconnect removes everything. You can also send /stop to the bot — same effect, from wherever you happen to be.

---

It speaks your language

The bot picks your language in this order: whatever you select in the Telegram section, otherwise your forum language, otherwise the language your browser asked for when you connected, otherwise the forum default. All 14 forum languages are supported.

That third step matters for people who never set a language in the forum — the browser already knows, so the bot simply uses it instead of defaulting to English.

---

Small things that keep it pleasant

• A cap per hour, so a heated thread doesn't turn into a ringtone marathon.
• Quiet hours can be configured forum-wide.
• Plain text only — no Markdown, no HTML. A topic title can't smuggle in bold "official" warnings or a fake link, because formatting simply isn't interpreted.
• Buttons only point back here. A link that isn't on this forum's own address doesn't get a button at all.
• Block the bot and delivery switches itself off instead of hammering away at a closed door.

---

What we store, and what we don't

Your chat ID, your display name, when you connected and which kinds you chose. That's all.

It disappears when you disconnect, when you send /stop, and when you delete your account. In server logs and in the admin overview the chat ID only ever appears shortened (****1570) — it's personal data, and it gets treated that way.

---

Tested the way we'd want it tested

Like the plugins above, this one ships with its own test suite — 59 tests, including the attacks we'd expect someone to try:

• hijacking a chat that already belongs to another account
• redeeming the same one-time link twice
• using an expired or invented link
• smuggling formatting or foreign links into a message
• forcing delivery to someone who never connected
• slipping past the hourly cap
• getting the bot key to appear in an error message

All of them fail, which is the point.

---

Questions, or something behaving oddly? Reply here. If you'd rather not use Telegram at all, you genuinely don't have to — nothing about the forum requires it.

[Blythex]

Update — /linklist in the Telegram group

The bot learned one more thing: ask it for the official links and it posts them.

Type /linklist in the group, in a topic, or in a private chat with @AntiQua_Blockchain_Bot. Back come the five addresses that are actually ours:

AntiQua — official links
• Forum · Website · Git · BugHive · Discord
If a link is not on this list, it is not ours.

That last line is the whole point. Communities like ours don't usually lose money to clever exploits — they lose it to a lookalike domain posted by a friendly stranger. Having one list that anyone can summon in two seconds makes it cheap to check and awkward to fake.

Anyone can ask. It isn't an admin command. Someone new turns up, wonders where the repository is, types six characters, done.

It won't spam you. The list stays quiet until 50 messages have passed since the last time it appeared — counted per topic, so a question in one channel doesn't silence another. Ask too early and your message just gets a instead of a repeat.

Delete it and you can ask again. If someone clears the list out of the chat, the counter resets and the next request brings it straight back. Telegram doesn't tell bots when a message is deleted, so ours checks for itself — but only when it's about to say no, so it costs nothing the rest of the time.

Small feature. It exists because the alternative is someone pasting a fake forum link at 2 a.m. and nobody having a quick way to prove it's fake.