I would still like to know how serious this exploit is.  As someone with a lot of portals, the cost of upgrading them could be signifigant.

I'd like to see a little bit more confidence in the resolution than just "should fix the problem". Out of everything posted to date on the subject, that one line is the single most disturbing to me.

I recently had work done to the brakes on my truck, I think I would have a problem if the mechanic told me that there was a flaw in the brake system by the original manufacturer and then said that this "should fix the problem". Yeah, thats a lot of confidence, thanks buddy.

On a side note, I can never say enough good things about PowerDNN. While I can certainly agree that things may and should have been handled differently in this case, I find it highly offensive that anyone could sit here and label them as being opportunistic or greedy.

The finger pointing and insinuations though show a complete lack of professionalism in an otherwise stellar community.

Edward DeGagne | Applications Engineering Manager
ektron, inc.
542 Amherst Street, Route 101A | Nashua, NH 03063

Ed, my apologies for the slip-up in wording. At the time I wrote the post we were still doing an investigation into the problem to fully understand all of the vectors and severity level. But there should be no doubt about one thing - we have fully and completely patched every security problem which has ever been reported to us in the DNN framework. This process can be very challenging and often takes time to ensure every use case is properly mitigated. But at the end of the day, we fully understand that the community trusts and relies on us to ensure their DNN installations are secure. Therefore, it would be irresponsible for us to release a patch which simply masks the problem, puts a band-aid on it, or even makes it worse. We deal in absolutes; therefore, a 100% solution is the only option. At this point, we already have a complete solution to the recent items reported by PowerDNN and we are running it through a variety of test cases to ensure full coverage.