It is highly recommended to install this update as soon as possible, because it contains a number of security fixes.

There is no news about this new release on the OpenX community forums or blog, as of yet. The readme file that comes with the downloaded file does not contain any specific information as to the nature of the security issues that have been fixed. However, a quick comparison of the source code of version 2.8.7 and version 2.8.8 reveals that there are multiple changes in the API, which seems to match reports about the origins of many hacking incidents that occurred these past few months.

You can download OpenX Source version 2.8.8 from the OpenX website.

Update November 8, 2011: Since many people are asking me for tips on how to upgrade their OpenX Source software, I’d like to point to an blog post I published in November, 2010: How to upgrade OpenX Source Ad Server software.

Update December 2nd, 2011: Yesterday, a post has been added to the OpenX official company blog, officially announcing this security fix release. It also specifically mentions that the security fixes relate to issues found in OpenX Source version 2.8.7, which indicates that versions 2.8.6 and earlier are not affected. However, it is always a good idea to upgrade to the most recent version available. Read the post “Security matters” on the OpenX blog for more information.

Meeting with OpenX executives in December 2009

We talked about the development of their company, and the transition they were going through from being a purely open source team into a commercial entity. At the time, there were a lot of concerns about OpenX Hosted system performance (OpenX Hosted is now called OpenX OnRamp). I also asked them about how they were planning to continue developing the OpenX software, since they had closed the Poland office where most of the developers were located, and moved the London, UK, office to Pasadena.

John and Mike tried to convince me that they were on track with the development of the next version, and that they expected it to be ready in the first quarter of 2010. They said it was going to be amazing and that I would get a login to a beta version shortly.

We also talked about the AdserverPlugins.com project that I had co-founded not too long before that date. I explained that it was my objective to make OpenX a more attractive offering by having third party developers contribute in the form of new features, and they agreed that it was a nice idea. I even told them in great detail about the Retargeting Plugin for OpenX that we had not announced yet back then. They seemed both surprised and delighted about that kind of development, but also a little bit shocked that someone other than themselves was taking this kind of initiative.

I left the meeting with a feeling of anticipation. They claimed OpenX 3.0 was almost ready and would be available withing about 3 months. And then the waiting began.

Many announcements, no progress in 2010

It is now exactly one year later, and nothing has happened. OpenX have had a bad first half of the year, when multiple security issues where discovered in the OpenX 2.8 software, resulting in hundreds if not thousands of OpenX installations getting hacked and infected with malware. Fortunately, fixes for these issues have been provided rather quickly, but still it was an unpleasant experience.

In March of 2010, an announcement was made about the project with France Telecom’s Orange to form a European equivalent of the OpenX Market, called Orange Market. The press release said the project would launch in the second quarter of 2010, but it never happened. In August 2010, a announcement was made about similar project in Japan called “OpenX Market Japan“. As of today, that’s the last we’ve heard about this project.

Starting in August 2010, OpenX began promoting OpenX Enterprise, which is the paid hosted version of the OpenX Ad server, but still no sign of OpenX 3.0 software. Meanwhile, I was still getting reports of people being very disappointed about the performance and stability of OpenX Community Hosted.

When OpenX launched their new website in October 2010, it was an interesting discovery by many that the links to the login pages for OpenX Community Hosted were missing. It was as if you come home from school one day only to find out your parents have moved house, and to make matters worse, forgot to tell you the new address. New names for several products were officially introduced, OpenX Community Hosted was renamed to OpenX OnRamp, OpenX Enterprise Hosted was now simply OpenX Enterprise, and OpenX Community Download was renamed OpenX Source. But still no sign of the OpenX 3.0 software.

So what happened to OpenX 3.0?

We were used to OpenX developing their software as true open source, with everything out in the open. There is a Developer zone which used to be very active but now looks very much dead. There is no trace of any kind of development of OpenX 3.0.

At the same time, OpenX have started heavily promoting OpenX Enterprise, their paid hosting service for the OpenX software, while at the same time barely keeping up with OpenX OnRamp, the free alternative for small publishers. They seem to be very keen on moving as many customers to OpenX Enterprise, in what looks like an attempt to build a revenue model. I’m just curious: is it a smart idea to try and compete with a well established market force like DoubleClick for Publishers?

I’ve seen some statements that OpenX Enterprise will be upgraded to OpenX 3.0 software “very soon now”. That’s surprising, to say the least, because that 3.0 release is nowhere to be seen, at least not in public.

Or is the strategy changing and is OpenX Ltd developing proprietary software now? Do they have no intention of making it available for download? What does this mean for the tens of thousands of individuals and companies around the world that use OpenX software for their ad serving? Will they be stuck with version 2.8?

When I was first introduced to this product back in 2002/2003, it was called phpAdsNew, and it was later named Openads and eventually OpenX, just like the company name. Doesn’t putting the word ‘open’ in your company name imply some sort of commitment to being transparent about your plans for your loyal users?

Fortunately, the OpenX 2.8 software is still open source in the true sense of the term. It means anyone has the right to take the software as it is today and continue developing it. I’m curious to find out what is going to happen next in 2011 and beyond.

Notes and disclaimer

Before I start, the most important tip I can give is: make backups!

Another important note: the procedure below is based on my personal experience upgrading several hundred OpenX installations over the last few months. I’ve generalized the process so that it can be applied in many situations. However, I don’t claim that this process will work in all cases and for all people.

Starting point

Single server setup

The procedure described below is for a setup where there is just one server that handles everything related to OpenX. When you have a setup with multiple servers, the basics of the upgrade process are the same, but obviously you’ll need to make some changes to the various steps. If you’ve managed to get a setup with multiple servers running, then I’m sure you’ll understand the differences.

OpenX installed in www.example.com/openx/

I’m starting with the assumption that you’ve installed your OpenX system on your website example.com in a folder called ‘openx’ (so the address is www.example.com/openx/), and that it has been installed and configured correctly.

OpenX running on a dedicated database

I’m also assuming that you are using a database called “openx_xyz”, where xyz is the version number of your current OpenX version. So if you’re running OpenX v2.8.4, your database would be named “openx_284″.

I’m also assuming that you have a specific MySQL user for the OpenX database, and that this user has “all privileges” on that database. For the examples below, I’m going to assume that this user is called “openx”.

Banner images stored in www.example.com/images/

I’m also assuming you have moved your banner image storage folder to a location outside of the OpenX directory. If you haven’t done that yet, then I suggest that you first do this by following the instructions in the earlier blog post How to: move banner image storage location in OpenX.

Overview of steps in OpenX upgrade process

The upgrade process consists of two major parts: preparations and upgrade.

The preparations involve:

1. Uploading the files of the new software version in a new folder on the server
2. Creating a new database
3. Copying and adjusting the configuration file
4. Preventing the creating of backup tables
5. Setting file and folder permissions

The actual upgrade involves:

1. Copying the database
2. Running the upgrade wizard
3. Making the upgraded copy the live system

Read this procedure carefully and completely

I strongly recommend that you read this whole procedure carefully and completely before starting. That way, you will know what to expect and what tools and information you will need.

You might even want to consider to do a dry run of the upgrade on a staging server or test copy of your system.

Preparations for upgrading OpenX

1. Upload the files of the new software version

The OpenX software has been designed so that it can run the upgrade wizard in a temporary folder. This means that the current software version will not be touched or changed in any way during the upgrade process. In the unlikely event that something goes wrong while running the upgrade wizard, the ad delivery on your site(s) will not be affected.

My first step in the preparations is to create a new folder at the same level as the existing ‘openx’ folder. I always call this folder ‘openx_new’. Then I use my FTP program to upload the files of the new version into the new folder. I always unpack the zip file I download from OpenX.org on my own computer first and then I upload the resulting file set to the web server.

2. Creating a new database

Instead of running the upgrade on the existing database, I always run the upgrade wizard on a new copy of that database. That way, when anything goes wrong during the upgrade, the original database will be unharmed and will continue to work as if nothing happened.

The second step is the preparations is to create a new database with a name that reflects the new version number. For example, if you’re upgrading to OpenX version 2.8.7, your new database might be named “openx_287″.  Create this new database, and also make sure that the MySQL user “openx” has “all privileges” on the new database.

3. Copying and adjusting the configuration file

The upgrade process described here means you’ll be running the upgrade wizard with the new database created in the previous step. To make this work, you will have to adjust the OpenX configuration file for the upgrade folder to point to the new database.

The OpenX configuration file can be found in the ‘var’ folder just below the ‘openx’ folder. The name of the starts with your domain name and ends in ‘conf.php’. So for our fictional installation at www.example.com/openx, the configuration file is named www.example.com.conf.php.

First download it to your local computer using your FTP program, and open it in a text editor like Notepad. You’ll need to make one change to the configuration file. Search for the database name in the [database] section, and change it to the name of the new database that you have created in the previous step.

Then upload it into the ‘var’ folder just below the ‘openx_new’ folder.

4. Preventing the creating of backup tables

The OpenX upgrade wizard normally creates backup versions of all the tables in your OpenX database that are changed during the upgrade. These backup tables are used to attempt a recovery when the upgrade goes wrong in any way. If you’re database is large, and if the tables that need to be backed up this way are also large, this can result in a very big increase in the overall size of the database. It will also mean the upgrade will take longer than without these backups.

However, since this upgrade scenario involves creating a new database, copying all existing data into this new database and then running the upgrade on that new copy database, there is no real need for the creating of those backup tables.

There is a trick to prevent the creating of the backup tables. Just create a file named “NOBACKUPS” in the ‘var’ folder just below your ‘openx_new’ folder. The file can be completely empty, it’s just the name and the fact that it’s there that tell the upgrade wizard to skip creating backup tables.

5. Setting file and folder permissions

During the upgrade, but also during normal operations, OpenX software requires that several files and folders can be created or changed on the server. This means you will have to change the permissions of those folders and files. The upgrade wizard will check this in one of the first steps, forcing you to make the changes at that time, but it’s easier to do it now during the preparations.

The following folders, plus all files and sub folders in them, will to be set to “world writable”:

• ‘openx_new/plugins’
• ‘openx_new/var’
• openx_new/www/admin/plugins’

If your server is running on Linux or Unix, the permissions have to be set to ’777′.

Selecting a day and time for the upgrade

It’s a good idea to carefully plan the day and time for the actual upgrade. Most sites will have a distinct day-and-night pattern in their visitor statistics. If you can, perform the upgrade during the least busy time of the day (or night). This has several advantages.

1. The server will be less busy than during the daytime, and thus faster when it comes to making changes to the database tables and files and folders in OpenX.
2. It’s likely that nobody will be working in the OpenX user interface during the night, adding campaigns or banners for instance. In any event, tell anyone on your team that uses OpenX to avoid working in OpenX during the upgrade process.
3. For the time it takes to perform the upgrade, you will miss a few minutes worth of statistics. If you do the upgrade at a time when few visitors are on the site, you’ll miss as little as possible.
4. At the very end of the upgrade, you’ll have to swap the ‘openx’ and ‘openx_new’ folder names. Depending on how fast you can type, this will take a few seconds. Doing this at a quiet time of the night will mean that hardly anyone will notice it.

Whatever day of the week and time of day you select, make sure that you start the upgrade steps just after the hourly maintenance process is completed. This means you’ll have a consistent copy of your data and that you’ll only be missing a few impressions, clicks and possibly conversions while going through the upgrade process.

It might be that you’ll have to decide to do the upgrade during the night from Sunday to Monday. So the disadvantage is obviously that you’ll have to sacrifice a chunk of time otherwise spent sleeping.

Performing the upgrade

With all preparations complete, it’s time to perform the upgrade for real.

The steps below will have to be performed in the shortest possible time. Make sure you’re not going to be disturbed or distracted by phone calls, meetings or people walking in to have you do other things. The time it will take to complete the whole upgrade largely depends on the size of your database and the speed of the server. It could be as quick as a few dozen seconds, but it might actually take minutes or even half an hour.

1. Copying the database

As explained in detail above, the upgrade process involves making a copy of your production database into a newly created database and then to run the upgrade on this new database.

If you’re not comfortable with command line statements, you might be able to use a tool like phpMyAdmin to copy all of your tables from the existing database ‘openx_abc’ into the new database ‘openx_xyx’.

However, it is often faster to use a few command line statements to export the data from the existing database and then to import it into the new database. If you don’t know how, ask a colleague, team member or outside expert for help.

Here is a template for the command line statements.

To export data from the existing database into a text file:

mysqldump -uUSER -pPASSWORD OLDDATABASE –skip-lock-tables > FILE.sql

To import data from this text file into the new database:

mysql -uUSER -pPASSWORD NEWDATABASE < FILE.sql

You’ll have to replace the USER, PASSWORD, OLDDATABASE and NEWDATABASE placeholders with the actual names and values.

Whatever way of copying the data you use, always make sure that you’ve got a copy of all the tables of your existing database. You can do this by comparing the list of tables of both databases.

2. Run the upgrade wizard

After you’ve completed copying the database as described in the previous step, you can run the upgrade wizard.

In your web browser, enter the address of your new OpenX version, which in the example used in this article would be:

http://www.example.com/openx_new

The OpenX software will recognize that an upgrade is in progress and instead of presenting the usual login screen it will start the upgrade wizard.

The upgrade wizard will do the necessary work for you. It involves a welcome screen, and a check for the technical requirements for your server to be able to successfully use OpenX.

At some point you will have to prove that you are authorized to perform the upgrade by entering the OpenX administrator user name and password. The newest versions of the OpenX software will also ask (or rather force) you to login in on an existing OpenX account or to create a new OpenX account.

The wizard will also display the database connection details that it finds in the configuration file. Check and make sure that you’ve changed the database name in the configuration file to point to the new database containing the copy of the data.

After this check, the upgrade wizard will make all necessary changes to the database tables. Depending on the size of the database and the speed of your server, this could take just a few seconds but it might take several minutes.

After the database changes have been completed, the upgrade wizard will display the folder path of the ‘old’ copy of OpenX. Since we’re actually working in a temporary folder, this should in fact be the folder path of the current, live version of the system. Check and confirm that the path is correct. The upgrade wizard will now find out which plugins are installed in the current version and then install the same set of plugins in the new version. During this step, it will even check if there are any new versions of any of the plugins and if so, it will install those instead of the older versions. Some plugins will actually create or change tables for their own use.

At the very last step of the upgrade wizard, it will present a page informing you that the upgrade was successful. If you click the “OK” button on that page, your browser will be redirected to the ‘official’ address of your OpenX installation, which is http://www.example.com/openx/www/admin/. Since you are not currently logged in on that folder, you’ll be presented with a login screen. Don’t be alarmed! The next step will take care of this.

If something goes wrong while running through the upgrade wizard, carefully read any warnings, errors and notifications you see in the browser. In almost all cases it will be clear enough how the problem can be corrected. You’ll have to decide if you want the correct the problem(s) right away and continue or if you’ll need to postpone the upgrade for more complex problem fixing later.

Whatever is the case, do not perform the next and finals step in the event of any major problems during the upgrade wizard.

3. Swap the folder names to have the upgraded copy delivering ads

If the upgrade wizard completes without errors or problems (see the last paragraphs of the previous step), all that is left is to swap the folders to make your upgraded copy the live copy. Here’s how:

• Rename your existing ‘openx’ folder to ‘openx_old’
• Rename your new ‘openx_new’ folder to ‘openx’

This should ideally be done in a short sequence, within a matter of seconds.

Finally…

After going to this complete upgrade procedure, you are now running the new version of the OpenX software in the original folder name www.example.com/openx. So there is no need to make any changes to the invocation code on your site(s).

I would recommend to keep the ‘old’ version of the software, currently sitting in the ‘openx_old’ folder, around for a little while. If you find anything wrong with the new version, you can easily switch back to the old version (including the original database) by changing the folder names back to their original names: openx to openx_new, and then openx_old to openx.

OpenX Ad Server v2.8.7 released for download

A new version of the OpenX Ad Server software has been released. This version 2.8.7 fixes a very serious security issue. According to the announcement on the OpenX blog:

there is a vulnerability in the 2.8 downloadable version of OpenX that can result in a server running the downloaded version of OpenX being compromised.

The issue stems from the Video Ads plugin for OpenX, which in turn uses an open source third party component called Open Flash Charts (OFC) to display graphs about video ad performance. There was a security issue with OFC which has now been fixed.

In addition, the upgrade notification inside the OpenX management pages has this information:

If you recently upgraded to version 2.8.6, you can simply install an upgraded video ad plug-in available [here] or remove the following file: admin/plugins/videoReport/lib/ofc2/ofc_upload_image.php from your installation.

This is the second update in less than 1 week, which might sound alarming. On the other hand, there will always be bugs and security vulnerabilities in software, and it’s better to have those fixed.

Besides this fix for the security issue that was uncovered, there is also a seemingly small functional change in this new version:

For users in the UK, all market interfaces now reflect your participation in Orange Ad Market, and all Orange Ad Market market monetary values are in GBP.

Since both the OpenX main website and the OpenX blog appear to be down at the time I’m writing this, I can’t give you any more information than what I included above.

What does still seem to work at the moment is the download link at http://download.openx.org/openx-2.8.7.zip.

This is a security fix release that takes care of one issue:

• A vulnerability has been discovered in the third-party open source graphing component Open Flash Charts that is used by this plugin to draw the graphs.

As always with security fix releases, it is crucial to upgrade to the newest version as soon as possible.

OpenX Ad Server v2.8.6 released for download

Just like in March 2010, a new version of the OpenX software has been released recently, but not a single byte of publicity has been devoted to it. No mention on the OpenX blog or on Twitter, nothing. Judging from the dates on the files in the download archive, the new release was completed on September 2nd of 2010, so almost a week ago.

This new version 2.8.6 seems to be mostly about the security issue that was found and fixed a few weeks ago. Back then, on August 12, a somewhat cryptic announcement was posted on the OpenX forums, informing people how to fix the security problem. That post also hinted at a new release that would be out soon.

The release notes file in the 2.8.6 archive points to the OpenX Developer site for more details, but the issue tracker for version 2.8.6 is still open and most issues in it are still marked as unresolved. And the version check inside the OpenX software doesn’t give any notifications about upgrade availability.

Altogether, this is a pretty strange situation. Obviously, it’s smart to upgrade to a new version as soon as it’s released, especially if the upgrade is about fixing security issues. On the other hand, what should we think about a release that is not announced in any way, shape or form?

Download the OpenX Community edition v2.8.6.

OpenX Ad Server v2.8.5 has been released for download, but I don't recommend upgrading (yet).

Without any form of publicity, OpenX.org have released version 2.8.5 of the OpenX Ad Server. There are a few strange things about this release, which makes me hesitant about recommending an upgrade.

• First of all, I wonder what the official status of this release is, since it hasn’t been formally announced like all previous releases. At the time of this writing, it’s been offered on the site for at least 10 days.
• Secondly, if you look at the OpenX Developer site, this version isn’t marked as ‘completed’, symbolized by the wrapper about the package icon of all previous versions.
• Thirdly, looking at all of the issues that are listed for version 2.8.5, a few of them still show a status of ‘unresolved’.
• And finally, work is already under way for the development of version 2.8.6, which must mean that version 2.8.5 has a few known bugs that require fixing.

Since it’s been so quiet about the release of version 2.8.5, I haven’t really had time yet to give it a good test drive. For the time being, it is my recommendation to stay with version 2.8.3.

OpenX Ad Server version 2.8.4 announced

On Friday, January 22, as one of the last things before the start of the weekend, OpenX.org announced the upcoming release of version 2.8.4 of the OpenX Ad Server. According to the blog post, the free service OpenX Community Hosted has already been upgraded, and the new version will be available for download ‘later in the week’ (which is a bit odd, because at the time of posting the week was effectively over).

More focus on OpenX Market

The announcement on the blog focuses primarily on the many changes and new features for using the OpenX Market. That’s not surprising, because OpenX Market is the main source of revenue for the company. Making it easier for more OpenX publishers to participate in this market was a move that was to be expected.

Bug fixes and improvements

The blog post doesn’t mention it, but this new release also fixes dozens of bugs and long standing issues. The Issue Tracker on the OpenX Developer site lists a total of 144 issues. A little bit surprising, perhaps, is that only 115 of these have been labeled as ‘fixed’.

Version 2.8.4 includes the security fix that was rushed out just before Christmas with the emergency release of version 2.8.3, and it also contains the fix for the serious under delivery problem for contract campaigns. Both of these fixes were contributed by independent consultant and developer Matteo Beccati.

Reviews to follow

Since the downloadable version of OpenX Ad Server v2.8.4 is not yet available, I haven’t been able to test drive it yet. I do have the OpenX Community Hosted account, and I can see the new features for working with OpenX Market in there.

I’m planning on writing some follow up blog posts as soon as possible, for instances about the new upgrade procedure (which is said to have a mandatory registration step), the new OpenX Market features and other noteworthy issues.

Your feedback, please!

What would you like to know about this new release? What should I be researching and writing about? Drop a comment below or contact me with your views!

You can submit my OpenX support request form if you’d like to discuss working with me on your OpenX project.