I am a site owner not a programmer, many times I came very close of hiring CREhelp but, did not for many reasons…
But all of CRE Comunity should give him credit because unlike Sal He emailed every potential CREloaded website soliciting business, which in turn alerted the website owners like me to take action.
On the other hand Mr. Sal ignoring such critical issues and not alerting site owners (I am registered CREl oaded user never heard of it) or partners.. even when I questioned my ISP who also sold /installed the CRE loaded package, He outright called the CREhelp scammer and opportunist… but of course I did not trust him and had a different programmer fix it.
The point is do not blame CREhelp because he figured it out first! or he used the vacuum to help himself. His action help to resolve the problem one way or another.
A mass alert should of went out immediately. So much for upgrading to PCI.. NO WAY!

CRE 6.15 FileManager was a 3rd party contribution in open source. The CRE team included it much like the other some 60 contributions into a Chain Reaction Edition of osCommerce. They continue to make strides in resolving CORE cart bugs and our company continues to point them out and seek help and collaborate where we can.

We are concerned, however, with their business decision NOT to modify the authorize.net payment module to meet new federal and industry mandate by 2011. In 2011 credit card merchants will be required to decline check card transactions where the funds are not available and offer alternative payment methods while showing the balance available on that card. The CRE guys have decided to corral folks into their merchant reseller program and duplicate their payment checkout pages onto a cloud server that meets PCI DSS D compliance I believe. But, I have not seen any PCI DSS D compliance certification. It’s rather costly. I would have hoped that CRE worked with community developers to modify the current authorize.net and many other gateway modules to meet any new mandates. It’s a business decision on their part and only the community can take away from it what they may.

I still will hope that the true revenue stream is in education and training.

Sincerely,

Denver Prophit
Sec / CTO
StrikeHawk eCommerce, Inc.

Here is a question for you, actually 2:

- Don’t you think that the amount of patch downloads over the past 4-5 months have been a bit low considering the amount of creloaded sites out there even if you count in the 200 non-unique views of your sticky announcement about this security issue.

So you have not felt the need at any point to inform customers, directly via email, in form of a newsletter announcement about the severeness of the issue?

Here are 2 screen shots from a little while ago:
http://www.oshelpers.com/Screenshot%20-%202_18_2010%20,%208_38_56%20PM.jpg
http://www.oshelpers.com/Screenshot%20-%202_18_2010%20,%209_06_40%20PM.jpg

CRE Loaded is not facing any liability issues since we identified and released a patch in a timely manner, such a thing that all application developers do. This code exploit and fix underscores the necessity to take security issue seriously and keep all your applications up to date.

I appreciate your efforts in the community, but please lets not do the community harm with incorrect statements about CRE Loaded.

Sal Iozzia