8 ms·

Man why would anyone install code like that. It’s script you can just read it guys, everyone fights so hard for open source and no one bothers reading anything

by swiley 7y ago

Man why would anyone install code like that. It’s script you can just read it guys, everyone fights so hard for open source and no one bothers reading anything.

koheripbal 7y ago
I once took over a Wordpress site and the prior dev told me that he just torrented the plugins. It took me all of 15 minutes to find code injections appended to the bottom of the code files. ...but that wasn't the interesting part. Since it was a very popular SEO plugin, I actually took the extra time and reported the attack code wordpress security scanners and the torrent site. A month later I checked back and the plugin had been re-uploaded, but this time with the attack code heavily obfuscated and much more subtely hidden within the plugin. ...and this time when I reported it to the torrent site, the site admins banned me and actually IP blocked me. tldr; The only open source code getting reviewed is heavily used stuff.
- ahje 7y ago
  WordPress has commercial closed-source plug-ins available and one of the more popular ones happen to be a certain SEO-plug-in. You're certain it wasn't a pirated copy of a closed-source plugin? Pirated closed-source themes and plug-ins for WordPress is a very common source of malware on WP sites.
  - 0x0 7y ago
    I think that's implied by the use of torrents. Bittorrent is not commonly used as the official distribution channel by professional wordpress plugin authors, I believe.
- ukyrgf 7y ago
  Wordpress is open source, but the plugins that people "null" and upload to a directory with write access usually aren't.
693471 7y ago
vBulletin is probably hundreds of thousands of lines of code. Nobody has time to "read the code" before installing it.
jcims 7y ago
vBulletin is closed source commercial software, isn't it?
- userbinator 7y ago
  It's PHP, so you get the source if you're a paying customer (or find a warez'd copy), but I suspect the number of people looking through the source for vulnerabilities and not intending to keep their discoveries private is relatively low.

by swiley 7y ago

Man why would anyone install code like that. It’s script you can just read it guys, everyone fights so hard for open source and no one bothers reading anything.

koheripbal 7y ago

I once took over a Wordpress site and the prior dev told me that he just torrented the plugins. It took me all of 15 minutes to find code injections appended to the bottom of the code files. ...but that wasn't the interesting part. Since it was a very popular SEO plugin, I actually took the extra time and reported the attack code wordpress security scanners and the torrent site. A month later I checked back and the plugin had been re-uploaded, but this time with the attack code heavily obfuscated and much more subtely hidden within the plugin. ...and this time when I reported it to the torrent site, the site admins banned me and actually IP blocked me. tldr; The only open source code getting reviewed is heavily used stuff.

ahje 7y ago
WordPress has commercial closed-source plug-ins available and one of the more popular ones happen to be a certain SEO-plug-in. You're certain it wasn't a pirated copy of a closed-source plugin? Pirated closed-source themes and plug-ins for WordPress is a very common source of malware on WP sites.
- 0x0 7y ago
  I think that's implied by the use of torrents. Bittorrent is not commonly used as the official distribution channel by professional wordpress plugin authors, I believe.
ukyrgf 7y ago
Wordpress is open source, but the plugins that people "null" and upload to a directory with write access usually aren't.

693471 7y ago

vBulletin is probably hundreds of thousands of lines of code. Nobody has time to "read the code" before installing it.

jcims 7y ago

vBulletin is closed source commercial software, isn't it?

userbinator 7y ago
It's PHP, so you get the source if you're a paying customer (or find a warez'd copy), but I suspect the number of people looking through the source for vulnerabilities and not intending to keep their discoveries private is relatively low.