<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body dir="auto"><div><br></div><div id="AppleMailSignature">While I think the tone of this email is a bit aggressive I do find the comments valuable (and terrifying). To date the tenor of this list has been shall we say "we're working on it" with no clear roadmap that at least I can follow. It's seemed a little rudderless at times. I feel if the vtiger team engaged a little more situations like this might be avoided. </div><div id="AppleMailSignature"><br></div><div id="AppleMailSignature">I'll add the timelines stated might be a little unreasonable as others besides you might like their issues worked on. <br><br>Sent from my iPhone</div><div><br>On Apr 23, 2018, at 10:07 AM, Błażej Pabiszczak <<a href="mailto:b.pabiszczak@yetiforce.com">b.pabiszczak@yetiforce.com</a>> wrote:<br><br></div><blockquote type="cite"><div><meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
<p>@Prasad</p>
<p>Who is all this marketing spam for? Security, safety, and data privacy aren’t your priorities. If that were the case you’d have a different approach for all these years. If we cared about publicity we’d post all these errors to CVE and LinkedIn, in large groups that have 100k-200k members, like the Open Source group. For now we just want to embarrass you, so that you get stuff done.</p>
<p>The majority of the errors that we’re going to publish will be sent to you earlier [what email address should we send it to?] so you have some time to fix them; depending on the type of an error it will be 7,14, or 21 days. If you don’t fix them [like coreBOS does] then we’ll stop reporting them to you and you will find out about them on the day we publish the articles.</p>
<p>Please don’t try to convince people that this system is safe because it isn’t. You’re not in touch with any security consultants; if you are you should change them. You’ve never had a decent security audit, and even if there was any it must’ve been short and a very long time ago.</p>
<p>I’ll tell you how things are right now:</p>
<ol>
<li>You don’t follow any standards as far as creating software is concerned, eg. PSR</li>
<li>You don’t analyze the code statically improving it according to current standards, eg.: <a href="https://insight.sensiolabs.com/," target="_blank" rel="noreferrer">https://insight.sensiolabs.com/,</a><span> </span><a href="https://scrutinizer-ci.com/," target="_blank" rel="noreferrer">https://scrutinizer-ci.com/,</a><span> </span><a href="https://sonarwhal.com/" target="_blank" rel="noreferrer">https://sonarwhal.com</a><span> </span></li>
<li>You have no unit/automatic tests.</li>
<li>You don’t follow OWASP ASVS guidelines</li>
<li>You don’t fix errors, you suppress them instead, and compatibility with the latest PHP versions is done with as little effort as possible.</li>
<li>You don’t know what libraries you use, many of them have security errors. It took us several months to clean up and update libraries, how long will it take you?</li>
<li>You don’t know under what license your libraries are, you still use GPL/AGPL in your system.</li>
</ol>
<p>And what does the security look like? It’s terrible, believe me. Please provoke me [block me here for example] or keep saying that the system is safe, then I’ll do what I don’t have time to do; I’ll write a few dozen articles, each with critical security vulnerabilities. Please tell your community:</p>
<ol>
<li>When are you going to update libraries to the latest versions? The’re full of holes! Eg.: jQuery 2.1.1 [CVE-2015-9251, CVE-2016-10707].</li>
<li>When are you going to move key files away from public_html?</li>
<li>When are you going to start checking permissions to each module, action, record; instead of what you do now, which is creating dozens of weird exceptions that lower the security level?</li>
<li>When are you going to properly [and centrally] check/clean data sent in request [especially when it comes to HTML files]</li>
<li>When are you going to verify security and quality of the addons in <a href="https://marketplace.vtiger.com/app/listings" target="_blank" rel="noreferrer">https://marketplace.vtiger.com/app/listings</a><span><span> </span>because the products available there aren’t under any control.</span></li>
<li>When are you going to present the results of security audits performed by a reputable company that specializes in web applications?</li>
</ol>
<p>Every week we’ll publish 1-2 articles related to coreBOS/Vtiger/VTE/SuiteCRM/EPESI, I hope you change your approach and start improving the core of your system.</p>
<div>---<br>
<p>Z poważaniem / Regards</p>
<div>
<div><strong>Błażej Pabiszczak</strong></div>
<div>M: +48.884999123<br>E: <a title="Mail do Błażej Pabiszczak" href="mailto:b.pabiszczak@yetiforce.com" rel="noreferrer">b.pabiszczak@yetiforce.com</a></div>
</div>
</div>
<p><br></p>
<p>W dniu 2018-04-20 13:44, Prasad napisał(a):</p>
<blockquote type="cite" style="padding: 0 0.4em; border-left: #1010ff 2px solid; margin: 0"><!-- html ignored --><!-- head ignored --><!-- meta ignored -->
<div dir="ltr">
<div class="gmail_default" style="font-family: arial,helvetica,sans-serif;">I hope you are following issue tracker as well.</div>
</div>
<div class="gmail_extra"><br clear="all">
<div>
<div class="gmail_signature">
<div dir="ltr">
<div>
<div dir="ltr">
<div>
<div dir="ltr">
<div>
<div dir="ltr">
<div>
<div dir="ltr">--</div>
<div dir="ltr"><span style="border-collapse: collapse; font-family: arial,sans-serif; font-size: 13px;"><a style="color: #0000cc;" href="http://www.facebook.com/vtiger">FB</a> I </span><a style="color: #0000cc;" href="http://twitter.com/vtigercrm">Twit</a> I <a style="color: #0000cc;" href="https://www.linkedin.com/company/1270573?trk=tyah">LIn</a> I <a style="color: #0000cc;" href="https://blogs.vtiger.com">Blog</a> I <a style="color: #0000cc;" href="https://www.vtiger.com/">Website</a></div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
<br>
<div class="gmail_quote">On Fri, Apr 20, 2018 at 5:11 PM, socialboostdk <span><<a href="mailto:socialboostdk@gmail.com">socialboostdk@gmail.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin: 0 0 0 .8ex; border-left: 1px #ccc solid; padding-left: 1ex;">
<div dir="ltr">+1
<div> </div>
<div>Also avoid using users email to hash passwords. Its crap + means that you cannot change email without also changing password...</div>
</div>
<div class="gmail_extra"><br>
<div class="gmail_quote">
<div>
<div class="h5">On 20 April 2018 at 13:31, Conrado Maggi <span><<a href="mailto:comaggi@gmail.com">comaggi@gmail.com</a>></span> wrote:</div>
</div>
<blockquote class="gmail_quote" style="margin: 0 0 0 .8ex; border-left: 1px #ccc solid; padding-left: 1ex;">
<div>
<div class="h5">
<div dir="ltr">Basically, Not doing this: <a style="font-family: Verdana,Geneva,sans-serif; font-size: 13.333333015441895px;" href="https://unsecure.blog/en/114-vtigercrm-storing-passwords-in-md5.html">https://unsecure.blog/en<wbr>/114-vtigercrm-storing-passwor<wbr>ds-in-md5.html</a><span style="font-family: Verdana,Geneva,sans-serif; font-size: 13.333333015441895px;"> </span>
<div><span style="font-family: Verdana,Geneva,sans-serif; font-size: 13.333333015441895px;"> </span></div>
<div><span style="font-family: Verdana,Geneva,sans-serif; font-size: 13.333333015441895px;">Conrado</span></div>
</div>
<div class="gmail_extra"><br>
<div class="gmail_quote">
<div>
<div class="m_5439000999589711979h5">On Fri, Apr 20, 2018 at 12:22 PM, Prasad <span><<a href="mailto:prasad@vtiger.com">prasad@vtiger.com</a>></span> wrote:</div>
</div>
<blockquote class="gmail_quote" style="margin: 0 0 0 .8ex; border-left: 1px #ccc solid; padding-left: 1ex;">
<div>
<div class="m_5439000999589711979h5">
<div dir="ltr">
<div class="gmail_default" style="font-family: arial,helvetica,sans-serif;">Thank you for the references. We are in touch with few wise security advisories as well.</div>
<div class="gmail_default" style="font-family: arial,helvetica,sans-serif;"> </div>
<div class="gmail_default" style="font-family: arial,helvetica,sans-serif;">The intent behind the post was to raise the awareness of quality of information that need to be exchanged</div>
<div class="gmail_default" style="font-family: arial,helvetica,sans-serif;">when understanding the security issue.</div>
<div class="gmail_default" style="font-family: arial,helvetica,sans-serif;"> </div>
<div class="gmail_default" style="font-family: arial,helvetica,sans-serif;">Regards,</div>
<div class="gmail_default" style="font-family: arial,helvetica,sans-serif;">Prasad</div>
<div class="gmail_default" style="font-family: arial,helvetica,sans-serif;"> </div>
</div>
<div class="gmail_extra"><br clear="all">
<div>
<div class="m_5439000999589711979m_7948517322867671089m_-2987375863098724244gmail_signature">
<div dir="ltr">
<div>
<div dir="ltr">
<div>
<div dir="ltr">
<div>
<div dir="ltr">
<div>
<div dir="ltr">--</div>
<div dir="ltr"><span style="border-collapse: collapse; font-family: arial,sans-serif; font-size: 13px;"><a style="color: #0000cc;" href="http://www.facebook.com/vtiger">FB</a> I </span><a style="color: #0000cc;" href="http://twitter.com/vtigercrm">Twit</a> I <a style="color: #0000cc;" href="https://www.linkedin.com/company/1270573?trk=tyah">LIn</a> I <a style="color: #0000cc;" href="https://blogs.vtiger.com">Blog</a> I <a style="color: #0000cc;" href="https://www.vtiger.com/">Websi<wbr>te</a></div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
<div>
<div class="m_5439000999589711979m_7948517322867671089h5"><br>
<div class="gmail_quote">On Fri, Apr 20, 2018 at 3:20 PM, IT-Solutions4You <span><<a href="mailto:info@its4you.sk">info@its4you.sk</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin: 0 0 0 .8ex; border-left: 1px #ccc solid; padding-left: 1ex;">I found this interesting project<br> <a href="https://hacktrophy.com/en/price-ethical-hacking/">https://hacktrophy.com/en/pric<wbr>e-ethical-hacking/</a><br> <br> I think to contact them for scanning vtiger. Maybe you(vtiger) can cooperate, basically it's your software ;-)<br> <br> Matus<br> <br> Dňa 20. 4. 2018 o 10:54 Prasad napísal(a):<br>
<blockquote class="gmail_quote" style="margin: 0 0 0 .8ex; border-left: 1px #ccc solid; padding-left: 1ex;">
<div>
<div class="m_5439000999589711979m_7948517322867671089m_-2987375863098724244h5">Dear members,<br> <br> Security and Data-Privacy is our top priority.<br> <br> Without providing much details citing security concern on public channels is more like whistleblowing, which does no good but creates suspicion in those who aren't full aware of the details.<br> <br> If you are aware of a security risk or suspect a possible hole that<br> can give attacker ability to gain customer data, please feel to reach to us<br> with complete details or file the issue on our tracker to keep our community informed.<br> <br> Regards,<br> Prasad<br> <br> </div>
</div>
______________________________<wbr>_________________<br> <a href="http://www.vtiger.com/">http://www.vtiger.com/</a><br> </blockquote>
<br> <br> ______________________________<wbr>_________________<br> <a href="http://www.vtiger.com/">http://www.vtiger.com/</a></blockquote>
</div>
</div>
</div>
</div>
</div>
</div>
______________________________<wbr>_________________<br> <a href="http://www.vtiger.com/">http://www.vtiger.com/</a></blockquote>
</div>
</div>
</div>
</div>
______________________________<wbr>_________________<br> <a href="http://www.vtiger.com/">http://www.vtiger.com/</a></blockquote>
</div>
</div>
<br>______________________________<wbr>_________________<br> <a href="http://www.vtiger.com/">http://www.vtiger.com/</a></blockquote>
</div>
</div>
<br>
<div class="pre" style="margin: 0; padding: 0; font-family: monospace">_______________________________________________<br> <a href="http://www.vtiger.com/">http://www.vtiger.com/</a></div>
</blockquote>
</div></blockquote><blockquote type="cite"><div><span>_______________________________________________</span><br><span><a href="http://www.vtiger.com/">http://www.vtiger.com/</a></span></div></blockquote></body></html>