Comments on: Should We Use OpenCart? http://blog.ericlamb.net/2010/05/should-we-use-opencart/ Thoughts on programming, people and life Sat, 04 Feb 2012 09:01:37 -0800 hourly 1 http://wordpress.org/?v= By: Macky http://blog.ericlamb.net/2010/05/should-we-use-opencart/comment-page-1/#comment-6537 Macky Tue, 27 Jul 2010 00:47:20 +0000 http://blog.ericlamb.net/?p=3184#comment-6537 Wow. this Daniel guy is truly a moron. He doesn't understand CSRF (duhh.. yeah, you have to be logged in.... and click a link.... OR view a page with the link embedded as img srcf... ever so unlikely!). Like he's never even heard of CSRF and has no idea why every framrwork includes anti-CSRF tokens. And then on top of it, he acts all angry? It's rare to see such complacent stupidity. Actually arguing against fixing this... wow.... I certainly will never use OpenCart. Wow. this Daniel guy is truly a moron. He doesn’t understand CSRF (duhh.. yeah, you have to be logged in…. and click a link…. OR view a page with the link embedded as img srcf… ever so unlikely!). Like he’s never even heard of CSRF and has no idea why every framrwork includes anti-CSRF tokens. And then on top of it, he acts all angry?

It’s rare to see such complacent stupidity. Actually arguing against fixing this… wow…. I certainly will never use OpenCart.

]]> By: Eric Lamb http://blog.ericlamb.net/2010/05/should-we-use-opencart/comment-page-1/#comment-6358 Eric Lamb Fri, 23 Jul 2010 07:37:19 +0000 http://blog.ericlamb.net/?p=3184#comment-6358 Amen man; This <em>is</em> old news… lets just move on. Daniel fixed the issue so all we're doing here is feeding a fire that's already burned out. I'm disabling comments here tomorrow (to give Daniel time to do his customary response :)) Amen man; This is old news… lets just move on. Daniel fixed the issue so all we’re doing here is feeding a fire that’s already burned out.

I’m disabling comments here tomorrow (to give Daniel time to do his customary response :) )

]]> By: Eric Lamb http://blog.ericlamb.net/2010/05/should-we-use-opencart/comment-page-1/#comment-6357 Eric Lamb Fri, 23 Jul 2010 07:32:22 +0000 http://blog.ericlamb.net/?p=3184#comment-6357 Hi David, No where do I say that Open Cart shouldn't be used because of the insecurities; I said it shouldn't be used because the developer, at the time, didn't seem to know how to handle criticism and had straight out refused to fix known security issues. That's the issue here. Think of it another way; imagine if Toyota's response to the Prius acceleration issue was to call people names all the while claiming that there was no issue and doing nothing about it. At the very least you'd be cautious about doing business with them. Exaggerated analogy, to be sure, but the idea is the same. Open Cart had an issue and they were notified and instead of fixing it they went on the offensive. But, as Daniel himself was kind enough to point out, the issue has been fixed. So, while I'm not as reticent to use Open Cart as I once was, I'm still a long way off from recommending it (at least until I see some maturity out of the community). To be honest, I'm a little annoyed at the straw men you've setup though. What does Wordpress being insecure have to do with an online e-commerce solution that once had security holes that went unresolved because of personality issues with the lead developer? Who said that there's software with no security issues and how did you make that connection between the article and the comments to make these conclusions? Please... take your time. I'll wait. Eric Hi David,

No where do I say that Open Cart shouldn’t be used because of the insecurities; I said it shouldn’t be used because the developer, at the time, didn’t seem to know how to handle criticism and had straight out refused to fix known security issues. That’s the issue here.

Think of it another way; imagine if Toyota’s response to the Prius acceleration issue was to call people names all the while claiming that there was no issue and doing nothing about it. At the very least you’d be cautious about doing business with them. Exaggerated analogy, to be sure, but the idea is the same. Open Cart had an issue and they were notified and instead of fixing it they went on the offensive.

But, as Daniel himself was kind enough to point out, the issue has been fixed. So, while I’m not as reticent to use Open Cart as I once was, I’m still a long way off from recommending it (at least until I see some maturity out of the community).

To be honest, I’m a little annoyed at the straw men you’ve setup though. What does WordPress being insecure have to do with an online e-commerce solution that once had security holes that went unresolved because of personality issues with the lead developer? Who said that there’s software with no security issues and how did you make that connection between the article and the comments to make these conclusions?

Please… take your time. I’ll wait.

Eric

]]> By: Joseph De Araujo http://blog.ericlamb.net/2010/05/should-we-use-opencart/comment-page-1/#comment-6355 Joseph De Araujo Fri, 23 Jul 2010 07:05:45 +0000 http://blog.ericlamb.net/?p=3184#comment-6355 It won't prove anything by finding a piece of software that hasn't had any security issues. In my opinion, security wasn't the real issue here, the issue was the response received. The response received led to blogs & bad publicity about a piece of software that is free. Both sides had expectations that were not being met - this is about people, not software or security. If you can't communicate, then you should just write the code, and be done. Let developers that can communicate, pick up the code and explain it to people. This is old news... lets just move on For the price you pay for opencart, you get a very easy to use shopping cart. You also get access to a forum where you can find more resources to further extend your own store from templates, modules and complete overhauls. Sure it's not at the oscommerce stage, but I invite people to look at other carts, then look at opencart and you'll see how easy it is to use in comparison. You will do things so much faster in Opencart & you'll wonder how you got by without it. It won’t prove anything by finding a piece of software that hasn’t had any security issues.
In my opinion, security wasn’t the real issue here, the issue was the response received.
The response received led to blogs & bad publicity about a piece of software that is free.
Both sides had expectations that were not being met – this is about people, not software or security.

If you can’t communicate, then you should just write the code, and be done. Let developers that can communicate, pick up the code and explain it to people.

This is old news… lets just move on

For the price you pay for opencart, you get a very easy to use shopping cart. You also get access to a forum where you can find more resources to further extend your own store from templates, modules and complete overhauls. Sure it’s not at the oscommerce stage, but I invite people to look at other carts, then look at opencart and you’ll see how easy it is to use in comparison.
You will do things so much faster in Opencart & you’ll wonder how you got by without it.

]]> By: David Frasier http://blog.ericlamb.net/2010/05/should-we-use-opencart/comment-page-1/#comment-6350 David Frasier Fri, 23 Jul 2010 06:37:37 +0000 http://blog.ericlamb.net/?p=3184#comment-6350 Good Lord... I'm very new to OpenCart, so I'm hardly here to defend it, the lead developer, or the OC community. I *do* find it odd that there's so much hub-bub over CSRF issue, yet you (the author) use WordPress, which is grossly insecure. CSRF is nothing new, cPanel had it and didn't see the issue as urgent, though they did eventually fix it. You'd have to be simultaneously logged into another site (banking, etc) and also be logged into the OC admin panel. http://www.cpanel.net/2009/08/cpanel-security-update-csrf-cross-site-request-forgery.html I don't mean to be argumentative here, but I see the author and some of the commenters acting like OC is the first software to have bugs or issues, and that it's somehow "unworthy" because of that. Truth is *all* software has bugs. If you don't get that then come back when your voice changes. The true test of any software / open-source community is how the bugs / issues are dealt with. Yes, IMO Daniel could have handled a lot of interactions a whole lot better. Honestly, that goes for roughly 80% of developers out there. Guess what? Lack of social skills is par for the course. Wish it were different, but it's not. Welcome the the world of geeks. They suck at communication. I dare anyone to find ANY software: commercial or open source, that's never had a security issue. Please...take your time. I'll wait. Good Lord…

I’m very new to OpenCart, so I’m hardly here to defend it, the lead developer, or the OC community. I *do* find it odd that there’s so much hub-bub over CSRF issue, yet you (the author) use WordPress, which is grossly insecure.

CSRF is nothing new, cPanel had it and didn’t see the issue as urgent, though they did eventually fix it. You’d have to be simultaneously logged into another site (banking, etc) and also be logged into the OC admin panel.

http://www.cpanel.net/2009/08/cpanel-security-update-csrf-cross-site-request-forgery.html

I don’t mean to be argumentative here, but I see the author and some of the commenters acting like OC is the first software to have bugs or issues, and that it’s somehow “unworthy” because of that. Truth is *all* software has bugs. If you don’t get that then come back when your voice changes. The true test of any software / open-source community is how the bugs / issues are dealt with.

Yes, IMO Daniel could have handled a lot of interactions a whole lot better. Honestly, that goes for roughly 80% of developers out there. Guess what? Lack of social skills is par for the course. Wish it were different, but it’s not. Welcome the the world of geeks. They suck at communication.

I dare anyone to find ANY software: commercial or open source, that’s never had a security issue. Please…take your time. I’ll wait.

]]> By: Trick http://blog.ericlamb.net/2010/05/should-we-use-opencart/comment-page-1/#comment-5645 Trick Mon, 05 Jul 2010 11:39:40 +0000 http://blog.ericlamb.net/?p=3184#comment-5645 I am not a coder,so I can only rely on the coding expertise of others.Logging into the admin of Open Cart is an absolute breath of fresh air in comparison to a lot of other carts.Front end isnt exactly bad either.I suppose like many other future shop owners-we just want a stable cart that just functions,and has enough support in the community to find solutions for any issues that arise. A shopping cart must be a complex thing to pull off-even with a community effort of very bright minds. I am not a coder,so I can only rely on the coding expertise of others.Logging into the admin of Open Cart is an absolute breath of fresh air in comparison to a lot of other carts.Front end isnt exactly bad either.I suppose like many other future shop owners-we just want a stable cart that just functions,and has enough support in the community to find solutions for any issues that arise.

A shopping cart must be a complex thing to pull off-even with a community effort of very bright minds.

]]> By: Joseph De Araujo (Readyman) http://blog.ericlamb.net/2010/05/should-we-use-opencart/comment-page-1/#comment-5595 Joseph De Araujo (Readyman) Sun, 04 Jul 2010 02:02:24 +0000 http://blog.ericlamb.net/?p=3184#comment-5595 Yes, it has been fixed. Yes, it has been fixed.

]]> By: Paul http://blog.ericlamb.net/2010/05/should-we-use-opencart/comment-page-1/#comment-5591 Paul Sat, 03 Jul 2010 21:51:52 +0000 http://blog.ericlamb.net/?p=3184#comment-5591 Hi, Is the CSRF issue fixed now? Thanks Paul Hi,

Is the CSRF issue fixed now?

Thanks

Paul

]]> By: Eric Lamb http://blog.ericlamb.net/2010/05/should-we-use-opencart/comment-page-1/#comment-5302 Eric Lamb Tue, 29 Jun 2010 04:55:43 +0000 http://blog.ericlamb.net/?p=3184#comment-5302 Well said and good advice Joseph :) Well said and good advice Joseph :)

]]> By: Joseph De Araujo http://blog.ericlamb.net/2010/05/should-we-use-opencart/comment-page-1/#comment-5299 Joseph De Araujo Tue, 29 Jun 2010 03:45:27 +0000 http://blog.ericlamb.net/?p=3184#comment-5299 You're right, I used the word taboo and downplayed it too much. I agree with all of what's been said about security issues, & about the way these issues were handled. It's just not the expected response, I know, but that's another issue entirely. However, I only beg that developers who make these types of claims try to give examples of how they themselves could exploit it & not just in opencart - in any situation or software. Ben Maynard did to some extent, but then, I'm guessing due to the response he received, he no longer wanted to help. Some exploits are socially engineered, others are so transparent that you won't even notice. I would feel 'safer' in the knowledge that if there is a security hole that someone has found, that they would take it as seriously as they claim, & document it, to allow other developers to secure their versions. You’re right, I used the word taboo and downplayed it too much. I agree with all of what’s been said about security issues, & about the way these issues were handled. It’s just not the expected response, I know, but that’s another issue entirely.
However, I only beg that developers who make these types of claims try to give examples of how they themselves could exploit it & not just in opencart – in any situation or software. Ben Maynard did to some extent, but then, I’m guessing due to the response he received, he no longer wanted to help.
Some exploits are socially engineered, others are so transparent that you won’t even notice.
I would feel ‘safer’ in the knowledge that if there is a security hole that someone has found, that they would take it as seriously as they claim, & document it, to allow other developers to secure their versions.

]]>