Anyone ever heard of "Billic"?

Damian

https://www.billic.com/

Stumbled across this while looking for a WHMCS module for VirtualBox. Anyone used it before? There were some issues with getting to the site due to SSL errors, and there's gems like this on their site:

Thank you, Lead Developer.

But with their statement of "fully modular", might be interesting, especially for 10 eur a month, or 200 eur once.

raindog308

"Too many redirects occurred trying to open https://www.billic.com"

AuroraZ

raindog308 said: "Too many redirects occurred trying to open https://www.billic.com"

Same here they might want to fix that for the chrome/chromium crowd. Did not try on FF.

Rallias

AuroraZ said: Same here they might want to fix that for the chrome/chromium crowd. Did not try on FF.

It happens for Firefox too.

jar

@AuroraZ said:
Same here they might want to fix that for the chrome/chromium crowd. Did not try on FF.

Same on Safari.

Damian

It would appear I'm the only one who can visit their site. That's not going to be good for business.

Safari refused to connect for me, I had to use Firefox which worked on my end of things.

AuroraZ

Interesting business plan they have there. Can imagine the meeting they had to come up with that one. Let's just let one user from LET visit our site and that should do it...........

emg

They are so secure that I couldn't see their website either.

century1stop

probably a ssl configuration error

doghouch

@Damian said:
It would appear I'm the only one who can visit their site. That's not going to be good for business.

Safari refused to connect for me, I had to use Firefox which worked on my end of things.

Their SSL configuration is terrible - they couldn't even stick the proper chain so the damn website would be secure.

Damian

I would imagine that they're not much better at software then!

Billic

Hello,

We apologize for any inconvenience this may have caused, and would like to thank you for your feedback on the matter.
We have addressed these issues and concerns. We once again apologize for any inconvenience this may have caused.

Regards,
Adam W
Billic.com

raindog308

"Custom Built Database Class
Custom built database class based on the MySQLi PHP extension which makes it easy for any module to prevent SQL injections."

Is Billic open-sourced or is it ion-cube'd? If it's open source and I can extend it, maybe this is interesting (though @joepie91 is going to smack you down for not using PDO).

If it's encrypted like WHMCS, then who cares? Woo hoo, you wrote a class...

joepie91

Billic said: Hello,

We apologize for any inconvenience this may have caused, and would like to thank you for your feedback on the matter. We have addressed these issues and concerns. We once again apologize for any inconvenience this may have caused.

Regards, Adam W Billic.com

Alright. So, given that you claim to have security as a core focus...

1. Do you encode your source code, using tools like IonCube Encoder?
2. Where is your security issue reporting procedure? Nothing of the sort listed on the Contact page.
3. Has your code been professionally audited by an independent third party? Is the report for this publicly available?
4. Do you use parameterized queries? The MySQLi extension has an escaping method as well, so just using that extension doesn't say much, in and of itself.
5. Why do your terms state that the user cannot modify the code? The ability to do so is necessary, in case they need to apply a security patch of any kind, that you as a vendor cannot or will not (timely) provide.

You shall not modify, copy, duplicate, reproduce, license, sublicense, transfer, convey any software created by or obtained from Billic Limited without the prior written consent of Billic Limited.

---

raindog308 said: (though @joepie91 is going to smack you down for not using PDO).

This is not necessarily a problem. MySQLi does offer parameterized queries (and it is, in fact, what PDO is based on), so it depends on the answer to question 4.

EDIT: Man, the quote feature is buggy...

zeitgeist

Remember Virtpanel? Same people as it seems. Only Virtpanel is no more.

http://www.dellam.com/07079770-VIRTPANEL LTD

http://www.lowendtalk.com/discussion/20245/bitaccel-com-having-problems-virtpanel-account-suspended

http://www.webhostingtalk.com/showthread.php?t=1488407

...

Billic

@joepie91 said:

Hello,

1. We obfuscate our source code using our own custom built encoder.
2. We are in the process of updating our websites design and have plans to add a security reporting page. Currently they use the ticket system.
3. No 3rd party audit has been made as of yet, we have had the public try sql injections via the ticket system and they have been unsuccesful.
4. Yes we do indeed use mysqli param queries
5. We will change our terms so that it says they can't tamper with source code to remove licensing.

Thank you for your questions, we work from your questions and use them as feedback as we want to give our clients and potential clients a decent product that has multiple uses.

Regards,
Adam W
Billic.com

joepie91

Billic said: We obfuscate our source code using our own custom built encoder.

Unacceptable. This keeps your customers from auditing the source code, or from patching issues themselves as needed, all the while not preventing actual pirates from pirating your software (just like for every other form of DRM).

As long as you are using an obfuscator, you are not in a position to claim that you "care about security". Kerckhoff's Principle applies.

Billic said: No 3rd party audit has been made as of yet, we have had the public try sql injections via the ticket system and they have been unsuccesful.

That is far from sufficient. You should get a professional third party audit ASAP, and publish the results.

Billic said: We are in the process of updating our websites design and have plans to add a security reporting page. Currently they use the ticket system.

That's something, but I'd advise speeding up the building of a security reporting page. You will also want to consider a promised patching timeframe, like Sails has done recently.

Billic said: Yes we do indeed use mysqli param queries

Billic said: We will change our terms so that it says they can't tamper with source code to remove licensing.

That's good.

Billic

Hello Joepie91,

We thank you for your advice and we are taking into consideration everything you have said, we are going to try pushing our new website as soon as we can with a security reporting page, as well as a patching timeframe.

We are encoding to prevent source code theft, not to provide security through obscurity.

We are also considering on making Billic 99% "readable" source.

We thank you for your time.

Regards,
Adam W - Billic.com

Mad

It seems to be interesting, even though I never heard it but honestly you can find a better alternative such as WHMCS for almost the same price.

Aga

Billic said: We obfuscate our source code using our own custom built encoder.

I would love to see the day were people realizes that trying to hide your code is pointless.

You may have a better chance to protect if you do SaaS, but if it runs on other people machines it will be cracked if a reson for cracking it exist.

99.9% of the times would be that hard to replicate the functionality even if you never saw a line of code.

Your software is a real living proof of that, it's not the first of his type, and it's not the first to be obfuscated. I would bet that the only reason you may think obfuscating to prevent code steal is working is probably because

andreamada said: honestly you can find a better alternative such as WHMCS for almost the same price.

they have less incentive to crack your software than your competitors.

William

joepie91 said: Unacceptable. This keeps your customers from auditing the source code, or from patching issues themselves as needed, all the while not preventing actual pirates from pirating your software (just like for every other form of DRM).

Might be, you will however not find any serious company that provides a paid PHP application unencoded. Simple as that.

zeitgeist

William said: Might be, you will however not find any serious company that provides a paid PHP application unencoded. Simple as that.

I strongly disagree with this statement. Just yesterday I installed a commercial PHP application - XenForo - and it happens to be not encoded, and it's definitely from a serious company.

rds100

Most of Blesta is not encoded either.

William

zeitgeist said: I strongly disagree with this statement. Just yesterday I installed a commercial PHP application - XenForo - and it happens to be not encoded, and it's definitely from a serious company.

Xenforo is not a billing system. Though, my answer was not clear in that regard, so you are sort of right.

joepie91

Billic said: We are encoding to prevent source code theft

I am aware. The problem is that source encoding doesn't and can't actually accomplish this. Once it leaves your physical systems, it is out of your control, and that's the hard reality of it - trying to obfuscate/encode/DRM/whatever is just going to end up hurting your real customers.

It is not technically possible to prevent somebody from copying or reproducing code from their own systems. End of story.

Billic said: We are also considering on making Billic 99% Open source.

Open-source, or readable source? For something to be open-source, it must comply with these rules. If customers are able to read the source but not allowed to modify or reproduce it, then it would not be open-source (even if it is still a step up from encoded/obfuscated source).

I do want to say that I'm happy that you're taking the feedback seriously

William said: Might be, you will however not find any serious company that provides a paid PHP application unencoded. Simple as that.

Very few companies use obfuscators. No legitimately professional ones do, that I have seen. Usage of obfuscators almost always correlates with poor quality code, a reactive approach to security rather than proactive, and various other 'hallmarks of incompetence'.

If you keep running into obfuscated code, then you're purchasing your software from the wrong companies.

Billic

@joepie91 said:

Hello,

Yes sorry Readable Source, i updated my original post for that aswell. Once again we do thankyou for your feedback and look forward to rolling out our changes shortly.

Regards,
Adam W
Billic.com

vld

    $billic->module_call_functions('global_before_header');
    $billic_theme['header'] = str_replace('', 'function addLoadEvent(o){var n=window.onload;window.onload="function"!=typeof window.onload?o:function(){n&&n(),o()}}' . PHP_EOL . '', $billic_theme['header']);
    $billic->enter_module('Header');
    eval('?>' . $billic_theme['header']);
    $billic->exit_module();
    register_shutdown_function(array($billic, 'shutdown'));
    $billic->module_call_functions('global_after_header');

My head is about to explode.

killswitch

Just chiming in as someone who used to believe that obfuscating your code would make it secure from being hacked and even stolen, you're wrong. Deadly wrong. All you're doing is making it harder for your customers to use it. If I want your source code, I can get it, obfuscating it won't stop me.

Obfuscating software is the equivalent of having non-skippable "DON'T COPY THIS MOVIE!!" messages 30 times before allowing a user to play the movie they bought. Sooner or later, pirating it is going to be the easier and better user experience.

Billic

@killswitch

Hello killswitch thank you for your reply can you give me an example please?

using this

<?php
$mlGXxHFEEc = str_rot13('Zl ');
$gzhCkUDhtj = str_rot13('vf ');
$eJfJnKKIEj = str_rot13('Wbfu');
$SpHpNrUfvn = str_rot13('anzr ');

$AiPWQvHKTJ = $mlGXxHFEEc.$SpHpNrUfvn.$gzhCkUDhtj.$eJfJnKKIEj;

echo $AiPWQvHKTJ;
?>

Regards,
Adam
Billic.com

joepie91

Billic said: Hello killswitch thank you for your reply can you give me an example please?

My name is Josh

Billic

Hello,

sorry i meant turning it back into its original source, not what the output was, i should have mentioned that.

Regards,
Adam