Hacker News Reader

Comment by zzleeper | Hacker News Reader

That's really pathetic, to put it mildly. Three weeks between initial contact and removal of compromised themes. Four months until public disclosure.

View on HN

Public disclosure by the people that found the backdoor. I couldn't find any disclosure about it by AccessPress themselves between 15. October when they pulled the compromised themes and plugins to now.

ThriveThemes still hasn't released a disclosure on an attack from March 2021.[0] This seems to be par for the course among theme developers.

0. https://www.wordfence.com/blog/2021/03/recently-patched-vuln...

That's not the timeline. It was a single day from contact to removal of compromised plugins. According to the article, the issue was that the vendor's contact form didn't work, not that the vendor didn't quickly remove the plugins.

You are also confusing plugins with themes. They are not exactly the same.

> vendor's contact form didn't work

Had this happen recently to a site. The SMTP password was set wrong and I don't know how many months/years this form just failed to submit but no one was aware of it... was for a landing page type site.

> The attack was discovered by researchers at Jetpack, the creators of a security and optimization tool for WordPress sites.

It’s a deceitful way to present it. Jetpack and WordPress are the same company.

It's not deceitful at all. Anyone who's in the WP ecosystem understands this.

Jetpack is part of Automattic. Automattic's main thing is wordpress.com (the hosted platform). Automattic and WP.org are not the same thing even though ( as with many open source projects that have commercial implications) the lines are somewhat blurred.

Presenting this as "deceitful" is really quite the over-reaction.

If the lines are somewhat blurred, you can understand my initial confusion, not being “in the WP ecosystem” myself.

Sure. but perhaps think about the use of emotive words like "deceitful" when you don't fully understand what's going on?

English as third language, so let’s say I didn’t realise it was such a strong word.

English is a mess.

Deceitful implies intention. Qualifiers help. "Unintentionally misleading" fits better. It's like the difference between manslaughter (whoopsiedeath) and murder (intentional).

You have to understand that this sort of intentional obfuscation of ownership and responsibility under a single root of ownership is in most areas of business a pretty good indication of ill intent (even if it is depressingly common).

That’s simply not true. Jetpack is owned by Automattic. Automattic has an exclusive license to the name “WordPress” from the WordPress Foundation but WordPress is owned, operated, and managed by the WordPress Foundation and is a totally separate entity.

Source: I work at Automattic and used to work on a Jetpack team.

Thanks for the clarification, it's not that easy to understand when one looks at the Automattic website.

This is true, but it's also important to note that Matt Mullenweg founded/co-founded and leads both organizations.[0][1]

0. https://www.linkedin.com/in/mattm/

1. https://www.guidestar.org/profile/20-5498932

I never download from anywhere but wordpress.org and a lot of others don't, and that wasn't attacked, so I disagree that it's "pathetic".

Reply on news.ycombinator.com