Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

WordPress plugin quirk resulted in UK Gov OBR Budget leak [pdf]

obr.uk

Post reply on HN
Print view View original

101–110 of 127 posts

Re: WordPress plugin quirk resulted in UK Gov OBR Budget leak [pdf]

#101

Post by blitzar »

jonplackett wrote: post #49
varispeed wrote: post #42

They didn’t suffer a breach; they published a market-moving PDF early because they put it on a public WordPress server at a predictable URL with no access control, then acted shocked when someone typed it into a browser. The report dresses this up in solemn language about “pre-publication facilities” and “configuration errors”, but the reality is negligent basics: no authentication, no server-level blocking, blind fa…

But but but they ‘have a limited budget’ (repeated multiple times for effect in the article)

~£4mil budget and 50 staff

Re: WordPress plugin quirk resulted in UK Gov OBR Budget leak [pdf]

#102

Post by mytailorisrich »

physicsguy wrote: post #95
exasperaited wrote: post #48

Earlier quoted context omitted.

> The fact that they were elected as a 'change' government and have barely done anything that really faces up to the scale of the challenge the country faces? They have done a lot. But they haven't even stopped the runaway train yet. And the fundamental mistake they have made is not explaining to people clearly enough, during the election campaign, that it would take the first three years just to stop it. Then you ha…

> They have done a lot. I really don’t agree. Look at the first year of 1997 Labour: * Good Friday agreement signed and referendum * Introduction of Minimum Wage * Human Rights act introduced and passed * Scottish and Welsh devolution set out, Parliament voted on it, referendums passed * Bank of England independence A government coming into a mess of a country on a platform of change cannot just fiddle around with mi…

Yes and I'd argue that this is because they have not been elected on merit but because the people rejected the Tories. I believe that Corbyn got more votes than Starmer!

They have neither talents nor a plan. So far it seems that Starmer has picked policies to make him survive and he knows that this means placating power bases in the Labour party, not generally good policies for the country. Opinion polls are scathing.

Re: WordPress plugin quirk resulted in UK Gov OBR Budget leak [pdf]

#103

Post by qcnguy »

louthy wrote: post #44
physicsguy wrote: post #38

Earlier quoted context omitted.

The fact that they were elected as a 'change' government and have barely done anything that really faces up to the scale of the challenge the country faces? If you're below the age of about 55, then the budget did absolutely nothing for you except put taxes up, and not even to improve services. I appreciate things time but so far the government have enormously walked back their planning reform proposals, which was on…

I don’t disagree with any of that, but the vitriol doesn’t match the disappointment imho. Especially as they’ve done pretty well in other areas. I realise “it’s the economy, stupid”, but still it feels like outsized outrage.

Starmer was already the most unpopular PM on record before the budget, and Labour's voting intention is the lowest it's ever been. It's just a really, really unpopular government so of course it gets a lot of attacks.

Re: WordPress plugin quirk resulted in UK Gov OBR Budget leak [pdf]

#104

Post by toyg »

graemep wrote: post #56
physicsguy wrote: post #38

Earlier quoted context omitted.

The fact that they were elected as a 'change' government and have barely done anything that really faces up to the scale of the challenge the country faces? If you're below the age of about 55, then the budget did absolutely nothing for you except put taxes up, and not even to improve services. I appreciate things time but so far the government have enormously walked back their planning reform proposals, which was on…

I largely agree, expect I think my expectations were lower than yours to start with. The ruling class all think alike regardless of party. They have pushed ahead with the Tories Online Safety Act. Legislation I have looked at or that affect things I know about such as the Children's Wellbeing and Schools Act is terrible. There is a lot of smoke and mirrors. For example, if you assume the justification for the "mansio…

No, it's designed to maximize what they can raise without pissing off too many voters. Even as it is, it's going to raise barely half a billion pounds, which is relatively insignificant in a budget worth hundreds of billions; but it's something, and something they (think they) can sell to their core electorate as a bit of token redistribution, when in reality it's just a cash-raising exercise.

If they'd targeted the really rich harder, it would have looked more consistent but would have probably raised even less (because, when a tax starts being significant, the really rich have the means to find ways to avoid it). As it is, it looks insignificant enough that the really wealthy will just pay it and move on.

Re: WordPress plugin quirk resulted in UK Gov OBR Budget leak [pdf]

#105

Post by accoil »

lesuorac wrote: post #58
gnfargbl wrote: post #30

The real kicker is in point 1.13: > website activity logs show the earliest request on the server for the URL https://obr.uk/docs/dlm_uploads/OBR_Economic_and_fiscal_outl... . This request was unsuccessful, as the document had not been uploaded yet. Between this time and 11:30, a total of 44 unsuccessful requests to this URL were made from seven unique IP addresses. In other words, someone was guessing the correct st…

> This suggests that the downloader knew that the OBR was going to make this mistake, and they were polling the server waiting for the file to appear. I think most of the tech world heard about the Nobel Peace Prize award so it doesn't seem that suspicious to me that somebody would just poll urls. Especially since before the peace prize there have been issues with people polling US economic data. My point is strictly…

How does the Nobel Peace Prize figure into this? I seem to be on the other side that didn't hear about the award. Which is not surprising as I don't follow it, but also I haven't worked out query terms to connect it with OBR.

Re: WordPress plugin quirk resulted in UK Gov OBR Budget leak [pdf]

#106

Post by petit_robert »

tonyedgecombe wrote: post #60
chuckreynolds wrote: post #53

"WordPress plugin quirk" AKA human error (as usual).

Yes, the human error was using WordPress.

I had to laugh out loud at this (by myself).

The amount of requests I get on my servers for WP related files is insane

Re: WordPress plugin quirk resulted in UK Gov OBR Budget leak [pdf]

#107

Post by _dain_ »

tantalor wrote: post #50
jamesbelchamber wrote: post #9

For those of you not closely following UK politics: the Office for Budget Responsibility (OBR) mistakenly published their Economic and Fiscal Outlook (EFO) document 40 minutes early, pre-empting the announcements by the Chancellor. This is being treated as an incredibly big deal here: https://www.bbc.co.uk/news/articles/cd74v35p77jo

> which it blamed on a "technical error" It's not a technical error at all! Technical errors are faults caused by technology, like a software or hardware bug. That's not what happened here. WordPress behaved exactly as it was supposed to. The true cause is revealed later in the article, > staff thought they had applied safeguards to prevent early publication, there were two errors in the way in which they were set up…

"Human error" is not the end of an explanation, it's the start of an explanation.

As an industry we should know this by now. Defaults matter.

https://www.humanfactors.lth.se/fileadmin/lusa/Sidney_Dekker...

Re: WordPress plugin quirk resulted in UK Gov OBR Budget leak [pdf]

#108

Post by Maxious »

stuaxo wrote: post #85
kypro wrote: post #78

Earlier quoted context omitted.

This is so incompetent. Given the market significance of the report it's damn obvious that this would happen. They should have assumed that security via obscurity was simply not enough, and the OBR should have been taking active steps to ensure the data was only available at the correct time. > Hedge-funds would want to get the file as soon as it would be available - I imagine someone set up a cron-job to try the URL…

This setup was not initially approved, see 1.7 in the document: > 1.7 Unlike all other IT systems and services, the OBR’s website is locally managed and outside the gov.uk network. This is the result of an exemption granted by the Cabinet Office in 2013. After initially rejecting an exemption request, the Cabinet Office judged that the OBR should be granted an exemption from gov.uk in order to meet the requirements o…

Gov.uk does not use some random wordpress plugin to protect information of national significance, doco at https://docs.publishing.service.gov.uk/repos/whitehall/asset...

Re: WordPress plugin quirk resulted in UK Gov OBR Budget leak [pdf]

#109

Post by jjmarr »

accoil wrote: post #105
lesuorac wrote: post #58

Earlier quoted context omitted.

> This suggests that the downloader knew that the OBR was going to make this mistake, and they were polling the server waiting for the file to appear. I think most of the tech world heard about the Nobel Peace Prize award so it doesn't seem that suspicious to me that somebody would just poll urls. Especially since before the peace prize there have been issues with people polling US economic data. My point is strictly…

How does the Nobel Peace Prize figure into this? I seem to be on the other side that didn't hear about the award. Which is not surprising as I don't follow it, but also I haven't worked out query terms to connect it with OBR.

Because it was insider traded on Polymarket many hours before it was publicly announced.

Re: WordPress plugin quirk resulted in UK Gov OBR Budget leak [pdf]

#110

Post by toyg »

kristianc wrote: post #90
gnfargbl wrote: post #30

The real kicker is in point 1.13: > website activity logs show the earliest request on the server for the URL https://obr.uk/docs/dlm_uploads/OBR_Economic_and_fiscal_outl... . This request was unsuccessful, as the document had not been uploaded yet. Between this time and 11:30, a total of 44 unsuccessful requests to this URL were made from seven unique IP addresses. In other words, someone was guessing the correct st…

Part of this is a product of the UK's political culture where expenses for stuff like this are ruthlessly scrutinised from within and without. The idea of the site hosting such an important document running independently on WordPress, being maintained by a single external developer and a tiny in-house team would seem really strange to many other countries. Everyone is so terrified of headlines like "OBR spends £2m up…

It's not an easy call. Sometimes, one or two dedicated and competent people can vastly outperform large and bureaucratic consulting firms, for a fraction of the price. And sometimes, somebody's cousin "who knows that internet stuff" is trousering inflated rates at the taxpayer's expense, while credentialed and competent professionals are shut out from old boys' networks. One rule does not fit all.
Post reply on HN