[chef] Re: Re: Re: Rack vulnerabilities in chef-server-webui in Chef Server 11

[Peter Donald < >]

Hi,

On Sun, Feb 10, 2013 at 1:26 PM, Bryan McLellan 
<
 >
 wrote:
>> Is the intention that starting with chef 12 server, the webui will be a
>> value add of the hosted/private offerings?
>
> Not exactly. Opscode Hosted and Private Chef (OHC + OPC) have had a
> separate webui from Open Source for a long time. As we recently
> announced [1], we've rewritten the OHC/OPC webui and added support for
> new OPC features (and OHC where applicable) like activity reporting
> and push client runs. So yes, there is a big value-add there, but
> that's not why we're deprecating it.
>
> In the history of the Open Source chef-server-webui project there have
> only been 20 contributions with 37 commits (since August 2009). That's
> less than one a month if you spread it out. We breathed a little life
> into it by porting it from merb to rails3 but it is a completely
> different project from our webui, so there's nothing to trickle down
> to it. In the face of multiple security patches in under a week, most
> people not using it, and very few developing it, it is more of a
> liability than a feature.

While I can imagine that a certain point of view from within opscode
the business would see it as a liability, that is not my view. At
least where I am, we would have been unlikely to have adopted it if it
had not had the web-ui. While our workflow is largely divorced from
the web ui we still use it to some limited degree to inspect the node
configuration data.

I am also actively training and advocating to others and it becomes a
lot harder sell if chef were to drop the web ui. I know that some
groups have adopted chef over other options because the perception was
that the other products were crippleware. I would hate to see chef
fall into this same category.

While many of us don't directly contribute to your bottom line, we do
help out with the marketing and sometimes the ecosystem. I know that i
may come at a cost to maintain something you don't use but I suspect
it is cheaper than paying a marketing group to make up the differece.

-- 
Cheers,

Peter Donald