0

I noticed the following in my EE account: "This license is in use on multiple domains, please make sure each use is authorized". The reason seems to be due to me having EE installed on development server and production.

This got me wondering and concerned though. I'm guessing EE has some sort of homing beacon? What information is being exposed from my server to EE? I know it's at least exposing my domain names. Anything else I need to be concerned about from a privacy and securiry perspective?

Are any of the addons doing something similar?

Improve this question

1 Answer 1

Reset to default
3

Addons is too broad for the forum, you'll have to contact the manufacurers however I've never seen a 3rd party phone home from the popular developers (SolSPace, P&T, GotoLow, Expresso, PutYourLightsOn)...

The Licence check came in on version 2.9 (July 15, 2014), all it does is send some server details back to EllisLabs, heres the actual payload code for you to see : 

$payload = array(
    'contact'           => ee()->config->item('license_contact'),
    'license_number'    => (IS_CORE) ? 'CORE LICENSE' : ee()->config->item('license_number'),
    'domain'            => ee()->config->item('site_url'),
    'server_name'       => (isset($_SERVER['SERVER_NAME'])) ? $_SERVER['SERVER_NAME'] : '',
    'ee_version'        => ee()->config->item('app_version'),
    'php_version'       => PHP_VERSION
);

Fairly safe. also I recall when they brought this out that the licence check is non destructive, it is for infomation purposes so you can manage your licenses better, but I can't find it anywhere(found it). The code doesn't show anything other than the payload-ping though...

Quote EllisLabs

EllisLab has always taken a soft approach to license registration so we treaded very lightly here. You will never be locked out of your software nor will the behavior and output of your site be impacted by this in any way.

Improve this answer
3
  • Thanks for this. I'm still trying to digest the ramifications of this if any. You say this is fairly safe. Is it possibly not safe? If so, how?
    – ExpressionEngineNewbie
    Jun 22, 2015 at 11:52
  • well, its sending the email address and licence number and domain entered on install/in config, the actual domain being served from, plus ee and php version number.. This is nothing more than any CDN/Vendor might gather when siging up to a service or purchasing a platform. it's the nicest possible way of letting you know "you're using that licence on 2 different domains, just letting you know" that I can think of from EllisLabs, pleanty of other highly regarded services out there will just DOS you if your domain doesn't match the 'purchased for' domain.
    – Blatant
    Jun 22, 2015 at 20:55
  • In a previous version Expresso Store used to anonymously report back, the latest version doesn't. A quick scan of my add-ons folder reports that gmaps (Rein de Vries) has a homing beacon - alas it's the function copied exactly from Store v1 calling back to exp-resso.com (oops).
    – Peter Lewis
    Jun 24, 2015 at 14:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.