JohnGrange wrote
I think one mistake we made was offering the patch to the public,
I was thinking it was not making sure that DotNetNuke was 100% aware before posting a press release on your home page offering a "Let me find a DotNetNuke site to hack tool".
The fact of the matter is that this is an open source piece of software. In every open source platform there are always critical bugs that the users usually have to wait until the next release for. Enterprise users require quicker updates and are willing to pay for it. When you are a PowerDNN customer you are getting premium service and support for an open source platform, and you pay for it. If there is a demand for a service, it is our job as business managers to accommodate that demand.
Since PowerDNN found the exploit and knew the full details, I would think that you could have put request filters in place to block the exploit instead of PowerDNN exclusive patch.
I agree that we should have waited on offering this to non-PowerDNN customers, but the fact of the matter is that there was A LOT of people willing to pay the small price to secure their site. We are one of the few companies out there who employs an intensive DNN training program for all employee's and specialized only in DNN. This allows us to focus our our dedicated resources on securing, optimizing, and extending the product we support. This is what enterprise customers want, and they will pay for it. We should not be criticized for meeting these demands to grow our DNN based business. DotNetNuke is our entire business and we love it, and we will always push the envelope and offer the largest selection of business critical DNN services.
Personally, I think you are being criticized for turning a negative situation for the community a into a rewarding experience for PowerDNN.
Getting back to your security scan tool, you really should reconsider the public availability. Since you are asking for a fee, it could be considered false representation under some circumstances. A better idea would have been to make this a free module, sponsored by PowerDNN, that did a true scan. See the screens below to see how your scan tool can provide false results.
