There's been 10 patches (2 with remote code execution exploits) and no version bump. Are they trying to make it seem like their product is more secure or stable by not incrementing the version?
Magento eCommerce PHP Remote Code Execution
41–50 of 81 posts
Re: Magento eCommerce PHP Remote Code Execution
#42Dutch's largest Magento hosting company Byte released a online testing tool: shoplift.byte.nl Btw, see the comments section in Mattias' blog post, you will see that Magento themselves admitted that they have "no automated tests" whatsoever. And 2+ months out, they haven't bother to updated the latest code release with the new patch in. Do you still trust Magento stores on the Internet? I don't.
"Dutch's"? I assume you mean the Netherlands since Dutch is the language, not a country or anything. This would be the same as saying "English's largest Magento ...". Alternatively you could say "The largest Dutch Magento ..."
Re: Magento eCommerce PHP Remote Code Execution
#43Would anyone be interested if I were to host a maintained fork of the Magento community edition on github with up-to-date security patches so you can just `git pull` and be done with it?
This already exists here: https://github.com/OpenMage/magento-mirror
Re: Magento eCommerce PHP Remote Code Execution
#44Magento is so slow.
Re: Magento eCommerce PHP Remote Code Execution
#45Earlier quoted context omitted.
It hasn't changed much. My company tried using it to build a store for a client since it's what her distribution house recommended. It's trash. We spent more time trying to get a theme to load properly than we did actually working on the theme.
It's not that bad once you wrap your head around it. That being said, it's getting old, and it shows. They have built up as much as they could, and right now we have a tower that might drop at anytime. Magento 2 will solve this.
It's not, developers just bear with it because they don't know of better alternatives.
Magento is a monolith and always will be. It's built on top of PHP's slowest framework, Zend which doesn't advertise speed but rather raw power.
Magento is going to crumble, it's just a matter of when
Re: Magento eCommerce PHP Remote Code Execution
#46This is hardly unique to Magento. Lots of applications do this. It's not ideal, but it's not SO bad if the application nags you to patch on start up. I don't use Magento, so I'm not sure if it does.
It does, and looks like this, a screen filling alert view when you login into the backend. http://i.imgur.com/yeBKQIM.png
That alert is shown because Magento issued a notification message, not because the system detected some security patches. Those two security patches were published on 2015 February 09 and 2014 October 03.
In fact, Magento issued two notification messages, on Friday and on Monday, so even if you applied the patch after seeing the first message, you still saw the second message and experienced that brief moment of panic.
Re: Magento eCommerce PHP Remote Code Execution
#47Earlier quoted context omitted.
What's your opinion on "popular frameworks".
They vary; generally, their maintainers mean well but that doesn't necessarily translate to secure code. Cake lacks security expertise in their core team, unfortunately. CodeIgniter is a bit conservative. (We must support PHP 5.2!) But then again, so is WordPress. They do listen to researchers. Laravel is okay, but their lead dev is a bit of an egotistical and hypocritical ass. Recently, found and privately reported…
I'm out of PHP, but I'll second Symfony - Fabien and the Sensio people are the best folks I know in the PHP universe and they're careful and sober in their thinking.
Re: Magento eCommerce PHP Remote Code Execution
#48Unless it got significantly better/redesigned in the last couple of years, Magento is a piece of junk. Arguably it's been years since I worked with it, but installation was weird, developing is slow a cumbersome, documentation was lacking, search was pretty much broken and it was slow. I can't image running it on a shared host, performance must be terrible. On the positive side Magento does have an impressive amount…
The sad thing is that they learned nothing from oscommerce. Yes, it's not a procedural pile, but it suffers from the same "can't implement sensibly. Fuck it, edit core. Patch?! Shit. Upgrade path broken" phenomenon in heaps.
If I got paid every time someone ditched magento because it doesn't perform, is hard and costly to host/maintain, gets blind alley'd by "someone else's problem" developers, can't do what they need, I'd be a rich man.
Oh wait, I do, and I am.
Re: Magento eCommerce PHP Remote Code Execution
#49Earlier quoted context omitted.
Its performance is so scant one must cache it to oblivion. This is especially true when you hit a certain high SKU threshold. Not to mention the horrible modules that are out there in the market. Plug: Had to write a full page caching mechanism that's powered by Varnish (dubbed Magento Warp - http://www.unixy.net/varnish/ ).
I did the ops-side of a large Magento site. It was a fucking nightmare... and I handled .NET and Java once too. We had 3 cache servers with 128GB of ram EACH just to cache the complete shit out of Magento pages. Each user had their own keyspace in the cache. _that's_ how bad Magento is. When cache would go down because of a network partition or something, Magento would fallback to rendering and our application web se…
Each user... So one for "not logged in" and one for each known id? That's the laziest possible implementation that can provide any variety of benefit. Caching on a per-actual-visitor basis is just a waste of ram.
Fwiw we partial view cache on our platform and achieve a 90%+ hit rate on most sites. Some run many user-variable-specific (referrer,cookie,stored data) site versions which drops the cache hit rate, but is worth the extra cpu and cost for the conversions. Little performance hit as the object data to render is already in memcached usually, pre-warmed by queued parallel processes.
Of course, we evolved this in response to "oh crap the web tier is burning", but I just can't comprehend how magento haven't come up with something better than what you describe. Perhaps they haven't experienced the pain of clients bearing down hard on you while Rome burns first hand, and don't understand the importance.
Re: Magento eCommerce PHP Remote Code Execution
#50Unless it got significantly better/redesigned in the last couple of years, Magento is a piece of junk. Arguably it's been years since I worked with it, but installation was weird, developing is slow a cumbersome, documentation was lacking, search was pretty much broken and it was slow. I can't image running it on a shared host, performance must be terrible. On the positive side Magento does have an impressive amount…
Magento code in general is of very dubious quality. I once ran a quick static analysis on it and found some ridiculous results: https://twitter.com/jlas_/status/391615992473722880
I just ran PHPStorm's inspections on Magento's core code: http://imgur.com/RMxWEgR
Granted, the tool I used is opinionated and not all those items are red flags, but the sheer number of issues is impressive.