Forum OpenACS Development: Should we continue to support PayflowPro?

1: Should we continue to support PayflowPro?

Posted by Janine Ohmer on 11/25/03 04:32 PM

I have a bug assigned to me containing a patch to update the Verisign PayflowPro module. But before I apply the patch, I wanted to get some opinions on whether we should continue to support this module at all.

As you can read in this thread: https://openacs.org/forums/message-view?message_id=93102 , the latest version of the Verisign SDK is statically linked with an older version of OpenSSL and causes our module to periodically crash AOLserver. Since Verisign has indicated that they don't intend to fix the problem, this situation is not likely to change. I'm wondering if we should therefore deprecate this module, rather than leaving it in the distribution and encouraging people to use it.

Thoughts? If folks are generally positive on this I'll make it a TIP.

2: Re: Should we continue to support PayflowPro? (response to 1)

Posted by Brad Duell on 11/25/03 05:35 PM

I support deprecating it.

3: Re: Should we continue to support PayflowPro.. or Verisign? (response to 1)

Posted by Torben Brosten on 11/27/03 09:31 AM

I'm about to buy some SSL security certificates...

Given this attitude from SSL Certificate Authority Versign, does anyone recommend any other CA's that seem to be more open minded about supporting open source?

4: Re: Should we continue to support PayflowPro? (response to 1)

Posted by Nagita Karunaratne on 11/27/03 09:42 AM

Getting off topic here, but have you looked at InstantSSL (http://www.instantssl.com/) that was mentioned here recently?

5: Re: Should we continue to support PayflowPro? (response to 1)

Posted by Torben Brosten on 11/27/03 11:44 AM

OT? You are right, Nagita Karunaratne. Back to topic.

OpenACS has a a working alternative, the AuthorizeNet gateway package[1]. Since alternatives exist for Verisign's other common offering, SSL Certificates[2], I say..

..deprecate the PayflowPro package.

1. https://openacs.org/doc/openacs-4-6-3/authorize-gateway/
2. http://news.netcraft.com/archives/2003/04/09/netcraft_ssl_survey.html

6: Re: Should we continue to support PayflowPro? (response to 1)

Posted by Torben Brosten on 12/04/03 10:35 AM

For the record, the Verisign "freeware apache notice"[1] suggests that SSL support (including liability) would be limited for an aolserver running OpenACS 4.6.3 (using Aolserver3.3oacs1).

1. https://digitalid.verisign.com/server/apacheNotice.htm