I was just directly notified by DNN Modules, that I should lock down my sites because some of them are still running DNN 3.2.  I feel these sorts of notifications are an absolutely imperative aspect of running a professional-grade platform.  Why wasn't this told to us directly by DNN?

Actually that's not accurate; the problem exists in 3.2.2 and possibly earlier versions as well. 3.2.2 is an actual production version, still available for download.  Since many users still continue running it, and earlier versions, this begs the question again:  why was this not announced --- not even to Platinums?

Bugs are inevitable but how can I have confidence in a platform which doesn't follow the industry-standard methodology of publishing patches and notifications of security holes --- even to its most-trusted sponsors?

ah okay, since I was mentioned.  Notice I didn't post in here, just my own forums for our customers.  And since Shane hosts our site, I sure wanted him to know about it as well.

Shane's point is his own, and I happen to think it's a really good one.  You're almost implying I shouldn't have informed my clients of potential issues outside of our own code.  I happen to be concerned about our credibility, and DotNetNuke's use of unauthorized and unapproved statements in regards to us.  If the comment is, well, we should inform our customers, then so be it - but then again, informing our users of an issue does not seem out of my realm of responsibility. Since there is no bulletins for any release of DNN,  this would seem to indicate that no security corrective fixes in DNN at all in the last two some odd years.  Thus my conclusions. 

Unlike core team (which Cathal - purportedly you approved the content), I didn't blather it all over the place and in here, nor release any technical details at all, and definitely no details that someone could even derive what the possible issue is and therefore, exploitable sites.  That and any ancillary reporting, I left up to dotnetnuke's security team.

Anyways, this wasn't meant to be a forum post in here, otherwise, I would have done that first.

Cheers,

Richard
DNN Modules