Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

WordPress plugin quirk resulted in UK Gov OBR Budget leak [pdf]

obr.uk

Post reply on HN
Print view View original

61–70 of 127 posts

Re: WordPress plugin quirk resulted in UK Gov OBR Budget leak [pdf]

#61

Post by pentagrama »

Ok, it was the Download Monitor plugin.

But I still have a few questions. What is WordPress’s default behavior? Does it prevent files uploaded to the media library from having public URLs? Are they only public once they are inserted into a published post? Images make sense because they are embedded, but what about a PDF linked inside a post? My understanding is that media files become publicly accessible as soon as they are uploaded, as long as someone knows or guesses the URL. I mean, the leak could have happened even without the plugin?

Re: WordPress plugin quirk resulted in UK Gov OBR Budget leak [pdf]

#62

Post by almostkindatech »

londons_explore wrote: post #23

> It is the worst failure in the 15-year history of the OBR I'm not sure publishing some information 3 hours early was really their biggest failure in 15 years... Especially when much of the info was already public because hundreds of civil servants involved in making these decisions told their family members who told the press...

If by 'much of the info' you mean policy changes, those are deliberately leaked by the politicians, not civil servants or their family members. They do this to test reactions and frame the debate.

Re: WordPress plugin quirk resulted in UK Gov OBR Budget leak [pdf]

#64

Post by Roscius »

merrvk wrote: post #4

Why are government organisations which handle sensitive information using Wordpress?

"On the reason for the early publication, Prof Martin said it was related to the software the OBR chose to publish to its website, which was more suitable for a small or medium company than a major publication of critical market-sensitive data."

Using WordPress plugins (with the exception of a limited sub-set) is like chewing gum you find on the sidewalk.

A technical oversight fail at multiple levels.

Re: WordPress plugin quirk resulted in UK Gov OBR Budget leak [pdf]

#65

Post by cristianraiber »

cstuder wrote: post #3
kingkool68 wrote: post #2

What was the quirk?

> A feature known as the Download Monitor plug-in created a webpage with the clear URL which provided a link to the live version, which bypassed the need for authentication. This rendered the protections on the ‘future’ function of WordPress redundant as it bypassed the required authentication needed to gain access to the pre-uploaded document. WordPress is a nice piece of software, but the plugin situation is gettin…

[dead]

Re: WordPress plugin quirk resulted in UK Gov OBR Budget leak [pdf]

#66

Post by ollybee »

chippiewill wrote: post #12
cstuder wrote: post #3

Earlier quoted context omitted.

> A feature known as the Download Monitor plug-in created a webpage with the clear URL which provided a link to the live version, which bypassed the need for authentication. This rendered the protections on the ‘future’ function of WordPress redundant as it bypassed the required authentication needed to gain access to the pre-uploaded document. WordPress is a nice piece of software, but the plugin situation is gettin…

> WordPress is a nice piece of software, but the plugin situation is getting worse and worse The plugin situation is a mess largely because Wordpress isn't a nice piece of software. It's popular, and functionally it's great, but the codebase is really showing its age. Wordpress has never properly rearchitected because it would break plugins on a scale that would endanger its dominance.

There's a whole industry of people selling solutions to WordPress's failings, all of whom have strong incentives for it not be properly improved.

Re: WordPress plugin quirk resulted in UK Gov OBR Budget leak [pdf]

#68

Post by [deleted] »

physicsguy wrote: post #38
louthy wrote: post #25

Earlier quoted context omitted.

Yes, it’s getting quite ridiculous now. Labour, for sure, have not done themselves any favours in their first 18 months in charge, but the level of attack and vitriol is exceptional and beyond any reasonable level. It makes me wonder what exactly is driving this.

The fact that they were elected as a 'change' government and have barely done anything that really faces up to the scale of the challenge the country faces? If you're below the age of about 55, then the budget did absolutely nothing for you except put taxes up, and not even to improve services. I appreciate things time but so far the government have enormously walked back their planning reform proposals, which was on…

[deleted]

Re: WordPress plugin quirk resulted in UK Gov OBR Budget leak [pdf]

#69

Post by RobotToaster »

louthy wrote: post #25
hdgvhicv wrote: post #21

Earlier quoted context omitted.

In the popular press it’s been sidelined because it would distract from the continuous attacks on the chancellor

Yes, it’s getting quite ridiculous now. Labour, for sure, have not done themselves any favours in their first 18 months in charge, but the level of attack and vitriol is exceptional and beyond any reasonable level. It makes me wonder what exactly is driving this.

They were elected with 33% of the vote thanks to our FPTP system, the lowest in history. They were unpopular when they were elected and have done nothing to change that.
Post reply on HN