Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Someone bought 30 WordPress plugins and planted a backdoor in all of them

anchor.host

Post reply on HN
Print view View original

291–300 of 368 posts

Re: Someone bought 30 WordPress plugins and planted a backdoor in all of them

#291

Post by AlBugdy »

psychoslave wrote: post #240
AlBugdy wrote: post #133

Earlier quoted context omitted.

> This is a perfect illustration of what cracks me up about the hyperbolic reactions to Mythos. Yes, increased automation of cutting-edge vulnerability discovery will shake things up a bit. No, it's nowhere near the top of what should be keeping you awake at night if you're working in infosec. Mythos will most likely not be the main thing that changes the infosec world, but AI in general will. Maybe in a few years or…

>we at least have the technological foundation to escape oppressive, corrupt and dysfunctional governments financially Who is we? How many transactions of any cryptocurrency was either done to buy bread and butter?

We the citizens, specifically the tech-inclined people who would be able to set up wallets for the different vendors. I have bought fast food from a small non-chain store with Bitcoin once, for what it's worth.

Re: Someone bought 30 WordPress plugins and planted a backdoor in all of them

#292

Post by xmcqdpt2 »

hgoel wrote: post #89
iugtmkbdfil834 wrote: post #17

Earlier quoted context omitted.

There is a reason. The prevailing wisdom has thus far been: "don't re-invent the wheel", or it non-HN equivalent "there is an app for that". I am absolutely not suggesting everyone should be rolling their own crypto, but there must be a healthy middle ground between that and a library that lets you pick font color.

I think we've pulled way too much towards "software must be a constantly maintained, living item, and users should update often", thus the recklessness with dependencies. This has also exacerbated the other aspects of dependency hell. But not only does this not match reality, it makes projects very vulnerable to this supply chain hijacking stuff. I think maybe the pendulum needs to swing back a little to being very s…

From a purely aesthetic point of view, this is what I enjoy so much about C and Fortran. You look up a Rust crate and it hasn't been touched in 5 years. That means it's unmaintained and unusable, don't add it to your project or you will have a bad time.

You find a C or fortran library that hasn't been touched in 20 years and (sometimes) it's just because it's complete and there hasn't been any reason to update any parts of it. You can just add it to your project and it will build and be usable immediately. I wish we had more of those.

Re: Someone bought 30 WordPress plugins and planted a backdoor in all of them

#293

Post by xmcqdpt2 »

thrance wrote: post #119
bradley13 wrote: post #7

Whenever I look at a web project, it starts with "npm install" and literally dozens of libraries get downloaded. The project authors probably don't even know what libraries their project requires, because many of them are transitive dependencies. There is zero chance that they have checked those libraries for supply chain attacks.

I've been toying with the idea of a language whose packages have to declare which "permissions" they require (file io, network access, shell...) and devs have to specify which permissions they give to their dependencies.

Java has Security Managers. I've never seen anyone use it in practice though, so it probably doesn't work very well.

I think it would be hard to get any kind of usable capability system without algebraic effects like those of Koka or Scala libraries.

EDIT: Apparently Security Managers are deprecated and slated for removal.

Re: Someone bought 30 WordPress plugins and planted a backdoor in all of them

#294

Post by BrandoElFollito »

tmoertel wrote: post #83
bradley13 wrote: post #7

Whenever I look at a web project, it starts with "npm install" and literally dozens of libraries get downloaded. The project authors probably don't even know what libraries their project requires, because many of them are transitive dependencies. There is zero chance that they have checked those libraries for supply chain attacks.

For exactly this reason, when I write software, I go out of my way to avoid using external packages. For example, I recently wrote a tool in Python to synchronize weather-statation data to a local database. [1] It took only a little more effort to use the Python standard library to manage the downloads, as opposed to using an external package such as Requests [2], but the result is that I have no dependencies beyond…

But then you rely on Python, C, your editor with all its extensions etc.

I develop as a pure amateur and there are areas I would never get into without libraries.

First are dates, it is a world of pain. Arrow is the answer (in Python)

Then HTML, another world of pain perfectly described in a Stack Overflow answer. Beautifulsoup.

HTTP is arguably easier but requests! :)

At some point there is a risk assessment to do and one should make decisions based on that. Kudos for having gone that way yourself!

Re: Someone bought 30 WordPress plugins and planted a backdoor in all of them

#295

Post by lambdaone »

It seems obvious to me that there should now be a concerted and open effort to detect malware in supply chains based on AI-based scanning. Sure, there will be an arms race in malware obfuscation, but that was coming anyway. Manual review is useless at this scale - it is just not happening.

Re: Someone bought 30 WordPress plugins and planted a backdoor in all of them

#296

Post by PaulHoule »

mrweasel wrote: post #268
PaulHoule wrote: post #187

Earlier quoted context omitted.

Also people keep insisting on using unsafe languages like C. It depends on exactly what you are doing but there are many languages which are efficient to develop in if less efficient to execute like Java and Javascript and Python which are better in many respects and other languages which are less efficient to develop in but more efficient to run like Rust. So at the very least it is a trilemma and not a dilemma.

The language plays a role, but I think the best example of software with very few bugs is something like qmail and that's written in C. qmail did have bugs, but impressively few. Write code that carefully however is really not something you just do, it would require a massive improvement of skills overall. The majority of developers simply aren't skilled enough to write something anywhere near the quality of qmail. M…

I was qmail fanbois back in the day and loved how djb wrote his own string handling library. I built things with qmail that were much more than an email server (think cgi-bin for web servers) and knew the people who ran the largest email installation in the world (not sure how good they were about opt-in…)

Djb didn’t allow forking and repackaging so quail did not keep up with an increasingly hostile environment where it got so bad that when the love letter virus came out it was insufficient to add content filtering to qmail and I had to write scripts that blocked senders at the firewall. Security was no longer a 0 and 1 problem, it was certainly possible to patch up and extend qmail to survive in that environment but there was something to say for having it all in one nice package…. And once the deliverability crisis started, I gave up on running email servers entirely.

Re: Someone bought 30 WordPress plugins and planted a backdoor in all of them

#297

Post by petcat »

MarsIronPI wrote: post #72
bradley13 wrote: post #7

Whenever I look at a web project, it starts with "npm install" and literally dozens of libraries get downloaded. The project authors probably don't even know what libraries their project requires, because many of them are transitive dependencies. There is zero chance that they have checked those libraries for supply chain attacks.

Rust is like this too. Every time I open a Rust project I look at Cargo.lock and see hundreds of recursive dependencies. Compared to traditional C or C++ projects it's madness.

> Compared to traditional C or C++ projects it's madness.

Those projects typically rely on an external package manager to handle their dependencies for them. Apt, yum, etc. Otherwise you end up in dependency hell trying to get ./configure to find the development headers of whatever it needs. I don't miss those days. Rust/Cargo is a godsend.

Re: Someone bought 30 WordPress plugins and planted a backdoor in all of them

#298

Post by MarsIronPI »

petcat wrote: post #297
MarsIronPI wrote: post #72

Earlier quoted context omitted.

Rust is like this too. Every time I open a Rust project I look at Cargo.lock and see hundreds of recursive dependencies. Compared to traditional C or C++ projects it's madness.

> Compared to traditional C or C++ projects it's madness. Those projects typically rely on an external package manager to handle their dependencies for them. Apt, yum, etc. Otherwise you end up in dependency hell trying to get ./configure to find the development headers of whatever it needs. I don't miss those days. Rust/Cargo is a godsend.

It may be better from a DX perspective, but it's pure pain for distros like Debian who don't want to use cargo at build time to fetch arbitrary dependencies and instead use vetted system versions.

Re: Someone bought 30 WordPress plugins and planted a backdoor in all of them

#299

Post by dgb23 »

xmcqdpt2 wrote: post #292
hgoel wrote: post #89

Earlier quoted context omitted.

I think we've pulled way too much towards "software must be a constantly maintained, living item, and users should update often", thus the recklessness with dependencies. This has also exacerbated the other aspects of dependency hell. But not only does this not match reality, it makes projects very vulnerable to this supply chain hijacking stuff. I think maybe the pendulum needs to swing back a little to being very s…

From a purely aesthetic point of view, this is what I enjoy so much about C and Fortran. You look up a Rust crate and it hasn't been touched in 5 years. That means it's unmaintained and unusable, don't add it to your project or you will have a bad time. You find a C or fortran library that hasn't been touched in 20 years and (sometimes) it's just because it's complete and there hasn't been any reason to update any pa…

Clojure and Go are similar to this from my experience.

Re: Someone bought 30 WordPress plugins and planted a backdoor in all of them

#300

Post by grvdrm »

wat10000 wrote: post #222
dylan604 wrote: post #199

Earlier quoted context omitted.

Software release dates are so arbitrary though. We no longer make physical media that needs time to make and ship. Why does software need to be released on February 15th instead of March 7th?

You could ask the same question about the contents of the release. Why does software need to be released with features X, Y, and Z on March 7th when it could be released with features X and Y on February 15th? It's inevitable that work will slip. That doesn't necessarily mean the release will slip. Sometimes you actually need the thing, but often the work is something you want to include in the release but don't abso…

This is the direction of my thinking, too.

Earlier discussion focuses on writing software at a slower pace to inject more accuracy and robust thinking/design/code. Conceptually, yes, I get it!

But in numerous practical scenarios, some adherence to a recurring schedule seems like the only way to align software to business outcomes. My thinking is tied more to enterprise products (both external and internal) rather than open-source.

I like an active dialog with engineers. (I'm neither SWE nor PM). Let's talk together about estimates. What's possible and not possible. Where do you feel most uncertain, most certain. What dependencies/externalities do you expect to cause problems.

Those conversations help me (business/analytics-side) do things like adjust my own deadlines, schedules. Communicate with c-suite to realign on what's possible and not. Adjust time.

Post reply on HN