Anyway to get a change log on firmware upgrades?

[fgc92210]

Greetings,

Is there any way to get webpage with a firmware upgrade changelog?

Thank you

 

[cobaltit]

Absolutely. Go to www.insertphonevendorhere.com and go to their support section. Generally change logs are posted with the firmware.

 

[fgc92210]

I thought 3CX had their own flavor of firmwares because of their tight partnership with some vendors ?
Hence for example why Fanvil 3CX Firmware is 2.2.13 , but Fanvil official firmware is 2.2.1 for the X210 for example.. Am I wrong?

 

[cobaltit]

It's not so much 3CX has their own flavor but that the vendor makes a specific version. Sometimes it's purely fluff/cosmetic, and sometimes there is a significant change from the standard/published firmware. But it's still the vendor making the firmware and the one making the changes, so documentation request should go to them. But given that standard firmware changelogs are published, there may be some reason why they don't publish changes to vendor specific firmware as 3CX is not the only one vendors make specific firmware for.

 

[fgc92210]

On other systems we sell, customers always want to have a changelog of any binaries coming in their way. Sensitive accounts obviously. Banks. Call centers. Hospitals. It's different though because the PBX manufacturer is also the phone manufacturer. So it's easier. I see what you mean. Thanks.

 

[NickD_3CX]

On other systems we sell, customers always want to have a changelog of any binaries coming in their way. Sensitive accounts obviously. Banks. Call centers. Hospitals. It's different though because the PBX manufacturer is also the phone manufacturer. So it's easier. I see what you mean. Thanks.

3CX collaborates with the IP Phone vendors, but the firmware is always sent by the IP Phone vendors and a lot of the testing is also done by the vendors.
We do not request from the vendors to make a special branch of their firmware for 3CX, we simply ask that certain functions work.

On that note, if you require the exact change log, you would need to contact the vendor.

 

[fgc92210]

@NickD_3CX Thank you Nick - So if I found a bug also, I should contact the vendor direct? This is related to BLFs

 

[cobaltit]

Y

On other systems we sell, customers always want to have a changelog of any binaries coming in their way. Sensitive accounts obviously. Banks. Call centers. Hospitals. It's different though because the PBX manufacturer is also the phone manufacturer. So it's easier. I see what you mean. Thanks.

I'm not sure why they care. I mean it's not like the change log will say 'we have this xyz bug in the firmware' so if there's an exploit or other security risk in the firmware, the changelog (or lack of one) isn't going to make a difference. If they are doing best practices and putting this stuff outside of the secure network it really shouldn't matter.

 

[NickD_3CX]

@NickD_3CX Thank you Nick - So if I found a bug also, I should contact the vendor direct? This is related to BLFs

You can contact the vendor of course, and if you want create a new thread in this forum section describing it and we and other users can discuss it seperately.

 

[fgc92210]

Y

I'm not sure why they care. I mean it's not like the change log will say 'we have this xyz bug in the firmware' so if there's an exploit or other security risk in the firmware, the changelog (or lack of one) isn't going to make a difference. If they are doing best practices and putting this stuff outside of the secure network it really shouldn't matter.

They care because they are sensitive accounts. If you worked in a bank, you'd see that nothing gets installed until it was scrutinized before. They don't install new versions just because it's new. They want to know what was fixed and any new feature. Sometimes a new feature change the behavior of something they have been using for a long time, and they might need to release information to all users or anything of the sort. And frankly, if a large account security team ask for something, I'm not going to say "I'm not sure why you care". Best way to piss them off and have them look for another manufacturer partner.

We have less than 10 accounts using 3CX since we're new with it. Our accounts usually have 2K+ users, up to 14K. Not sure I'd push any of those large account to switch to 3CX yet until we do PoF with smaller ones. We have a potential -small- bank interested, but I need to prep my strategy in advance, ig: knowing that I'll be able to find changelog when requested without the hassle of "but why do you want this". I'm here to facilitate their life regardless of what they are asking -to a reason obviously-.

 

[cobaltit]

LOL, I wasn't saying to ask them why they care. Obviously you aren't going to tell that to a client. I'm certain whatever you are installing/supporting now isn't inside the secure network but is on it's own segment. For the exact reason that changelogs and test environments aren't going to discover all issues. For example:

- Let's say a change logs says a particular vendor says they patched/installed a version of OpenSSL because of a risk in a previous version. Are you going to take their word for it or will you or the security folks for the sensitive account still perform their due diligence to confirm?

- As far as features, everything feature-wise is going to be driven by 3CX. I imagine you are going to want to stay in the supported by 3CX arena for the most part, which means any 'features' that might change in a firmware aren't going to be available to you anyways if it's not part of the 3CX template. 3CX configuration of phones, at least via the stock templates, is very basic and generally limited to features all of the phones support.

Understood if it's necessary to 'check the box' but scrutinizing a change log accomplishes very little in the grand scheme of things. But it's certainly a reasonable ask by the client and kudos for doing your due diligence. Do keep us updated on how things are progressing though. Demands for changes to support larger/more secure/more particular environments do move the needle for 3CX and that generally benefits all who use 3CX.

 

[fgc92210]

Ha - Frankly for small / mid size customer, we don't really bother with those. Sensitive ones usually run audit on a weekly basis, if not more, to check things. The changelog here is always requested for them to scrutinize any security change since you bring it. Anyways. I found a bug on this firmware, and will create a new thread as @NickD_3CX suggested