6 ms·

Automattic turns to weaponizing responsible disclosure against WP Engine

63 points by flutas 2y ago

jccc 2y ago
Regardless of what anyone thinks about the issue, we don’t editorialize in headlines.
- flutas 2y ago
  Would you mind posting what would be the better headline instead of a shallow dismissal of it? I actually struggled with a good one and felt this is the most fair take when seen in context of A) Matt's post <8 hours before this disclosure saying > "I suspect there are going to be millions of sites moving away from it in the coming weeks."[0]. B) WordPress has banned WP Engine from updating the plugin on the repo. [0]: https://x.com/photomatt/status/1842500184825090060 https://x.com/photomatt/status/1842500184825090060
  - echoangle 2y ago
    Maybe "Automattic announces responsible disclosure of safety issue in WP-Engine-plugin" or something like that? It's pretty clear that they are doing it maliciously but I don't think it should be put in the title as if it's a confirmed fact. I would have liked to make it "WP-Engine-developed plugin" or something like that because it's not specifically a WP Engine plugin, but the title length limit is 80 chars, right?
- threatofrain 2y ago
  This one doesn't have a natural title. Then we let the community judge whether we've been clickbaited in regards to the mismatch between title and this tiny tweet.
Arctic051 2y ago
Didn’t they ban WP Engine on their plugin platform? So they can’t post an update to the CVE even if they wanted to?
- flutas 2y ago
  Yup. Basically: 1. Ban them from updating the plugin. 2. "btw, here's a CVE for that plugin, you have 30 days until it gets removed or ownership changed." You can guess what's going to happen next... "Oh, they didn't fix their plugin, the repo is now owned by Automattic."
  - Arctic051 2y ago
    Have they ever announced a CVE like this before? This seems really convenient. I don’t really like conspiracy theorizing but with everything going in, it doesn’t seem far fetched to think this is sabotage.
    - flutas 2y ago
      Not that I'm aware of. Couple that with Matt's clearly hinting post earlier today[0] and it really feels... calculated. Just another thing for them to throw on the lawsuit I guess. [0]: https://x.com/photomatt/status/1842500184825090060 https://x.com/photomatt/status/1842500184825090060 > What are the best alternatives to Advanced Custom Fields @wp_acf for people who want to switch away? Is there an easy way to migrate? > I suspect there are going to be millions of sites moving away from it in the coming weeks.
    - unsnap_biceps 2y ago
      A responsible CEO would put the legal squabble aside and allow the fix to happen for the sake of the customers. Given Matt isn't doing it, I'm of the opinion that he is using it maliciously.
    - mrweasel 2y ago
      One idea that crossed my mind is that Automattic found a security issue and now they can "force" WPEngine to come up with a mechanism for managing plugins on their own. Then when all this hits the courts they point go "See, they could setup their own infrastructure in less than 30 days. They just choose to use ours to save money.". Or if WPEngine fails to do so, they lose credibility as a Wordpress hosting provider. Not sure, I'm not a lawyer.
stackghost 2y ago
Can someone provide some context for what's going on here and why people are so worked up? Why is it unseemly for Automattic to find this bug?
- pluc 2y ago
  https://www.cnbc.com/2024/10/05/wordpress-ceo-matt-mullenweg-goes-nuclear-on-silver-lake-wp-engine-.html https://www.cnbc.com/2024/10/05/wordpress-ceo-matt-mullenweg...
- flutas 2y ago
  The other comment has a link with a good overview of the fight, but there's a tiny but of nuance to why this is especially "bad." Essentially they are announcing a CVE on software while holding the fix for it hostage to normal users.
- echoangle 2y ago
  Automattic and WP Engine are in litigation. The Story roughly goes like this: Matt (CEO of Automattic) tries to get WP Engine to contribute more to WordPress development, including stuff close to blackmail WP Engine sends a cease and desist Automattic sends cease and desist to WP Engine claiming Trademark infringement Automattic bans Access of WP Engine customers to WordPress servers, breaking plugin updates (which was temporarily reinstated and then banned after a deadline of a few days) WP Engine sues Automattic Automattic has a program where employees can leave until a deadline and get a severance payout if they are unhappy with the management. Here's an article about it: https://techcrunch.com/2024/10/04/wordpress-vs-wp-engine-drama-explained/ https://techcrunch.com/2024/10/04/wordpress-vs-wp-engine-dra...
  - stackghost 2y ago
    Thanks, that's a great summary.
- deleted 2y ago
  [deleted]
- bastawhiz 2y ago
daft_pink 2y ago
I believe the fact that WP Engine relies on WordPress’ servers to run their platform suggests that this is more than just an open-source issue. If the problem were solely related to the source code, WP Engine’s access to WordPress servers wouldn’t be so critical. Although I’m not very familiar with WordPress, it appears their service is highly dependent on WordPress maintaining its servers, which makes the expectation for some kind of financial support seem reasonable.
- yjftsjthsd-h 2y ago
  What does that have to do with this tweet?
- bastawhiz 2y ago
  If I run a service that hosts VS Code in the cloud, should I have to pay Microsoft for my users to be able to access the extension marketplace or receive updates?
  - daft_pink 2y ago
    Visual Studio Code is the proprietary version (under the Microsoft Traditional License) of the open-source Code - OSS repository (licensed under MIT). Most of the code is open source, except for a small portion that includes elements such as code used for or providing access to services we run in our data centers (e.g., access to the Visual Studio Marketplace). Summarized from the following article: https://github.com/microsoft/vscode/wiki/Differences-between-the-repository-and-Visual-Studio-Code https://github.com/microsoft/vscode/wiki/Differences-between... If your whole business depends on leeching off of someone else’s servers, you should probably be contributing to those servers in some way.
- pluc 2y ago
  Everyone relies on those servers. That's how WordPress ships. There is no way to make it use other servers and WordPress is an otherwise very flexible platform; it benefits from centralizing all of that as illustrated by the way it's designed. The whole ecosystem works around it. So should everyone have to pay then? Everyone who uses the software uses the servers. If not what's the threshold? And remember that Matt has insisted WordPress.org ("those servers") belong to him personally, not to WordPress or to Automattic. If you're going to monetize access to plugins and themes produced from volunteer work on your open source code... can they monetize too? Does everyone get a cut?
amanzi 2y ago
Looks like this tweet was deleted - what did it say?
- pluc 2y ago
  https://imgur.com/a/OIB65Ro https://imgur.com/a/OIB65Ro (Copied from here: https://news.ycombinator.com/item?id=41753687 https://news.ycombinator.com/item?id=41753687)

63 points by flutas 2y ago

jccc 2y ago

Regardless of what anyone thinks about the issue, we don’t editorialize in headlines.

flutas 2y ago
Would you mind posting what would be the better headline instead of a shallow dismissal of it? I actually struggled with a good one and felt this is the most fair take when seen in context of A) Matt's post <8 hours before this disclosure saying > "I suspect there are going to be millions of sites moving away from it in the coming weeks."[0]. B) WordPress has banned WP Engine from updating the plugin on the repo. [0]: https://x.com/photomatt/status/1842500184825090060 https://x.com/photomatt/status/1842500184825090060
- echoangle 2y ago
  Maybe "Automattic announces responsible disclosure of safety issue in WP-Engine-plugin" or something like that? It's pretty clear that they are doing it maliciously but I don't think it should be put in the title as if it's a confirmed fact. I would have liked to make it "WP-Engine-developed plugin" or something like that because it's not specifically a WP Engine plugin, but the title length limit is 80 chars, right?
threatofrain 2y ago
This one doesn't have a natural title. Then we let the community judge whether we've been clickbaited in regards to the mismatch between title and this tiny tweet.

Arctic051 2y ago

Didn’t they ban WP Engine on their plugin platform? So they can’t post an update to the CVE even if they wanted to?

flutas 2y ago
Yup. Basically: 1. Ban them from updating the plugin. 2. "btw, here's a CVE for that plugin, you have 30 days until it gets removed or ownership changed." You can guess what's going to happen next... "Oh, they didn't fix their plugin, the repo is now owned by Automattic."
- Arctic051 2y ago
  Have they ever announced a CVE like this before? This seems really convenient. I don’t really like conspiracy theorizing but with everything going in, it doesn’t seem far fetched to think this is sabotage.
  - flutas 2y ago
    Not that I'm aware of. Couple that with Matt's clearly hinting post earlier today[0] and it really feels... calculated. Just another thing for them to throw on the lawsuit I guess. [0]: https://x.com/photomatt/status/1842500184825090060 https://x.com/photomatt/status/1842500184825090060 > What are the best alternatives to Advanced Custom Fields @wp_acf for people who want to switch away? Is there an easy way to migrate? > I suspect there are going to be millions of sites moving away from it in the coming weeks.
  - unsnap_biceps 2y ago
    A responsible CEO would put the legal squabble aside and allow the fix to happen for the sake of the customers. Given Matt isn't doing it, I'm of the opinion that he is using it maliciously.
  - mrweasel 2y ago
    One idea that crossed my mind is that Automattic found a security issue and now they can "force" WPEngine to come up with a mechanism for managing plugins on their own. Then when all this hits the courts they point go "See, they could setup their own infrastructure in less than 30 days. They just choose to use ours to save money.". Or if WPEngine fails to do so, they lose credibility as a Wordpress hosting provider. Not sure, I'm not a lawyer.

stackghost 2y ago

Can someone provide some context for what's going on here and why people are so worked up? Why is it unseemly for Automattic to find this bug?

pluc 2y ago
https://www.cnbc.com/2024/10/05/wordpress-ceo-matt-mullenweg-goes-nuclear-on-silver-lake-wp-engine-.html https://www.cnbc.com/2024/10/05/wordpress-ceo-matt-mullenweg...
flutas 2y ago
The other comment has a link with a good overview of the fight, but there's a tiny but of nuance to why this is especially "bad." Essentially they are announcing a CVE on software while holding the fix for it hostage to normal users.
echoangle 2y ago
Automattic and WP Engine are in litigation. The Story roughly goes like this: Matt (CEO of Automattic) tries to get WP Engine to contribute more to WordPress development, including stuff close to blackmail WP Engine sends a cease and desist Automattic sends cease and desist to WP Engine claiming Trademark infringement Automattic bans Access of WP Engine customers to WordPress servers, breaking plugin updates (which was temporarily reinstated and then banned after a deadline of a few days) WP Engine sues Automattic Automattic has a program where employees can leave until a deadline and get a severance payout if they are unhappy with the management. Here's an article about it: https://techcrunch.com/2024/10/04/wordpress-vs-wp-engine-drama-explained/ https://techcrunch.com/2024/10/04/wordpress-vs-wp-engine-dra...
- stackghost 2y ago
  Thanks, that's a great summary.
deleted 2y ago
[deleted]
bastawhiz 2y ago

daft_pink 2y ago

I believe the fact that WP Engine relies on WordPress’ servers to run their platform suggests that this is more than just an open-source issue. If the problem were solely related to the source code, WP Engine’s access to WordPress servers wouldn’t be so critical. Although I’m not very familiar with WordPress, it appears their service is highly dependent on WordPress maintaining its servers, which makes the expectation for some kind of financial support seem reasonable.

yjftsjthsd-h 2y ago
What does that have to do with this tweet?
bastawhiz 2y ago
If I run a service that hosts VS Code in the cloud, should I have to pay Microsoft for my users to be able to access the extension marketplace or receive updates?
- daft_pink 2y ago
  Visual Studio Code is the proprietary version (under the Microsoft Traditional License) of the open-source Code - OSS repository (licensed under MIT). Most of the code is open source, except for a small portion that includes elements such as code used for or providing access to services we run in our data centers (e.g., access to the Visual Studio Marketplace). Summarized from the following article: https://github.com/microsoft/vscode/wiki/Differences-between-the-repository-and-Visual-Studio-Code https://github.com/microsoft/vscode/wiki/Differences-between... If your whole business depends on leeching off of someone else’s servers, you should probably be contributing to those servers in some way.
pluc 2y ago
Everyone relies on those servers. That's how WordPress ships. There is no way to make it use other servers and WordPress is an otherwise very flexible platform; it benefits from centralizing all of that as illustrated by the way it's designed. The whole ecosystem works around it. So should everyone have to pay then? Everyone who uses the software uses the servers. If not what's the threshold? And remember that Matt has insisted WordPress.org ("those servers") belong to him personally, not to WordPress or to Automattic. If you're going to monetize access to plugins and themes produced from volunteer work on your open source code... can they monetize too? Does everyone get a cut?

amanzi 2y ago

Looks like this tweet was deleted - what did it say?

pluc 2y ago
https://imgur.com/a/OIB65Ro https://imgur.com/a/OIB65Ro (Copied from here: https://news.ycombinator.com/item?id=41753687 https://news.ycombinator.com/item?id=41753687)