Is there a way to tell if a third-party site has patched the bug? (Upgraded to 1.0.1g) Not much point in changing your password on that site before the vulnerability is fixed.
If you add the live_console gem to a rails app, you can use netcat to run IRB against the live application.
You can change the app's state from a console, like flushing a cache or even making a patch, without having to restart the app.
If a merchant doesn't want to be on our site, all they have to do is ask and we'll remove them.
The merchant is our friend. We bring them customers and sales. We avoid the things they hate, like linking customers away to another site. We also have some future features in mind that they'll really like.
We're also willing to let them run plurchase on their own servers, and in the future, will offer white-label functionality.
I evaluated cgiproxy at the beginning of this project, along with a variety of apache mods and other libraries. cgiproxy didn't work for most of the merchant sites that I checked. Was an oversight to ignore them thereafter though. Like you said, they've put a lot of time into special cases, and we can learn things from them.
Their primary goal is anonymous browsing. Ours is collaborative shopping, or more specifically, adding new functionality to existing sites. Our proxy lets us do amazing things with client state, image scraping, and more. A different tool for a different problem.
We plan on supporting both public & private. Mostly just UI work to add the public functionality. One idea: when in a public shopping group/room, we'd replace the little preview boxes with a stream of just-product-pages as people visit them.