I like both options, I'll talk to the company buying the app, see if
they can negociate any source code release, I doubt it but you never
know.
The second option is the one that I'd like to go with but all I've
been paid to do is to get the app installed and running as quickly as
possible, there are no funds for me to spend time setting up the extra
environment. I may have a go on my own dev box to see how easy it
would be so that if there are any problems I would have a working
solution ready to implement.
Either way, I've made sure that my client knows that I'm not happy
with the app and I've documented all I've found so far along with my
concerns. I guess that is about all I can do for now then.
Ta
Robin
On 8/19/06, Attila-Mihaly Balazs <abalazs@bitdefender.com> wrote:
I see two possible solutions. First maybe you can leverage your (and by
this I mean your companies) buying power to get the source code. Maybe
you can work out a plan with management (yeah, right :) ). Something
along the lines you find X vulnerabilities and then you (your company)
presents the findings in a report which goes along the lines: your code
is very insecure and if you want you to buy your product, sell it with
the source code (probably you have to sign some kind of agreement about
not redistributing the source code, but at least you can take a look at it).
An other way would be to separate it off your main server by using a
virtual machine, an other chrooted instance of apache / mysql or
something like that. Backup that virtual server often and make the
access as restricted as possible. Make sure you write down the risks the
installation of this application creates and communicate it to
management, so when it blows up they can't point their fingers at you.
Hope this helps.
--
This message was scanned for viruses by BitDefender for Linux Mail Servers.
For more information please visit http://www.bitdefender.com/
-------------------------------------------------------------------------
Sponsored by: Watchfire
Watchfire was recently named the worldwide market leader in Web
application security assessment tools by both Gartner and IDC.
Download a free trial of AppScan today and see why more customers choose
AppScan then any other solution. Try it today!
https://www.watchfire.com/securearea/appscancamp.aspx?id=701500000008VnB
--------------------------------------------------------------------------
