Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Someone bought 30 WordPress plugins and planted a backdoor in all of them

anchor.host

Post reply on HN
Print view View original

201–210 of 368 posts

Re: Someone bought 30 WordPress plugins and planted a backdoor in all of them

#201

Post by therealdrag0 »

tarkin2 wrote: post #46
bradley13 wrote: post #7

Whenever I look at a web project, it starts with "npm install" and literally dozens of libraries get downloaded. The project authors probably don't even know what libraries their project requires, because many of them are transitive dependencies. There is zero chance that they have checked those libraries for supply chain attacks.

Isn't this the same for maven, python, ruby projects too? I don't see this as a web only problem

IME there’s a core set of very popular Java libs you can go very far without adopting obscure libraries you’ve never heard of. Eg apache-commons, spring, etc. the bar to adopt a 3p lib seems higher in some ecosystems than others.

Re: Someone bought 30 WordPress plugins and planted a backdoor in all of them

#202

Post by saalweachter »

ryandrake wrote: post #107
KronisLV wrote: post #101

Earlier quoted context omitted.

> We know how to write software with very few bugs (although we often choose not to) Do we, really? Because a week doesn’t go by when I don’t run into bugs of some sort. Be it in PrimeVue (even now the components occasionally have bugs, seems like they’re putting out new major versions but none are truly stable and bug free) or Vue (their SFC did not play nicely with complex TS types), or the greater npm ecosystem, o…

> > We know how to write software with very few bugs > Do we, really? Because a week doesn’t go by when I don’t run into bugs of some sort. I mean, we do know how to do it, but we don't because business needs tend to throw quality under the bus in exchange for almost everything else: (especially) speed to develop, but also developer comfort, feature cram, visual refreshes, and so on always trump bugs, so every projec…

The simplest recipe for writing "almost bug-free" software is:

  1.  Freeze the set of features.
  2.  Continue to pay programmers to polish the software for several years while it is being actively used by many people.
  3.  Resist adding new features or updating the software to feel modern.
If you do that, your program will asymptomatically approach zero bug.

Of course, your users will complain about missing features, how ugly and ancient your products look, and how they wished you were more like your buggy competitors.

And if your users are unhappy, then you probably lose the "used heavily by a lot of people" part that reveals the bugs.

Re: Someone bought 30 WordPress plugins and planted a backdoor in all of them

#205

Post by 0xbadcafebee »

weird-eye-issue wrote: post #200
0xbadcafebee wrote: post #113

This is interesting, because not only was this not a hack (someone bought the plugin and changed its operation), it's something that would be solved by a separate solution I have to security vulnerabilities in general. A software building code could provide a legal framework to hold someone liable for transferring ownership of a software product and significantly altering its operation without informing its users. Th…

If the sellers are in India and the buyer is in who knows where, how is your legal framework going to actually hold them accountable? Besides, it's not reasonable to hold the sellers accountable. that's a very dangerous precedent.

It works like any other case of liability. If the seller is in the US, the seller is held liable if they transfer to a foreign entity who isn't accountable to US laws (because the user/customer would have no recourse if the buyer does something evil). Opposite is true if the buyer is in the US. If only the user is in the US, there's not much they can do but use the courts or politicians to try to get justice overseas. If no party is in the US, our laws don't apply.

I must not have been clear, I'm not saying you only hold one party accountable. I mean all parties engaged in a specific kind of contract or agreement would be liable. Since it's a transfer of ownership, and the law would specifically be intended to protect people who are at risk because of that transfer, both parties would need to ensure the law was followed, or both parties would be putting those people at risk.

Re: Someone bought 30 WordPress plugins and planted a backdoor in all of them

#206

Post by zeroq »

KronisLV wrote: post #101
chromacity wrote: post #32

This is a perfect illustration of what cracks me up about the hyperbolic reactions to Mythos. Yes, increased automation of cutting-edge vulnerability discovery will shake things up a bit. No, it's nowhere near the top of what should be keeping you awake at night if you're working in infosec. We've built our existing tech stacks and corporate governance structures for a different era. If you want to credit one specifi…

> We know how to write software with very few bugs (although we often choose not to) Do we, really? Because a week doesn’t go by when I don’t run into bugs of some sort. Be it in PrimeVue (even now the components occasionally have bugs, seems like they’re putting out new major versions but none are truly stable and bug free) or Vue (their SFC did not play nicely with complex TS types), or the greater npm ecosystem, o…

We do.

The issue is almost always feature management.

Back in the days I was making Flash games, usually a 3-5 weeks job, with no real QA, and the project was live for 3-5 months. Every time I was ahead of schedule someone came with a brilliant idea to test few odd things and add couple new features that was not discussed prior. Sometimes literally hours before the launch.

Every time I was making the argument that adding one new feature will create two bugs. And almost always I was right about it.

Fast forward and I'm working for BigCo. Few gigs back I was working for a major bank which employed supper efficient and accountable workflow - every release has to be comprised of business specific commits, and commits that are not backed by explicit tickets are not permitted.

This resulted in team having to literally cheat and lie to smuggle refactors and optimizations.

Add to that that most enterprise projects start not because the requirements were gathered but because the budget was secured and you have a recipe for disaster.

Re: Someone bought 30 WordPress plugins and planted a backdoor in all of them

#207

Post by arjie »

Personally, I've found that nowadays the README.md file of most projects is more useful than the code. With the code I inherit their dependency chain and all of that. But with an LLM I can rewrite most of these things myself. This is not yet to the degree of universality. For instance I still use ratatui, but I also don't use a worktree manager or a Claude coordinator from other people - I just have my own. I also don't use OpenClaw - I have my own.

Looking at the list of plugins, I'd probably write accordion-and-accordion-slider and so on myself (meaning Claude Code and Codex would do most of the work). I think the future of software is like that: there is no reason to use most dependencies and so we'll likely tend towards our own library of software, with the web of trust unnecessary because all we need are other people's ideas, not their software.

Re: Someone bought 30 WordPress plugins and planted a backdoor in all of them

#210

Post by neya »

tmoertel wrote: post #83
bradley13 wrote: post #7

Whenever I look at a web project, it starts with "npm install" and literally dozens of libraries get downloaded. The project authors probably don't even know what libraries their project requires, because many of them are transitive dependencies. There is zero chance that they have checked those libraries for supply chain attacks.

For exactly this reason, when I write software, I go out of my way to avoid using external packages. For example, I recently wrote a tool in Python to synchronize weather-statation data to a local database. [1] It took only a little more effort to use the Python standard library to manage the downloads, as opposed to using an external package such as Requests [2], but the result is that I have no dependencies beyond…

> I go out of my way to avoid using external packages.

I go out of my way to avoid Javascript. Because in all my years of writing software, it has 100% of the time been the root cause for vulnerabilities. These days I just use LiveView.

Post reply on HN