Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Someone bought 30 WordPress plugins and planted a backdoor in all of them

anchor.host

Post reply on HN
Print view View original

351–360 of 368 posts

Re: Someone bought 30 WordPress plugins and planted a backdoor in all of them

#351

Post by dundundundun »

DarkUranium wrote: post #286
TeMPOraL wrote: post #282

Earlier quoted context omitted.

> the number of bugs and hacks observed are far enough from the desired value of zero Zero is not the desired number, particularly not when discussing "hacks". This may not matter in current situation, but there's a lot of "security maximalism" in the industry conversations today, and people seem to not realize that dragging the "security" slider all the way to the right means not just the costs becoming practically…

I know a lot of security researchers will disagree with this notion, but I personally think that security (& privacy, I'm going to refer to both as "security" for brevity here) are an overhead. I think that's why it needs to exist * and be discussed* as a sliding scale. I do find a lot of people in this space chase some ideal without a consideration for practicality. Mind, I'm not talking about financial overhead for…

In my experience, the proper infosec professionals both know and balance this well, it's the amateurs and posers who gets it wrong.

Re: Someone bought 30 WordPress plugins and planted a backdoor in all of them

#352

Post by zbentley »

psychoslave wrote: post #235
chromacity wrote: post #32

This is a perfect illustration of what cracks me up about the hyperbolic reactions to Mythos. Yes, increased automation of cutting-edge vulnerability discovery will shake things up a bit. No, it's nowhere near the top of what should be keeping you awake at night if you're working in infosec. We've built our existing tech stacks and corporate governance structures for a different era. If you want to credit one specifi…

Wealth odd distribution doesn't scale by definition. A malicious actor can possibly bribe some other actors, but they can't bribe them all. At large, the infosec nightmare should be society governed by corrupted plutocrats ruling pauperized populations through threat, lies and planned scarcity. We know how to write software with very few bugs just as sure as we know how to structure societies with very few corrupted…

> we know how to structure societies with very few corrupted people

We do?

Re: Someone bought 30 WordPress plugins and planted a backdoor in all of them

#353

Post by gbibas »

chromacity wrote: post #32

This is a perfect illustration of what cracks me up about the hyperbolic reactions to Mythos. Yes, increased automation of cutting-edge vulnerability discovery will shake things up a bit. No, it's nowhere near the top of what should be keeping you awake at night if you're working in infosec. We've built our existing tech stacks and corporate governance structures for a different era. If you want to credit one specifi…

Mythos and AI infused make some sense, but the thing I keep wondering is that while attacks can be planned and executed by AI, because they inherently we have not yet solved the hallucination problem, any though that AI will help you defend against attacks completely is short sighted. Mythos can find things, but if you ask it if you are secure, can you trust it? It is asymmetric AI warfare because of hallucinations.

Re: Someone bought 30 WordPress plugins and planted a backdoor in all of them

#354

Post by 1dontnkow_ »

TeMPOraL wrote: post #282
LeifCarrotson wrote: post #165

Earlier quoted context omitted.

Cost is a parameter subject to engineering tradeoffs, just like performance, feature sets, and implementation time. Security and reliability are also parameters that exist on a sliding scale, the industry has simply chosen to slide the "cost" parameter all the way to one end of the spectrum. As a result, the number of bugs and hacks observed are far enough from the desired value of zero that it's clear the true requi…

> the number of bugs and hacks observed are far enough from the desired value of zero Zero is not the desired number, particularly not when discussing "hacks". This may not matter in current situation, but there's a lot of "security maximalism" in the industry conversations today, and people seem to not realize that dragging the "security" slider all the way to the right means not just the costs becoming practically…

The thing with zero bugs is that software is very complicated not due it being harder than hardware but by simply that get some devs, POs, sys admins, devops and stuff and zero bugs will be defined entirely different.

For example, in theory the only real system with zero bugs would be one you use exactly always the same way, at the same place for the same exact goal and never change that.

Its a bit related to the old saying in cybersec " the msot secure system is the one who isnt used at all and not connected to anything" so basically a tradeoff with UX always. But who would want that?

I think thats why software on more actual mission critical systems are way more stable and bug free... still hate the word. Because it cant be avoided, since you see bugs sometiems are just situations when your uncontrolled actors (users, other services) use the system in a non-intented way so you try plan for that such us retry mechanisms, logging, backups etc.

Because when we further think about it, have you ever witnessed a system in real life thats bug free? Humans have bugs all around, buildings, cars, even nature. So how would you expect we could do that, esp each random company? Also do we want that? What if we said there is a 100% defiend system we can make perfect in 100 years... Good, but whats the point?

Re: Someone bought 30 WordPress plugins and planted a backdoor in all of them

#355

Post by 1dontnkow_ »

xyzzy123 wrote: post #315
LeifCarrotson wrote: post #165

Earlier quoted context omitted.

Cost is a parameter subject to engineering tradeoffs, just like performance, feature sets, and implementation time. Security and reliability are also parameters that exist on a sliding scale, the industry has simply chosen to slide the "cost" parameter all the way to one end of the spectrum. As a result, the number of bugs and hacks observed are far enough from the desired value of zero that it's clear the true requi…

Is it the industry making this choice or the customer? You could make a car that's safer than others at 10x the price but what would the demand look like at that price? Would you pay 2x for your favourite software and forego some of the more complex features to get a version with half the security issues?

Thats very true and I think about often because even in everyday task e.g. "We need a new feature to download reports" then you get a ticket but still depending how much that is used, desired, invested in or marketed and all those things, how flexible should I make, whats all the errors, whats the data, how secure and million other small or bigger decisions.

The point isn't how user stories are written, but realizing that everything is a compromise for practicality since if I wanted it to be the most secure thing ever, Id say "Lets just not offer that feature at all".

But now back to cars, I like that I heard some companies promised or started to build cars again with real buttons. In our world its when I try to use more and support the tools which aren't build on Electron (and slow as hell) but actually care about performance. Open source and decent enough security is already the minimum requirement.

Re: Someone bought 30 WordPress plugins and planted a backdoor in all of them

#356

Post by soulofmischief »

Eisenstein wrote: post #346
soulofmischief wrote: post #239

Earlier quoted context omitted.

Equating the concept of cryptographic currency with specific implementations such as proof-of-work just shows that you have no idea what you are talking about. The importance of financial sovereignty can not be understated, whether you understand that or not.

What problems are solved by financial sovereignty? How does crypto solve those problems?

> What problems are solved by financial sovereignty?

It's right there in the name. Some people believe that their assets should not be freezable or restricted by the whim of their local government-of-the-week. Cryptocurrencies have obviously solved this problem quite well or people wouldn't be complaining about how it has enabled more cybercrime (specialists, include cyber criminals, are often quicker to adopt trends than society at large).

Moving beyond that, the utility of a cryptographic smart contract system paves the way for the future of the internet. People forget computers are less than a hundred years old, and that there are thousands of years of computing ahead of us. The fundamentals will look very different one day.

Re: Someone bought 30 WordPress plugins and planted a backdoor in all of them

#357

Post by isidkwidkiejdk »

bruckie wrote: post #112
KronisLV wrote: post #101

Earlier quoted context omitted.

> We know how to write software with very few bugs (although we often choose not to) Do we, really? Because a week doesn’t go by when I don’t run into bugs of some sort. Be it in PrimeVue (even now the components occasionally have bugs, seems like they’re putting out new major versions but none are truly stable and bug free) or Vue (their SFC did not play nicely with complex TS types), or the greater npm ecosystem, o…

> Do we, really? Yes, or pretty close to it. What we don't know how to do (AFAIK) is do it at a cost that would be acceptable for most software. So yes, it mostly gets done for (components of) planes, spacecraft, medical devices, etc. Totally agreed that most software is a morass of bugs. But giving examples of buggy software doesn't provide any information about whether we know how to make non-buggy software. It onl…

> But giving examples of buggy software doesn't provide any information about whether we know how to make non-buggy software. It only provides information about whether we know how to make buggy software—spoiler alert: we do :)

Conversely, and perhaps MUCH more importantly, only saying that we know how to write relatively bug-free software without giving any evidence or proof that it is indeed the case is a gigantic red flag.

In fact, given how our brains work and how illogical we actually are, it’s quite unbelievable that we actually have the capacity to write “bug-free” code. Such a thing is much more likely to really be just a myth more than anything else, and simply saying “nuh-uh” won’t change that.

Re: Someone bought 30 WordPress plugins and planted a backdoor in all of them

#358

Post by Eisenstein »

soulofmischief wrote: post #356
Eisenstein wrote: post #346

Earlier quoted context omitted.

What problems are solved by financial sovereignty? How does crypto solve those problems?

> What problems are solved by financial sovereignty? It's right there in the name. Some people believe that their assets should not be freezable or restricted by the whim of their local government-of-the-week. Cryptocurrencies have obviously solved this problem quite well or people wouldn't be complaining about how it has enabled more cybercrime (specialists, include cyber criminals, are often quicker to adopt trends…

Inability to evade the justice system is not something that most people would agree is a problem; quite the opposite. The rule of law is the thing that allows you and I to live in such relative splendor. If you remove the ability for courts to operate you will not be in a libertarian utopia, you will be a dystopian free for all where there is no one to uphold contracts or stop people from doing what they like when they have even a bit more power than you.

Re: Someone bought 30 WordPress plugins and planted a backdoor in all of them

#360

Post by emailsysadmin »

mrweasel wrote: post #310
PaulHoule wrote: post #296

Earlier quoted context omitted.

I was qmail fanbois back in the day and loved how djb wrote his own string handling library. I built things with qmail that were much more than an email server (think cgi-bin for web servers) and knew the people who ran the largest email installation in the world (not sure how good they were about opt-in…) Djb didn’t allow forking and repackaging so quail did not keep up with an increasingly hostile environment where…

qmail was a lot of fun, so was djbdns and daemontools, but you're right it failed to keep up and DJBs attitude didn't help. We built a weird solution where two systems would sync data via email. Upstream would do a dump from an Oracle database, pipe it to us via SMTP and a hook in qmail would pick up the email, get the attachment and update our systems. I remember getting a call one or two years after leaving the org…

you have no idea how much your story made me smile today. thanks.
Post reply on HN