Hacker News Reader

That's largely not going to make a difference. You can already mostly trust themes and plugins listed on the WordPress.org website. The themes with the bad code are the ones available elsewhere, and quite often are pirated versions of commercially available themes.

View on HN

I shiver when I think how many pieces of code are fetched over the internet on my machines.

If you are a motivated attacker you can compromise a plugin author's PC or server and silently push a backdoor to a whole lot of people.

Signed releases are commonplace. It would make sense to require them in most plugin systems, especially those with central plugin repositories and lots of users.

Reply on news.ycombinator.com