I joined a toastmasters club about a year and half ago and a little over a month ago I became a member of the executive committee the group that ensures the club can operate on a day to day basis. I am an Associate Sargent At Arms(SAA). During this time I've been looking for ways to improve our clubs spending and some how improving the foot fall of new prospective members. While normally that task is left to the Vice President Public Relations(VP-PR) I've also been keeping my eye out to help anyway I can. When I was board one day looking for a way I could help I found out we had a website(yeah no not going to link, don't fancy doxxing myself). I was initially in a state of "wow this is relic of 2010". In my opinion it looked out of date, a little ugly and the information was also out of date.

I initially wanted to rewrite everything, make a fancy website using astro. Making some cool components, adding a JSON file for a calendar and an agenda for each meeting. A sort of snapshot outside our WhatsApp groups, and Instagram page. When I went to update the pages I discovered the site, had very little you could edit. The parts you could edit were just plain text. Not html, not markdown, not even a custom text format. Just plain old text. I discovered the website was hosted on ToastHost, a hosting provider specifically made for toastmaster clubs. My reaction on finding out about this was. Okay time to ditch this, buy a domain instead of the subdomain we were using and throw everything on netlify. Up until this point I had not heard of ToastHost, I felt kinda weird using this obviously closed source system with very little information on about it online.

Reddit, the voice of reason for once?

Then I looked up ToastHost and came across a reddit thread where the OP(Original Poster) talked about just setting up a website with wordpress and inquiring where do other clubs host their pages. I found the comments all actually eye opening. We often as developers think about what we can do and not what others can do. A comment in the thread highlighted this with

You might have people that want to play with HTML and CSS right now, but as a club leader you should plan to have leaders rotate in the future. Your future website administrator might not be willing to do this. 

I had not actually thought about this, yeah I could simplify things and make a website using a static site generator(SSG) like hugo host everything on Github pages, but thinking about the future. What happens when a group of a people who don't know markdown in any form become the executive committee. What then? Who'll maintain it then? Even if you use wordpress, an industry standard for enabling non-technical people to create and publish content. Wordpress needs a sysadmin keeping a close eye on it. Watching for plugins and themes going out of date, or even CVEs in wordpress. Even a minor misconfiguration in wordpress can lead to people hacking into it.

Wordpress is so popular you people almost every day have scripts that look for these issues. You can easily confirm this by adding the URL /wp-admin/install.php to your website and storing the hits. Lets think about a hypothetical. You decide to move everything to wordpress. The next executive committee has a person who's maintained a wordpress install before and they take over. However the next committee has no one who can maintain it. Everyday the site sits unmaintained bad things can happen. Lets say everything some how survives, and a new member who knows their way around computer joins, and decides to take up maintenance. However the server credentials over time were lost, they no longer can access the backend.

Over this past month I've learnt credentials are the hardest to deal with. During the setup of a meeting where the person who was SAA, could not attend and I had to takeover. During the takeover I discovered the following things, the credentials i had been shared were only for Zoom. To login in to zoom I need to approve the login via an email sent to our clubs gmail account. Eventually another member who knew the password was able to login to the email but it highlighted how fragile our authentication chain is. One missing credential had effectively locked us out of all our accounts. Just ensuring credentials are shared properly is a monumental task.

A solution?

I thought about a solution for a day, thinking about maybe maintaining everything myself; or storing credentials in the clubs google accounts built in password store. But I just couldn't come up with a sane solution until I looked back at ToastHost. ToastHost solved this problem by

1. Reducing overall control to let them maintain the backend and keep everything up to date and working.
2. Keeping things dead simple; most pages on ToastHost are generated without your direct input, but rather things like the member lists where people can be invited via email.
3. Login is tied to a email, so you can login via password, but you can login with a link sent to your email instead of a password and update the lost password.
4. Free is the best

On the last point you can get your own domain and point it at the ToastHost URL but domains cost money. Many clubs have tight budgets. Money spent on a domain will mean less money for events for club members, or even just snacks(yes a lot of clubs have snacks with every meeting so a minor incentive to visit). When you think about clubs as small non-profit groups that have to worry about paying of a venue and things for the members. ToastHost sits in this small niche solving issues in a tiny segment of the internet really really well. In summary ToastHost can be ugly, outdated and clunky, but it solves a problem a few people have to think about perfectly. The next time you build something, ask yourself what happens after you?

-- This is nullrequest signing off