4 ms·

The title implies that WP did something wrong, but did they? As Sucuri notes: > We disclosed the vulnerability to the WordPress Security Team who handled it e

by amq 10y ago

The title implies that WP did something wrong, but did they? As Sucuri notes: > We disclosed the vulnerability to the WordPress Security Team who handled it extremely well. They worked closely with us to coordinate the disclosure timeline and get as many hosts and security providers aware and patched before this became public. https://blog.sucuri.net/2017/02/content-injection-vulnerability-wordpress-rest-api.html https://blog.sucuri.net/2017/02/content-injection-vulnerabil...

ceejayoz 10y ago
The actions, at least as-described, sound entirely reasonable to me.
deleted 10y ago
[deleted]
onion2k 10y ago
The title implies that WP did something wrong, but did they? In my opinion the implication of what they did means people who don't host with Wordpress or Wordpress's partners will have to wait longer for security patches. That gives Wordpress and their partners a very clear business advantage - "host with us or be vulnerable to attack until we get around to releasing our patch publicly". That doesn't necessarily mean WP were in the wrong though. It's possible there simply wasn't a better approach - releasing a patch that doesn't fix the problem can be worse than waiting until you have a good fix, and you definitely can't disclose a problem until you have a strong fix. Put simply, disclosing vulnerabilities is hard.
- fencepost 10y ago
  Is that "wait longer" referring to the difference between "over the weekend" for WAFs and "Monday" for WordPress hosts? Because I didn't get the impression that the companies that got advance notification were chosen based on being partners. They had to balance the question of getting as many installs as possible protected before doing the easy-to-analyze release, because probably within hours after the release there were going to be attacks starting to turn up. In the meantime, as long as they had feedback from the WAF vendors that the vulnerability wasn't being probed they had a pretty good idea that it wasn't widespread. The only real question about it that I was curious about as well is which firewall plugin developers they communicated with.
- aaroncampbell 10y ago
  Put simply, disclosing vulnerabilities is hard. This is so true! To try to set the record straight, WordPress.org (the open source project) doesn't host and websites apart from our own (WordPress.org, WordCamp.org, BuddyPress.org, etc). So people can't host with us. Also, while we do have some recommended hosts that have helped the community as well as put a lot of effort into making their WordPress hosting really exceptional, they were not the only hosts we worked with on this (or even the majority). Additionally, the work with hosts and WAFs happened in parallel with the work on the patch. WordPress users are our priority and they exist at pretty much every host. The best way to secure them all is to get a patch out. Anything we can do to mitigate the risk between finding out and when that patch is ready, is really just a bonus :)

by amq 10y ago

ceejayoz 10y ago

The actions, at least as-described, sound entirely reasonable to me.

deleted 10y ago

[deleted]

onion2k 10y ago

The title implies that WP did something wrong, but did they? In my opinion the implication of what they did means people who don't host with Wordpress or Wordpress's partners will have to wait longer for security patches. That gives Wordpress and their partners a very clear business advantage - "host with us or be vulnerable to attack until we get around to releasing our patch publicly". That doesn't necessarily mean WP were in the wrong though. It's possible there simply wasn't a better approach - releasing a patch that doesn't fix the problem can be worse than waiting until you have a good fix, and you definitely can't disclose a problem until you have a strong fix. Put simply, disclosing vulnerabilities is hard.

fencepost 10y ago
Is that "wait longer" referring to the difference between "over the weekend" for WAFs and "Monday" for WordPress hosts? Because I didn't get the impression that the companies that got advance notification were chosen based on being partners. They had to balance the question of getting as many installs as possible protected before doing the easy-to-analyze release, because probably within hours after the release there were going to be attacks starting to turn up. In the meantime, as long as they had feedback from the WAF vendors that the vulnerability wasn't being probed they had a pretty good idea that it wasn't widespread. The only real question about it that I was curious about as well is which firewall plugin developers they communicated with.
aaroncampbell 10y ago
Put simply, disclosing vulnerabilities is hard. This is so true! To try to set the record straight, WordPress.org (the open source project) doesn't host and websites apart from our own (WordPress.org, WordCamp.org, BuddyPress.org, etc). So people can't host with us. Also, while we do have some recommended hosts that have helped the community as well as put a lot of effort into making their WordPress hosting really exceptional, they were not the only hosts we worked with on this (or even the majority). Additionally, the work with hosts and WAFs happened in parallel with the work on the patch. WordPress users are our priority and they exist at pretty much every host. The best way to secure them all is to get a patch out. Anything we can do to mitigate the risk between finding out and when that patch is ready, is really just a bonus :)