Beware of ASTPP 6.0 Community Edition (Inextrix).

[RandomSeed]

Good day all,

Just posting this here because the original post may get deleted soon. I personally looked at this product a number of times but it never felt right that they attract customers to their Community Edition that is not maintained and is using a version of CodeIgniter that is 15 years old.

Thanks to ScITGmbH who writes on their forum:

"While reviewing ASTPP 6.0 Community Edition before putting it into production, we found code that collects personal data of all active accounts plus details about the server, and sends them once a day to a server of the vendor. We found no mention of this in the repository’s documentation or in the installation guide, and the admin interface has no setting for it."

ASTPP 6.0 sends data about all your customers to the vendor every day (dcoll.inextrix.com)

While reviewing ASTPP 6.0 Community Edition before putting it into production, we found code that collects personal data of all active accounts plus details about the server, and sends them once a day to a server of the vendor. We found no mention of this in the repository’s documentation or in...

forum.astppbilling.org

I'm surprised that ScITGmbH was able to post this as most of the time posts are reviewed.

The above is subsequent to a security advisory posted here https://forum.astppbilling.org/t/se...nomaly-detected-in-version-6-0-community/3053 .

Attached is a PDF of the forum page, as well as a zipped archive of the page "Firefox Web Page, Complete.

Regards.

Edit: Can't upload the zip due to file size limit.

 

[RandomSeed]

PM me if you want the zip file.

 

[pbxgeek]

Ah, that's too bad. I don't use them personally, but I know a lot of folks who do.

 

[RandomSeed]

It is. They’ve removed the tracking and are working on the bugs. But the apathy towards the Community is catching up with them. This isn’t just an oops. It’s reckless and irresponsible behaviour. This is who they are. This is their company ethos. I’ve never seen them respond so quickly before, with anything community related–because they’re in deep sh1t.

They announced version 7 of a community version, but months and months went by and they canned it after keeping everyone in limbo–like a bait and switch. It’s pseudo open source software. They refused to answer if there was going to be a Community Edition of version 7. They just keep quiet. So as to imply that if they’re not getting paid, they’re not responsible, or not even culpable–guess again.

Honestly, they should change the license terms so folks can fork it and actually be allowed to contribute (they don’t accept pull requests), and focus on commercial software. They provide paid support for the Community Version, and patch those customers before releasing anything publicly, or at all–like some sort of resentment towards folks running successful businesses with the Community Version for zero $.

Doesn’t affect me so much as I’m tired of organisations getting away with blatant dishonesty.