Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Someone bought 30 WordPress plugins and planted a backdoor in all of them

anchor.host

Post reply on HN
Print view View original

261–270 of 368 posts

Re: Someone bought 30 WordPress plugins and planted a backdoor in all of them

#261

Post by weird-eye-issue »

0xbadcafebee wrote: post #256
weird-eye-issue wrote: post #211

Earlier quoted context omitted.

So you want people who sell a business to be open to liability for things that the new owner does? Don't you see what kind of negative consequences that would have?

I meant to hold the seller liable if they do not follow a due diligence process. But actually the liability you mean also exists. The two are called direct liability and vicarious liability.

I'm not sure what kind of due diligence you think would have prevented this that couldn't have been easily circumvented by the buyer just simply lying about their intentions. This is such a typical knee-jerk reaction that results in policies that harm the average person but do not actually reduce fraud or crime.

Re: Someone bought 30 WordPress plugins and planted a backdoor in all of them

#264

Post by Dma54rhs »

jdthedisciple wrote: post #260

Presumably, Wordpress knows more about the identity of the buyer and will initiate legal action against them... right?

Why or how would they know? There's no such vetting if you want to get listed on their plugin catalogue.

Re: Someone bought 30 WordPress plugins and planted a backdoor in all of them

#266

Post by brikym »

bradley13 wrote: post #7

Whenever I look at a web project, it starts with "npm install" and literally dozens of libraries get downloaded. The project authors probably don't even know what libraries their project requires, because many of them are transitive dependencies. There is zero chance that they have checked those libraries for supply chain attacks.

I too get worried when I see npm. Luckily I use bun install so it's all good. In seriousness I do at least have a 7d min age on the packages.

Re: Someone bought 30 WordPress plugins and planted a backdoor in all of them

#267

Post by Dylan16807 »

winddude wrote: post #147
amarant wrote: post #95

Earlier quoted context omitted.

Yes, on the one hand, they enable a lot of shady illegal business, but in the other hand, they also destroy the environment while doing it, so it's really a toss up whether cryptocurrency is good or bad overall!

bitcoin is forecast to uses about 150 TWh of electricity this year vs all other datacenter operations foretasted to use 1000 TWh. Bitcoin is esitimated to be about 52.4% sustainable energy (renewables plus nuclear) where datacenters are 42% sustainable energy.

And those other datacenters are mostly doing useful things, while bitcoin is somewhere between pure waste and the least efficient way of doing security ever conceptualized. (A few dozen centralized nodes, set up right, would likely be more secure than the current mining pools.)

Re: Someone bought 30 WordPress plugins and planted a backdoor in all of them

#268

Post by mrweasel »

PaulHoule wrote: post #187
colonCapitalDee wrote: post #153

Earlier quoted context omitted.

Then we can't do it. Cost is a requirement

Also people keep insisting on using unsafe languages like C. It depends on exactly what you are doing but there are many languages which are efficient to develop in if less efficient to execute like Java and Javascript and Python which are better in many respects and other languages which are less efficient to develop in but more efficient to run like Rust. So at the very least it is a trilemma and not a dilemma.

The language plays a role, but I think the best example of software with very few bugs is something like qmail and that's written in C. qmail did have bugs, but impressively few.

Write code that carefully however is really not something you just do, it would require a massive improvement of skills overall. The majority of developers simply aren't skilled enough to write something anywhere near the quality of qmail.

Most software also doesn't need to be that good, but then we need to be more careful with deployments. The fact that someone just installs Wordpress (which itself is pretty good in terms of quality) and starts installing plugins from un-trusted developers indicates that many still doesn't have a security mindset. You really should review the code you deploy, but I understand why many don't.

Re: Someone bought 30 WordPress plugins and planted a backdoor in all of them

#270

Post by GJim »

sippeangelo wrote: post #255
soulofmischief wrote: post #79

Earlier quoted context omitted.

Well, Cryptocurrencies are part of said new era. They aren't strictly a problem that made things worse: they're a technology that comes with tradeoffs. The cat is out of the bag and we have to design around technologies that are here to stay in whatever capacity. Distributed, cryptography-based currencies/tokens are one of those technologies.

Crypto has been an awful development in many ways, but I happily welcome it when it has made malware so much more benign to me. The last malware that affected me personally was a crypto miner worm, and the one before that was a crypto wallet stealer, neither of which affects me at all as I don't meddle with crypto. I don't know the statistics, but it seems like it's way more profitable for the grifters to target othe…

> when it has has made malware so much more benign to me.

Eh?

Cryptocurrencies have enabled ransomware. Possibly the most nasty malware to hit the internet in terms of damage caused...

This damage has affected services you use (including hospitals, schools, research institutions and local government) even if it hasn't infected one of your boxen directly.

Post reply on HN