Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Magento eCommerce PHP Remote Code Execution

ma.ttias.be

Post reply on HN
Print view View original

31–40 of 81 posts

Re: Magento eCommerce PHP Remote Code Execution

#31

Post by dhagz »

mrweasel wrote: post #14

Unless it got significantly better/redesigned in the last couple of years, Magento is a piece of junk. Arguably it's been years since I worked with it, but installation was weird, developing is slow a cumbersome, documentation was lacking, search was pretty much broken and it was slow. I can't image running it on a shared host, performance must be terrible. On the positive side Magento does have an impressive amount…

It hasn't changed much. My company tried using it to build a store for a client since it's what her distribution house recommended.

It's trash. We spent more time trying to get a theme to load properly than we did actually working on the theme.

Re: Magento eCommerce PHP Remote Code Execution

#32

Post by Phil_Latio »

sarciszewski wrote: post #27
BringTheTanks wrote: post #24

Earlier quoted context omitted.

What's your opinion on "popular frameworks".

They vary; generally, their maintainers mean well but that doesn't necessarily translate to secure code. Cake lacks security expertise in their core team, unfortunately. CodeIgniter is a bit conservative. (We must support PHP 5.2!) But then again, so is WordPress. They do listen to researchers. Laravel is okay, but their lead dev is a bit of an egotistical and hypocritical ass. Recently, found and privately reported…

Looks like after your "evil" public disclosure, they now added security contact: https://github.com/laravel/framework/commit/69e5c3c1daca8454...

Re: Magento eCommerce PHP Remote Code Execution

#33

Post by Raphmedia »

dhagz wrote: post #31
mrweasel wrote: post #14

Unless it got significantly better/redesigned in the last couple of years, Magento is a piece of junk. Arguably it's been years since I worked with it, but installation was weird, developing is slow a cumbersome, documentation was lacking, search was pretty much broken and it was slow. I can't image running it on a shared host, performance must be terrible. On the positive side Magento does have an impressive amount…

It hasn't changed much. My company tried using it to build a store for a client since it's what her distribution house recommended. It's trash. We spent more time trying to get a theme to load properly than we did actually working on the theme.

It's not that bad once you wrap your head around it.

That being said, it's getting old, and it shows. They have built up as much as they could, and right now we have a tower that might drop at anytime.

Magento 2 will solve this.

Re: Magento eCommerce PHP Remote Code Execution

#34

Post by devy »

Dutch's largest Magento hosting company Byte released a online testing tool: shoplift.byte.nl

Btw, see the comments section in Mattias' blog post, you will see that Magento themselves admitted that they have "no automated tests" whatsoever. And 2+ months out, they haven't bother to updated the latest code release with the new patch in.

Do you still trust Magento stores on the Internet? I don't.

Re: Magento eCommerce PHP Remote Code Execution

#35

Post by vhost- »

jjoe wrote: post #23
mrweasel wrote: post #14

Unless it got significantly better/redesigned in the last couple of years, Magento is a piece of junk. Arguably it's been years since I worked with it, but installation was weird, developing is slow a cumbersome, documentation was lacking, search was pretty much broken and it was slow. I can't image running it on a shared host, performance must be terrible. On the positive side Magento does have an impressive amount…

Its performance is so scant one must cache it to oblivion. This is especially true when you hit a certain high SKU threshold. Not to mention the horrible modules that are out there in the market. Plug: Had to write a full page caching mechanism that's powered by Varnish (dubbed Magento Warp - http://www.unixy.net/varnish/ ).

I did the ops-side of a large Magento site. It was a fucking nightmare... and I handled .NET and Java once too.

We had 3 cache servers with 128GB of ram EACH just to cache the complete shit out of Magento pages. Each user had their own keyspace in the cache. _that's_ how bad Magento is.

When cache would go down because of a network partition or something, Magento would fallback to rendering and our application web servers would melt.

Re: Magento eCommerce PHP Remote Code Execution

#36

Post by mahouse »

jlas wrote: post #18
mrweasel wrote: post #14

Unless it got significantly better/redesigned in the last couple of years, Magento is a piece of junk. Arguably it's been years since I worked with it, but installation was weird, developing is slow a cumbersome, documentation was lacking, search was pretty much broken and it was slow. I can't image running it on a shared host, performance must be terrible. On the positive side Magento does have an impressive amount…

Magento code in general is of very dubious quality. I once ran a quick static analysis on it and found some ridiculous results: https://twitter.com/jlas_/status/391615992473722880

Sorry, but what is that tool?

Re: Magento eCommerce PHP Remote Code Execution

#37

Post by sarciszewski »

Phil_Latio wrote: post #32
sarciszewski wrote: post #27

Earlier quoted context omitted.

They vary; generally, their maintainers mean well but that doesn't necessarily translate to secure code. Cake lacks security expertise in their core team, unfortunately. CodeIgniter is a bit conservative. (We must support PHP 5.2!) But then again, so is WordPress. They do listen to researchers. Laravel is okay, but their lead dev is a bit of an egotistical and hypocritical ass. Recently, found and privately reported…

Looks like after your "evil" public disclosure, they now added security contact: https://github.com/laravel/framework/commit/69e5c3c1daca8454...

Yes, but I originally emailed that address so I don't think it was a reaction to me (or even a passive aggressive gesture). Taylor had a week's heads up and chose to dismiss my report.

Re: Magento eCommerce PHP Remote Code Execution

#38

Post by dewey »

devy wrote: post #34

Dutch's largest Magento hosting company Byte released a online testing tool: shoplift.byte.nl Btw, see the comments section in Mattias' blog post, you will see that Magento themselves admitted that they have "no automated tests" whatsoever. And 2+ months out, they haven't bother to updated the latest code release with the new patch in. Do you still trust Magento stores on the Internet? I don't.

Thanks for the test link, just applied the patch to a site I'm managing.

Re: Magento eCommerce PHP Remote Code Execution

#39

Post by jlas »

mahouse wrote: post #36
jlas wrote: post #18

Earlier quoted context omitted.

Magento code in general is of very dubious quality. I once ran a quick static analysis on it and found some ridiculous results: https://twitter.com/jlas_/status/391615992473722880

Sorry, but what is that tool?

It was a while ago but I think it was PHPMD: http://phpmd.org/rules/codesize.html

Re: Magento eCommerce PHP Remote Code Execution

#40

Post by Someone1234 »

jlas wrote: post #18
mrweasel wrote: post #14

Unless it got significantly better/redesigned in the last couple of years, Magento is a piece of junk. Arguably it's been years since I worked with it, but installation was weird, developing is slow a cumbersome, documentation was lacking, search was pretty much broken and it was slow. I can't image running it on a shared host, performance must be terrible. On the positive side Magento does have an impressive amount…

Magento code in general is of very dubious quality. I once ran a quick static analysis on it and found some ridiculous results: https://twitter.com/jlas_/status/391615992473722880

While it could be better written, that's just their installer, it doesn't run in production by its very nature so might be a low priority for coding standards.

If you wanted to call them out, at least call them out for something which actually runs during normal operation.

Post reply on HN