PBX in a Flash vs. trixbox

As promised, I have spent some time comparing the various benefits of PBX-in-a-Flash over trixbox. In a nutshell, my conclusion is relatively straightforward.

It's worth switching.

Why, you may ask? Well, the reasons are many and varied, but here are the high points:

1) Upgrades. If you've spent any time poring over the various email lists for trixbox, you will quickly come to realize that the general consensus with respect to upgrading trixbox is as follows: if it ain't broke, don't fix it. Upgrading trixbox can be a nightmare (something I've personally experienced), and the simplest solution is to either (a) live with an older version; or (b) do a clean install. Upgrading PBIAF, though, is really, really simple, and it actually works. Everything is web-based, wizard driven, and painless. In fact, the default installation regularly checks for both core and module upgrades, and offers to do it for you.

2) Extending functionality. PBIAF has a rapidly growing set of modules that are simple to install, and add nice functionality to the base system. Wait, you say -- so does trixbox! Well, yes, it does, but when it comes to installing and upgrading these modules, PBIAF is the hands down winner.

For these two reasons alone, it's worth the upgrade. 

Highly recommended.

PBX in a Flash

Last week I downloaded and installed the new PBX in a Flash alternative to Trixbox. I have had excellent luck with Trixbox, and no real complaints, but I like to keep abreast of things, had some time on my hand, and thought I'd give it a whirl.

I am impressed.

Installation was simple, and it has all the functionality of Trixbox, and then some. Like Trixbox, it uses FreePBX for the actual management of the PBX, but unlike Trixbox, it runs on CentOS 5, and lacks the annoying "feature" of having all Zap functionality die if you happen to be running on a non-multicore CPU.

There are a host of modules already available, including some nifty text-to speech features, but I haven't had an opportunity to test those as of yet. I plan on doing so next week, just to see how things work.

One added bonus -- for some reason, PBX-in-a-Flash actually fixed one annoying problem I had with Trixbox: on my outbound trunk using Vonage, I often had problems with IVRs (when I was dialing the phone company to complain about another billing error, for example). The whole "press one for sales, two for tech support" etc. didn't work a lot of the time. Now it does.

That alone was worth making the switch.

Trixbox phones home?

Nerdvittles has an interesting post today -- apparently, trixbox phones home at 3:41 AM each day and gets a list of shell commands to run:

You may have read that a user discovered last week that current trixbox systems as recently as today include a remotely-configurable BOT, a software program that can execute certain commands locally once it receives its instructions. Reportedly, trixbox’s registry.pl “phones home” to Fonality via the Internet at 3:41 a.m. each morning to get a list of Linux commands to run. It then executes those Linux commands on your server while you’re sleeping. If the assertions of trixbox end users are true and we have no reason to believe otherwise, the existence of this remotely-configurable BOT had never been disclosed to unsuspecting users whether they were individuals or corporations. In fact, it doesn’t appear that even trixbox resellers were aware of the existence of the remotely-configurable BOT.

This is interesting, and disturbing. To be fair, the folks at Nerdvittles suggest that they "don’t for a minute believe that Chris Lyman and other senior management of Fonality knew about this in advance", but they certainly know about it now!

This is cause for concern. Since the ability to remotely execute shell commands exists, it's only a matter of time before someone else figures out how to exploit it.

Maybe it's time to accelerate my testing of pbx-in-a-flash....