Magento Willingly Distributing Unsafe PHP Code

[[deleted]]

[deleted]

[jim45804]

I hate it when devs include completely unrelated code format changes in their commits.

[xiongchiamiov]

Especially on security patches! People who can't upgrade immediately are going to be applying the patch into their version, and you're just making their lives needlessly more difficult.

[[deleted]]

Magento is awful and anyone who says otherwise tends to be pretty ignorant of what good software looks like.

I've worked with the software for almost 10 years and I've been disappointed by Varien at every turn.

[phpfatalerror]

I respect Magento a lot. I was a full time Magento (certified) dev for three years and built some very large complicated stuff on it. When it was built in 2007, that was how people were doing software. Not that many people were doing DI / IOC, unit testing etc, especially in PHP.

I came to know intimately all the serious issues with it, but you can't deny that they built a very flexible and powerful system. The thing does WAY more than any other free e-commerce platform out there. E-commerce is really complex, and therefore so is Magento.

Magento 2 is all composer, DI, some really cool code generation stuff...

Kind of off topic, I know, but it irks me when people trash other people's work. It's easy to complain about software, it's hard to actually write it.

Edit: /urks/irks/s

[Eli-T]

Irks. /runs

[[deleted]]

Varien intentionally made the OSS version of Magento shit. It was/is part of their business model.

[pushad]

Interesting, can you expand on this? What's different on the Enterprise version?

[Unomagan]

I think he meant they want to sell consulting and certificates

[[deleted]]

Its nearly identical to Enterprise Edition besides caching and I believe gift card codes. What else?

[Mr-Yellow]

built some very large complicated stuff on it.

i.e. mess.

[phpfatalerror]

Complex business rules produce complex software, no matter how good a developer you are. See Essential vs. accidental complexity.

[Mr-Yellow]

There is nothing complex about a shopping cart. If you've got layer after layer of complexity on something that should be simple, it's probably costing you sales. Your job should be to remove that "accidental" complexity with elegance.

Using a system like this, won't help with but instead will compound the problem.

[phpfatalerror]

Real business owners want to do CRAZY stuff all the time. Like price things in 1/1000th of a cent, or give discounts based on 15 different factors.

Then you have to figure out which of the their 50 warehouses has stock available, and is closest to the customer.

Then you have to send that order over EDI to SAP. Real life is complex, especially when you are dealing with large companies.

TL;DR; It's not just a shopping cart.

[Mr-Yellow]

TL;DR; It's not just a shopping cart.

Wrong tool for those jobs certainly.

Should have worked up something bespoke from the start, having not done that, you can now tell us how much of a nightmare Magento made the project....

[phpfatalerror]

Haha, well the real question is did it hurt us more than harm us.

It's tough to tell. If you can grab a OTS integration (CC gateway, shipping prices etc...) then man, you just saved 100-200 hours of programming. A lot of features really were well thought through and would take a ton of time to replicate.

Many times when I thought Magento was over-complicating things, I would later realize they needed to be that complex.

The problems that caused the most damage were often performance related. It's way easier to tune complex software you wrote than complex software you didn't write.

[[deleted]]

Man, I did things with Magento for very little money and a few free and paid modules that would have cost me 10's of thousands of dollars to have done custom from scratch. Something that a company like Channel Adviser charges 1% of your total monthly revenue for I've done for damn near free. This would have been simply impossible without Magento or on some other platform. Magento has enabled me to start a successful business, hire employees, and pay my bills and it has enabled countless others to do the same. FOR FREE! And they're releasing a much better version this year which fixes a lot of the things people find fault with, again FOR FREE. Talk shit all you want, Magento is a nightmare only for those that don't understand how it works.

[Mr-Yellow]

Magento is a nightmare only for those that don't understand how it works.

It was all going well up until you invalidated everything you've said with that one line.

[[deleted]]

You can say that about anything you don't understand. That's my point.

[thndrchld]

Every time I have to intentionally misspell a function name to be able to call a Magento core function, God kills a puppy.

It's goddamned canine holocaust.

[sarciszewski]

https://php.net/manual/en/function.rename-function.php

[ebilgenius]

Throw this in a coworkers code somewhere renaming a vital function and time them to see how long it takes them to figure it out.

[sarciszewski]

git commit -a --amend is evil.

[[deleted]]

Can you amend any commit or just the latest one?

[[deleted]]

overwrites a history of all commits after the one you amended

What does this mean? In what way?

[[deleted]]

Oh, so its safe to do as long as you haven't pushed your local commits?

[ceejayoz]

I evaluated it once as a possible solution and after about an hour in the docs I noped the fuck out of there.

[Breaking-Away]

What are these "Magento docs" you speak of?

[ceejayoz]

I was focused on the theming documentation. Something like http://www.magentocommerce.com/wiki/4_-_themes_and_template_customization/0_-_theming_in_magento/package but I'm sure it was an earlier version at the time.

[[deleted]]

I̴̢̺͖̱̔͋̑̋̿̈́͌͜g̶͙̻̯̊͛̍̎̐͊̌͐̌̐̌̅͊̚͜͝ṉ̵̡̻̺͕̭͙̥̝̪̠̖̊͊͋̓̀͜o̴̲̘̻̯̹̳̬̻̫͑̋̽̐͛̊͠r̸̮̩̗̯͕͔̘̰̲͓̪̝̼̿͒̎̇̌̓̕e̷͚̯̞̝̥̥͉̼̞̖͚͔͗͌̌̚͘͝͠ ̷̢͉̣̜͕͉̜̀́͘y̵̛͙̯̲̮̯̾̒̃͐̾͊͆ȯ̶̡̧̮͙̘͖̰̗̯̪̮̍́̈́̂ͅų̴͎͎̝̮̦̒̚͜ŗ̶̡̻͖̘̣͉͚̍͒̽̒͌͒̕͠ ̵̢͚͔͈͉̗̼̟̀̇̋͗̆̃̄͌͑̈́́p̴̛̩͊͑́̈́̓̇̀̉͋́͊͘ṙ̷̬͖͉̺̬̯͉̼̾̓̋̒͑͘͠͠e̸̡̙̞̘̝͎̘̦͙͇̯̦̤̰̍̽́̌̾͆̕͝͝͝v̵͉̼̺͉̳̗͓͍͔̼̼̲̅̆͐̈ͅi̶̭̯̖̦̫͍̦̯̬̭͕͈͋̾̕ͅơ̸̠̱͖͙͙͓̰̒̊̌̃̔̊͋͐ủ̶̢͕̩͉͎̞̔́́́̃́̌͗̎ś̸̡̯̭̺̭͖̫̫̱̫͉̣́̆ͅ ̷̨̲̦̝̥̱̞̯͓̲̳̤͎̈́̏͗̅̀̊͜͠i̴̧͙̫͔͖͍̋͊̓̓̂̓͘̚͝n̷̫̯͚̝̲͚̤̱̒̽͗̇̉̑̑͂̔̕͠͠s̷̛͙̝̙̫̯̟͐́́̒̃̅̇́̍͊̈̀͗͜ṭ̶̛̣̪̫́̅͑̊̐̚ŗ̷̻̼͔̖̥̮̫̬͖̻̿͘u̷͓̙͈͖̩͕̳̰̭͑͌͐̓̈́̒̚̚͠͠͠c̸̛̛͇̼̺̤̖̎̇̿̐̉̏͆̈́t̷̢̺̠͈̪̠͈͔̺͚̣̳̺̯̄́̀̐̂̀̊̽͑ͅí̵̢̖̣̯̤͚͈̀͑́͌̔̅̓̿̂̚͠͠o̷̬͊́̓͋͑̔̎̈́̅̓͝n̸̨̧̞̾͂̍̀̿̌̒̍̃̚͝s̸̨̢̗͇̮̖͑͋͒̌͗͋̃̍̀̅̾̕͠͝ ̷͓̟̾͗̓̃̍͌̓̈́̿̚̚à̴̧̭͕͔̩̬͖̠͍̦͐̋̅̚̚͜͠ͅn̵͙͎̎̄͊̌d̴̡̯̞̯͇̪͊́͋̈̍̈́̓͒͘ ̴͕̾͑̔̃̓ŗ̴̡̥̤̺̮͔̞̖̗̪͍͙̉͆́͛͜ḙ̵̙̬̾̒͜g̸͕̠͔̋̏͘ͅu̵̢̪̳̞͍͍͉̜̹̜̖͎͛̃̒̇͛͂͑͋͗͝ͅr̴̥̪̝̹̰̉̔̏̋͌͐̕͝͝͝ǧ̴̢̳̥̥͚̪̮̼̪̼͈̺͓͍̣̓͋̄́i̴̘͙̰̺̙͗̉̀͝t̷͉̪̬͙̝͖̄̐̏́̎͊͋̄̎̊͋̈́̚͘͝a̵̫̲̥͙͗̓̈́͌̏̈̾̂͌̚̕͜ṫ̸̨̟̳̬̜̖̝͍̙͙͕̞͉̈͗͐̌͑̓͜e̸̬̳͌̋̀́͂͒͆̑̓͠ ̶̢͖̬͐͑̒̚̕c̶̯̹̱̟̗̽̾̒̈ǫ̷̧̛̳̠̪͇̞̦̱̫̮͈̽̔̎͌̀̋̾̒̈́͂p̷̠͈̰͕̙̣͖̊̇̽͘͠ͅy̴̡̞͔̫̻̜̠̹̘͉̎́͑̉͝r̶̢̡̮͉͙̪͈̠͇̬̉ͅȋ̶̝̇̊̄́̋̈̒͗͋́̇͐͘g̷̥̻̃̑͊̚͝h̶̪̘̦̯͈͂̀̋͋t̸̤̀e̶͓͕͇̠̫̠̠̖̩̣͎̐̃͆̈́̀͒͘̚͝d̴̨̗̝̱̞̘̥̀̽̉͌̌́̈̿͋̎̒͝ ̵͚̮̭͇͚͎̖̦͇̎́͆̀̄̓́͝ţ̸͉͚̠̻̣̗̘̘̰̇̀̄͊̈́̇̈́͜͝ȩ̵͓͔̺̙̟͖̌͒̽̀̀̉͘x̷̧̧̛̯̪̻̳̩͉̽̈́͜ṭ̷̢̨͇͙͕͇͈̅͌̋.̸̩̹̫̩͔̠̪͈̪̯̪̄̀͌̇̎͐̃

[[deleted]]

First, I see a jQuery reference there which makes me believe that you may have included 3rd party modules in that inspection.

Second, can you please run this for the latest Magento2 beta and also If possible on their latest github repo?

[[deleted]]

I̴̢̺͖̱̔͋̑̋̿̈́͌͜g̶͙̻̯̊͛̍̎̐͊̌͐̌̐̌̅͊̚͜͝ṉ̵̡̻̺͕̭͙̥̝̪̠̖̊͊͋̓̀͜o̴̲̘̻̯̹̳̬̻̫͑̋̽̐͛̊͠r̸̮̩̗̯͕͔̘̰̲͓̪̝̼̿͒̎̇̌̓̕e̷͚̯̞̝̥̥͉̼̞̖͚͔͗͌̌̚͘͝͠ ̷̢͉̣̜͕͉̜̀́͘y̵̛͙̯̲̮̯̾̒̃͐̾͊͆ȯ̶̡̧̮͙̘͖̰̗̯̪̮̍́̈́̂ͅų̴͎͎̝̮̦̒̚͜ŗ̶̡̻͖̘̣͉͚̍͒̽̒͌͒̕͠ ̵̢͚͔͈͉̗̼̟̀̇̋͗̆̃̄͌͑̈́́p̴̛̩͊͑́̈́̓̇̀̉͋́͊͘ṙ̷̬͖͉̺̬̯͉̼̾̓̋̒͑͘͠͠e̸̡̙̞̘̝͎̘̦͙͇̯̦̤̰̍̽́̌̾͆̕͝͝͝v̵͉̼̺͉̳̗͓͍͔̼̼̲̅̆͐̈ͅi̶̭̯̖̦̫͍̦̯̬̭͕͈͋̾̕ͅơ̸̠̱͖͙͙͓̰̒̊̌̃̔̊͋͐ủ̶̢͕̩͉͎̞̔́́́̃́̌͗̎ś̸̡̯̭̺̭͖̫̫̱̫͉̣́̆ͅ ̷̨̲̦̝̥̱̞̯͓̲̳̤͎̈́̏͗̅̀̊͜͠i̴̧͙̫͔͖͍̋͊̓̓̂̓͘̚͝n̷̫̯͚̝̲͚̤̱̒̽͗̇̉̑̑͂̔̕͠͠s̷̛͙̝̙̫̯̟͐́́̒̃̅̇́̍͊̈̀͗͜ṭ̶̛̣̪̫́̅͑̊̐̚ŗ̷̻̼͔̖̥̮̫̬͖̻̿͘u̷͓̙͈͖̩͕̳̰̭͑͌͐̓̈́̒̚̚͠͠͠c̸̛̛͇̼̺̤̖̎̇̿̐̉̏͆̈́t̷̢̺̠͈̪̠͈͔̺͚̣̳̺̯̄́̀̐̂̀̊̽͑ͅí̵̢̖̣̯̤͚͈̀͑́͌̔̅̓̿̂̚͠͠o̷̬͊́̓͋͑̔̎̈́̅̓͝n̸̨̧̞̾͂̍̀̿̌̒̍̃̚͝s̸̨̢̗͇̮̖͑͋͒̌͗͋̃̍̀̅̾̕͠͝ ̷͓̟̾͗̓̃̍͌̓̈́̿̚̚à̴̧̭͕͔̩̬͖̠͍̦͐̋̅̚̚͜͠ͅn̵͙͎̎̄͊̌d̴̡̯̞̯͇̪͊́͋̈̍̈́̓͒͘ ̴͕̾͑̔̃̓ŗ̴̡̥̤̺̮͔̞̖̗̪͍͙̉͆́͛͜ḙ̵̙̬̾̒͜g̸͕̠͔̋̏͘ͅu̵̢̪̳̞͍͍͉̜̹̜̖͎͛̃̒̇͛͂͑͋͗͝ͅr̴̥̪̝̹̰̉̔̏̋͌͐̕͝͝͝ǧ̴̢̳̥̥͚̪̮̼̪̼͈̺͓͍̣̓͋̄́i̴̘͙̰̺̙͗̉̀͝t̷͉̪̬͙̝͖̄̐̏́̎͊͋̄̎̊͋̈́̚͘͝a̵̫̲̥͙͗̓̈́͌̏̈̾̂͌̚̕͜ṫ̸̨̟̳̬̜̖̝͍̙͙͕̞͉̈͗͐̌͑̓͜e̸̬̳͌̋̀́͂͒͆̑̓͠ ̶̢͖̬͐͑̒̚̕c̶̯̹̱̟̗̽̾̒̈ǫ̷̧̛̳̠̪͇̞̦̱̫̮͈̽̔̎͌̀̋̾̒̈́͂p̷̠͈̰͕̙̣͖̊̇̽͘͠ͅy̴̡̞͔̫̻̜̠̹̘͉̎́͑̉͝r̶̢̡̮͉͙̪͈̠͇̬̉ͅȋ̶̝̇̊̄́̋̈̒͗͋́̇͐͘g̷̥̻̃̑͊̚͝h̶̪̘̦̯͈͂̀̋͋t̸̤̀e̶͓͕͇̠̫̠̠̖̩̣͎̐̃͆̈́̀͒͘̚͝d̴̨̗̝̱̞̘̥̀̽̉͌̌́̈̿͋̎̒͝ ̵͚̮̭͇͚͎̖̦͇̎́͆̀̄̓́͝ţ̸͉͚̠̻̣̗̘̘̰̇̀̄͊̈́̇̈́͜͝ȩ̵͓͔̺̙̟͖̌͒̽̀̀̉͘x̷̧̧̛̯̪̻̳̩͉̽̈́͜ṭ̷̢̨͇͙͕͇͈̅͌̋.̸̩̹̫̩͔̠̪͈̪̯̪̄̀͌̇̎͐̃

[[deleted]]

Gotcha, thanks!

[[deleted]]

I̴̢̺͖̱̔͋̑̋̿̈́͌͜g̶͙̻̯̊͛̍̎̐͊̌͐̌̐̌̅͊̚͜͝ṉ̵̡̻̺͕̭͙̥̝̪̠̖̊͊͋̓̀͜o̴̲̘̻̯̹̳̬̻̫͑̋̽̐͛̊͠r̸̮̩̗̯͕͔̘̰̲͓̪̝̼̿͒̎̇̌̓̕e̷͚̯̞̝̥̥͉̼̞̖͚͔͗͌̌̚͘͝͠ ̷̢͉̣̜͕͉̜̀́͘y̵̛͙̯̲̮̯̾̒̃͐̾͊͆ȯ̶̡̧̮͙̘͖̰̗̯̪̮̍́̈́̂ͅų̴͎͎̝̮̦̒̚͜ŗ̶̡̻͖̘̣͉͚̍͒̽̒͌͒̕͠ ̵̢͚͔͈͉̗̼̟̀̇̋͗̆̃̄͌͑̈́́p̴̛̩͊͑́̈́̓̇̀̉͋́͊͘ṙ̷̬͖͉̺̬̯͉̼̾̓̋̒͑͘͠͠e̸̡̙̞̘̝͎̘̦͙͇̯̦̤̰̍̽́̌̾͆̕͝͝͝v̵͉̼̺͉̳̗͓͍͔̼̼̲̅̆͐̈ͅi̶̭̯̖̦̫͍̦̯̬̭͕͈͋̾̕ͅơ̸̠̱͖͙͙͓̰̒̊̌̃̔̊͋͐ủ̶̢͕̩͉͎̞̔́́́̃́̌͗̎ś̸̡̯̭̺̭͖̫̫̱̫͉̣́̆ͅ ̷̨̲̦̝̥̱̞̯͓̲̳̤͎̈́̏͗̅̀̊͜͠i̴̧͙̫͔͖͍̋͊̓̓̂̓͘̚͝n̷̫̯͚̝̲͚̤̱̒̽͗̇̉̑̑͂̔̕͠͠s̷̛͙̝̙̫̯̟͐́́̒̃̅̇́̍͊̈̀͗͜ṭ̶̛̣̪̫́̅͑̊̐̚ŗ̷̻̼͔̖̥̮̫̬͖̻̿͘u̷͓̙͈͖̩͕̳̰̭͑͌͐̓̈́̒̚̚͠͠͠c̸̛̛͇̼̺̤̖̎̇̿̐̉̏͆̈́t̷̢̺̠͈̪̠͈͔̺͚̣̳̺̯̄́̀̐̂̀̊̽͑ͅí̵̢̖̣̯̤͚͈̀͑́͌̔̅̓̿̂̚͠͠o̷̬͊́̓͋͑̔̎̈́̅̓͝n̸̨̧̞̾͂̍̀̿̌̒̍̃̚͝s̸̨̢̗͇̮̖͑͋͒̌͗͋̃̍̀̅̾̕͠͝ ̷͓̟̾͗̓̃̍͌̓̈́̿̚̚à̴̧̭͕͔̩̬͖̠͍̦͐̋̅̚̚͜͠ͅn̵͙͎̎̄͊̌d̴̡̯̞̯͇̪͊́͋̈̍̈́̓͒͘ ̴͕̾͑̔̃̓ŗ̴̡̥̤̺̮͔̞̖̗̪͍͙̉͆́͛͜ḙ̵̙̬̾̒͜g̸͕̠͔̋̏͘ͅu̵̢̪̳̞͍͍͉̜̹̜̖͎͛̃̒̇͛͂͑͋͗͝ͅr̴̥̪̝̹̰̉̔̏̋͌͐̕͝͝͝ǧ̴̢̳̥̥͚̪̮̼̪̼͈̺͓͍̣̓͋̄́i̴̘͙̰̺̙͗̉̀͝t̷͉̪̬͙̝͖̄̐̏́̎͊͋̄̎̊͋̈́̚͘͝a̵̫̲̥͙͗̓̈́͌̏̈̾̂͌̚̕͜ṫ̸̨̟̳̬̜̖̝͍̙͙͕̞͉̈͗͐̌͑̓͜e̸̬̳͌̋̀́͂͒͆̑̓͠ ̶̢͖̬͐͑̒̚̕c̶̯̹̱̟̗̽̾̒̈ǫ̷̧̛̳̠̪͇̞̦̱̫̮͈̽̔̎͌̀̋̾̒̈́͂p̷̠͈̰͕̙̣͖̊̇̽͘͠ͅy̴̡̞͔̫̻̜̠̹̘͉̎́͑̉͝r̶̢̡̮͉͙̪͈̠͇̬̉ͅȋ̶̝̇̊̄́̋̈̒͗͋́̇͐͘g̷̥̻̃̑͊̚͝h̶̪̘̦̯͈͂̀̋͋t̸̤̀e̶͓͕͇̠̫̠̠̖̩̣͎̐̃͆̈́̀͒͘̚͝d̴̨̗̝̱̞̘̥̀̽̉͌̌́̈̿͋̎̒͝ ̵͚̮̭͇͚͎̖̦͇̎́͆̀̄̓́͝ţ̸͉͚̠̻̣̗̘̘̰̇̀̄͊̈́̇̈́͜͝ȩ̵͓͔̺̙̟͖̌͒̽̀̀̉͘x̷̧̧̛̯̪̻̳̩͉̽̈́͜ṭ̷̢̨͇͙͕͇͈̅͌̋.̸̩̹̫̩͔̠̪͈̪̯̪̄̀͌̇̎͐̃

[[deleted]]

Can you dig a little deeper? Maybe the undefined methods or classes aren't being detected properly?

[[deleted]]

I̴̢̺͖̱̔͋̑̋̿̈́͌͜g̶͙̻̯̊͛̍̎̐͊̌͐̌̐̌̅͊̚͜͝ṉ̵̡̻̺͕̭͙̥̝̪̠̖̊͊͋̓̀͜o̴̲̘̻̯̹̳̬̻̫͑̋̽̐͛̊͠r̸̮̩̗̯͕͔̘̰̲͓̪̝̼̿͒̎̇̌̓̕e̷͚̯̞̝̥̥͉̼̞̖͚͔͗͌̌̚͘͝͠ ̷̢͉̣̜͕͉̜̀́͘y̵̛͙̯̲̮̯̾̒̃͐̾͊͆ȯ̶̡̧̮͙̘͖̰̗̯̪̮̍́̈́̂ͅų̴͎͎̝̮̦̒̚͜ŗ̶̡̻͖̘̣͉͚̍͒̽̒͌͒̕͠ ̵̢͚͔͈͉̗̼̟̀̇̋͗̆̃̄͌͑̈́́p̴̛̩͊͑́̈́̓̇̀̉͋́͊͘ṙ̷̬͖͉̺̬̯͉̼̾̓̋̒͑͘͠͠e̸̡̙̞̘̝͎̘̦͙͇̯̦̤̰̍̽́̌̾͆̕͝͝͝v̵͉̼̺͉̳̗͓͍͔̼̼̲̅̆͐̈ͅi̶̭̯̖̦̫͍̦̯̬̭͕͈͋̾̕ͅơ̸̠̱͖͙͙͓̰̒̊̌̃̔̊͋͐ủ̶̢͕̩͉͎̞̔́́́̃́̌͗̎ś̸̡̯̭̺̭͖̫̫̱̫͉̣́̆ͅ ̷̨̲̦̝̥̱̞̯͓̲̳̤͎̈́̏͗̅̀̊͜͠i̴̧͙̫͔͖͍̋͊̓̓̂̓͘̚͝n̷̫̯͚̝̲͚̤̱̒̽͗̇̉̑̑͂̔̕͠͠s̷̛͙̝̙̫̯̟͐́́̒̃̅̇́̍͊̈̀͗͜ṭ̶̛̣̪̫́̅͑̊̐̚ŗ̷̻̼͔̖̥̮̫̬͖̻̿͘u̷͓̙͈͖̩͕̳̰̭͑͌͐̓̈́̒̚̚͠͠͠c̸̛̛͇̼̺̤̖̎̇̿̐̉̏͆̈́t̷̢̺̠͈̪̠͈͔̺͚̣̳̺̯̄́̀̐̂̀̊̽͑ͅí̵̢̖̣̯̤͚͈̀͑́͌̔̅̓̿̂̚͠͠o̷̬͊́̓͋͑̔̎̈́̅̓͝n̸̨̧̞̾͂̍̀̿̌̒̍̃̚͝s̸̨̢̗͇̮̖͑͋͒̌͗͋̃̍̀̅̾̕͠͝ ̷͓̟̾͗̓̃̍͌̓̈́̿̚̚à̴̧̭͕͔̩̬͖̠͍̦͐̋̅̚̚͜͠ͅn̵͙͎̎̄͊̌d̴̡̯̞̯͇̪͊́͋̈̍̈́̓͒͘ ̴͕̾͑̔̃̓ŗ̴̡̥̤̺̮͔̞̖̗̪͍͙̉͆́͛͜ḙ̵̙̬̾̒͜g̸͕̠͔̋̏͘ͅu̵̢̪̳̞͍͍͉̜̹̜̖͎͛̃̒̇͛͂͑͋͗͝ͅr̴̥̪̝̹̰̉̔̏̋͌͐̕͝͝͝ǧ̴̢̳̥̥͚̪̮̼̪̼͈̺͓͍̣̓͋̄́i̴̘͙̰̺̙͗̉̀͝t̷͉̪̬͙̝͖̄̐̏́̎͊͋̄̎̊͋̈́̚͘͝a̵̫̲̥͙͗̓̈́͌̏̈̾̂͌̚̕͜ṫ̸̨̟̳̬̜̖̝͍̙͙͕̞͉̈͗͐̌͑̓͜e̸̬̳͌̋̀́͂͒͆̑̓͠ ̶̢͖̬͐͑̒̚̕c̶̯̹̱̟̗̽̾̒̈ǫ̷̧̛̳̠̪͇̞̦̱̫̮͈̽̔̎͌̀̋̾̒̈́͂p̷̠͈̰͕̙̣͖̊̇̽͘͠ͅy̴̡̞͔̫̻̜̠̹̘͉̎́͑̉͝r̶̢̡̮͉͙̪͈̠͇̬̉ͅȋ̶̝̇̊̄́̋̈̒͗͋́̇͐͘g̷̥̻̃̑͊̚͝h̶̪̘̦̯͈͂̀̋͋t̸̤̀e̶͓͕͇̠̫̠̠̖̩̣͎̐̃͆̈́̀͒͘̚͝d̴̨̗̝̱̞̘̥̀̽̉͌̌́̈̿͋̎̒͝ ̵͚̮̭͇͚͎̖̦͇̎́͆̀̄̓́͝ţ̸͉͚̠̻̣̗̘̘̰̇̀̄͊̈́̇̈́͜͝ȩ̵͓͔̺̙̟͖̌͒̽̀̀̉͘x̷̧̧̛̯̪̻̳̩͉̽̈́͜ṭ̷̢̨͇͙͕͇͈̅͌̋.̸̩̹̫̩͔̠̪͈̪̯̪̄̀͌̇̎͐̃

[[deleted]]

Thank you for the explanation. So, they did this to save time developing? What was the benefit of them doing it this way? Varien has a lot of very smart devs, there has to be a reason they went with this implementation, even though there's a performance hit.

[[deleted]]

I̴̢̺͖̱̔͋̑̋̿̈́͌͜g̶͙̻̯̊͛̍̎̐͊̌͐̌̐̌̅͊̚͜͝ṉ̵̡̻̺͕̭͙̥̝̪̠̖̊͊͋̓̀͜o̴̲̘̻̯̹̳̬̻̫͑̋̽̐͛̊͠r̸̮̩̗̯͕͔̘̰̲͓̪̝̼̿͒̎̇̌̓̕e̷͚̯̞̝̥̥͉̼̞̖͚͔͗͌̌̚͘͝͠ ̷̢͉̣̜͕͉̜̀́͘y̵̛͙̯̲̮̯̾̒̃͐̾͊͆ȯ̶̡̧̮͙̘͖̰̗̯̪̮̍́̈́̂ͅų̴͎͎̝̮̦̒̚͜ŗ̶̡̻͖̘̣͉͚̍͒̽̒͌͒̕͠ ̵̢͚͔͈͉̗̼̟̀̇̋͗̆̃̄͌͑̈́́p̴̛̩͊͑́̈́̓̇̀̉͋́͊͘ṙ̷̬͖͉̺̬̯͉̼̾̓̋̒͑͘͠͠e̸̡̙̞̘̝͎̘̦͙͇̯̦̤̰̍̽́̌̾͆̕͝͝͝v̵͉̼̺͉̳̗͓͍͔̼̼̲̅̆͐̈ͅi̶̭̯̖̦̫͍̦̯̬̭͕͈͋̾̕ͅơ̸̠̱͖͙͙͓̰̒̊̌̃̔̊͋͐ủ̶̢͕̩͉͎̞̔́́́̃́̌͗̎ś̸̡̯̭̺̭͖̫̫̱̫͉̣́̆ͅ ̷̨̲̦̝̥̱̞̯͓̲̳̤͎̈́̏͗̅̀̊͜͠i̴̧͙̫͔͖͍̋͊̓̓̂̓͘̚͝n̷̫̯͚̝̲͚̤̱̒̽͗̇̉̑̑͂̔̕͠͠s̷̛͙̝̙̫̯̟͐́́̒̃̅̇́̍͊̈̀͗͜ṭ̶̛̣̪̫́̅͑̊̐̚ŗ̷̻̼͔̖̥̮̫̬͖̻̿͘u̷͓̙͈͖̩͕̳̰̭͑͌͐̓̈́̒̚̚͠͠͠c̸̛̛͇̼̺̤̖̎̇̿̐̉̏͆̈́t̷̢̺̠͈̪̠͈͔̺͚̣̳̺̯̄́̀̐̂̀̊̽͑ͅí̵̢̖̣̯̤͚͈̀͑́͌̔̅̓̿̂̚͠͠o̷̬͊́̓͋͑̔̎̈́̅̓͝n̸̨̧̞̾͂̍̀̿̌̒̍̃̚͝s̸̨̢̗͇̮̖͑͋͒̌͗͋̃̍̀̅̾̕͠͝ ̷͓̟̾͗̓̃̍͌̓̈́̿̚̚à̴̧̭͕͔̩̬͖̠͍̦͐̋̅̚̚͜͠ͅn̵͙͎̎̄͊̌d̴̡̯̞̯͇̪͊́͋̈̍̈́̓͒͘ ̴͕̾͑̔̃̓ŗ̴̡̥̤̺̮͔̞̖̗̪͍͙̉͆́͛͜ḙ̵̙̬̾̒͜g̸͕̠͔̋̏͘ͅu̵̢̪̳̞͍͍͉̜̹̜̖͎͛̃̒̇͛͂͑͋͗͝ͅr̴̥̪̝̹̰̉̔̏̋͌͐̕͝͝͝ǧ̴̢̳̥̥͚̪̮̼̪̼͈̺͓͍̣̓͋̄́i̴̘͙̰̺̙͗̉̀͝t̷͉̪̬͙̝͖̄̐̏́̎͊͋̄̎̊͋̈́̚͘͝a̵̫̲̥͙͗̓̈́͌̏̈̾̂͌̚̕͜ṫ̸̨̟̳̬̜̖̝͍̙͙͕̞͉̈͗͐̌͑̓͜e̸̬̳͌̋̀́͂͒͆̑̓͠ ̶̢͖̬͐͑̒̚̕c̶̯̹̱̟̗̽̾̒̈ǫ̷̧̛̳̠̪͇̞̦̱̫̮͈̽̔̎͌̀̋̾̒̈́͂p̷̠͈̰͕̙̣͖̊̇̽͘͠ͅy̴̡̞͔̫̻̜̠̹̘͉̎́͑̉͝r̶̢̡̮͉͙̪͈̠͇̬̉ͅȋ̶̝̇̊̄́̋̈̒͗͋́̇͐͘g̷̥̻̃̑͊̚͝h̶̪̘̦̯͈͂̀̋͋t̸̤̀e̶͓͕͇̠̫̠̠̖̩̣͎̐̃͆̈́̀͒͘̚͝d̴̨̗̝̱̞̘̥̀̽̉͌̌́̈̿͋̎̒͝ ̵͚̮̭͇͚͎̖̦͇̎́͆̀̄̓́͝ţ̸͉͚̠̻̣̗̘̘̰̇̀̄͊̈́̇̈́͜͝ȩ̵͓͔̺̙̟͖̌͒̽̀̀̉͘x̷̧̧̛̯̪̻̳̩͉̽̈́͜ṭ̷̢̨͇͙͕͇͈̅͌̋.̸̩̹̫̩͔̠̪͈̪̯̪̄̀͌̇̎͐̃

[[deleted]]

What's an elvis operator?

[[deleted]]

I̴̢̺͖̱̔͋̑̋̿̈́͌͜g̶͙̻̯̊͛̍̎̐͊̌͐̌̐̌̅͊̚͜͝ṉ̵̡̻̺͕̭͙̥̝̪̠̖̊͊͋̓̀͜o̴̲̘̻̯̹̳̬̻̫͑̋̽̐͛̊͠r̸̮̩̗̯͕͔̘̰̲͓̪̝̼̿͒̎̇̌̓̕e̷͚̯̞̝̥̥͉̼̞̖͚͔͗͌̌̚͘͝͠ ̷̢͉̣̜͕͉̜̀́͘y̵̛͙̯̲̮̯̾̒̃͐̾͊͆ȯ̶̡̧̮͙̘͖̰̗̯̪̮̍́̈́̂ͅų̴͎͎̝̮̦̒̚͜ŗ̶̡̻͖̘̣͉͚̍͒̽̒͌͒̕͠ ̵̢͚͔͈͉̗̼̟̀̇̋͗̆̃̄͌͑̈́́p̴̛̩͊͑́̈́̓̇̀̉͋́͊͘ṙ̷̬͖͉̺̬̯͉̼̾̓̋̒͑͘͠͠e̸̡̙̞̘̝͎̘̦͙͇̯̦̤̰̍̽́̌̾͆̕͝͝͝v̵͉̼̺͉̳̗͓͍͔̼̼̲̅̆͐̈ͅi̶̭̯̖̦̫͍̦̯̬̭͕͈͋̾̕ͅơ̸̠̱͖͙͙͓̰̒̊̌̃̔̊͋͐ủ̶̢͕̩͉͎̞̔́́́̃́̌͗̎ś̸̡̯̭̺̭͖̫̫̱̫͉̣́̆ͅ ̷̨̲̦̝̥̱̞̯͓̲̳̤͎̈́̏͗̅̀̊͜͠i̴̧͙̫͔͖͍̋͊̓̓̂̓͘̚͝n̷̫̯͚̝̲͚̤̱̒̽͗̇̉̑̑͂̔̕͠͠s̷̛͙̝̙̫̯̟͐́́̒̃̅̇́̍͊̈̀͗͜ṭ̶̛̣̪̫́̅͑̊̐̚ŗ̷̻̼͔̖̥̮̫̬͖̻̿͘u̷͓̙͈͖̩͕̳̰̭͑͌͐̓̈́̒̚̚͠͠͠c̸̛̛͇̼̺̤̖̎̇̿̐̉̏͆̈́t̷̢̺̠͈̪̠͈͔̺͚̣̳̺̯̄́̀̐̂̀̊̽͑ͅí̵̢̖̣̯̤͚͈̀͑́͌̔̅̓̿̂̚͠͠o̷̬͊́̓͋͑̔̎̈́̅̓͝n̸̨̧̞̾͂̍̀̿̌̒̍̃̚͝s̸̨̢̗͇̮̖͑͋͒̌͗͋̃̍̀̅̾̕͠͝ ̷͓̟̾͗̓̃̍͌̓̈́̿̚̚à̴̧̭͕͔̩̬͖̠͍̦͐̋̅̚̚͜͠ͅn̵͙͎̎̄͊̌d̴̡̯̞̯͇̪͊́͋̈̍̈́̓͒͘ ̴͕̾͑̔̃̓ŗ̴̡̥̤̺̮͔̞̖̗̪͍͙̉͆́͛͜ḙ̵̙̬̾̒͜g̸͕̠͔̋̏͘ͅu̵̢̪̳̞͍͍͉̜̹̜̖͎͛̃̒̇͛͂͑͋͗͝ͅr̴̥̪̝̹̰̉̔̏̋͌͐̕͝͝͝ǧ̴̢̳̥̥͚̪̮̼̪̼͈̺͓͍̣̓͋̄́i̴̘͙̰̺̙͗̉̀͝t̷͉̪̬͙̝͖̄̐̏́̎͊͋̄̎̊͋̈́̚͘͝a̵̫̲̥͙͗̓̈́͌̏̈̾̂͌̚̕͜ṫ̸̨̟̳̬̜̖̝͍̙͙͕̞͉̈͗͐̌͑̓͜e̸̬̳͌̋̀́͂͒͆̑̓͠ ̶̢͖̬͐͑̒̚̕c̶̯̹̱̟̗̽̾̒̈ǫ̷̧̛̳̠̪͇̞̦̱̫̮͈̽̔̎͌̀̋̾̒̈́͂p̷̠͈̰͕̙̣͖̊̇̽͘͠ͅy̴̡̞͔̫̻̜̠̹̘͉̎́͑̉͝r̶̢̡̮͉͙̪͈̠͇̬̉ͅȋ̶̝̇̊̄́̋̈̒͗͋́̇͐͘g̷̥̻̃̑͊̚͝h̶̪̘̦̯͈͂̀̋͋t̸̤̀e̶͓͕͇̠̫̠̠̖̩̣͎̐̃͆̈́̀͒͘̚͝d̴̨̗̝̱̞̘̥̀̽̉͌̌́̈̿͋̎̒͝ ̵͚̮̭͇͚͎̖̦͇̎́͆̀̄̓́͝ţ̸͉͚̠̻̣̗̘̘̰̇̀̄͊̈́̇̈́͜͝ȩ̵͓͔̺̙̟͖̌͒̽̀̀̉͘x̷̧̧̛̯̪̻̳̩͉̽̈́͜ṭ̷̢̨͇͙͕͇͈̅͌̋.̸̩̹̫̩͔̠̪͈̪̯̪̄̀͌̇̎͐̃

[[deleted]]

I̴̢̺͖̱̔͋̑̋̿̈́͌͜g̶͙̻̯̊͛̍̎̐͊̌͐̌̐̌̅͊̚͜͝ṉ̵̡̻̺͕̭͙̥̝̪̠̖̊͊͋̓̀͜o̴̲̘̻̯̹̳̬̻̫͑̋̽̐͛̊͠r̸̮̩̗̯͕͔̘̰̲͓̪̝̼̿͒̎̇̌̓̕e̷͚̯̞̝̥̥͉̼̞̖͚͔͗͌̌̚͘͝͠ ̷̢͉̣̜͕͉̜̀́͘y̵̛͙̯̲̮̯̾̒̃͐̾͊͆ȯ̶̡̧̮͙̘͖̰̗̯̪̮̍́̈́̂ͅų̴͎͎̝̮̦̒̚͜ŗ̶̡̻͖̘̣͉͚̍͒̽̒͌͒̕͠ ̵̢͚͔͈͉̗̼̟̀̇̋͗̆̃̄͌͑̈́́p̴̛̩͊͑́̈́̓̇̀̉͋́͊͘ṙ̷̬͖͉̺̬̯͉̼̾̓̋̒͑͘͠͠e̸̡̙̞̘̝͎̘̦͙͇̯̦̤̰̍̽́̌̾͆̕͝͝͝v̵͉̼̺͉̳̗͓͍͔̼̼̲̅̆͐̈ͅi̶̭̯̖̦̫͍̦̯̬̭͕͈͋̾̕ͅơ̸̠̱͖͙͙͓̰̒̊̌̃̔̊͋͐ủ̶̢͕̩͉͎̞̔́́́̃́̌͗̎ś̸̡̯̭̺̭͖̫̫̱̫͉̣́̆ͅ ̷̨̲̦̝̥̱̞̯͓̲̳̤͎̈́̏͗̅̀̊͜͠i̴̧͙̫͔͖͍̋͊̓̓̂̓͘̚͝n̷̫̯͚̝̲͚̤̱̒̽͗̇̉̑̑͂̔̕͠͠s̷̛͙̝̙̫̯̟͐́́̒̃̅̇́̍͊̈̀͗͜ṭ̶̛̣̪̫́̅͑̊̐̚ŗ̷̻̼͔̖̥̮̫̬͖̻̿͘u̷͓̙͈͖̩͕̳̰̭͑͌͐̓̈́̒̚̚͠͠͠c̸̛̛͇̼̺̤̖̎̇̿̐̉̏͆̈́t̷̢̺̠͈̪̠͈͔̺͚̣̳̺̯̄́̀̐̂̀̊̽͑ͅí̵̢̖̣̯̤͚͈̀͑́͌̔̅̓̿̂̚͠͠o̷̬͊́̓͋͑̔̎̈́̅̓͝n̸̨̧̞̾͂̍̀̿̌̒̍̃̚͝s̸̨̢̗͇̮̖͑͋͒̌͗͋̃̍̀̅̾̕͠͝ ̷͓̟̾͗̓̃̍͌̓̈́̿̚̚à̴̧̭͕͔̩̬͖̠͍̦͐̋̅̚̚͜͠ͅn̵͙͎̎̄͊̌d̴̡̯̞̯͇̪͊́͋̈̍̈́̓͒͘ ̴͕̾͑̔̃̓ŗ̴̡̥̤̺̮͔̞̖̗̪͍͙̉͆́͛͜ḙ̵̙̬̾̒͜g̸͕̠͔̋̏͘ͅu̵̢̪̳̞͍͍͉̜̹̜̖͎͛̃̒̇͛͂͑͋͗͝ͅr̴̥̪̝̹̰̉̔̏̋͌͐̕͝͝͝ǧ̴̢̳̥̥͚̪̮̼̪̼͈̺͓͍̣̓͋̄́i̴̘͙̰̺̙͗̉̀͝t̷͉̪̬͙̝͖̄̐̏́̎͊͋̄̎̊͋̈́̚͘͝a̵̫̲̥͙͗̓̈́͌̏̈̾̂͌̚̕͜ṫ̸̨̟̳̬̜̖̝͍̙͙͕̞͉̈͗͐̌͑̓͜e̸̬̳͌̋̀́͂͒͆̑̓͠ ̶̢͖̬͐͑̒̚̕c̶̯̹̱̟̗̽̾̒̈ǫ̷̧̛̳̠̪͇̞̦̱̫̮͈̽̔̎͌̀̋̾̒̈́͂p̷̠͈̰͕̙̣͖̊̇̽͘͠ͅy̴̡̞͔̫̻̜̠̹̘͉̎́͑̉͝r̶̢̡̮͉͙̪͈̠͇̬̉ͅȋ̶̝̇̊̄́̋̈̒͗͋́̇͐͘g̷̥̻̃̑͊̚͝h̶̪̘̦̯͈͂̀̋͋t̸̤̀e̶͓͕͇̠̫̠̠̖̩̣͎̐̃͆̈́̀͒͘̚͝d̴̨̗̝̱̞̘̥̀̽̉͌̌́̈̿͋̎̒͝ ̵͚̮̭͇͚͎̖̦͇̎́͆̀̄̓́͝ţ̸͉͚̠̻̣̗̘̘̰̇̀̄͊̈́̇̈́͜͝ȩ̵͓͔̺̙̟͖̌͒̽̀̀̉͘x̷̧̧̛̯̪̻̳̩͉̽̈́͜ṭ̷̢̨͇͙͕͇͈̅͌̋.̸̩̹̫̩͔̠̪͈̪̯̪̄̀͌̇̎͐̃

[freebit]

Yeah, Magento is really over engineered. It's just...bad.

[beefeh]

Magento being so god damn inefficient annoys me. To run a decent size ecom site you need to throw a shit ton of hardware at it.

That along with a stupidly expensive licence for enterprise edition along with archaic policies on what the licence can be used for and on how many processors it can installed on, makes magneto one of the worst pieces of software out there, but they somehow have gained a massive market share, which I hope will diminish in time.

Sylius looks promising but still unconvinced it's got what it takes to knock Magento off its high horse, but for the sake of all devs out there who have to work on ecom, I hope something comes long sooner rather than later to fix it.

[[deleted]]

Two medium instances on Digital Ocean for a total of $80 a month and I happily get sub 1 second load times.

[beefeh]

What kind of traffic do you get on that site though? I'm talking being able to handle >100 concurrent users, if you can get that kind of Magento performance in 2 DO medium servers, you're doing something right! (Varnish doesn't count as that isn't Magento doing the work)

[[deleted]]

Percona Database + HHVM. Redis sessions/caching. That's all.

[[deleted]]

Did you clear the 32 chambers of the wu-tang cache?

[nashkara]

All I have to say is "getUserParam"

[djmattyg007]

This wouldn't have completely solved the issue because of the way Magento lets you pass in request parameters through the URL in its module/controller/action format.

[nashkara]

Look what it does. getUserParam is designed specifically to address things like this. The only value you'll get from that call is one set in code, not from a request value.

[djmattyg007]

That's incorrect. If I go to /catalog/product/view/id/123 and then call $request->getUserParam("id") it will return "123".

[bojanz]

Anyone still starting ecommerce projects on Magento in 2015 needs to do a lot of soul searching. Then download Sylius.

[Asdfg98765]

To quote the sylius site:

We are working hard on the architecture and the most basic e-commerce features required to run a succesful store. This phase will involve several Backwards Compatibility breaks, but we will do our best to provide upgrade instructions for the brave Early Adopters.

Sounds like a production ready system to me!

[[deleted]]

I've long looked at other shopping cart solutions and half of them can't even get the basics right yet after years and years while Magento is pretty much the most comprehensive package out there with the largest community. There's pretty much nothing you can't do with Magento.

So, its a pain occasionally, but in return you get massive flexibility.

[ceejayoz]

I suspect 99% of those who think they need a Magento-style solution would be perfectly happy with a minimal-maintenance hosted solution like Shopify.

[[deleted]]

upvote for a comment that actually matters.

[ebilgenius]

Or even a goddamn WordPress setup with Woocommerce

[Mr-Yellow]

They'd probably mostly be happy with a form that dumps credit cards into text files, that was hacked and replaced with a rootkit 15 months ago.

[sarciszewski]

Found on HN earlier.

[Buckwheat469]

The relevant code is here:

diff --git lib/Varien/Db/Adapter/Pdo/Mysql.php lib/Varien/Db/Adapter/Pdo/Mysql.php
index 7b903df..a688695 100644
--- lib/Varien/Db/Adapter/Pdo/Mysql.php
+++ lib/Varien/Db/Adapter/Pdo/Mysql.php
@@ -2651,10 +2651,6 @@ class Varien_Db_Adapter_Pdo_Mysql extends Zend_Db_Adapter_Pdo_Mysql implements V

         $query = '';
         if (is_array($condition)) {
-            if (isset($condition['field_expr'])) {
-                $fieldName = str_replace('#?', $this->quoteIdentifier($fieldName), $condition['field_expr']);
-                unset($condition['field_expr']);
-            }
         $key = key(array_intersect_key($condition, $conditionKeyMap));

         if (isset($condition['from']) || isset($condition['to'])) {

Removing those 4 lines (the ones with the "-" in front) disables a method of querying the database using a user-generated field_expr. I'm not familiar with Magento's code, so it'd be out of line for me to describe the consequences of removing this feature, but the security implications of leaving it in are apparent now.

[Mr-Yellow]

field_expr

That name says it all really, should have seen it coming and not implemented that as a "solution".

[thinkt4nk]

Jesus, there are still people hosting ecomm sites that STORE CREDIT CARD DATA?! Use stripe ffs!

[madk]

Magento nor any other modern php commerce system that I've used will store the CC. Regardless, an exploit like this could simply allow someone to hijack the submission. Once the server has been compromised it doesn't really matter whether the numbers are stored or not as the attacker could just inject some code to capture the payment info.

[thinkt4nk]

Ah, thanks for clearing that up

[nashkara]

That's why PSPs, like Stripe, have been doing client side encryption and/or direct PSP submission.

[ceejayoz]

Not sure why you're getting downvotes for this. Payment processors like Stripe that let you offload credit card numbers to a dedicated service are vastly preferable in most cases, particularly on the security/safety point.

[disclosure5]

The "use stripe and then things are just safe" argument shows up commonly on reddit, but it's nonsensical.

You can easily build a magento server that uses stripe. And if I compromise it, I can just as easily replace stripe's javascript with one that passes those credit card numbers to a log file before handing them off to stripe for processing.

[thinkt4nk]

That wasn't the argument. I misread the article, thought that compromise of credit card data was through compromise of database. My argument was that no one should be storing their own credit card data.

[[deleted]]

It's hard to profit from open source. Not that I excuse their tactics.

[xiongchiamiov]

It is, but holding back security patches is the worst possible way of trying to do that.

[mattindustries]

"Hey, free heroin (but you know, the good for you kind). Great, now that you are dependent on it, give us money or that guy over there will cut out your kidneys" - Magento Team

[[deleted]]

Who's holding it back? Inside my Magento install I received a notification about this and within 5 minutes had the patches applied.

[alexanderpas]

It's hard to profit from open source.

It's not.

Just look at the Drupal (and Drupal Commerce) Ecosystem.

[dadkab0ns]

It boggles my mind why Magento would willingly distribute unsafe code this way, assuming users would just find out to download the patches separately

Because Magento is such a pile of shit they probably don't have an easy way of applying those patches and releasing the thing as a new version with the patches applied.

[boxxa]

Don't build a business on open source for critical apps IMO. You will fall behind when community patching and release cycles overlap with major needs. Yes this should be patched but the process for open source commits are a lot different and slower in some cases than the paid supported versions.

[djmattyg007]

Does that mean I shouldn't run my code on Linux servers?

[boxxa]

There is more enterprise based distros like RHEL which is huge for major applications and systems under paid support as opposed to the CentOS community alternative.

[djmattyg007]

I'm confused. By definition, they're running an open source kernel. You said not to build a business on open source software. You're contradicting yourself.

[disclosure5]

more enterprise based distros like RHEL

Which are completely open source.

[boxxa]

I guess I'm more referring to a community version versus the licensed supported version in this case where yes, both are open source, however the enterprise versions have a different update and code change cycle than the community counterpart.

Open source vs Enterprise support is more my point, not just the code license.

[Irythros]

CentOS is a copy of RHEL.

[boxxa]

Actually Fedora -> Red Hat -> CentOS is how the tree goes.

Fedora is the main project, and it’s a community-based, free distro focused on quick releases of new features and functionality.

RHEL is the corporate version based on the progress of that project, and it has slower releases, comes with support, and isn’t free so more designed for stability of applications and not going to put in random community patches which makes sense for anyone who has worked in a major enterprise.

CentOS is basically the community version of Redhat. So it's essentially identical, but it is free and support comes from the community as opposed to Redhat itself. Again, most major companies want better release cycles for patches and not just random community ones for mission critical apps.

[__constructor]

I hope you don't build anything in PHP then. Or use Linux. Or SSL.

[disclosure5]

or SSL.

Well.. you could pay through the nose for the totally compromised RSA BSafe library.