Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

WordPress.org's latest move involves taking control of a WP Engine plugin

theverge.com

Post reply on HN
Print view View original

21–30 of 222 posts

Re: WordPress.org's latest move involves taking control of a WP Engine plugin

#21

Post by grayhatter »

maxloh wrote: post #13
vintagedave wrote: post #6

> It’s not clear what security problem Mullenweg is referring to in the post. Where is the CVE? What risk is there continuing to use the original plugin? No details at all. This results in fear: we don't know if the original is safe to use. > Going forward, Secure Custom Fields is now a non-commercial plugin Does this imply that Wordpress is potentially going after a revenue stream from WPEngine? If the plugin had Pr…

> Where is the CVE? What risk is there continuing to use the original plugin? Here’s the diff showing what has changed: https://plugins.trac.wordpress.org/changeset?new=3167679%40a...

wow, they deleted 300 lines, many giving credit to others, just to replace it with

> Security - ACF defined Post Type and Taxonomy metabox callbacks no longer have access to $_POST data. (Thanks to the Automattic Security Team for the disclosure)

If I was on that security team, I would be livid they used my team's name on this behavior.

If this was done by that security team, their ethics are disgusting, and likely non-salvageable...

Still looking for the security exploit worthy of a plugin takeover though.

edit; best I can figure tonight is it's some concern over CSRF, but they don't even sanitize $_GET nor $_SESSION, only _POST and _REQUEST... so either it's more complicated than it looks on the surface, or this "fix" is partial at best, and wasn't written by someone from security. (It's also possible or likely that I'm missing some context, it's been a long time since I've had to work on php)

Re: WordPress.org's latest move involves taking control of a WP Engine plugin

#23

Post by Svip »

maxloh wrote: post #13
vintagedave wrote: post #6

> It’s not clear what security problem Mullenweg is referring to in the post. Where is the CVE? What risk is there continuing to use the original plugin? No details at all. This results in fear: we don't know if the original is safe to use. > Going forward, Secure Custom Fields is now a non-commercial plugin Does this imply that Wordpress is potentially going after a revenue stream from WPEngine? If the plugin had Pr…

> Where is the CVE? What risk is there continuing to use the original plugin? Here’s the diff showing what has changed: https://plugins.trac.wordpress.org/changeset?new=3167679%40a...

     -        public $version = '6.3.6';
     +        public $version = '6.3.6.2';
Why would you break the version standard? Maybe there are scripts expecting a specific format or some such. Also, given the majority of this change, I think 6.4.0 or even 7.0.0 is more in order, but at least 6.3.7.

Edit: To make matters worse, elsewhere in the code, it's referenced as 6.3.8. Very confusing.

Re: WordPress.org's latest move involves taking control of a WP Engine plugin

#24

Post by gorbachev »

nurettin wrote: post #12

You make an opensource project, provide hosting services, then others take your project, modify it for their needs, cut into your hosting market share and then you try to get rid of them. ...What was the end game plan?

At this point I wouldn't be surprised if he'd had secured funding for a new CMS platform startup and is secretly working on it. He seems absolutely hellbent on assuring nobody should use Wordpress.

Re: WordPress.org's latest move involves taking control of a WP Engine plugin

#25

Post by crote »

shprd wrote: post #19
sccxy wrote: post #10

Mullenweg is hijacking existing users with supply chain attack.

> supply chain attack. Where's the "attack" part? I thought that was a crucial part in the definition

The author of a library has lost all control over the codebase, and a third party is now making changes to it. That's pretty much the textbook definition of stage one of a supply chain attack.

Considering what Matt has already done, it wouldn't even remotely come as a surprise if a future ACF update would, say, brick all WP installations using ACF on a WP Engine host.

Re: WordPress.org's latest move involves taking control of a WP Engine plugin

#27

Post by r721 »

LeoPanthera wrote: post #3

Previously on Hacker News. https://news.ycombinator.com/item?id=41821400

Also

https://news.ycombinator.com/item?id=41821336 (165 comments, including 5 by photomatt)

https://news.ycombinator.com/item?id=41824852 (63 comments)

Re: WordPress.org's latest move involves taking control of a WP Engine plugin

#28

Post by luckylion »

maxloh wrote: post #16
vintagedave wrote: post #6

> It’s not clear what security problem Mullenweg is referring to in the post. Where is the CVE? What risk is there continuing to use the original plugin? No details at all. This results in fear: we don't know if the original is safe to use. > Going forward, Secure Custom Fields is now a non-commercial plugin Does this imply that Wordpress is potentially going after a revenue stream from WPEngine? If the plugin had Pr…

> If the plugin had Pro options* then are those closed source and so not available to Wordpress in their fork of the codebase? It's not clear. Because WordPress is licensed under the GPL, all plugins must be licensed under GPL-compatible licenses. This applies to ACF Pro as well.

Fundamentally yes, though it hasn't really been tested in court and I'm not sure that plugins really are obviously derivative works - you can create a plugin that doesn't depend on WP but can be used with WP, but I'm not a lawyer.

Matt and WP's position however includes that this applies to the PHP code but not to accompanying assets like images, CSS, JS (because those can obviously be used without WP). Those only need to be GPL if you want to host it on wordpress.org which the commercial versions of those freemium-plugins are not.

Re: WordPress.org's latest move involves taking control of a WP Engine plugin

#29

Post by pwdisswordfishz »

threeseed wrote: post #11
withinboredom wrote: post #2

They either have some of the best or worst legal counsel; or they just ignore the legal counsel.

They also have the worst social media team I have ever seen: https://x.com/WordPress/status/1845121130207535524

Who is she, though?

Re: WordPress.org's latest move involves taking control of a WP Engine plugin

#30

Post by mimsee »

maxloh wrote: post #16
vintagedave wrote: post #6

> It’s not clear what security problem Mullenweg is referring to in the post. Where is the CVE? What risk is there continuing to use the original plugin? No details at all. This results in fear: we don't know if the original is safe to use. > Going forward, Secure Custom Fields is now a non-commercial plugin Does this imply that Wordpress is potentially going after a revenue stream from WPEngine? If the plugin had Pr…

> If the plugin had Pro options* then are those closed source and so not available to Wordpress in their fork of the codebase? It's not clear. Because WordPress is licensed under the GPL, all plugins must be licensed under GPL-compatible licenses. This applies to ACF Pro as well.

As far as I've understood, the copyleftness of the Wordpress's GPL tainting themes and plugins is or at least has been controversial (I'm not in the WP community, but have read stuff regarding this drama). Wordpress itself uses React and other non-GPL licensed software in the core that yes, may be GPL-compatible but doesn't enforce everything to be GPL'd. When it comes to themes and plugins, I'd consider that userspace, akin to installing Spotify on Ubuntu doesn't make Spotify suddenly GPL'd.
Post reply on HN