Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Someone bought 30 WordPress plugins and planted a backdoor in all of them

anchor.host

Post reply on HN
Print view View original

301–310 of 368 posts

Re: Someone bought 30 WordPress plugins and planted a backdoor in all of them

#301

Post by PaulHoule »

whstl wrote: post #279
jjav wrote: post #250

Earlier quoted context omitted.

> if less efficient to execute like Java and Javascript and Python One of these is not like the others... Java (JVM) is extremely fast.

The JVM has been extremely fast for a long long time now. Even Javascript is really fast, and if you really need performance there’s also others in the same performance class like C#, Rust, Go. Hot take, but: Performance hasn’t been a major factor in choosing C or C++ for almost two decades now.

I think it is the perception of performance instead of the actual performance, also that C/C++ encroaches on “close to the metal” assembly for many applications. (E.g. when I think how much C moves the stack pointer around meaninglessly in my AVR-8 programs it drives me nuts but AVR-8 has a hard limit and C programs are portable to the much faster ESP32 and ARM.

A while back when my son was playing Chess I wrote a chess engine in Python and then tried to make a better one in Java which could respect time control, it was not hard to make the main search routine work without allocating memory but I tried to do transposition tables with Java objects it made the engine slower, not faster. I could have implemented them with off-heap memory but around that time my son switched from Chess to guitar so I started thinks about audio processing instead.

The Rust vs Java comparison is also pointed. I was excited about Rust the same way I was excited about cyclone when it came out but seeing people struggle with async is painful for me to watch and makes it look like the whole idea doesn’t really work when you get away from what you can do with stack allocation. People think they can’t live with Java’s GC pauses.

Re: Someone bought 30 WordPress plugins and planted a backdoor in all of them

#303

Post by rmccue »

altairprime wrote: post #180
rmccue wrote: post #134

Earlier quoted context omitted.

The aggregators can choose who to index, and we operate one at fair.pm - the idea being that you only federate repositories that meet requirements, and can defederate those which are bad actors. (End users can install directly from repositories though, and can always switch the aggregator if they find the rules too restrictive - no lock-in.)

What aggregators? How would I locate fair.fm? Is there a Whole Earth Guide to Repositories that’s human-curated? What is the published malware incidences and non-responses rate for each repository?

An "aggregator" is the thing that discovers and lists repositories - the equivalent of a search engine. Anyone can operate one themselves, and we (the FAIR project) operate a canonical one on our website, which is fair.pm.

Re: Someone bought 30 WordPress plugins and planted a backdoor in all of them

#304

Post by heisenbit »

chromacity wrote: post #32

This is a perfect illustration of what cracks me up about the hyperbolic reactions to Mythos. Yes, increased automation of cutting-edge vulnerability discovery will shake things up a bit. No, it's nowhere near the top of what should be keeping you awake at night if you're working in infosec. We've built our existing tech stacks and corporate governance structures for a different era. If you want to credit one specifi…

crypto: incentives

ai: scaling finding opportunities

ai: improving exploit code engineering

ai: scaling automation of exploit execution

homogenization of infrastructures: simplifying target navigation

perfect storm

Re: Someone bought 30 WordPress plugins and planted a backdoor in all of them

#305

Post by 112233 »

PaulHoule wrote: post #187
colonCapitalDee wrote: post #153

Earlier quoted context omitted.

Then we can't do it. Cost is a requirement

Also people keep insisting on using unsafe languages like C. It depends on exactly what you are doing but there are many languages which are efficient to develop in if less efficient to execute like Java and Javascript and Python which are better in many respects and other languages which are less efficient to develop in but more efficient to run like Rust. So at the very least it is a trilemma and not a dilemma.

C is about the safest language you can choose, between cbmc, frama-c and coccinelle there is hardly another language with comparable tooling for writing actually safe software, that you can actually securely run on single-core hardened systems. I would be really interested to hear the alternatives, though!

Re: Someone bought 30 WordPress plugins and planted a backdoor in all of them

#306

Post by rmccue »

knowaveragejoe wrote: post #169
rmccue wrote: post #132

Earlier quoted context omitted.

Currently the reference implementation is for WordPress, but we’re working to bring it to Typo3 and other software at the moment too. The protocol is comprised of a core plus per-software extensions when needed.

I see. Are there other similar projects for other ecosystems? I guess more broadly I'm intrigued by the idea of the decentralized supply chain concept, the way you described it sounds like it was more broadly applicable.

You can check out the protocol at https://github.com/fairpm/fair-protocol - anything WordPress or Typo3 specific are in the extensions, and the core protocol is self-contained. We'd love to work with more ecosystems to bring FAIR to them, and we've already had some discussions with others including maintainers of popular (dependency) package managers.

Re: Someone bought 30 WordPress plugins and planted a backdoor in all of them

#307

Post by pwillia7 »

tmoertel wrote: post #83
bradley13 wrote: post #7

Whenever I look at a web project, it starts with "npm install" and literally dozens of libraries get downloaded. The project authors probably don't even know what libraries their project requires, because many of them are transitive dependencies. There is zero chance that they have checked those libraries for supply chain attacks.

For exactly this reason, when I write software, I go out of my way to avoid using external packages. For example, I recently wrote a tool in Python to synchronize weather-statation data to a local database. [1] It took only a little more effort to use the Python standard library to manage the downloads, as opposed to using an external package such as Requests [2], but the result is that I have no dependencies beyond…

and the pendulum swings again the other way...

Re: Someone bought 30 WordPress plugins and planted a backdoor in all of them

#309

Post by FuriouslyAdrift »

chromacity wrote: post #32

This is a perfect illustration of what cracks me up about the hyperbolic reactions to Mythos. Yes, increased automation of cutting-edge vulnerability discovery will shake things up a bit. No, it's nowhere near the top of what should be keeping you awake at night if you're working in infosec. We've built our existing tech stacks and corporate governance structures for a different era. If you want to credit one specifi…

crypto is just money laundering by another name. It's actually easier to trace than the old school ways.

No... if you want to point to the one thing that transformed computer crime, it's the "cloud" and the programming paradigms that came with it.

Re: Someone bought 30 WordPress plugins and planted a backdoor in all of them

#310

Post by mrweasel »

PaulHoule wrote: post #296
mrweasel wrote: post #268

Earlier quoted context omitted.

The language plays a role, but I think the best example of software with very few bugs is something like qmail and that's written in C. qmail did have bugs, but impressively few. Write code that carefully however is really not something you just do, it would require a massive improvement of skills overall. The majority of developers simply aren't skilled enough to write something anywhere near the quality of qmail. M…

I was qmail fanbois back in the day and loved how djb wrote his own string handling library. I built things with qmail that were much more than an email server (think cgi-bin for web servers) and knew the people who ran the largest email installation in the world (not sure how good they were about opt-in…) Djb didn’t allow forking and repackaging so quail did not keep up with an increasingly hostile environment where…

qmail was a lot of fun, so was djbdns and daemontools, but you're right it failed to keep up and DJBs attitude didn't help.

We built a weird solution where two systems would sync data via email. Upstream would do a dump from an Oracle database, pipe it to us via SMTP and a hook in qmail would pick up the email, get the attachment and update our systems. I remember getting a call one or two years after leaving the organisation, the new systems administrator wanted to know how their database was always kept up to date. It worked brilliantly, but they felt unsafe not knowing how. I really should have documented that part better.

Post reply on HN