In reply to Rick.

Lastly,

I see the Tavern filtered off some of the tsk_RemoveWpVersion() maybe they can put that back in.

tsk_RemoveWpVersion()

OK, we'll try that. just reverse the front and end.

return '>meta name="generator" content="SquirrelsGoneWild"/<';

-------

Security as a whole. As I said in a prior article, eCommerce and CMS dont mix.

It doesnt matter if the ecommerce plugin or extension is secure as a rock. IF data is compromised both site owner and/or the developer/design firm can be held libel. That comes direct from a attorney who prosecutes such things.

ANY customer data, shipping addresses, what they purchased, their names etc. are ALL datum that cannot LAWFULLY be disclosed without their consent. Period.

Your attorney cannot call Amazon and request all order Jeff C. has placed, in fact, Amazon cannot disclose if Jeff C. is even a customer to any entity other than the transactors unless via court order.

If a site is compromised by whatall, some other plugins security flaw .vs. the commerce package itself is COMPLETELY immaterial. Makes no sense?

Lets look at it this way. Sarah V. orders jewelery online. She lives in Norfolk VA. The database is compromised due to some plugin. Even though her credit card information is not there nor her paypal login data whatall. Her orders are. The amounts are. Her address is. She's ordered $80,000 in fine jewelery over the past year. A hacker knows where she lives, what she's bought, perhaps her phone number. He calls a crew in Norfolk and they break into her house.

Anything can and DOES happen.

This is WHY it cannot be disclosed. A court of law does not care if "Mr Commerce plugin is secure" and the comment plugin wasnt. It is the ecommerce entities fiduciary responsibility to do their BEST to ensure the security of the PLATFORM (not JUST the plugin!).

Since "Jeannies Jewelery" contracted Bob's Web Design to do the site Bob's can also stand in the path of libel/damages. IRREGARDLESS OF DISCLAIMERS as DISCLAIMERS do NOT circumvent liability in the eyes of breach of LAW.

That'd be like saying, "Well... See the bar had me sign a disclaimer that I or anyone I hit while driving drunk after leaving the bar voids them of libel". Not at all. They let the drinker go out the door snot stinking drunk knowing he could not drive and 5 people were killed due to it".

Law says, "This disclaimer means nothing."

Or, Your toaster had a form that needed be signed saying "We are not libel if this toaster under normal use catches fire" or even if its implied in the paperwork accompanying the toaster. 10,000 peoples toasters catch fire and because you signed or had an implied disclaimer of liability means NOTHING in as far as a court action goes.

The toasters were defective.

In as far as the ecommerce PLATFORM security goes "It was defective".

This is WHY standards exist and WHY applications complying WITH those standards SUBMIT their applications to BE approved of meeting or exceeding those standards. THUS there is a LEG to stand on.

Now the plugin/extension developer may well be able to bring in a independent security expert who goes over their code and says, "Yep. This is solid as a rock". Ok, they stand in no target of libel. Doesnt mean the ecommerce owner or developer/designer of their site is scott free. Again, the ecommerce owner TRUSTED in the developer/designer and the developer/designer trusted in the plugin developers of the ratings widget and all the disclaimers in the world dont void liability when law has been breached. They are worthless in fact pretty much.

Theft of data surrounding their address, names, orders, amounts etc. all cannot lawfully be obtained by ANY party except the transactors and court. Anything other than that is illegal whether its one consumer or 50,000.

UNLESS terms of services agreements that the CONSUMER signs off on ALLOW sharing of the data. For example, Amazon may share with some book publisher demographical data under the terms of services user agreement (which people never read but nonetheless does not VOID it). But even with the BESTEST off terms of services agreements it doesnt cover "hackers" as again as "hacking" is illegal in as far as doing so to obtain data not readily available.

If a hacker hacks the national weather service site to obtain maps that are a year old of weather is an illegal activity even though those maps were publicly accessible in the weeks they were active. The act of hacking NOAA is illegal.

Liability is a crazy deal as anyone can sue anyone for anything irregardless of disclaimers.

If 500,000 email addresses are compromised that can constitute a class action should a Councillor wish to take it on to/and try assign liability and disclaimers are up to the judge to discern or toss out.

We went through this with a campaign site. Joomla. Overnight was defaced. Next day, phone rings, "Get it back online, secure it proper or expect a lawsuit within a handful of days in the amount of 2 million dollars". Literally. Crapped my knickers. I put the site back up. Spent hours and hours sifting through code. Got a call from someone at Xerox on another project. Told him, "Couldnt talk. Emergency going on". Calls me back little later. Told him same, he asked me what was happening. I told him. He said let me look into this for you. I said fine. short time later, he calls back. He found it. Xerox ran "Fortify" against the site. Not only did they find THE security hole but found others as well. Every single one a third party extension.

So fixed em, quietly fixed some other sites.

After I talk to our council. Could they have sued us even though we have this disclaimer HE wrote up! He said, "Anyone can sue anyone for anything. Does not mean they will be awarded damages. Thats up to a judge." Then he said he'd get me in touch with a friend of his. He did.

I go to this other law office days later. He looks at the disclaimer and asks me some questions about the software, extensions etc. Told me yes they could have sued any yes they'd be awarded damages. He is an IT attorney. All he does. I wont go into the entire conversation. But at the end of it he told me, "Rick. I shouldnt even be talking with you". I asked why. His response was, "If you are so irresponsible to be making websites knowing full well that these third party components may or may not be secure then you deserve to be sued." I was floored. He then said, "I should not be speaking with you because I do not defend businesses, I prosecute them." and showed me to the door.