Non-Compliance Fees

[joshpappas]

Is there no way to consider Miva 10 to be a "public beta" for another 30 days so we can all get through the end of the year without facing non-compliance fees? As much as I'm excited to start working with v10, this seems like really awkward timing. I definitely won't be updating our live stores before the end of the year, and I imagine many others are in this same situation. Many organizations have policies about freezing code in Q4. It seems impossible that Miva wouldn't have considered this since this is an enterprise ecommerce platform, so it feels like a situation where forcing a release this month just ensured a nice little bump in billing for January. Based on comments in other threads, it was known that v10 wasn't completely ready yet (some of the admin screens are still the v9 UI, for example), which makes this timing even more confusing for me. This has been in the works for several years, so what's another 30 days?

I'm not trying to start a revolt or anything, but I'm legitimately curious and imagine others are as well. I appreciate any insights or help the Miva team can offer.

[Rick Wilson]

As of now, the answer is no. From a PCI perspective you can never run beta anyway.

As of today you need to upgrade by 12/21/20 to remain PCI Compliant and you'll need to upgrade by 12/31/20 to avoid the fees (based on when we run the report to calculate those).

We might choose to wave them for 1 month if something goes very haywire, but as of now all of the bugs have been extremely minor and after the 10.00.02 release expected tomorrow, other than getting comfortable with the new admin, there shouldn't be much reason to hold off.

Even if we do postpone the fees, you'd still be out of PCI compliance during that month if you postpone the upgrade.

With that said we're not a monolith and keeping a close eye on this as an issue.

[Rick Wilson]

Also we still have 87 days and based on 2020, a lot can happen in 87 days

[lesliekirk]

Also we still have 87 days and based on 2020, a lot can happen in 87 days

Yeah, don't tempt 2020. I would like to request we end the year right now, please.

[candystore]

I must agree with Josh. It also required our host server to upgrade, and it did not function. There are at least a hundred bugs in this product. Templates need to be individually upgraded as well if I'm not mistaken. We had to revert back to 5.34. And why would this make us nonPCI compliant? Also, trying to do this upgrade during 4th qrt. with the COVID issues makes this nearly unbearable. I'll be a bit snarky here, but not all of us can travel in an RV and say oh well! Perhaps it is best to incur the fees, and work on this project in a more methodical and measured manner.

[Rick Wilson]

There are not anywhere near 100 known bugs in this software.

This software had been in development for 3 years and 11 days, and software doesn't age well when not released because it blocks us from being able to support customers (you can't go back and change the last gen platform once this is done).

There is also no good time for everyone to release software. Some of our customers had to have the new features for Q4, we also have a lot of diverse customers who have their peak season in Q1, Q2 or Q3, so it's not a universal Q4 thing within our customer base.

If the software is having issues going into December, we will adjust as necessary, but 3 days after release to ask us to foresee the state of things on 12/21/20 is not practical (Covid or no Covid)

[candystore]

There are not anywhere near 100 known bugs in this software.

This software had been in development for 3 years and 11 days, and software doesn't age well when not released because it blocks us from being able to support customers (you can't go back and change the last gen platform once this is done).

There is also no good time for everyone to release software. Some of our customers had to have the new features for Q4, we also have a lot of diverse customers who have their peak season in Q1, Q2 or Q3, so it's not a universal Q4 thing within our customer base.

If the software is having issues going into December, we will adjust as necessary, but 3 days after release to ask us to foresee the state of things on 12/21/20 is not practical (Covid or no Covid)

Well, not sure exactly how many bugs there are, I have attached a link identifying them. What I do know, our host provider tried to upgrade their system, and too many flaws resulted in loss of functionality. As you say, COVID or NO COVID, (which I think is naive to believe it doesn't affect businee) it is possible to delay charging fees. Thats what we ask, so we can work together and make MIVA 10 awesome. A little empathy for the 4th quarter folks, or others, might be helpful.
https://docs.miva.com/miva-10-bug-list

[Rick Wilson]

That bug list was the bugs fixed from V9 coming into 10, we have not published a bug list for v10.

I don't think Covid doesn't impact business, I never said that. I simply said there is no perfect time to release software.

I also think I've made myself clear. We are 86 days away from needing to make a final decision, we will keep people updated as we go, but as of now I don't have any further guidance to give.

[Rick Wilson]

One final note, since you're not hosted with us. There are no known bugs in the 5.34 engine which is what's necessary to upgrade to 10, so I'm not sure why your host told you that, but it is factually incorrect on every level.

Waiting a week or 4 is definitely prudent, but it sounds like you were given a lot of false info from your host.

[ILoveHostasaurus]

I must agree with Josh. It also required our host server to upgrade, and it did not function. There are at least a hundred bugs in this product. Templates need to be individually upgraded as well if I'm not mistaken. We had to revert back to 5.34. And why would this make us nonPCI compliant? Also, trying to do this upgrade during 4th qrt. with the COVID issues makes this nearly unbearable. I'll be a bit snarky here, but not all of us can travel in an RV and say oh well! Perhaps it is best to incur the fees, and work on this project in a more methodical and measured manner.

When a Miva Merchant upgrade is released, templates are normally not touched unless, possibly, the template is confirmed as being never modified from original. Template upgrades are required to make use of new features that may come to exist after the template code was originally written, but are not required. For example, ReadyThemes written before the MivaPay payment system existed must be updated to make use of it, but continue to work fine in stores that don't want to use that payment option. The longer a particular store exists without updating the templates, the theme, applying a newly released theme, etc., there will possibly be an ever increasing number of front end features that cannot be utilized. Our intent is always to have updates go on without causing any change to the front end, vs forcing shopper-facing changes onto a site at a schedule not of the site owner's choosing. If you're using a ReadyTheme and let me know which one, I'm happy to try and determine where you can look for documentation on per-template changes to take it from the release it's on through subsequent releases.

Regarding PCI, the way this software release relates to PCI is simply that if a business is choosing to, or mandated to, operate in a manner consistent with PCI guidelines, any "payment application" that they use must be updated within 90 days of that application having a new release. If the release is categorized as a security release (this one is not), the requirement is 30 days. The Merchant 10 release has features that many businesses wanted for the Q4 shopping season. Adding an artificial delay to push the 90 day window well into Q1 would not have left adequate time for entities to deploy the new software on their non-production websites, test, train staff, and then move to production ahead of mid-November when order volume increases.

If you do have concerns over the Merchant 10 update creating shopper-facing problems, or just want to test it with no risk, I'd recommend deploying it on a non-production copy of your website. Generally the upgrade process takes about 10-20 minutes, and once adequately tested, you could then upgrade your primary copy.

[lesliekirk]

If you do have concerns over the Merchant 10 update creating shopper-facing problems, or just want to test it with no risk, I'd recommend deploying it on a non-production copy of your website. Generally the upgrade process takes about 10-20 minutes, and once adequately tested, you could then upgrade your primary copy.

This is a highly recommended course of action, it's easy to do and makes it easy for you or any of your folks working in the admin to get comfortable with the admin. I had one of the sites I updated this way go bonkers, Miva Support was right there to fix it.

Yes, I have had store owners contact me in a panic because this is the wrong time for them to even think about updating anything. I also have store owners that have been chomping at the bit to take a look at the new layout.

Do I think Miva has done everything they could have done before releasing Miva 10? Well almost, they didn't ask me to break it. But it's also very hard to try and test for every possible scenario. What things have come up, Miva has been extremely responsive in getting resolved (and that is on top of the normal support stuff).

As for where everyone is working lately, it's been a real challenge for all of us. I've had to pack up my laptop and head out of state to tend to family business more times in the past few weeks than I want to count (which has gone from emergency to funeral). That is the wonderful thing about the internet - as long as I have a signal and a few minutes I'll do what I can when I'm on the road.

On a wish list note, I would like the update button to say "you need to update within XX days for avoid paying a non-compliance fee" (which by the way, you can pay if you don't want to update - but that's another story for another time).

[jsdva]

I must say that for clients that have had other hosts, not Miva, hosting their Miva shopping cart, I found so many issues and erroneous statements from those hosts. It is not Miva that has the issues, the issues are with those that don't know Miva like Miva corp does. Not trying to start anything, it is just always best to go with those who are the experts.

[bonnie1525]

I would like to second Leslie's request to add "you need to update within XX days for avoid paying a non-compliance fee".

[birdwaves]

If I were to have to chose between upgrading for those who are "comping at the bit" and those who are just trying to get through this Christmas shopping season without needing to learn a whole new store system, I think I would side for the latter.

I just don't see the need to put this on people's plate at this crucial time of year.

I installed on the Dev site, and it broke our storefront slider. I not only have to fix that, which I'm still working on, I have to inform the front office that they need to learn a new system by the end of the year or incur fees.

Sheesh! What are you thinking MIVA?

[Kent Multer]

I see where Miva has a dillema about satisfying the people who really wanted the upgrade now, and those who really wanted to delay it. Here's a thought: just allow more time before the non-compliance fee kicks in?

Of course, if there's a PCI compliance issue, that would be something that's "bigger than both of us." Rick, can you elaborate on that please? Is there a new PCI standard that kicks in on Dec. 21?

Thanks --