Equifax Breach via Apache Struts Framework

(This is a cross post from our CEOs personal blog. Note that Tendenci sites do NOT use Apache and the vulnerabilities in Equifax’s implementation of Apache Struts do NOT impact your Tendenci site. Still be aware that nothing is is 100% secure so stay vigilant and be prepared friends!)

As reported last Friday, the 2017 Equifax personal credit reporting agency had a data breach of 143 Million people’s identities. It started in May 2017 and is just now (August 2017) being disclosed. It is going to impact all of us. Sources:

  1. Equifax data leak could involve 143 million consumers
  2. PSA: no matter what, Equifax may tell you you’ve been impacted by the hack
  3. Did Lack of Visibility into Apache Struts Lead to the Equifax Breach?

From the second article on the Equifax breach linked above, this portion really galls me:

… not only are none of the last names tied to your Social Security number, but there’s no way to tell if you were really impacted.

It’s clear Equifax’s goal isn’t to protect the consumer or bring them vital information. It’s to get you to sign up for its revenue-generating product TrustID.

Earlier it was revealed executives had sold stock in the company before going public with the leak. We also found TrustID’s Terms of Service to be disturbing. The wording is such that anyone signing up for the product is barred from suing the company after.

The following phrase alone, if true, combined with Equifax literally trying to monetize their security errors, is what gives capitalism a bad name:

The wording is such that anyone signing up for the product is barred from suing the company after.

I have to believe the Equifax PR team is working for PharmaBro or Putin trying to make them look good in comparison.

Note: Equifax has changed the indemnification, but only under duress imho. Furthermore 30 days free credit monitoring by the company that released your data and then you will have to pay monthly still seems wrong. But to be fair, here is their update:

Questions continue to be raised about the arbitration clause and class action waiver language that was originally in the terms of use for the free credit file monitoring and identity theft protection products that we are offering called TrustedID Premier.
(Editor: well ya, duh!?)

We have removed that language from the TrustedID Premier Terms of Use and it will not apply to the free products offered in response to the cybersecurity incident or for claims related to the cybersecurity incident itself. The arbitration language will not apply to any consumer who signed up before the language was removed.
(Editor: but did you fire the person who did it in the first place?)

I get it. Nothing is secure. If the NSAs hacking tools get stolen and OPM loses all of the data on security clearance checks on our own people, then truly nothing is safe. I get it.

What I do not understand is a company as large as Equifax not being prepared for something like this. That Equifax did not announce it promptly. That Equifax executives sold stock before announcing it. That Equifax then attempted to indemnify themselves. That Equifax is using the crisis to sell a monitoring service that you have to pay for after 30 days. A service to monitor YOUR data that THEY lost control of!

This boggles the mind of a PR Professional.

The Internet was not built for e-commerce – it was built for knowledge sharing in a “walled garden”. Therefore keeping sites secure is not possible. Any security professional will tell you best practice is to white-list good guys (selective inclusion) as opposed to trying to find every attack and block it. Therefore the difficulty at a high level is primarily in identifying and blocking bad actors.

I hate to say it folks, but we are playing whack-a-mole with your identity and money.  It will always be an uphill battle to maintain security on the Internet and you will never ever be 100% safe.

As reported by Black Duck (awesome people btw), the specifics of the attack on Equifax are currently easily exploitable on similar sites. This is like Hurricane Harvey – it’s not even close to over.

The Incredible Growth of Python – StackOverflow

growth of python programming language

Python, the language used to program TendenciThe Open Source AMS, continues it’s meteoric rise in the world of developers. And where the developers go is where the rest of us go. Thus Python’s rise matters. And it benefits every Tendenci user, self hosted or hosted with our small company (same software either way).

IEEE Spectrum rates the languages by its readers as follows:

Python has continued its upward trajectory from last year and jumped two places to the No. 1 slot, though the top four—Python, CJava, and C++—all remain very close in popularity.

StackOverflow, a go-to site for pretty much every programmer and sysadmin out there, has a new blog post up on the incredible growth of the Python Programming Language. Python is of course the programming language used in Tendenci – The Open Source AMS. From the Stack Overflow post:

June 2017 was the first month that Python was the most visited tag on Stack Overflow within high-income nations. This included being the most visited tag within the US and the UK, and in the top 2 in almost all other high income nations (next to either Java or JavaScript). This is especially impressive because in 2012, it was less visited than any of the other 5 languages, and has grown by 2.5-fold in that time.

They have numerous charts to back up the data, but these two in particular paint a telling picture.

From Stack Overflow – the current tag questions viewed:

Growth of Python Programming Language
StackOverflow – The Incredible Growth of Python

Perhaps even more impressive is the projection on the continued growth of Python. Just WOW!

growth of python programming language
Python – Incredible growth with developers

The above graphs should give you confidence in your choice of using Tendenci as your AMS as the developers are not only there, but growing. Given Tendenci is fully open source (this is different from “free trial” AMS systems which are NOT actually FOSS (Free and Open Source Software). Wikipedia describes the difference as:

(FOSS means) anyone is freely licensed to use, copy, study, and change the software in any way, and the source code is openly shared so that people are encouraged to voluntarily improve the design of the software.[3] This is in contrast to proprietary software, where the software is under restrictive copyright and the source code is usually hidden from the users.

Many of our competitors who are NOT Open Source and not true FOSS which can sometimes confuse people. I’ll do a future post on examples of sometimes misleading representations by AMS systems that are not “actually” Free and Open Source (FOSS)  as defined on Wikipedia.

The good news is with the growth of Python, it only make sense that developers will look at and many will join in to help the community improve the software as they join associations themselves.

We’ve written about why we chose Python over PHP to develop Tendenci open source several times. Correctly choosing the open source stack gives us, and everyone in the community, confidence to see the trends predicted correctly. It wasn’t rocket science – we just listened to our team, we listened to younger developers, and most importantly we listened to our clients on what the future was/is going to be.

And associations are kind of a big deal and they can’t use minimum viable products.

Why are associations unwilling to accept apps that meet only minimal requirements? Um… because they started as Guilds and go back to Medieval times. From Britannica on Guilds and Trade Associations:

Guildalso spelled gild , an association of craftsmen or merchants formed for mutual aid and protection and for the furtherance of their professional interests. Guilds flourished in Europe between the 11th and 16th centuries and formed an important part of the economic and social fabric in that era.

and Britannica goes on….

… associations are known to have existed in ancient Rome, however, where they were called collegia. These craft guilds seem to have emerged in the later years of the Roman Republic. They were sanctioned by the central government and were subject to the authority of the magistrates.

This is a huge topic of course. Just know that Tendenci is the ONLY top ranked AMS system that is truly FOSS. Unlimited admins, users, contacts – you can self host or if hosted with us we only charge for processing power. Got 1M users and contacts and 50 admins? No problem. And the growth of Python assures your continued freedom from vendor lock-in no matter what.

#peace and happy (Python) programming y’all!

Why Tendenci Chose Python over PHP

Note: this is a repost from the eschipul.com blog.

This blog is a WordPress blog written in PHP. And WordPress, which is written in PHP is a great platform when secured properly.

So why did our team choose to rewrite Tendenci Open Source and in the Python Programming language? It is a question I get asked a lot. We’ve never been a company that likes to talk in the negative if at all possible, yet it is important to talk about the megatrends going on given we work with associations and nonprofits.

Python Growing in Academia
Why Python instead of PHP for Tendenci

Source: https://www.upguard.com/blog/which-web-programming-language-is-the-most-secure

programming vulnerabilities
Vulnerabilities in each language

Source: http://info.whitehatsec.com/rs/whitehatsecurity/images/statsreport2014-20140410.pdf

security-report

Source: http://info.whitehatsec.com/rs/whitehatsecurity/images/statsreport2014-20140410.pdf

Popularity of a language is a trend, and what you want is as many developers familiar and liking the language of your open source project as possible. This means you have a better chance to have a secure web site and therefore a more secure future.

To be fair – as Disraeli said – “lies, damn lies and statistics” – so there is no one perfectly secure language any more than there is a perfectly “safe” hammer. There will always be operator error and programmers make mistakes.

So we’re not saying Python is perfect, and all of us have used most of the other languages on those charts at some point. We’re just saying we are pleased so many other programmers also like Python and Open Source. THAT is the best that can be done to secure your future online. Secure code that you can examine yourself and even host yourself!

Addendum: As I post this on the Tendenci Blog. Given we focus on non-profits, associations, memberships, education, medical, religious – basically the do-good cause-based organizations, I believe it is particularly important that the project is as transparent as possible. Sometimes it is healthy to inform everyone of WHY we made a decision seven years ago. Python was the right call.

Tendenci Exports – Plus Easy Ways to Make Static Copies of Your Site

Today’s Tendenci community knowledge share. Here are three very easy free or low cost methods of making a static copy a web site. Use with caution, just know you have the power.

On Windows you can use HTTrack https://www.httrack.com/

HTTrack_Website_Copier_-_Free_Software_Offline_Browser__GNU_GPL_
Download a static version of a web site to your PC

On a Mac computer you can use sitesucker ($5) http://ricks-apps.com/osx/sitesucker/index.html

SiteSucker to download a static site to your Mac Computer
SiteSucker to download a static site to your Mac Computer

On the go? You can also use sitesucker from the app store to download to your iphone or ipad for $2 http://ricks-apps.com/ios/sitesucker/index.html

Use IOS to download your site for $2
Use IOS to download your site for $2

Of course for structured data in Tendenci, there are TONS of ways to export including exporting a copy of your entire database. There are help files on common exports like How to export your membership . There are too many options to list them all, but I’d encourage you to visit the support center or just google “tendenci exports” for more.

If you are on version 5 and want to “kick the tires” on Tendenci version 7, use https://demo.tendenci.com – you can login here https://demo.tendenci.com/accounts/login/ using “admin/admin” or “user/user”. It does reset every hour or so because of spammers but you can still get a feel for it. A HUGE upgrade from version 5.

Tendenci Admin Default Dashboard
Tendenci Admin Default Dashboard

There is also a previous post on making a static copy of your site here that is a bit more technical as well.

Why do we point out all of the ways to copy your Tendenci site (or most sites really)? Doesn’t that make it easier to leave?

Yes. Yes it does. BUT people rarely leave. Or if they do, they typically stay on Tendenci and self host. They’re still part of the Tendenci community which helps us all.

Another reason we promote exports and offsite backups is because we know the more freedom you have, realizing you have that freedom especially on the Tendenci open source platform, makes it less likely for clients to leave.

Think about it. Why would anyone who actually understands their product is open, does far more than other options, is lower cost, and they can self host if they want… why would that person make the decision to leave? It’s illogical.

I mean, who wants to be the President of an Association that takes it backwards in time to proprietary technology or an older open source software built on an unpopular programming language? That’s not in the best interests of the association long term.

Tendenci is written in Python and uses Java and Javascript libraries. This linked chart says it all.

programming-popularity-2016
THE 8 MOST IN-DEMAND PROGRAMMING LANGUAGES OF 2016

Popular programming languages means more coders for open source projects written in that language. And more capable people to modify and customize your install if you choose.

One of our goals is FREEDOM from the tyranny of per-user-licensing, proprietary products that want to own YOUR DATA, long term contracts, sites that post your events on THEIR site so if you leave then the history of that event is gone in the blink of an eye. Companies don’t own your data and they shouldn’t trap you.

We think that is unethical and just wrong.

Membership Management Software should be Open Source, Accessible, Responsive, and Search Engine friendly by default. Tendenci does all of those things.

Further we believe that Open Source Membership Management Software should be written in a Modern Programming Language like Python (watch out for bunnies) and the software should documented and open source (free, as in beer.) Even the US Government likes Open Source!

Want to change something? Get involved! Post on the forums at https://ww.tendenci.com/forums or post an issue at https://github.com/tendenci/tendenci/issues . If you are a programmer or into documentation, submit a pull request.

We make it easy to leave because we hope you don’t. Hence Tendenci has an incredibly low churn rate. That creates stability you can count on.

#peace

Cloud Server Upgrades in Progress

Clouds from a trip a long time ago...
Clouds from a trip a long time ago…

For the few night owls out there, you may have noticed your sites going offline for 5 to 10 minutes at some point in the middle of the night. Well, some good news! We are in the process of upgrading the Tendenci cloud servers to further increase response time to serve you better.

If you notice anything unusual please contact us at https://helpdesk.tendenci.com

Follow along on this blog, the Tendenci forums or on github. We’d love your input as we set the milestones for Tendenci 8 even while we are still working on Tendenci 7.1.x.  Your voice matters, you are the ones who we are listening to. And it is your input that sets the roadmap for Tendenci.

We appreciate you. And we believe you will appreciate the performance upgrades as we finish the night-shift updates throughout the week and wrapping up next weekend.

Thank You!

Elon Musk on Work Ethic

“Constantly seek criticism. … A well thought out critique of whatever you are doing is as valuable as gold.”- Elon Musk

and….

“If you do the simple math, if somebody else is working 50 hours and you are working 100, you’ll get twice as much done in the course of a year as the other company.”

“Just work like hell. You’ve gotta put in 80, 100 hour work weeks.” – Elon Musk

“Starting a business. Number 1 is having a high pain threshold.” – Elon Musk

“You are always going to buy the trusted brand unless there is a BIG difference.” – Elon Musk

“Constantly seek criticism. … A well thought out critique of whatever you are doing is as valuable as gold.” – Elon Musk

“Usually your friends know what is wrong. They don’t want to tell you because they don’t want to hurt you. … Usually your friends are right. …. You should take the approach that as an entrepreneur you are wrong. You want to be less wrong.” – Elon Musk

#listen #endure #powerthrough #succeed

Tendenci Transformation – The Right Choices for the Future

We’ve had a lot of crucial conversations lately about decisions that we made between 2006 and 2010. Yup, really. We are explaining now about how we are possibly too far ahead of the curve and why if you give it a bit of time, it will make you look like a rock-star.

MobileGeddon being a great example of how our early adopters are benefiting the absolute most!

 

Top39-Programming-Trends-700.4
Python for the Win!

Source: Python is Now the Most Popular Introductory Teaching Language at Top U.S. Universities

We started using Python, the programming language named after Monty Python, in 2004 if not earlier. We first tested Pinax in 2008 if not earlier under J who was running our programming team.

We used Python extensively in our old environment to move files and push out content to our sites. Tasks that are now done by Puppet and Chef and Docker-Compose. We rolled our own using Python on Windows.

So for the curious, that explains why we have this huge depth of knowledge on Python programming dating back to when nobody heard of it. We’ve had to train numerous graduates of Tech, UofH, Aggies, Rice, Penn State, etc, what Python even was!

But that is all ancient history. Why? Because Python is now number 1!

Top39-Programming-Trends-700.4

It’s hard to predict the future. We started out writing our own compete web framework in ASP. We were too early in 2001. PHP soon arrived and, being basically identical but open source, the outcome was PHP won. It should have, and did, win. We were too early. But with timing there is also a bit of luck.

I’ll do another post about GIS and mapping and why our move to strictly Postgres with GIS enabled is working out so well. Another post. And I’ll edit this one with links soon. Just needed to get the content out.

Screen Shot 2015-05-12 at 3.28.36 PM

Bootstrap3. – Because we know that we take gambles on technology and they have an impact. On you. And that is serious business. We take it seriously as evidenced by our decision to shut down Windows in line with Microsoft’s EOL policies. These are hard choices. Crucial Conversations. We’re the messenger.

And we CARE about YOU. Our clients. The future is bright. We picked our technology future amazingly well. Too well, so now perhaps our problems is more one of resources. And we’ll work through that.

Thank you. If I can leave you with one thought – it is this. THANK YOU! For those who stuck with us, WOW, um… our position for search and the future is crazy good. Open Source means freedom. Results mean donations and sales. Software means sustainable business models.

We appreciate you. Yes closure for some was hard. We wish you the best. We appreciated your time with us while it lasted longer than a Honda. As some depart and some charge forward, I’m especially excited about those who chose to charge forward.

We, you and us, we didn’t “guess” right. We did our homework and validation came ironically on April 21, the same day mobilegeddon hit and our Tendenci 6 clients jumped up in the search rankings. Luck? Hard work? I don’t know.

What do I know? I know how to serve. I serve y’all.

#peace

Ed

 

State of Change – Microsoft Servers Offline Tomorrow April 21 Reminder

State of Change at Tendenci

State of Change at Tendenci

For our Tendenci 5 and Tendenci 6 and Open Source clients in the wild – you’re cool. Move along. None of this applies to you. If you don’t have a “.asp” in your file extensions on your site it doesn’t apply to you.

Seriously, we love you, but off you go. Go check out the source code at https://github.com/tendenci/ or something. None of this blog post applies to those of you in the 95% majority of our clients.

This isn’t to say we don’t think you look great today. You do! And we’re looking forward to being able to focus on YOU more after tomorrow.

Upgrading Clients – YEA!!!

A HUGE THANK YOU to all of our former T4 clients who have chosen to stay with us and upgrade to Tendenci 6.

As we’ve communicated to each of you individually, there may be a period where we have a holder page up for a bit and unlike a usual long term project we will be going live and incrementally flushing out the site. It’s a lot of sites. We are going to focus on functionality first, SEO next and then bring more uniqueness of design per the scope of each of your migration projects.

We’re excited for both of the groups above that we will be focused on one technology stack and can accelerate Tendenci’s growth.

Microsoft Servers Offline Tomorrow April 21 at 12:00 CST

For our former clients who were running on Tendenci 4 and are choosing to leave, we’re sorry to see you go. I get it. I hated the idea of giving up my blackberry because “it just worked”. Yet now I can’t imagine not having a smart phone. Software is emotional. It just is.

We have to move forward. Tendenci 4 was never going to able to work on a mobile device because it’s legacy went back too far. Microsoft declaring end of life for Windows 2003 was the final straw. It was time.

Again – yes, Tuesday April 21 at 12:00 PM CST is a hard deadline. It’s been 90 days since first announced.

[IMPORTANT! If you are pointed at our DNS Servers or Email Servers make sure your new provider makes these updates!]

I believe we have communicated with everyone in person at this point, and the remaining group is small.

This is just a courtesy reminder that you may want to have your new provider make their DNS entries tonight to avoid any downtime. Don’t forget they will need to set up email relays and transfer dns servers so be nice to your new vendor and give them another reminder please as all of us want to see you succeed.

A website is an ecosystem of databases and content and media and email and relays. Be sure your new provider, if you chose to leave, is on top of it.

Please know that we have appreciated your business and wish you the best in the future. You are always welcome back, or even consider using Tendenci Open Source with another company. That’s the point – Freedom!

#peace

Ed

EOL Policy for Tendenci 4 (T4) Software

EOL Policy for Tendenci 4 (T4) Software

Tendenci 6 Interface for Upgraded clients
Tendenci 6 Nav Bar

[EDIT FOR EMPHASIS] April 21, 2015 is End of Life for T4. The Windows servers on the Tendenci hosted network will be shut down and be offline permanently. [END-EDIT] 

Tendenci has always been at the forefront of technology with regard to meeting the needs of associations and nonprofits. When we released Version 5.0 of Tendenci in 2012, the software took a major leap forward by going completely open source, allowing for outside contributions from the development community on software enhancements and bringing a level of transparency and complete control into the hands of all Tendenci users. We are excited about what the future holds for Tendenci as we have Version 6.0 currently in beta and a roadmap for Version 7.0 already underway.

With the focus on the future and what we can achieve with the new technology available, we have made the business decision to formally establish an End-of-Life (EOL) policy. In particular the EOL for Version 4.0 of the Tendenci on the Microsoft software platform is now set for April 21, 2015.

Tendenci was revolutionary when released in 2001. By the time we released Tendenci 4.0 in 2004, it ran seamlessly on the technology that existed at the time. As Microsoft phases out support for its older technology, Tendenci must also adapt to the newer technology options that will provide the best environment for stability and growth.

For those clients still running on the Tendenci 4.0 software, there are two paths for moving forward.

  1. Upgrade to the latest version of Tendenci. T6 is mobile ready using Bootstrap, brings back the newsletter functionality using a client provided smtp relay like Mailgun, and can accommodate a host of pre-built bootstrap 3 templates. Tendenci is open source and runs on Linux, an open source server environment. This means complete freedom for you with regard to customization and hosting. We can migrate you to the new platform, including transfer of existing data and implementation of a mobile-ready theme for $7500.
  2. You can stay on T4 and self host. If you would like to stay on the older technology, we can provide limited assistance to your IT team or an outside vendor with the move to your internal server environment. We will provide a single instance of Tendenci 4.0 for your use (not for resale) and you will need to establish your own security, monitoring, database server, DNS, mail servers, firewall and a VPC (recommended). We estimate the cost of the move at $5000 for the web server portion and this is variable based on the exact hosting environment to be configured.

The last two months have underscored the need to migrate away from the outdated server environment and jump headfirst into the new era of open source hosting options. We all must adapt as we receive new information. I stated previously that we intended to restore the functionality fully of Windows 2003 on Windows 2012 R2 if it could be done securely. After further research, it is clear to me that while you can definitely secure a Windows environment, it can only be done securely on dedicated servers or dedicated virtual machines isolating each client. We cannot bring full functionality back to you securely in a shared hosting environment using classic ASP. On a dedicated server, you can have security parameters that are set by you, for you. There are a number of IT firms that can assist with this and we will extend a single use license in perpetuity if this is the route you choose in the short term.

Effective immediately, there will be no additional changes to the T4 software or hosting environment so that we can focus on the release of T6 and ensuring the migration for our clients is a seamless transition.

The Microsoft sites will be taken offline permanently in 90 days.

For clients wishing to migrate to Tendenci 6.0 on our hosted servers, we will begin migrations on February 16, 2015. We expect the migration to take 30 days and are requiring full payment up front. To achieve this, there will be a need for some compromises on layouts initially, but being upgraded to a responsive design is long overdue and we can continue to work on layouts once we get everything secured and you can edit your sites easily again.

For clients wishing to self host or move to another platform, we will provide a one-time export of your data within the next 90 days. We will be accepting requests for exports starting February 2, 2015. There will be no charge for this export and it will be limited to a one-time event. If this needs to be expedited, we can refer you to an outside trusted contractor although they will charge a fee.

There will be a conference call on Friday, January 23 at 11:00AM CST (details to be emailed separately) to answer any questions about the most recent server issues and to discuss the best course of action for your organization.

We appreciate the support of all of our clients as we have fought to protect and restore your sites during this time. We can all agree that despite our best efforts, the only course of action at this point is to adapt to the changing environment and look forward to what the newer technologies have to offer. Tendenci is a great product and successfully serves websites throughout the world. We look forward to a continued relationship with our clients in the open source world of dynamic software.

[UPDATE: Another option – Generate a Static Sites. You can simply pull the site down in static format using a one line Unix command or a $5 program on the Mac. Then edit it in a product like Dreamweaver. FTP the content to any number of hosting providers. So you CAN download and transfer your site right now to fulfill any obligations. As posted previously there is also simply linking from Dropbox or AWS if that is more convenient. Neither are as convenient as Tendenci, but will keep the sites secure.]

[Update: For developers you can use this script to download. Please be nice to the servers. And scan your files! Several clients had malware on their PC and then uploaded it to the server. All responsibility is on YOU to be sure any files pulled down. This is one of the reasons we are moving away from this older technology. Virus scanners won’t catch it all. IT IS A MANUAL PROCESS TO CLEAN IF FOUND. You must review it carefully by hand. Code snippet below

wget --limit-rate=400k --no-clobber --convert-links --restrict-file-names=windows --random-wait -r -p -E -e robots=off -U mozilla URLHERE

Did I mention scan your files!?

Thanks]

Continued Configuration Changes on Windows Legacy Servers

Update: We will be doing a planned reboot of the Windows servers late this afternoon Wednesday January 21, 2014 to begin the process of restoring two of the remaining clients that are still offline.

Scope: This update applies to Tendenci 4 clients on Windows only. It specifically does NOT apply to Tendenci 5 or Tendenci 6 clients on Linux.

To give you an idea of the scope and velocity of hack attacks that continue, these are attempted crimes mind you, I’ve attached a 15 second video taken several days ago of actual attacks on one of our servers INSIDE the allowed ports.

15 seconds of network attacks

A further update on the 404 errors that the legacy Tendenci 4 clients have been experiencing intermittently. We have been measuring everything possible and tweaking the configuration settings as we see patterns in the logs. Each day generates over 1GB in security alerts across the data centers. All of these are either known attacks, or zero day attempts.

This is what we are fighting and it is relentless. The fact remains that we have protected the legacy sites by moving them from Windows 2003R2 IIS 6 to Windows 2012R2 IIS 8. But to make ASP classic run in IIS 8 we are running the servers in “compatibility mode” which is not an ideal configuration for any technology. And “secure” does not mean “functional” if your sites locked down to the point of not meeting functional requirements.

We have taken a step back and concluded that a technology platform started in 2001 is not up for the cyberwars of 2015. We will have a further update posted later today on possible paths forward for Tendenci 4 clients.

~ Ed