4 ms·

It sounds like they got a little overaggressive fighting with the company that had hijacked their themes and were selling them last year. They were probably ob

by saluki 8y ago

It sounds like they got a little overaggressive fighting with the company that had hijacked their themes and were selling them last year. They were probably obfuscating those functions to hide them from the people selling their themes. Sounds like they were also disabling this plugin as well. But they definitely went about things the wrong way, including functions like that and obfuscating them is definitely not the right way to do things. I think a simple, we're sorry we had included these functions in this manner to combat the company stealing our themes last year. We understand this was wrong and a fresh clean version of the plugin will be out this week. We will do things the right way from now on, you can trust us and we welcome audits of all our code.

ceejayoz 8y ago
> It sounds like they got a little overaggressive fighting with the company that had hijacked their themes and were selling them last year. Some of this might be explainable in this fashion, but not all. https://www.wordfence.com/blog/2019/03/peculiar-php-present-in-popular-pipdig-power-pack-plugin/ https://www.wordfence.com/blog/2019/03/peculiar-php-present-... > Firstly, the plugin includes a content filter that automatically replaces references to Blogerize, a service which claims to be a beginner’s blogging course, with references to Pipdig’s own services.
- cortesoft 8y ago
  It sounds like that might have been the place that stole it?
  - duskwuff 8y ago
    Doesn't matter. A WordPress plugin/theme developer has no business altering the content of sites using their software.
    - cortesoft 8y ago
      I don't know anything about WordPress, but isn't a plugin supposed to alter the content of the site using their software? If it didn't, why use it?
      - basilgohar 8y ago
        Not changing content linking to a competitor's services into one linking to author of the plugin's without the user's knowledge.
      - duskwuff 8y ago
        Generally speaking, most WordPress plugins alter the presentation or functionality of a site, not its content. There's some exceptions, like search-and-replace [1], but even in those cases the functionality is made obvious to the user. [1]: https://wordpress.org/plugins/search-and-replace/ https://wordpress.org/plugins/search-and-replace/
muraiki 8y ago
Saw this on Twitter: > Phil you need to stop with the lies. Not only do you outright lie about having the ability to kill sites with your plugin, you state that this was implemented in response to a security breach you experienced in July 2018. The code was implemented in November 2017. https://twitter.com/nickstadb/status/1112444919409446912 https://twitter.com/nickstadb/status/1112444919409446912 Unfortunately, pipdig wiped and recreated the repo an hour ago, so that history is no longer available there at least.
- pavel_lishin 8y ago
  https://web.archive.org/web/20190331195338/bitbucket.org/pipdig/p3/commits/edc47824200e15d64cab7270debc4a0526a8d323 https://web.archive.org/web/20190331195338/bitbucket.org/pip...
- saluki 8y ago
  y, even having this in their plugin wasn't the right way to do things. And if the timing isn't lining up that starts poking holes in their response. I was just trying to give them the benefit of the doubt if this was done to try to combat piracy. With GPL some piracy is expected though, and this isn't the right way to combat it. WordPress plugins and development is still the Wild Wild West. Most developers are good but they are some Black/Gray Hats out there for sure.

by saluki 8y ago

ceejayoz 8y ago

> It sounds like they got a little overaggressive fighting with the company that had hijacked their themes and were selling them last year. Some of this might be explainable in this fashion, but not all. https://www.wordfence.com/blog/2019/03/peculiar-php-present-in-popular-pipdig-power-pack-plugin/ https://www.wordfence.com/blog/2019/03/peculiar-php-present-... > Firstly, the plugin includes a content filter that automatically replaces references to Blogerize, a service which claims to be a beginner’s blogging course, with references to Pipdig’s own services.

cortesoft 8y ago
It sounds like that might have been the place that stole it?
- duskwuff 8y ago
  Doesn't matter. A WordPress plugin/theme developer has no business altering the content of sites using their software.
  - cortesoft 8y ago
    I don't know anything about WordPress, but isn't a plugin supposed to alter the content of the site using their software? If it didn't, why use it?
    - basilgohar 8y ago
      Not changing content linking to a competitor's services into one linking to author of the plugin's without the user's knowledge.
    - duskwuff 8y ago
      Generally speaking, most WordPress plugins alter the presentation or functionality of a site, not its content. There's some exceptions, like search-and-replace [1], but even in those cases the functionality is made obvious to the user. [1]: https://wordpress.org/plugins/search-and-replace/ https://wordpress.org/plugins/search-and-replace/

muraiki 8y ago

Saw this on Twitter: > Phil you need to stop with the lies. Not only do you outright lie about having the ability to kill sites with your plugin, you state that this was implemented in response to a security breach you experienced in July 2018. The code was implemented in November 2017. https://twitter.com/nickstadb/status/1112444919409446912 https://twitter.com/nickstadb/status/1112444919409446912 Unfortunately, pipdig wiped and recreated the repo an hour ago, so that history is no longer available there at least.

pavel_lishin 8y ago
https://web.archive.org/web/20190331195338/bitbucket.org/pipdig/p3/commits/edc47824200e15d64cab7270debc4a0526a8d323 https://web.archive.org/web/20190331195338/bitbucket.org/pip...
saluki 8y ago
y, even having this in their plugin wasn't the right way to do things. And if the timing isn't lining up that starts poking holes in their response. I was just trying to give them the benefit of the doubt if this was done to try to combat piracy. With GPL some piracy is expected though, and this isn't the right way to combat it. WordPress plugins and development is still the Wild Wild West. Most developers are good but they are some Black/Gray Hats out there for sure.