Bill- Again, I think for the third time, our customers are primarily businesses who are running staging and production environments.  many of these customers even have development departments within their organizations that develop locally and push live versions to PowerDNN.  It is our responsibility to notify them of this change or else they would be unprotected the next time they pushed a new site live.  If you noticed, this thread was started by one of our customers who had recieved this e-mail.  I would not look into it as anything more than that, and to do so would be foolish given our circumstances.

Every word on our testimonials are directly from our clients. Periodically clients send us testimonials, which is very nice of them.  We try to get every testimonial sent to us published on the website.  Andy Graves had many problems with DNN early on and we helped him get a lot of things ironed out.  We are specifically a DNN specialist, and every person on our staff has a passion for the framework that all of us on this forum love. 

I think that their were some miscommunications, and we should have pushed information out in a slightly different mannor.  But there was never any ill will, or any sort of mal intent associated with discovering, and patching an issue that effected over 5,000 domains we host.  Being a hosting and service provider we are in a very unique position to many others in that we are responsible for an extremely large number of DNN sites with varying levels of service agreements.  All of our clients expect to be getting the best from PowerDNN and it's our responsibility to give it to them.  This has been very far from a "fear-based marketing attack", no e-mails were sent to anyone except our own customers, that's not marketing that's communication.

The behavior of the PowerDNN people is typical of the YouTube generation, they are probably very proud of generating all this "free" publicity and/or buzz, whether good or bad.  It is also typical of "security analysts" to make this maneuvers just to be able to say that they uncovered a vulnerability in a major product.  They are probably celebrating and watching everybody being so scared while they prepare their press releases and case studies.  They forgot that DNN is an open source project and did not act in good faith to actually help the Core Team and the community in general, that would have looked a lot better and would have scored major points for them.

But they don't really care about the community, they are just interested in the buzz.

And they should take the scanning tool off-line, anybody can capture its traffic and see what it is that it is looking for in the so called vulnerability.

Carlos