Hacker News Reader

Comment by leepowers | Hacker News Reader

One of the great things about WordPress is the plugin ecosystem. This is also a something of an achilles heel, especially when it comes to security. WordPress seems to attract a lot of lowest-common-denominator coders who create plugins. So while the WordPress core is now pretty solid when it comes to security, the various plugins are almost never coded to the same standard.

I have to wonder if WordPress added a small cost and verification system at front, similar to the app store, if third-party code would be of higher quality.

View on HN

There is a lot more process around plugin submissions and how they get listed than there used to be. See https://developer.wordpress.org/plugins/wordpress-org/detail...

An alternative would be for plugin authors to achieve a Core Infrastructure Initiative Best Practices Badge, which is free and shows a commitment to secure coding.

https://bestpractices.coreinfrastructure.org

Disclosure: I'm the co-author of the badge at the Linux Foundation.

Is there a single plugin that has been granted the badge?

The policy docs don't seem specific enough in areas where plugin developers need help (ie. don't use superglobals, raw sql or PHP scripts outside of the plugin load process) while being an over burden in less important areas (ie. requirement that each project have a security expert, and CI builds)

Having an audited plugin repository for Wordpress is an idea i've had in the back of my mind for a while now. I believe it's something a lot of businesses would pay for

The badge project is less than a year old, and there are several WP plugins registered, though none at 100% yet: https://bestpractices.coreinfrastructure.org/projects?q=Plug...

I agree that a big part of wpengine's value is the validation they do of certain plugins. A business model that could charge for information of which plugins are most safe would be challenging.

The goal of the Badge project is to incentivize improved behavior by the plugin authors.

Some WordPress plugins have started working on getting a CII best practices badge. None have gotten it quite yet, but there's no reason they can't. There's no cost for the badge, and the criteria are general "common sense" criteria that most people would agree are reasonable.

That shouldn't be surprising. The CII badge process opened in May 2016, so it's only been available for about half a year. I expect that most WordPress plug-in authors don't even know about it (yet).

> I have to wonder if WordPress added a small cost and verification system at front, similar to the app store, if third-party code would be of higher quality.

I think that's likely. At the very least, someone could run some static analysis on the plug-in with rules very specific to WordPress (e.g., "don't use superglobals"). That could really help.

However, there are many general "good things" that plug-ins should do. Trying to recreate a list of general good practices would take a lot of time, and be a pain (trust me!). Instead of reinventing the wheel for a list of general good practices, I suggest using the CII best practices badge identify general good practices, and then if you wish, create a separate list of rules specific to WordPress. That'd be much easier.

Disclosure: I'm technical lead on the CII best practices project. But it's still a good thing :-).

Reply on news.ycombinator.com