Wezzul.com - It's the Dinglez

At work, we use SugarCRM for a wide array of tasks. While we do pay for the "Pro" version of the software, there is also an OS version of it. I recently read a post on a blog that described a lot of the woes I have with Sugar. However, it also detailed a bunch of other less-than-savory dealings by the company itself. Check that out here. The paragraph on upgrading the software is my nomination for Paragraph of the Year 2006. Absolutely spot on about the huge pain in the ass it is to upload, of all things, PHP files. It seems that, as each incremental update is released, Sugar wants to change the database around, drop all your old data, add new php files, when really, it should be as simple as copying over some php scripts to a directory and perhaps running some SQL files on a database.

However, my main issue from a security standpoint is that Sugar requires running PHP with safe mode turned off. PHP code, when written poorly, can be as insecure as anything on the web. I'm not saying Sugar itself is vulnerable, but running PHP without safe mode turned on, as a rule, is poor web server administration.

Not to mention I have to up PHP's memory buffer to like 64MB to do any of the upgrades from their "upgrade" console (which never really work anyways). In any case, read that blog post, it's stating a lot of the things I now don't feel I have to state because they are all laid out there.

---