Client Upgrade and Security Concerns

We've been running multiple MODx sites for many of our clients over the years, from 9.6.2 up to the latest Revo version. Love MODx overall. We're sold as an agency on the framework.

However, one of our existing clients (currently running Evo 1.0.4) is worried about upgrading to Revo -- they're sure that the upgrade process from Evo to Revo is going to be a painful and drawn-out process, due to the many changes between versions.

They are even more concerned with MODx security in general, especially since they were subject to the "Forgot Manager" exploit about a year ago, and blame the CMS for the server breach and cleanup that they had to deal with.

We obviously want to both retain this client for work and keep them using MODX -- but how to convince them that the upgrade and security issues are not going to be a problem? Specifically, we were tasked with bringing a list of the following to our next meeting:

1) Show how the process to upgrade will be seamless and smooth, with steps defined that we can show them. (e.g., is a tutorial available for this upgrade, and is Provisioner still a viable option to migrate content?)

2) Most importantly, we need to provide a clear list of exactly how MODx deals with security issues (they don't just want our opinion). We've pointed already to forums and how proactive the community and core developers are with regards to security, but they're looking for a conclusive list to share with their C-level execs and IT senior staff. We're worried that they will opt for another CMS option if we can't give detailed information about how MODx manages security.

Thanks for your response and help. We'd like to keep this client, and others, using MODx.

Anyone?
Moderators -- surely the word "security" should ring some bells!

1. If you have access (ie. hosting their site), then just make a test instance where you transfer all of their data to Revo; Showing them the significant upgrades and changes.

Although Evo is still being developed, much of the core team is working on Revo, which is a major selling point. If they're worried about security, having direct access to core team security patches is the way to go.

The first mistake they're making is assuming that there is any one CMS thats free from security issues, so switching will not benefit them in the longrun.

From my personal experience, the MODX community/devs are much quicker in releasing patches to security issues. You might go weeks without a drupal/wordpress/etc security patch, or gain 0 support from their community when the security breach is caused by one of the 8 trillion plugins that have been left for dead.

Many of the more popularly used packages are either heavily supported by or directly maintained by the core team, which is more than enough when you want to install them.

So my list is:

1. Many popular working packages are also updated by the core team/expert community members.
2. Security patches for Revo usually go out within a couple days maximum after being discovered vs weeks with 'more popular CMS's, whom might leave a note to disable some integral feature on your site rather than patching it immediately to avoid releasing a patch version earlier than scheduled.
3. Opting for another CMS doesn't inherently deal with security issues. (These could simply be caused by a flaw in PHP itself that wasn't documented or another edge issue)
4. Create a development copy of their website and make a video (so you dont have to do it live in front of them) showing them the upgrade process. It allows you to iron out any kinks ahead of time.
5. Not sure about what you're doing now, and I know its a hassle, but make sure that YOU keep your client updated. We're regularly updating 50+ sites every time a new version comes out for our clients security, (since thats generally when new versions are released; early for a security patch). I think the key thing is how YOU handle security moreso than how modx does. (this isn't an attack Just noting)

If you notice anything strange on a website, i'd report it IMMEDIATELY. We had a russion spammer changing values of our text fields on a couple sites that we manually patched before MODX did, and before we could write a patch/notice post in the forums, they had already fixed it and issued and update.

Thanks Eein -- great points, and much appreciated!

@marknow,

MODX has had the luxury of having one of the best security records amongst the top-20 OS CMSs for the past 8 years and that includes both what became Evo and Revo (http://secunia.com/advisories/search/?search=modx of course check any other OS CMS in there, large or small.) . Admittedly, some of that is due to our smaller profile than the top 3, which accounts for a huge percentage of the entire CMS-driven web. However much of it is the maturity of the development and concern for security in the architecture of the software. In addition, Revo has undergone several security audits for the US Government (through NIST for a MODX Agency in the DC area) and for banks in US and the EU. Findings in these audits affirmed the integrity of Revo. That, though is not to lead to a false sense of security. All software is by it's nature exploitable in the right hands, given enough time.

All software has bugs and vulnerabilities. There is no escaping it. No web software will be without them. If we look at today's headlines (and not just the geeky tech news headlines), the Heartbleed, OpenSSL vulnerability is extremely bad but it's actually been in the software for a year. However, one of the reasons Revo ships without any addons and as few external libraries as possible is because shipping 3rd party add-ons requires that we to some degree manage those, and the Evo team is stuck doing that until Evo sees it's end of life and is part of the reason that it makes it more difficult to ensure it's not insecure.

Here's an outline of how we handle security issues:

• When issues are reported to us we verify and validate the issue can be reproduced.
• Depending on the severity* and or critical nature of the exploit we work on a fix, often times, the reporters actually send along fixes.
• We either release a patch to resolve the issue or incorporate into an upcoming patch release (read asterisked section below).
• We publish a security alert at https://forums.modx.com/board/8/security-notices, if a release is required we'll also include that information into a release announcement in the forums, the blog and through our social media channels. In addition all subscribers to the MODX Insider receive a Security Bulletin when the security notice is published.
• We do our best to ensure that the members of the MODX community and as many MODX users as possible are made aware, and recommend upgrade.

Security is a spectrum and secure software is software that considers it important and responds as quickly as possible to issues. In most cases MODX has a patch (new release) within 24 hours of the report and at most 48 hours. This is how serious we consider web security. We run MODX on MODX.com and at MODX Cloud and we're as concerned about their security and protection as any one of the hundreds of thousands of people who use it. There is no invulnerable software so long as people look at ways to exploit software for illicit or mischievous purposes.

*Vulnerabilities vary in nature and risk significantly. Some, for instance, require a server or computer to already be compromised while others can be hit directly without authorization. We resolve those that are direct access and most damaging first. In the recent case of a vulnerability found in Revo we had a report and by the end of the next day, once confirmed resolved, we had a patch release and send out upgrade notifications to as many channels as was available to us. Other low risk issues would be resolved in a regular patch release. These are of a non critical nature where a session would have to be hijacked (which requires some form of additional vulnerability). [ed. note: smashingred last edited this post 12 years, 6 months ago.]

@marknow,

I neglected to comment on question 1 regarding migration from Evo to Revo. This is something I can't personally answer but I have heard that people have had mixed results with Provisioner and recently mostly good things. At MODX we generally don't use Provisioner but rather do a data export and import in MySQL, regex cleanup the tags and replace Extras that don't work in Revo with ones that do. They are two entirely different codebases and their similarities are mostly on the surface and some shared paradigms.

You may actually wish to ask around on Twitter using hte #modx hashtag.

All the best,

Jay

Thank you, Jay -- possibly the *best security answer I've heard, for any CMS. This is exactly the type of detailed information that we needed to share with our client.

I'm confident now that we can persuade them to stay with MODx and that their security concerns can be mitigated by the steps you mentioned above.

This is another example of why we appreciate the MODx community. Hopefully one day we can contribute somehow to making MODx even more widely used!

*RESOLVED!*

Update to last:

Thanks to the info received here, the client has decided to STAY WITH MODx!
I very much appreciate all who took time to answer, which directly resulted in helping us retain our client on the best CMF available today - MODx.

Mark,

Glad to help. Nice to hear they're sticking with MODX.