Page 13 Any PowerDNN users? - Community Member Announcements

New Community Website

Ordinarily, you'd be at the right spot, but we've recently launched a brand new community website... For the community, by the community.

Yay... Take Me to the Community!

Welcome to the DNN Community Forums, your preferred source of online community support for all things related to DNN.
In order to participate you must be a registered DNNizen

Home All Forums

5/21/2008 5:41 PM

Michael Washington

www.LightSwitchHelpWebsite.com
Joined: 7/17/2004

Posts: 3526

Re: Any PowerDNN users?

JohnGrange wrote

I think people are also misunderstanding the situation in a number of ways.

John stop. Please. I am guilty of trying to get the patch for free (because I provided free advertising for PowerDNN on my site). I was assuming security@dotnetnuke.com was working on the issue but did not release a patch yet. I saw an opportunity to "get my sites fixed now" and I took it. I was wrong (the only reason I did not get my sites patched was because PowerDNN wanted FTP access to my site).

Just admit PowerDNN made a mistake and refund any money you took. If you do that I think the "community" can find forgiveness.

Michael Washington
http://ADefWebserver.com

A Free Open Source DotNetNuke Help Desk Module

5/21/2008 5:45 PM

Pat Cummings

Joined: 7/23/2003

Posts: 64

Re: Any PowerDNN users?

PowerDNN:

I guess I do not understand why a vulnerability would be posted to a public site before a fix is applied.

Generally a good process to use is to fix the issue first then post the details. I understand you need to help your customers, however posting and making the vulnerability public creates another problem.

I could care less about someone charging for a fix. It’s the process of notifying the public that a vulnerability exists and that some systems are affected. On top of that a person can check whether another remote system is affected and proceed to target.

I think that’s the crux of the contention you are hearing from the community.

I think you should remove any posting and or tools from your public site until a fix is sent to the general public. What is your answer to this?

5/21/2008 5:45 PM

Scott Willhite

alkihomes.com
Joined: 4/11/2003

Posts: 3047

Re: Any PowerDNN users?

Pursuant to our forum policy, I am locking this "announcement" thread. Please feel free to continue this convesation in one of our more conversation oriented forums so that our announcements may remain timely.

Kind Regards,
Scott

Scott Willhite, Co-Founder DNN

"It is only with the heart that one can see rightly... what is essential is invisible to the eye. "
~ Antoine de Saint-Exupéry

5/21/2008 5:49 PM

Sebastian Leupold

www.dnnwerk.de
Joined: 3/8/2004

Posts: 46212

Re: Any PowerDNN users?

Alex Shirley wrote

Not only are there apparent vulnerabilities with sketchy details, but we now have a site that allows Tom, Dick, Harry, everybody else, and their dog to look at the security issues of everyone’s DNN website in mere seconds. IF indeed the website actually scans and checks for vulnerabilities rather than just anticipate them?... and all of us dance around like headless chickens :). In this case I think we are entitled to, that is because we don't exactly know the impact, because rightly or wrongly we assume the worst, and because the cat was out of the bag before the solution was made available. Plus there is a tool that apparently allows me to know that YOUR website is effected.

Alex,

as far as I understood, the "Scan" simply retrieves the installed DNN's version number and issues a list of potential security risks, I did run it against a customers site, which is not affected by previous issues due to its configuration (like being a single portal installation with host = admin, i.e. no risk of the admin gaining host permission) and the service listed the two assumingly identified new issues as all published security bulletins issued by DNN since that version (even if affecting later versions solely). To me, this scan does not really sound like a valuable service and, since noone had the chance to validate the changed code applied to the site, you cannot be sure that a) it fixes the issue and b) does not harm or damage your portal software. I would be very careful with accecpting any service like this.

Cheers from Germany,
Sebastian Leupold

Speed up your DNN Websites with TurboDNN

Page 13 of 13

...12

These Forums are dedicated to discussion of DNN Platform and Evoq Solutions.

For the benefit of the community and to protect the integrity of the ecosystem, please observe the following posting guidelines:

No Advertising. This includes promotion of commercial and non-commercial products or services which are not directly related to DNN.
No vendor trolling / poaching. If someone posts about a vendor issue, allow the vendor or other customers to respond. Any post that looks like trolling / poaching will be removed.
Discussion or promotion of DNN Platform product releases under a different brand name are strictly prohibited.
No Flaming or Trolling.
No Profanity, Racism, or Prejudice.
Site Moderators have the final word on approving / removing a thread or post or comment.
English language posting only, please.

Products

Solutions

Resources

Partners

Community

Blog

About

QA

Ideas Test

New Community Website

DNN Corp. (DotNetNuke)