We launched new forums in March 2019—join us there. In a hurry for help with your website? Get Help Now!
    • 33014 ☆ A M B ☆
    • 1,231 Posts

    http://forum.modx.jp/viewtopic.php?f=34&t=839
    Remake Russian theme
      • 28439
      • 222 Posts
      Hello Ryan,

      thanks for answering in this thread.

      For me, an integrator is the same as a gatekeeper.

      I really do understand, that you are panicked about security issues, I'm with you in this. This is one of the reasons, that I developed a PHPIDS detection for Evo and it does run on every Evo instance, where I have my hands on. yama and I are working on a solution, to get more security on password hashes, because, as demonstrated in this forum, with a crappy snippet, one is able to get access to Evo.

      The people that are involved in the progress of the development are the "us". Speaking for myself, I fear, that the work all this people have done, will never find the way into an Evo release. For example take the history of the changes done by the Japanese community. To make it clear in four words: They have a fork.

      The reason was, that nobody wanted to take their code back, or work with them on the format issues, which where correct. But as you might see, that could be done by some encouraged people, who where willing to spend their spare time on this.

      At the moment, the "them" is your side, because it felt like even my cat listens more to me, than the people involved in MODX. This led to the feeling, that Evo is not longer of any interest and it might come into your way, by having features, that are not available with Revo by now.

      My words where to wake you up and start a discussion, how you want to integrate the community further on. Let's see, if this is the start for an open discussion about the future of Evo.
        Gone away and found a better place to stay
        • 28042 ☆ A M B ☆
        • 24,524 Posts
        Indeed, personally I am much dismayed at the though of a fork, but something has to be done.

        What, exactly, do you want to see, Ryan? One change at a time submitted? Is it possible to somehow accept the entire updated package once Stefanie has finished with her unit tests? (not that I know what a "unit test" is, other than that they are a Good Thing)
          Studying MODX in the desert - http://sottwell.com
          Tips and Tricks from the MODX Forums and Slack Channels - http://modxcookbook.com
          Join the Slack Community - http://modx.org
          • 36595
          • 29 Posts
          EVO it very well, albeit it is not as ambitious as a revolution but it is worth what would be given a little time and support it.
          Stefanie and yama did a great job and I would like to have their work is not lost in vain as the result of evo 1.1 Released.
            • 28439
            • 222 Posts
            Sorry, that I have to disappoint you, Susan, but unit tests do not extend the security, they are for tests, that everything works as expected.

            For security tests one has to use vulnerability scanners. They help to find possible security issues. But in the end, every software has to be treated as insecure because of the human factor.
              Gone away and found a better place to stay
              • 28042 ☆ A M B ☆
              • 24,524 Posts
              Well, yes, I knew that much. There's no way a computer can be programmed to detect all the foolishness humans are capable of. But if a function behaves as expected, and is written to certain standards, I would presume that would at least reduce the chances of unexpected behavior opening security vulnerabilities. If we know exactly what everything is doing and where every function and variable comes from, then it's much easier to detect and fix them when they do occur.

                Studying MODX in the desert - http://sottwell.com
                Tips and Tricks from the MODX Forums and Slack Channels - http://modxcookbook.com
                Join the Slack Community - http://modx.org
                • 3749
                • 24,544 Posts
                I've pretty much stayed out of this topic because my work is centered on Revolution now, but I thought I should throw in my $.02. This is just my opinion and not necessarily worth anything, but I don't think you can expect solid support for Evo. Not because the MODX team doesn't mean well by Evo, but because there just isn't enough programmer time available.

                Now that they're working on the cloud platform, the small number of core programmers don't really even have time to fix the bugs in Revo, the Forums, and the main Revo add-ons.

                If you look through the bug tracker, you can see bugs in all three that have been open for some time. I've filed a number of confirmed but non critical Revo bugs that have gotten the "fix version" pushed back several times because no one had time to work on them. I'm still seeing the blank console in Revo 2.2.2. The Forum has been mangling code, eating carriage returns, and throwing gateway timeouts for a long time. There's a pull request for a fix to a non-trivial bug in the ConfirmRegister snippet that no one (as far as I know) has had time to look at.

                I don't say any of this to be critical, just to point out that the MODX programmer resources are limited. I would expect that Evo, important as it is, will not have a higher priority than the things I've listed (especially MODX Cloud, which is probably more important for MODX's long-term success than Revo).

                The problem with Evo is that because it was developed so long ago and so many parts were tacked on haphazardly, it's almost impossible to add the functionality that would make it usable in the future. The underlying architecture is, frankly, a mess. The last time I looked, in Evo snippets, plugins, chunks, TVs, and templates each have their own separate code. In Revo, they all extend the modElement object which extends the basic xPDO object. Creating Package Manager in Evo would be a nightmare and it's really a necessity for a modern CMS. Version Control, extremely difficult to implement in Evo, is another example.

                The same is true of essential tools like PackMan and MyComponent for creating Transport Packages. PackMan lets you build an add-on component in Revolution (if it's not too complex), then create a Transport Package for it by filling in a form in the Manager. I'm working on a version of MyComponent that will do the same thing with more complex packages. Again, both would be almost impossible in Evolution.

                You can take an old, often modified, pre-OOP snippet and continue to shoehorn new features into it, but at some point, you rewrite it from scratch as an elegant OOP snippet. Evo, much as we all love it, is like that old snippet and Revo is the OOP version of it. There's no better example of this than what we ask the user to do to install an add-on component. If you look at the SPForm tutorial at my site and compare the installation instructions, you can see the dramatic difference. In Revo, you have a working contact form with a few mouse clicks. In Evo, not so much.

                It's just not acceptable these days to ask a new CMS user to cut and paste PHP code in order to install or upgrade an add-on component.

                I'm really impressed with all the energy and hard work being put into Evo, but I sometimes wonder if it wouldn't be better to build a new, Evo-like Manager for Revo that used Evo's security model and faster Manager, and Revo's Package Management and underlying architecture to give you the best of both platforms. Call it Revo-lite and it would be perfect for smaller web sites that don't need to scale or use the more granular security model of Revolution.

                Public relations is definitely not my strong suit, which is part of why I've hesitated to jump into this topic. I sincerely hope that I haven't offended anyone with this post. I'm sure a more tactful person could have made these points in a much more diplomatic way. I want to emphasize that I don't speak for the MODX team here and that my assumptions may be way off base.

                  Did I help you? Buy me a beer
                  Get my Book: MODX:The Official Guide
                  MODX info for everyone: http://bobsguides.com/modx.html
                  My MODX Extras
                  Bob's Guides is now hosted at A2 MODX Hosting
                  • 4172
                  • 5,888 Posts
                  But in the end, every software has to be treated as insecure because of the human factor.

                  There's no way a computer can be programmed to detect all the foolishness humans are capable of.


                  must not necessarily be so. Read about Reliably Secure Software Systems:
                  http://www.reliably-secure-software-systems.de/proposal-en.html
                  http://www.mais.informatik.tu-darmstadt.de/Heiko_Mantel_Publications.html

                  not that I understand, about what they are talking.
                    -------------------------------

                    you can buy me a beer, if you like MIGX

                    http://webcmsolutions.de/migx.html

                    Thanks!
                    • 28439
                    • 222 Posts
                    Sorry Bruno, but there are always ways to hack a System. First you need language that is secure by design. For this I prefer Ada.

                    There are so many security violations arround by design, here is one example:
                    With HTML5, CSS, and SVG one can write keyloggers without JavaScript. At this moment you can use that on every browser, including the crappy IE up from version 8.
                      Gone away and found a better place to stay
                      • 28042 ☆ A M B ☆
                      • 24,524 Posts
                      Check out the SkinGraft module for the beginnings of a package manager. It will install chunks and TVs. It even generates the files necessary for inserting TVs, as well as the skin.php configuration file.
                        Studying MODX in the desert - http://sottwell.com
                        Tips and Tricks from the MODX Forums and Slack Channels - http://modxcookbook.com
                        Join the Slack Community - http://modx.org

                      This discussion is closed to further replies. Keep calm and carry on.