Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Someone bought 30 WordPress plugins and planted a backdoor in all of them

anchor.host

Post reply on HN
Print view View original

311–320 of 368 posts

Re: Someone bought 30 WordPress plugins and planted a backdoor in all of them

#311

Post by giarc »

bradley13 wrote: post #7

Whenever I look at a web project, it starts with "npm install" and literally dozens of libraries get downloaded. The project authors probably don't even know what libraries their project requires, because many of them are transitive dependencies. There is zero chance that they have checked those libraries for supply chain attacks.

Off topic, but this is why the whole "a vibe coded app is a security risk" trope is not quite right to me. That "vibe coder" doesn't know what Claude wrote, but the experienced dev also didn't know what all the packages, libraries and frameworks contained either. Is one worse than the other?

Re: Someone bought 30 WordPress plugins and planted a backdoor in all of them

#312

Post by fasteo »

paglaghoda wrote: post #308

One of the best time for Cloudflare to market EmDash as Wordpress alternative.

They were onto something

April 1st, 2026 Introducing EmDash — the spiritual successor to WordPress that solves plugin security

[1] https://blog.cloudflare.com/emdash-wordpress/

Re: Someone bought 30 WordPress plugins and planted a backdoor in all of them

#313

Post by denzil »

bruckie wrote: post #112
KronisLV wrote: post #101

Earlier quoted context omitted.

> We know how to write software with very few bugs (although we often choose not to) Do we, really? Because a week doesn’t go by when I don’t run into bugs of some sort. Be it in PrimeVue (even now the components occasionally have bugs, seems like they’re putting out new major versions but none are truly stable and bug free) or Vue (their SFC did not play nicely with complex TS types), or the greater npm ecosystem, o…

> Do we, really? Yes, or pretty close to it. What we don't know how to do (AFAIK) is do it at a cost that would be acceptable for most software. So yes, it mostly gets done for (components of) planes, spacecraft, medical devices, etc. Totally agreed that most software is a morass of bugs. But giving examples of buggy software doesn't provide any information about whether we know how to make non-buggy software. It onl…

> So yes, it mostly gets done for (components of) planes, spacecraft, medical devices, etc.

I have to disagree here. All of these you mentioned have regularly bugs. Multiple spacecraft got lost because of these. For planes there's not so distant Boeing 737 MAX fiasco (admittedly this was bad software behavior caused by sensor failure). And medical devices, the news about their bugs semi-regularly pop up. So while the software for these might do a bit better than the rest, they certainly are not anywhere close to being bug free.

And same goes for specifications the software is based on. Those aren't bug-free either. And writing software based on flawed specification will inevitably result in flawed software.

That's not to say we should give up on trying to write bug free software. But we currently don't know how to do so.

Re: Someone bought 30 WordPress plugins and planted a backdoor in all of them

#314

Post by Cthulhu_ »

tmoertel wrote: post #83
bradley13 wrote: post #7

Whenever I look at a web project, it starts with "npm install" and literally dozens of libraries get downloaded. The project authors probably don't even know what libraries their project requires, because many of them are transitive dependencies. There is zero chance that they have checked those libraries for supply chain attacks.

For exactly this reason, when I write software, I go out of my way to avoid using external packages. For example, I recently wrote a tool in Python to synchronize weather-statation data to a local database. [1] It took only a little more effort to use the Python standard library to manage the downloads, as opposed to using an external package such as Requests [2], but the result is that I have no dependencies beyond…

This is good wisdom, and I think this is a strong reason why language and runtime developers should ensure their standard library is (over)complete.

Go does this well, to the point where a lot of people in the community say "you don't need a library" for most use cases, only for e.g. database drivers. This is contrary to what a lot of developers believe, that they need e.g. a REST API library or enterprise application framework as soon as possible.

Re: Someone bought 30 WordPress plugins and planted a backdoor in all of them

#315

Post by xyzzy123 »

LeifCarrotson wrote: post #165
colonCapitalDee wrote: post #153

Earlier quoted context omitted.

Then we can't do it. Cost is a requirement

Cost is a parameter subject to engineering tradeoffs, just like performance, feature sets, and implementation time. Security and reliability are also parameters that exist on a sliding scale, the industry has simply chosen to slide the "cost" parameter all the way to one end of the spectrum. As a result, the number of bugs and hacks observed are far enough from the desired value of zero that it's clear the true requi…

Is it the industry making this choice or the customer?

You could make a car that's safer than others at 10x the price but what would the demand look like at that price?

Would you pay 2x for your favourite software and forego some of the more complex features to get a version with half the security issues?

Re: Someone bought 30 WordPress plugins and planted a backdoor in all of them

#316

Post by nathanmills »

pwillia7 wrote: post #307
tmoertel wrote: post #83

Earlier quoted context omitted.

For exactly this reason, when I write software, I go out of my way to avoid using external packages. For example, I recently wrote a tool in Python to synchronize weather-statation data to a local database. [1] It took only a little more effort to use the Python standard library to manage the downloads, as opposed to using an external package such as Requests [2], but the result is that I have no dependencies beyond…

and the pendulum swings again the other way...

Does it? Or is it simply different people

Re: Someone bought 30 WordPress plugins and planted a backdoor in all of them

#317

Post by Pikamander2 »

stratts wrote: post #102
toniantunovi wrote: post #45

The supply chain attack surface in WordPress plugins has always been particularly dangerous because the ecosystem encourages users to install many small single-purpose plugins from individual developers, most of whom aren't security-focused organizations. Buying out an established plugin with a large install base is a clever approach because you inherit years of user trust that took the original developer a long time…

Not only that, but so many people are reluctant to pay for anything so your average installation is chock full of freemium plugins. I've worked on plenty of sites whose admin page looked a bit like the IE6 toolbar meme.

The premium plugins are arguably even worse.

Unlike the free plugins, they're not reviewed by the WordPress.org team, and if you stop paying for them then you'll lose access to their future plugin updates, including critical security fixes.

I wouldn't say that their code quality is noticably higher, either; there have been countless CVEs for premium WordPress plugins over the years, and no shortage of discontinued/abandoned premium plugins that are no longer being maintained but are still installed on thousands of sites.

Re: Someone bought 30 WordPress plugins and planted a backdoor in all of them

#318

Post by [deleted] »

112233 wrote: post #305
PaulHoule wrote: post #187

Earlier quoted context omitted.

Also people keep insisting on using unsafe languages like C. It depends on exactly what you are doing but there are many languages which are efficient to develop in if less efficient to execute like Java and Javascript and Python which are better in many respects and other languages which are less efficient to develop in but more efficient to run like Rust. So at the very least it is a trilemma and not a dilemma.

C is about the safest language you can choose, between cbmc, frama-c and coccinelle there is hardly another language with comparable tooling for writing actually safe software, that you can actually securely run on single-core hardened systems. I would be really interested to hear the alternatives, though!

[deleted]

Re: Someone bought 30 WordPress plugins and planted a backdoor in all of them

#319

Post by DrewADesign »

grvdrm wrote: post #300
wat10000 wrote: post #222

Earlier quoted context omitted.

You could ask the same question about the contents of the release. Why does software need to be released with features X, Y, and Z on March 7th when it could be released with features X and Y on February 15th? It's inevitable that work will slip. That doesn't necessarily mean the release will slip. Sometimes you actually need the thing, but often the work is something you want to include in the release but don't abso…

This is the direction of my thinking, too. Earlier discussion focuses on writing software at a slower pace to inject more accuracy and robust thinking/design/code. Conceptually, yes, I get it! But in numerous practical scenarios, some adherence to a recurring schedule seems like the only way to align software to business outcomes. My thinking is tied more to enterprise products (both external and internal) rather tha…

The main problem I’ve had is the unpredictability of where the complexity lies. Unless you’ve done exactly what you’re doing, before, with the same tools and requirements, there’s a good chance that some discrete trivial aspect could take up an incredible amount of time, and that won’t indicate whether the main goal will take more or less time. I’ve worked both as a developer and as a designer, and while some aspects of design can be really nebulous and uncertain compared to dev work, it lacks some of the unpredictability — it’s not like I’m going to unexpectedly have to re-make the logo.

I feel for anyone that has to wrangle these tasks into a business-consumable time frame.

Post reply on HN