Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Someone bought 30 WordPress plugins and planted a backdoor in all of them

anchor.host

Post reply on HN
Print view View original

331–340 of 368 posts

Re: Someone bought 30 WordPress plugins and planted a backdoor in all of them

#331

Post by btown »

whattheheckheck wrote: post #230
btown wrote: post #142

Earlier quoted context omitted.

IMO the thing that AI will change is the type of target. It's reasonable to assume that if you launch a website for a small business nowadays - sure, you'll get phishing attempts, port scans, attempts to submit SQL injections into your signup forms, etc. But you won't get the equivalent of a sophisticated actor's spear-phishing efforts, highly customized supply chain attacks on likely vendor data, the individualized…

They're gonna shut the internet down by country

Can't stop the signal, Mal.

Re: Someone bought 30 WordPress plugins and planted a backdoor in all of them

#332

Post by winddude »

Dylan16807 wrote: post #267
winddude wrote: post #147

Earlier quoted context omitted.

bitcoin is forecast to uses about 150 TWh of electricity this year vs all other datacenter operations foretasted to use 1000 TWh. Bitcoin is esitimated to be about 52.4% sustainable energy (renewables plus nuclear) where datacenters are 42% sustainable energy.

And those other datacenters are mostly doing useful things, while bitcoin is somewhere between pure waste and the least efficient way of doing security ever conceptualized. (A few dozen centralized nodes, set up right, would likely be more secure than the current mining pools.)

are they? or are they running, spam, ecommerce throw away culture? overreaching government data collection? lots of porn as well.

Re: Someone bought 30 WordPress plugins and planted a backdoor in all of them

#334

Post by pxtail »

paglaghoda wrote: post #308

One of the best time for Cloudflare to market EmDash as Wordpress alternative.

Now only thing missing is leadership, development and active maintenance of the project for at least 5+ years - and keeping it and ecosystem around it fair and open (to some degree at least) because that whats allows WP to last for so long, it's not zero sum game.

For such rich and resourceful corp like Cloudflare surely this isn't a problem and they are going to overview, maintain and steward the project for a long, long time. Surely.

Re: Someone bought 30 WordPress plugins and planted a backdoor in all of them

#335

Post by pxtail »

Dma54rhs wrote: post #264
jdthedisciple wrote: post #260

Presumably, Wordpress knows more about the identity of the buyer and will initiate legal action against them... right?

Why or how would they know? There's no such vetting if you want to get listed on their plugin catalogue.

This is actually business opportunity for WP/Automattic - they could introduce vetted plugins where plugin author and/or consumer pays for review service.

Re: Someone bought 30 WordPress plugins and planted a backdoor in all of them

#336

Post by tclancy »

exogenousdata wrote: post #93
tclancy wrote: post #76

Earlier quoted context omitted.

>if they're rational (an assumption that is debatable, of course) Feels like crime is an almost perfect simulation of the free market: almost/ all of the non-rational actors will be crowded out by evolutionary pressure to be better at finding the highest expected values, where EV would be something like [difficulty to break in] x [best-guess value of access].

This is a total tangent. However note that the creator of the ‘free market’ idea, Adam Smith, wasn’t an advocate for zero law/regulation regulation. In fact Chapter 10 of his “Wealth of Nations,” specifically states, “When the regulation, therefore, is in favour of the work-men, it is always just and equitable.” He goes on to explain that regulation that benefits the masters can wind up being unjust. Smith’s concept…

Oh for sure and a good point. I meant the free market in the sense certain groups tout as the solution to all problems but that the studiously avoid themselves because it’s dog-eat-dog.

Re: Someone bought 30 WordPress plugins and planted a backdoor in all of them

#337

Post by Adachi91 »

iamkeithmccoy wrote: post #216
raincole wrote: post #174

Earlier quoted context omitted.

C#/.NET is a good example showing no matter how much programmers you have, how much capital you hold, it's still impossible to make a 'batteries-included' ecosystems because the real world is simply too vast.

Say what you want but I can write a production backend without any non-Microsoft dependencies. Everything from db and ORM to HTTP pipeline/middleware to json serialization to auth to advanced logging (OTel). Yes, sometimes we opt for 3rd party packages for advanced scenarios but those are few and far between, as opposed to npm/js where the standard library is small and there is little OOTB tooling and your choices ar…

I agree with you, almost all .NET code I write is within the .NET framework, yet when I look at C# repos, it's disheartening to see so many (new) projects just NuGet this NuGet that.

We have text.json now but I still see people use Newtonsoft JSON.

There's old repo's out there that should be archived and deprecated, yet I see new games use it when the repo is very questionable with automated whitespace or comment commits to keep up the appearance that it is still being maintained[0].

Right now I'm working on a Golang project and the dependency tree is a nightmare to say the least, I hope to be able to rip out the parts I don't need and compile it without the massive bulk that I do not need.

It's very frustrating to want me to trust the author, who trust the author, who trust the author. When I doubt they even audited or looked at what they imported.

[0] https://github.com/sta/websocket-sharp

Re: Someone bought 30 WordPress plugins and planted a backdoor in all of them

#338

Post by xp84 »

dylan604 wrote: post #123
stouset wrote: post #116

Earlier quoted context omitted.

> No matter where I look, up and down the stack, across different OSes and tech stacks, there are bugs. I’m not sure I’d go quite as far as GP, but they did caveat that we often choose not to write software with few bugs. And empirically, that’s pretty true. The software I’ve written for myself or where I’ve taken the time to do things better or rewrite parts I wasn’t happy with have had remarkably few bugs. I have c…

> I’m not sure I’d go quite as far as GP, but they did caveat that we often choose not to write software with few bugs. And empirically, that’s pretty true. Blame PMs for this. Delivering by some arbitrary date on a calendar means that something is getting shipped regardless of quality. Make it functional for 80% of use, then we'll fix the remaining bits in releases. However, that doesn't happen as the team is assign…

Hearty agree. I think the PMs fall victim to wildly optimistic imagination of how fast and easy it will be to correct from “good enough to not get yelled at by CEO for not shipping by X date” to “works correctly and isn’t creating more bugs” - and importantly, it seems like they repeat this mistake every project, compounding the problem. So we perpetually have an increasing number of hacks, interacting with each other to cause difficult issues, all of which the PM says we will fix next sprint, just as soon as we ship one more Important Feature.

Not all orgs of course. But most I’ve personally seen, seem to be like this.

Re: Someone bought 30 WordPress plugins and planted a backdoor in all of them

#339

Post by grvdrm »

DrewADesign wrote: post #319
grvdrm wrote: post #300

Earlier quoted context omitted.

This is the direction of my thinking, too. Earlier discussion focuses on writing software at a slower pace to inject more accuracy and robust thinking/design/code. Conceptually, yes, I get it! But in numerous practical scenarios, some adherence to a recurring schedule seems like the only way to align software to business outcomes. My thinking is tied more to enterprise products (both external and internal) rather tha…

The main problem I’ve had is the unpredictability of where the complexity lies. Unless you’ve done exactly what you’re doing, before, with the same tools and requirements, there’s a good chance that some discrete trivial aspect could take up an incredible amount of time, and that won’t indicate whether the main goal will take more or less time. I’ve worked both as a developer and as a designer, and while some aspects…

> The main problem I’ve had is the unpredictability of where the complexity lies. Unless you’ve done exactly what you’re doing, before, with the same tools and requirements, there’s a good chance that some discrete trivial aspect could take up an incredible amount of time, and that won’t indicate whether the main goal will take more or less time

What a great articulation. Completely agree.

This is why I don't blame PMs anymore than devs anymore than business folks throwing requirements at PMs. Possible to find fault everywhere.

I think the broader problem is scale and growth. Many people in many roles are caught in growth-mind or scale-mind companies where the business wants to operate at a velocity that may not align with the realistic development work we're discussing. PMs are similarly caught with less time to understand, scope, plan, etc. Business folks ask questions like "why isn't this ready" to devs that may not understand the reasons why the business operates the way it does, or the business at all.

Full disclosure: I'm in insurance. Seeing lots of these problems play out in front of me. C-suite moving at speed 100, devs moving at a perceived speed of 50. Silos and communication problems and unclear requirements up and down the stack.

So, in my interactions, the way I try to help is just to understand the most basic components and their ability to come alive or not. Is there anything to show? Yes, ok - let's celebrate a small win. Is there a rather large delay? Why - ok, let's use that to reinforce building something robust vs. crap.

But, there are schedules! Someone above mentioned sqlite. Another example comes to mind: Obsidian. I think they're anomalies (good ones) rather than examples that broadly prove the point to slow down.

Re: Someone bought 30 WordPress plugins and planted a backdoor in all of them

#340

Post by altairprime »

rmccue wrote: post #303
altairprime wrote: post #180

Earlier quoted context omitted.

What aggregators? How would I locate fair.fm? Is there a Whole Earth Guide to Repositories that’s human-curated? What is the published malware incidences and non-responses rate for each repository?

An "aggregator" is the thing that discovers and lists repositories - the equivalent of a search engine. Anyone can operate one themselves, and we (the FAIR project) operate a canonical one on our website, which is fair.pm.

[dead]
Post reply on HN