From: Aredridel <aredridel@...>
Date: 2005-01-06T16:41:34+09:00
Subject: Re: [BOUNTY] Re: Shopping cart ...

On Thu, 2005-01-06 at 11:13 +0900, James Britt wrote:
> Aredridel wrote:
> > On Thu, 2005-01-06 at 07:46 +0900, Sarah Tanembaum wrote:
> > 
> >>Is there any good(secure) Ruby shopping cart program example? Thanks
> > 
> > 
> > I'd put $100 up for anyone who would code and release under liberal license:
> > 
> > * A shopping cart
> >   * that takes all data in from a post or URL
> >   * that requires no database at all, session storage excepted.
> >   * that runs as a CGI or FastCGI
> >   * that can use an XHTML file or a few as a template for output.
> >   * that has few dependencies, and can be deployed with no special
> > configuration beyond making generic CGI or FastCGI go on
> > $user[:webserverofchoice]
> >   * that would link to paypal at least for payment processing.
> 
> Are there any security considerations, and what might they be?

Should be reasonably secure, but I'd love something I can offer my
mom-and-pop customers. Something simple, something that can be made to
look just like the rest of their site, something where orders are not
shipped automatically, and so can be hand-verified for sanity. If the
payment can't be faked, and there's a clear list of what was ordered and
by whom, Good Enough.

Keeping it simple would be the security needed. SSL's also cheap enough
now that one can not worry about eavesdropping if that makes things
easier.