Hacker News Reader

STEP 1:

Make every theme/plugin author create a private key to sign their releases. Their public key will be available on their profile page and via API. Wordpress will notify you if the public key for an author has changed or if a release signature doesn't match the public key.

Why is this not done?

(Also in other software that uses plugins and is updated easily over the internet.)

View on HN

That's largely not going to make a difference. You can already mostly trust themes and plugins listed on the WordPress.org website. The themes with the bad code are the ones available elsewhere, and quite often are pirated versions of commercially available themes.

I shiver when I think how many pieces of code are fetched over the internet on my machines.

If you are a motivated attacker you can compromise a plugin author's PC or server and silently push a backdoor to a whole lot of people.

Signed releases are commonplace. It would make sense to require them in most plugin systems, especially those with central plugin repositories and lots of users.

Reply on news.ycombinator.com