Ruining the Magic of Magento's Encryption Library
Magento is incompetent on much simpler levels than this.<p>1. Someone thought chmod 777 was a good idea, ever, under any circumstances. Not only is this standard practice in Magento installs (it&#x27;s a how-to step in many books on Magento), it&#x27;s all through the actual codebase.<p>The below is from the Magento Enterprise 1.14.0.1 tarball, downloaded from the company (and I double-checked this after someone questioned this last time I brought this up):<p><pre><code>  $ grep -r chmod .|grep 777
  .&#x2F;downloader&#x2F;lib&#x2F;Mage&#x2F;Backup&#x2F;Filesystem.php: chmod($backupsDir, 0777);
  .&#x2F;app&#x2F;code&#x2F;core&#x2F;Mage&#x2F;Compiler&#x2F;Model&#x2F;Process.php: @chmod($dir, 0777);
  .&#x2F;app&#x2F;code&#x2F;core&#x2F;Mage&#x2F;Install&#x2F;Model&#x2F;Installer&#x2F;Console.php: @chmod(&#x27;var&#x2F;cache&#x27;, 0777);
  .&#x2F;app&#x2F;code&#x2F;core&#x2F;Mage&#x2F;Install&#x2F;Model&#x2F;Installer&#x2F;Console.php: @chmod(&#x27;var&#x2F;session&#x27;, 0777);
  .&#x2F;app&#x2F;code&#x2F;core&#x2F;Mage&#x2F;Install&#x2F;Model&#x2F;Installer&#x2F;Config.php: chmod($this-&gt;_localConfigFile, 0777);
  .&#x2F;app&#x2F;code&#x2F;core&#x2F;Mage&#x2F;Catalog&#x2F;Model&#x2F;Product&#x2F;Attribute&#x2F;Backend&#x2F;Media.php: $ioAdapter-&gt;chmod($this-&gt;_getConfig()-&gt;getTmpMediaPath($fileName), 0777);
  .&#x2F;app&#x2F;Mage.php: chmod($logDir, 0777);
  .&#x2F;app&#x2F;Mage.php: chmod($logFile, 0777);
  .&#x2F;lib&#x2F;Zend&#x2F;Service&#x2F;WindowsAzure&#x2F;CommandLine&#x2F;PackageScaffolder&#x2F;PackageScaffolderAbstract.php: @chmod($path, &#x27;0777&#x27;);
  .&#x2F;lib&#x2F;Zend&#x2F;Service&#x2F;WindowsAzure&#x2F;CommandLine&#x2F;PackageScaffolder&#x2F;PackageScaffolderAbstract.php: @chmod($path, 0777);
  .&#x2F;lib&#x2F;Zend&#x2F;Service&#x2F;WindowsAzure&#x2F;CommandLine&#x2F;PackageScaffolder&#x2F;PackageScaffolderAbstract.php: @chmod($path, 0777);
  .&#x2F;lib&#x2F;Zend&#x2F;Cloud&#x2F;StorageService&#x2F;Adapter&#x2F;FileSystem.php: chmod($path, 0777);
  .&#x2F;lib&#x2F;Varien&#x2F;Autoload.php: @chmod($this-&gt;_collectPath, 0777);
  .&#x2F;lib&#x2F;Varien&#x2F;File&#x2F;Uploader.php: chmod($destinationFile, 0777);
  .&#x2F;lib&#x2F;Mage&#x2F;Backup&#x2F;Filesystem.php: chmod($backupsDir, 0777);
  .&#x2F;errors&#x2F;processor.php: @chmod($this-&gt;_reportFile, 0777);
</code></pre>
2. The company thinks there&#x27;s nothing wrong with storing money as floats: <a href="https:&#x2F;&#x2F;github.com&#x2F;magento&#x2F;magento2&#x2F;issues&#x2F;555" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;magento&#x2F;magento2&#x2F;issues&#x2F;555</a><p>The way we eventually dealt with hosting Magento (which we had <i>strongly</i> advised against) was a concrete sarcophagus and a thirty-kilometre exclusion zone:<p>* a cron line specifically to remove o-w permissions from all files in the webroot every minute (which is very inelegant, but the alternative is maintaining our own patches to core).<p>* Files not owned www-data, except where Magento must be able to write to them.<p>* deploy all webroot files as a user the webserver can&#x27;t write.<p>* cron.sh (Magento&#x27;s internal cron) runs as root out of the box. We ran it as www-data.<p>* AppArmor to keep Magento from ever, ever being able to pull shit. This caught Magento&#x27;s more antisocial tendencies on more than one occasion.<p>* Admin login: use a path other than &quot;&#x2F;admin&quot; to foil quite a lot of attack bots at the very simplest level.<p>We have outsourced our remaining Magento, thankfully, and I don&#x27;t personally have to maintain the above any more. (You know you&#x27;ve been administering Magento a bit long when you can hum along to bits of &quot;Metal Machine Music&quot; accurately.﻿)<p>The use case for Magento is (apparently deliberately) confused. It&#x27;s an unholy melange of a CMS and a shopping basket. There is no good out-of-the-box experience; in practice it&#x27;s a job creation scheme for consultants.<p>Even crap-tier &quot;well technically I can tell my boss&#x27;s boss we have paid support&quot; support, with a four-day response time for them to ask you a simple question you already put the answer to in the original ticket, is swingeingly expensive. I can&#x27;t say what we&#x27;re paying for this standard of quality, but I can say that it&#x27;s public knowledge that Magento is at least $13k&#x2F;yr: <a href="http:&#x2F;&#x2F;web.archive.org&#x2F;web&#x2F;20120215011525&#x2F;http:&#x2F;&#x2F;www.magentocommerce.com&#x2F;product&#x2F;enterprise-pricing-contact" rel="nofollow">http:&#x2F;&#x2F;web.archive.org&#x2F;web&#x2F;20120215011525&#x2F;http:&#x2F;&#x2F;www.magento...</a><p>The problem Magento seems to solve is when the business wants a quick site without developer involvement. After a few other abortive platforms (Plone, Drupal - which are both fine for what they are, in ways Magento just isn&#x27;t, but didn&#x27;t end up matching our needs), our eventual solution to this was Wordpress, which we have outsourced so I don&#x27;t have to think about that either. Outsourced Wordpress with securing it being the host&#x27;s problem is totally the right answer.<p>I don&#x27;t have a good answer on the shopping basket, but Magento was bad enough at that too that we went back to our in-house homerolled system.<p>I understand some work has gone into Magento 2.0 to make it less mind-bogglingly horrible.