0

Core updates are frequent, so are some extension updates.

How frequently do people update? All of them or only sometimes?

Do you always up date to the latest version or pick one that is a little older?

How do you know the update is not loaded with dodgy code or ransomware?

Working with highly sensitive data and I am concerned about the vetting process for updates.

Thanks in advance

Improve this question

2 Answers 2

Reset to default
3

There is no clear policy for this. But it is good to put CiviCRM behind a firewall/VPN. That way you can only access civicrm if your ip address is allowed. For connecting external websites/application you can then use CiviProxy.

This way CiviCRM and your data are secure, no matter whether your CiviCRM installation has securty issues.

My personal advice is that when it aint broken don't fix it. So that also means for updates, if your system still works and you don't need any new features keep it as it is. We are brainwashed by Android and Windows which install updates automatically and so we all think it is good to install updates regularly however I cannot think of a rationale for that.

Also I do think that installing updates is not much work from a technical perspective. But with every update you have test your whole setup and see if nothing ain't broken. And this test work is usually quite a lot of work.

My experience is also that the organization using CiviCRM is also changing over time. And that those business changes might also require some (minor) changes in your CiviCRM setup/configuration. And usually when doing those kind of things it might be worth to also update to the latest version.

Improve this answer
2
  • Thanks. Yes of course whole system will be behind firewall and encrypted at rest etc. My concern is that if the updates to core and especially extensions are not vetted - how do you know you are not installing something that will (a) steal your data or (b) ransomware it. How do I know the update does not include trojan ware - I am concerned about the vetting process for updates being released.
    – Simon Walden
    Commented Nov 13, 2019 at 10:22
  • Because it is open source you can inspect the source code your self (or pay someone to inspect it for you). And then check whether there is any trojan horse included. Generally speaking it comes down to trust. I would trust code from civicrm core and regarding extensions it depends whether you trust the extension developer.
    – Jaap Jansma - CiviCooP
    Commented Nov 13, 2019 at 14:51
0

Regarding tampering of the release files to insert malware, there are md5 and sha checksums listed at sourceforge that you can compare to the downloaded file, e.g. https://sourceforge.net/projects/civicrm/files/civicrm-stable/5.19.1/

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.