Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Magento eCommerce PHP Remote Code Execution

ma.ttias.be

Post reply on HN
Print view View original

51–60 of 81 posts

Re: Magento eCommerce PHP Remote Code Execution

#51

Post by devy »

tokenizerrr wrote: post #42
devy wrote: post #34

Dutch's largest Magento hosting company Byte released a online testing tool: shoplift.byte.nl Btw, see the comments section in Mattias' blog post, you will see that Magento themselves admitted that they have "no automated tests" whatsoever. And 2+ months out, they haven't bother to updated the latest code release with the new patch in. Do you still trust Magento stores on the Internet? I don't.

"Dutch's"? I assume you mean the Netherlands since Dutch is the language, not a country or anything. This would be the same as saying "English's largest Magento ...". Alternatively you could say "The largest Dutch Magento ..."

Thanks.

Re: Magento eCommerce PHP Remote Code Execution

#52

Post by rakk »

devy wrote: post #34

Dutch's largest Magento hosting company Byte released a online testing tool: shoplift.byte.nl Btw, see the comments section in Mattias' blog post, you will see that Magento themselves admitted that they have "no automated tests" whatsoever. And 2+ months out, they haven't bother to updated the latest code release with the new patch in. Do you still trust Magento stores on the Internet? I don't.

We run some shops at Byte and were able to quickly apply the patches back in February. This week we got an e-mail from a worried customer who got a message in the back-end (from Magento) that his site might be vulnerable: 2 month's later..

Personally I've never liked Magento much; it needs expensive hosting even for modest shops and seems to be bloated with functionality you never use. And in the end you always end up with writing a bunch of custom modules because the Magento way is never your way.

Re: Magento eCommerce PHP Remote Code Execution

#53

Post by Raphmedia »

nightclubsub wrote: post #45
Raphmedia wrote: post #33

Earlier quoted context omitted.

It's not that bad once you wrap your head around it. That being said, it's getting old, and it shows. They have built up as much as they could, and right now we have a tower that might drop at anytime. Magento 2 will solve this.

It's not, developers just bear with it because they don't know of better alternatives. Magento is a monolith and always will be. It's built on top of PHP's slowest framework, Zend which doesn't advertise speed but rather raw power. Magento is going to crumble, it's just a matter of when

Okay, let's me phrase it this way then. It's a big piece of weird code that isn't intuitive at first but become relatively easy to work with once you understand what's happening (give up on the why, half the stuff makes no sense). The current version is going to crumble, but hopefully Magento 2 will be built to last.

Re: Magento eCommerce PHP Remote Code Execution

#54

Post by mrweasel »

madaxe_again wrote: post #48
mrweasel wrote: post #14

Unless it got significantly better/redesigned in the last couple of years, Magento is a piece of junk. Arguably it's been years since I worked with it, but installation was weird, developing is slow a cumbersome, documentation was lacking, search was pretty much broken and it was slow. I can't image running it on a shared host, performance must be terrible. On the positive side Magento does have an impressive amount…

The sad thing is that they learned nothing from oscommerce. Yes, it's not a procedural pile, but it suffers from the same "can't implement sensibly. Fuck it, edit core. Patch?! Shit. Upgrade path broken" phenomenon in heaps. If I got paid every time someone ditched magento because it doesn't perform, is hard and costly to host/maintain, gets blind alley'd by "someone else's problem" developers, can't do what they nee…

There are a large number of jobs for Magento developers in my area right now, some of them are really interesting companies. Sadly I won't be applying because I can't see myself doing Magento again. Maybe I should apply and talk them out of Magento, so I too can become a rich man :-)

Re: Magento eCommerce PHP Remote Code Execution

#56

Post by [deleted] »

sarciszewski wrote: post #27
BringTheTanks wrote: post #24

Earlier quoted context omitted.

What's your opinion on "popular frameworks".

They vary; generally, their maintainers mean well but that doesn't necessarily translate to secure code. Cake lacks security expertise in their core team, unfortunately. CodeIgniter is a bit conservative. (We must support PHP 5.2!) But then again, so is WordPress. They do listen to researchers. Laravel is okay, but their lead dev is a bit of an egotistical and hypocritical ass. Recently, found and privately reported…

[deleted]

Re: Magento eCommerce PHP Remote Code Execution

#57

Post by D3ve1inE »

dante9999 wrote: post #55

Where can one find analysis of this vulnerability? There are no details in checkpost blogpost revealing vulnerability. I assume its serious and real if magento releases patches but would be cool to be able to judge myself.

It will be released in the next day or 2 so people will have time patching up their systems.

Re: Magento eCommerce PHP Remote Code Execution

#58

Post by kevando »

madaxe_again wrote: post #48
mrweasel wrote: post #14

Unless it got significantly better/redesigned in the last couple of years, Magento is a piece of junk. Arguably it's been years since I worked with it, but installation was weird, developing is slow a cumbersome, documentation was lacking, search was pretty much broken and it was slow. I can't image running it on a shared host, performance must be terrible. On the positive side Magento does have an impressive amount…

The sad thing is that they learned nothing from oscommerce. Yes, it's not a procedural pile, but it suffers from the same "can't implement sensibly. Fuck it, edit core. Patch?! Shit. Upgrade path broken" phenomenon in heaps. If I got paid every time someone ditched magento because it doesn't perform, is hard and costly to host/maintain, gets blind alley'd by "someone else's problem" developers, can't do what they nee…

It really isn't that difficult to avoid core updates. Sure, it isn't a perfect platform, but it gets the job done for most eCommerce companies

Re: Magento eCommerce PHP Remote Code Execution

#59

Post by billmalarky »

mrweasel wrote: post #14

Unless it got significantly better/redesigned in the last couple of years, Magento is a piece of junk. Arguably it's been years since I worked with it, but installation was weird, developing is slow a cumbersome, documentation was lacking, search was pretty much broken and it was slow. I can't image running it on a shared host, performance must be terrible. On the positive side Magento does have an impressive amount…

Nothing has changed, it's pure garbage.

Re: Magento eCommerce PHP Remote Code Execution

#60

Post by davidgerard »

> It boggles my mind why Magento would willingly distribute unsafe code this way, assuming users would just find out to download the patches separately.

Because Magento are OBSERVABLY INSANE.

This is from the Magento Enterprise tarball. I can't say how much we're paying, but I can say it's public knowledge that it's at least $13,000 a year:

  $ grep -r chmod app | grep 777
 app/code/local/Gorilla/Heartbeat/Helper/Data.php:  chmod($logDir, 0777); 
 app/code/local/Gorilla/Heartbeat/Helper/Data.php:  chmod($logFile, 0777); 
 app/code/core/Mage/Install/Model/Installer/Console.php:   @chmod('var/cache', 0777); 
 app/code/core/Mage/Install/Model/Installer/Console.php:   @chmod('var/session', 0777); 
 app/code/core/Mage/Install/Model/Installer/Config.php:   chmod($this->_localConfigFile, 0777); 
 app/code/core/Mage/Compiler/Model/Process.php:   @chmod($dir, 0777); 
 app/code/core/Mage/Catalog/Model/Product/Attribute/Backend/Media.php:  $ioAdapter->chmod($this->_getConfig()->getTmpMediaPath($fileName), 0777); 
 app/Mage.php:   chmod($logDir, 0777); 
 app/Mage.php:   chmod($logFile, 0777);
Post reply on HN