Products

Solutions

Resources

Partners

Community

Blog

About

QA

Ideas Test

New Community Website

Ordinarily, you'd be at the right spot, but we've recently launched a brand new community website... For the community, by the community.

Yay... Take Me to the Community!

Welcome to the DNN Community Forums, your preferred source of online community support for all things related to DNN.
In order to participate you must be a registered DNNizen

HomeHomeUsing DNN Platf...Using DNN Platf...Skins, Themes, ...Skins, Themes, ...DNNGo Themes no longer in DNN StoreDNNGo Themes no longer in DNN Store
Previous
 
Next
New Post
2/13/2018 6:57 PM
 
Scippy One wrote:
@Tony: sorry but I still do not understand, others vendors in the store are selling skins and thems that use server-side tecnology for custom and great advanced skin configuration! Furthernow, I don’t understand this different security policy beetween modules and skins. If there is bad code, it is dangerous in skins as well as in modules!

It's not the fact that there is server-side code integration included.  It's because their specific implementation in their themes wasn't passing basic security standards/scans.   

If you really want action at this point for this specific issue, I'd suggest e-mailing Ash since he's not participating in this thread any longer.  You should even CC the folks at DNNGo on the same e-mail if you want to really see what the remaining issues are.  From what I've been told, there have been things reported that aren't entirely accurate.

ash.prasad@dnnsoftware.com


Will Strohl

Upendo Ventures Upendo Ventures
DNN experts since 2003
Official provider of the Hotcakes Commerce Cloud and SLA support
 
New Post
2/13/2018 7:10 PM
 
What DNN Software needs to do is come up with a security best practices white paper for everyone to read and apply. Something that includes a list of No's No's. If I plan to develop a theme or a module, I would like to know before I start development what I should avoid. If there's no such thing out there, why not??

 
New Post
2/13/2018 7:26 PM
 
Tony Henrich wrote:
What DNN Software needs to do is come up with a security best practices white paper for everyone to read and apply. Something that includes a list of No's No's. If I plan to develop a theme or a module, I would like to know before I start development what I should avoid. If there's no such thing out there, why not??

This already exists (link below), but I don't believe this is the sole responsibility of DNN Corp. This is a responsibility for all of us. We're an open source project - now more than ever before. 

http://www.dnnsoftware.com/wiki/secur...


Will Strohl

Upendo Ventures Upendo Ventures
DNN experts since 2003
Official provider of the Hotcakes Commerce Cloud and SLA support
 
New Post
2/13/2018 8:40 PM
 
Will Strohl wrote:
Tony Henrich wrote:
What DNN Software needs to do is come up with a security best practices white paper for everyone to read and apply. Something that includes a list of No's No's. If I plan to develop a theme or a module, I would like to know before I start development what I should avoid. If there's no such thing out there, why not??

This already exists (link below), but I don't believe this is the sole responsibility of DNN Corp. This is a responsibility for all of us. We're an open source project - now more than ever before. 

http://www.dnnsoftware.com/wiki/secur...

 Right but they are the ones doing the security scans and audits and determining what can go in the store so the onus is on them to inform the developers what they are looking for. We as an open source community can *add* to their baseline. They also need to update the baseline every time they update their scan process.

 
New Post
2/13/2018 11:00 PM
 
Tony Henrich wrote:

 Right but they are the ones doing the security scans and audits and determining what can go in the store so the onus is on them to inform the developers what they are looking for. We as an open source community can *add* to their baseline. They also need to update the baseline every time they update their scan process.

I agree that DNN Corp should tell developers what fails a security audit when it's necessary to remove product(s) from the DNN Store, and that's what has happened in this case.  Beyond the wiki article I've posted, any developer simply needs to observe the commonly accepted security best practices that can be found with any Google search.  

This isn't DNN Corp creating arbitrary standards, and publishing security standards really isn't their responsibility either - nor would it be for any other vendor.  Their responsibility is simply to protect customers that pay money on the store.


Will Strohl

Upendo Ventures Upendo Ventures
DNN experts since 2003
Official provider of the Hotcakes Commerce Cloud and SLA support
 
Previous
 
Next
HomeHomeUsing DNN Platf...Using DNN Platf...Skins, Themes, ...Skins, Themes, ...DNNGo Themes no longer in DNN StoreDNNGo Themes no longer in DNN Store


These Forums are dedicated to discussion of DNN Platform and Evoq Solutions.

For the benefit of the community and to protect the integrity of the ecosystem, please observe the following posting guidelines:

  1. No Advertising. This includes promotion of commercial and non-commercial products or services which are not directly related to DNN.
  2. No vendor trolling / poaching. If someone posts about a vendor issue, allow the vendor or other customers to respond. Any post that looks like trolling / poaching will be removed.
  3. Discussion or promotion of DNN Platform product releases under a different brand name are strictly prohibited.
  4. No Flaming or Trolling.
  5. No Profanity, Racism, or Prejudice.
  6. Site Moderators have the final word on approving / removing a thread or post or comment.
  7. English language posting only, please.
What is Liquid Content?
Find Out
What is Liquid Content?
Find Out
What is Liquid Content?
Find Out