Slashdot Mirror
Popular Wordpress Plug-in Caught Spamming Is Put On Probation
chicksdaddy writes "Social Media Widget, a free plug-in for the WordPress blogging platform with more than a million downloads, was restored to WordPress's official plugin directory on Thursday, days after it was found injecting WordPress websites with spam links to web sites offering Pay Day Loans. In a post on a support forum for Social Media Widget (SMW), Samuel Wood, a WordPress administrator, said that WordPress was willing to give SMW and its owner a second chance after he claimed to have been the victim of a contract developer gone rogue. 'Naturally we do take a very hard line on spam, and obviously an author putting malicious code into a plugin is enough grounds for us to bring down the ban hammer,' Wood wrote on Friday. 'But there are natural circumstances where an author may not be at fault.' SMW appears to be such a case. It is one of the 20 most popular WordPress add-ons and allows WordPress web site operators to include links to their other social media accounts. Brendan Sheehan, the owner of SMW, said, 'We trusted the wrong people with our plugin code and take full responsibility. We are a marketing company at heart and are not actually developers, so in order to provide major updates and improvements, we had to seek outside help. Some of these people deceived us and abused our trust and naivety...We will not make this mistake again.' Wood said the folks at Wordpress decided to accept that story — but that they're watching SMW closely. 'Basically, the current maintainer is not a professional programmer, and put his trust in the wrong freelancers to do the coding work for him...We'll be watching the plugin for changes,' he said. 'The plugin is back up for now, and as long as it stays clean, it's fine.'"
That's a nice attitude to have. "The author of this plugin was caught injecting malicious code into every website using it, but we'll keep it on the downloads page so long as he agrees to follow the honour system?"
How fucking stupid do you have to be?
Wordpress is a cancer on the Internet. It really needs to die.
And apparently that app works !!
I know! We'll write everything in-house instead! Once I've got my custom language compiling, I'll start work on the relational database engine. We should have the site finished some time in 2030.
Sooner or later, you're going to have to trust someone else's code. I guarantee you, whatever projects you work on, you're using someone else's code for something, and probably sight-unseen.
Just because you're paranoid doesn't mean there isn't an invisible demon about to eat your face
That's fucking par for the course for PHP devs...
And there's the troll.
If you want news from today, you have to come back tomorrow.
Truly confidence-inspiring.
-jcr
The only title of honor that a tyrant can grant is "Enemy of the State."
Firstly I want to make it clear I don't think it's a matter of being a "PHP dev" that makes people stupid, since I'm a freelancer myself and am sometimes forced to use PHP. I wouldn't say I'm stupid or incompetent. I will however say that you're missing the point grandparent was trying to make, mislead as it was. You're acting like the matter of wheel reinventing and copy and pasting is so black and white. It's not, it isn't unreasonable to expect people to take a quick look and test over a new plugin before putting it into production usage. Nor is it unreasonable to spend a few extra dollars to higher someone for a short while to review the other guy's code. You can not trust every single piece of code you see while at the same time reusing other people's code, it's naive to make the leap of logic you did.
I will however say that I end up being hired to fix shitty PHP code more often than not. Kind of worrying... It's why I'm on my way out of this sorry excuse for a career. I don't recommend it.
...Dice!!! Bwahahaha.
IOW, "we are scum whose very purpose in life is to force unwanted messages into your eyes and ears, but trust us that this incident of unwanted messages was accidental."
Tom Swiss | the infamous tms | my blog
You cannot wash away blood with blood
looking at the malicious URL (i.aaur.net) it seems Akamai ,Qwest are hosting malware now, site registered with hidden whois, take out the malicious domain and their scumbag rackspace DNS and their shit falls apart
For f*cks sake, there's no reason a supervisor shouldn't at least run a diff of the code and recompile (if applicable) before pushing a release. Unless there are huge changes, it shouldn't take more than 10 minutes. If anything looks really weird or out of place, start asking questions, preferably to someone else.
You can not trust every single piece of code you see while at the same time reusing other people's code, it's naive to make the leap of logic you did.
And I never said you did; the leap of "logic" was on the part of the GP, not me. He said, and I paraphrase, if you install code you haven't reviewed, you deserve whatever you get. I said that, sooner or later, you must trust some code, not that every random piece of code is worthy of trust.
And in this case, it's quite possible that people did perform a review of this plugin; after all, it hasn't been spamming the whole time it's been available. They performed an update on their plugin without vetting the update. Sure, that's not best practice, but I do the same thing on my personal computer at home all the time, even if I don't do it on my production systems. If I hosted a podunk little blog on Wordpress? I probably wouldn't vet every "security patch" for every plugin I used either.
GP is a great big case of "blame the victim" mentality. Someone was malicious. They deliberately inserted malicious code into a trusted repository.
Just because you're paranoid doesn't mean there isn't an invisible demon about to eat your face
As opposed to cause you to tighten confidence?
the next lower life form after attornies
We are a marketing company at heart and are not actually developers
It's a tool like any other, and it definetely has its place. What doesn't have a place is people who reject tools for pseudo philosophical reasons rather than utility.
"We trusted the wrong people with our plugin code and take full responsibility. We are a marketing company at heart and are not actually developers, so in order to provide major updates and improvements, we had to seek outside help."
The first headline on their website states, "Blink Web Effects creates innovative web applications and tools - totally free and open source." If they're not developers, why are they a company to begin with? It is really tiresome to see fucking marketing hacks thinking they are enlightened and entitled while they pay some 3rd world country developer to build their company.
This is what they deserve. Good riddance.
A contract programmer pulled a fast one on a marketing company to get their product to spam people. Yes, absolutely, I can believe that. So can my friend the Easter Bunny.
foreach (array('PHP', 'Perl', 'Java', 'C', 'C++', 'Javascript') as $language) {
}
"There does not now, nor will there ever exist, a programming language in which it is the least bit hard to write bad programs." -- Lawrence Flon
Tom Swiss | the infamous tms | my blog
You cannot wash away blood with blood
That's fucking par for the course for PHP devs: "I don't know what this code does, but I pasted it into my website so I have a twitter feed now! You should too!
You could say the same thing with Java, except that the result is slower
So, we're still ok with a business structure in the software development world where programmers have absolutely zero legal liability for their code (outside of military contracts and medical devices).
Seriously, programmers need to be put on notice and on the same legal liability standards as every other person working in the economy.
Shit like this, is exactly why I do not recommend using Word Press. I mean seriously, WP devs you are in action condoning black hat hackers. Awww... let's give them a second chance to abuse the millions of users that trust us... they said they were sorry... :O *blnk *blink *blink Really!?!
when you contract your project out to some random unknown asian or russian (or african) through online "freelance" services
You could say the same copy and paste stuff about Javascript and Jquery.
It's like saying only compiled languages qualify as programming.
Naturally we do take a very hard line on spam...
Yes, of course, it's not like WordPress got caught spamming themselves.
Nah, it's not slower anymore. It just takes up more RAM.
You do realize we are talking about a Wordpress widget?
Per my experience with PHP, your one-liner will eventually break in some strange way. It really is the worst.
GP made no such qualification. He was speaking in general about how stupid it was to reuse code you hadn't written yourself.
Just because you're paranoid doesn't mean there isn't an invisible demon about to eat your face
I recently broke my WordPress cherry, and I have to say the experience was extremely frustrating because 90% of the resources are not aimed at "developers" or even "PHP developers". Trying to find any real information about the API was incredibly frustrating.
The entire WordPress ecosystem seems to oriented towards semi-technical users who just want to click this thing and copy some files around. Basically people with blogs and brochure-ware sites who want a twitter icon without opening a text editor.
Cool. Sorry I missed that. I shouldn't've presumed his comment was in direct response to TFS.
Sooner or later, you're going to have to trust someone else's code. I guarantee you, whatever projects you work on, you're using someone else's code for something, and probably sight-unseen.
It's not everyone's code you can't trust.
It's only (1) the code you will actually distribute with your software, and (2) uncommon dependencies that are not part of widely used software packages.
And even then, you have to be able to trust the code of people working for you; e.g. the coders you hire. If you can't do that, then you can't get anything done.
So you should check into their background, and make sure the people you hire to make your code are either under a good contract or surety bond that protects your interest, and effects some risk transfer by providing you the right to sue for damages, especially, in case of obvious or provable malice.
That way you align your worker's interest with yours, by ensuring that if they conduct an intentional abuse they are at risk.
I will however say that I end up being hired to fix shitty PHP code more often than not. Kind of worrying... It's why I'm on my way out of this sorry excuse for a career. I don't recommend it.
It sounds challenging... then again rewrite may be better than fixing, as long as the pay is good....
This is the problem of subcontracting to China, who knows what else they have put in that hasn't shown up yet but is slowly attacking the USA's defences.
I've been doing wordpress development for about ten years, and FWIW, I've found Shareaholic's "Sexy Bookmarks" looks better, works better, and gets a better response.
Despite the stupid name(s). Here's a tip: If people find your name is too "sexy," re-branding it as somethign to do with drug/alcohol abuse is NOT your best alternative.
It's not really any less true for a good many other languages...
LOLOOLOLOL
Any programmer reading the stuff this guys says should become properly terrified of PHP. If they aren't, I don't want to use any software they work on.