Copyright footer requirement?

I never said that casual visitors could see it, but /manager is still publicly available (albeit not publicly promoted), and an automated trawl of /manager on a set of URLs would find the MODx line. I’m just carrying through the "security" argument.

I am also 100% in agreement with Ryan, given his caveat of "assuming the policy was clear". And in any case if he decides that’s the line MODx takes I will back it. It does not affect me, I keep the copyright in anyway for the reasons I gave before.

And certainly, rebranding needs a hefty licence and is a distinct argument from debranding.

But the thing we actually want to discourage people from doing is being take-take-take without giving anything back; it is very easy to get hung up on one signifier. Respecting the work is not merely about some small print copyright link, it’s about respecting the spirit of the licence and returning genuine value to the greater good.

Quote from: PaulGregory at Dec 11, 2006, 07:54 PM

But the thing we actually want to discourage people from doing is being take-take-take without giving anything back; it is very easy to get hung up on one signifier. Respecting the work is not merely about some small print copyright link, it’s about respecting the spirit of the licence and returning genuine value to the greater good.

Expertly spoken Paul. Brilliant.

I did not mean to come across as wanting to be argumentative with you in my previous comment. I only used your name to encourage people to read your comment before finishing the response I posted. I will refrain from using names in the future as I don’t wish to be misread (just as every poster here also wishes). I absolutely respect your opinion and your effort on these forums. Thank you Mr. Gregory.

-sD-
Dr. Scotty Delicous, Scientist.

Even with 0.9.5, it’s very easy to co-brand MODx to suit your purpose including custom login and welcome pages. Take a peek at manager/media/style/your-theme/login.html and welcome.html... I personally plan on putting a support request form in my own custom default install for clients. (And I’m very certain that most folks aren’t aware of this yet, especially ones that have register_globals on and that can’t get their hosts to turn them off... )

I’m also fairly certain that when there’s a new manager with the next release, there will be a subtle copyright line in the footer in addition to the credits page, which is also due a serious update (overlooked in 095 release, not giving nearly enough credit to folks).

Now, a "whitebox" private label solution is another issue entirely, and those with serious businesses that recognize the amount of work it takes to build a product like MODx will likely be quite happy to pay just a thousand bucks or so a year for a custom in-house solution they can sell for far more than that to each and every one of their clients.

I think the security issues.... unfortunately, but they are a sign of our times, are important and any publicly assessible page should help obfuscate the backend as much as possible. In fact, that could be one more great selling point for MODx. Most systems seem to have tell-tale signs and it doesn’t take long for even someone unexperienced with that particular system to identify it through some recogniable trait or a standard css file that gets called, etc.

The reality is, the people we are concerned about "cheating" the system, are generally not your average bear and will have ways around whatever you come up with. All it does is limit the users who are going to promote and respect the system anyway.

Once logged into the backend, I think that’s a completely different story. And I agree, everyone should be providing value-added services to what they are offering clients so we’re talking about more than just getting a MODx based site from this guy or that. Being able to say that "here is a system that is backed by a team and a strong community; tested by countless users in just about every configuration, system, and environment; and one that if you decide you don’t want to work with me anymore or I get hit by a bus you will be okay," is also a great selling point.

So again, like most things, you can’t stop those that need to be stopped. I think it is better to focus on the benefits and added security of having a completely white-label front end.

The one negative right now is not being able to change the manager directory. The little security issue that popped up recently was really quite minimal compared to most issues that come up with scripts and I think part of that was the natural obfuscation that MODx easily allows. But we can all look at traffic logs and where sites have been probed looking for this file or that directory. Not having a public copyright or requiring a linkback is a great asset.

Another reason to make the directory structure customizable is that there are other things that use directory names and cause conflicts, such as the Tomcat jsp server using "manager". These usually can’t be modified, as they are part of the server infrastructure, so it’s up to the scripts being installed to be able to be flexible enough to work under those circumstances.

Thanks everyone for your replies. This has been very informative...

Sorry if I’ve annoyed anyone with my suggestion, but my idea with the login form which you see in the root of the manager folder was because it’s the only page where if you really didn’t want a client to know you were using MODx, it’s the only page they can stumble across on the front-end where it’s got a copyright footer as standard. I didn’t think making .htaccess load up a static html form instead of the form with the copyright notice on would be seen as such a bad thjing - apologies again Ryan.

It’s not like I was actually going to do it though, I was just saying how you could hide all trace of the copyright without actually technically going against the license or defiling any of the source code.

I did just see an instant flaw in that however, as if someone submitted the wrong credentials in your form, or tried to hack in then they’d still see a mention of MODx when the error popped up, as the form would only submit to the same page the proper login form does so it’s a bit pointless.

It just seemed at the time I posted that you could remove the footers elsewhere to prevent a potential client from seeing branding, but the login form was an obvious place where you couldn’t.

To be honest what I’ve found in the past is it’s generally not even the direct client that’s bothered about what’s under the hood. If it’s good they tend to be more bothered about their competition finding out what it is

Anywho, as Martin says, this thread has been very informative and I know a bit more about what should and shouldn’t be done.

Quote from: rthrash at Dec 11, 2006, 09:11 PM

Now, a "whitebox" private label solution is another issue entirely, and those with serious businesses that recognize the amount of work it takes to build a product like MODx will likely be quite happy to pay just a thousand bucks or so a year for a custom in-house solution they can sell for far more than that to each and every one of their clients.

The only problem with this is that if the business stops essentially reselling MODx as part of their services, or if the business stops trading, how do you work this out? Since they’ve made more money from the MODx project than they’ve had to pay each year, do you have a minimum term they have to be signed up for, or if they stopped using it do you just end the "contract" (as good a word as any) after the current year?

It’s certainly a good way to get a steady income for the project though.

As a temporary solution,couldn’t a plugin be built so that the manager login is simply different ?

Displaying the ModX copyright notice on the page could also be somewhat of a security issue ( hackers could find your site easier once search engines index the pages that have it) , and for people to better protect their websites from a zero-day exploit,it might be better not to display it by default , or to easily make it optional.[include all copyright notices in chunks, e.g.: {ModXCopyrightNotice}].

I found that manager pages are not indexed in Google (they just don’t have a link I guess,since there is no restriction for the search engine bots either in meta tags or robots.txt ) , and I have tried to find such a page indexed , and haven’t succeeded thus far. However, the fact that a sitemap or some other place (a article for editors/etc) could contain a link to them ,and thus pose a potential problem.


The people that really want to contribute to ModX can do it in a lot of ways , recognizing the power of the ModX CMF/CMS through copyright notices is powerfull voluntary marketing (as in word of mouth) but is certainly not the only way .

PS: I finally state that the copyright notice should still stay by default ,but it should be a lot easier to eliminate in all of the public pages that ModX displays (as core php code is not a problem:) ).