Ipstenu (Mika Epstein) 5:10 pm on November 29, 2021
Tags: reminder ( 26 ), security ( 11 ), trademarks ( 5 )

Please don’t ‘test’ submitting other people’s plugins.

tl;dr: Never test vulnerabilities on someone else’s live site without their permission.

By now, a lot of you have read the post about the so-called “WordPress Plugin Confusion” whereby a pluginPlugin A plugin is a piece of software containing a group of functions that can be added to a WordPress website. They can extend functionality or add new features to your WordPress websites. WordPress plugins are written in the PHP programming language and integrate seamlessly with WordPress. These can be free in the WordPress.org Plugin Directory https://wordpress.org/plugins/ or can be cost-based plugin from a third-party hosted on WordPress.orgWordPress.org The community site where WordPress code is created and shared by the users. This is where you can download the source code for WordPress core, plugins and themes as well as the central location for community conversations and organization. https://wordpress.org/ can ‘override’ a plugin not hosted here, by using the same name/permalink. Someone even made a CVE for it.

Please stop ‘testing’ this vulnerability with us.

This is not a new issue by any means. Heck, this has been something people report on now and then for years. In the past, the plugin team coordinated a release of a plugin to intentionally do that and protect users from a significantly dangerous plugin. We’ve locked out permalinks to prevent abuse and so on.

Sadly, the post conflated a couple of issues, which have to do with social engineering and a misunderstanding of why we have those permalink-checks for trademarks. Also it’s entirely incorrect with this one claim:

and the whole approval process is automated

This could not be further from the truth. All new plugins submitted go through human review. When you submit a plugin, somebody reads your plugin code, your submitted slug and name, checks on the history of the plugin, checks that the developer isn’t a returned banned user, etc. The process is by no means “automated” and while it has some automated pre-flight checks, they’re really there to weed out things that would end with a pended review, to make the process faster for everyone. While we have some tools we run, they don’t actually approve or reject anything, they’re just fancy code-sniffers, customized to look for specific patterns or known bad behavior, outside of the overall quality like PHPCSPHP Code Sniffer PHP Code Sniffer, a popular tool for analyzing code quality. The WordPress Coding Standards rely on PHPCS. (you are using that, right?). Submitting things to test out what you think is an “automated” system is wasting the time of our volunteers and reviewers.

See, that trademark ‘blockBlock Block is the abstract term used to describe units of markup that, composed together, form the content or layout of a webpage using the WordPress editor. The idea combines concepts of what in the past may have achieved with shortcodes, custom HTML, and embed discovery into a single consistent API and user experience.’ isn’t actually there to protect trademarks for the owners. We have them to make our life easier and to protect you, the developers, from making some pretty common mistakes. Just for an example, we block ‘akismet’ not because we were asked to by Automattic, but because over 50 people a year tried to submit a copy of Akismet instead of uploading it to their own site.

As the post (properly) notes, you can’t submit a plugin with a permalink that’s already in use, be it on WordPress.org or if it has a notable user-base outside of WordPress.org. Even if a name gets by those checks, the review team can see if the permalink is being used and by (roughly) how many people. That’s a large part of why we have humans checking these things. A human can look at an email and a plugin and check for proper ownership.

By the way, as a number of people have complained about, this is why we require official plugins to be owned by demonstrably official accounts (like with an email address that uses the right domain, and so on). It’s not just to prevent trademark abuse, it’s to ensure that kind of thing is less likely to happen.

Now. Do you need to test this? No. All you’re doing is making things more stressful and more likely to be missed, which doesn’t solve a problem. Do you need to add your trademark to the blocked list? Again, no. Unless it’s being actively abused, or there’s a high-risk situation that it might be, it’s just adding more work for a low (to negligible) risk in the first place.

How DO you protect your own, non-org hosted plugins, from this?

Use the UPDATE URI flag.

We check for it on .org, and won’t allow you in with it (since… why?) but for plugins we don’t host, well that’s literally why it exists 🙂 Use it. Love it. But please, remember the first step in ethical hacking is never trying out a vulnerability on someone else’s site without their permission.

#reminder, #security, #trademarks

Ipstenu (Mika Epstein) 10:30 pm on November 3, 2021
Tags: reminder ( 26 )

Reminder: Check Your Accounts’ Emails (and your Committers)

Hi Devs!

We’re getting nearer to WordPress 5.9, and that means the email will be headed out soon.

This is the perfect time to double check the email on your accounts, especially if it’s a group email/mailing list. Make sure external emails (like … us) can contact you without bounces or autoreplies.

You also should check everyone who has commit access to your pluginPlugin A plugin is a piece of software containing a group of functions that can be added to a WordPress website. They can extend functionality or add new features to your WordPress websites. WordPress plugins are written in the PHP programming language and integrate seamlessly with WordPress. These can be free in the WordPress.org Plugin Directory https://wordpress.org/plugins/ or can be cost-based plugin from a third-party! Did someone leave? It’s okay to remove their access, and in fact is great to do so for security 🙂

And as a regular reminder: Never share accounts! Every individual human should have their own individual account. That lets you (and us) keep tabs on who did what.

#reminder

Ipstenu (Mika Epstein) 5:15 pm on September 27, 2021

https://make.wordpress.org/core/2021/09/27/changes-to-the-wordpress-core-php-test-suite/

Changes to the WordPress Core PHP Test Suite

Ipstenu (Mika Epstein) 7:17 pm on September 20, 2021
Tags: reviews ( 5 ), timeline

Change to How Long Active Reviews Remain Open

tl;dr Starting in October, you will have THREE (3) months to complete your review before we reject it.

This will not affect most of you who actively read this site.

For a very long time, we’ve allowed plugins 6 months to finish a pluginPlugin A plugin is a piece of software containing a group of functions that can be added to a WordPress website. They can extend functionality or add new features to your WordPress websites. WordPress plugins are written in the PHP programming language and integrate seamlessly with WordPress. These can be free in the WordPress.org Plugin Directory https://wordpress.org/plugins/ or can be cost-based plugin from a third-party review. That’s more than enough time for any reasonably attentive developer to make changes (especially considering the majority are ‘please sanitize/escape’).

In January 2021, we had 596 ‘pending’ reviews, which meant there just under 600 plugins that had been reviewed and we were waiting on a reply/completion. We’re seeing over 800 in September.

That rise is out of step with the number of plugin submissions. In fact, if you look at our posts to Make/Updates, you can see we’re pretty stable around 140 plugins submitted a week, but the “pending; replied to” value is inching up.

Since the majority of those plugins that don’t reply or finish in 3 months aren’t going to any time soon, we’re changing our policy to try and be more sustainable and less work. From now on, you have THREE months to finish a review before we reject it.

What about existing plugins/reviews through September?

There’s no change to existing submissions. Which means the “Reject all reviews pending completion” logic works like this:

Sept 30 – 6 months (i.e. from March ’21)
Oct 31 – 6 months (i.e. from April ’21)
Nov 30 – 6 months (i.e. from May ’21)
Dec 31 – 6 months (i.e. from Jun ’21)
Jan 31 – 6 months (i.e. from Jul ’21) and 3 months (i.e. Oct ’21)
Feb 28 – 6 months (i.e. from Jul ’21) and 3 months (i.e. Nov ’21)
March 31 – 6 months (i.e. from Aug ’21) and 3 months (i.e. Dec ’21)
April 30 – 3 months and older (i.e. Jan ’22 and before)

Yes, it’s a little messier for us, but it’s the most fair we can be to existing reviewers. It would not be kind to pull the rug out from under them.

What happens if I take more than 3 months?

Just keep replying to the review! We’ll work through it with you and tell you to resubmit when the review is good. That also lets us fast track you since you’ve worked so hard!

Can’t I just resubmit right away?

You could, but we’d pend your review and ask you why you never finished the previous one, which means your whole review will take longer, and we’ll make a note on your account about not following directions.

What if I can’t reply because I deleted/lost the review?

We get it. Mistakes happen. We’ve all deleted the important email! Email us at [email protected] from the account/address that submitted the plugin and we will re-send it for you.

Why did I get rejected if I never got a review?

There are two cases where this could happen:

Your plugin was rejected right away. In those cases we email you with an explanation as to why, so please wait an hour. You should get a followup.
Your email ate the review email. A number of services (including Gmail) can be configured in a way that might cause you to have a review misplaced through no one’s fault.

In both cases, reply to the rejection email and ask.

Is this automated?

Not yet, no, but I’d like it to be eventually.

UYes, this means every month end, someone goes through and selects all submissions from a time period and changes the status en bulk.

Why did you rejected my plugin after you emailed and said it was approved?

Human error. Or internet greebles. Probably the first. We do our best, but sometimes a mouse didn’t click when we thought it did, or a human got distracted, and mistakes happen. Those are generally our mistakes, and we are sorry when that happens.

Please email us back and tell us. We’ll get you fast tracked and sorted.

I have another question not answered!

Have a shout in the comments.

#reviews, #timeline

Milana Cap 2:39 pm on September 15, 2021
Tags: make.wordpress.org/docs ( 5 ), p2-xpost ( 47 )

X-post: [Announcement] New workflow for reporting documentation issues

X-comment from +make.wordpress.org/docs: Comment on [Announcement] New workflow for reporting documentation issues

Ipstenu (Mika Epstein) 4:44 pm on August 27, 2021
Tags: statistics ( 2 )

Inaccurate Stats Have Been Corrected

It gives me no joy whatsoever to have to post this.

A little over 100 plugins recently were impacted by a stats gathering change. This means those plugins had their active install stats seemingly adjusted downward.

We understand this was painful for a number of developers and we held off on announcing this as we were still doing a bit of triage and making sure it was blocked. We are sorry about that confusion.

What happened?

Recently, it was pointed out that the active install counts of several plugins appeared to be inflated artificially. When we looked at the raw data, we found that this was correct for roughly 100+ plugins; fake update data was being sent to us.
This is not unusual, it’s happened before, although people are usually much more blatant about it, which is why it took a long time to notice it. In any case, we adjusted our stats mechanisms to ignore these, and so those 100+ plugins will have seen a drop of around ~8000 installs.
As the data was being faked before, this new count is more accurate. But it doesn’t change the old counts, and we can’t redo those counts as we don’t store that raw data for more than 2 days.
@Otto42

Will this happen again?

Probably. This specific attack won’t, as the folks with server power on WordPress.orgWordPress.org The community site where WordPress code is created and shared by the users. This is where you can download the source code for WordPress core, plugins and themes as well as the central location for community conversations and organization. https://wordpress.org/ are outstanding. However about once every other year someone tries to do stuff like this. We usually catch on to them a little faster and blockBlock Block is the abstract term used to describe units of markup that, composed together, form the content or layout of a webpage using the WordPress editor. The idea combines concepts of what in the past may have achieved with shortcodes, custom HTML, and embed discovery into a single consistent API and user experience. them. Now that we know about this one, we’ll add it to the list of things to monitor and block. But yes, people love munging with stats, they’ll certainly try it again.

Why didn’t you post right away?

We were asked not to while people were still working on stopping it, and then we didn’t want to while we were investigating the root cause. Basically we didn’t want to announce it until we had all the facts.

Can you tell us exactly what happened?

No, we cannot. We’ve learned that telling people exactly how we caught what they did, or even just what they did in details, leads to them doing it again in a slightly more clever way. Right now, they have no idea how we solved it, and that’s just fine.

How many users did I lose?

The Active Install count for affected plugins would be decreased by somewhere between 1 and 8 thousand. Depends on the pluginPlugin A plugin is a piece of software containing a group of functions that can be added to a WordPress website. They can extend functionality or add new features to your WordPress websites. WordPress plugins are written in the PHP programming language and integrate seamlessly with WordPress. These can be free in the WordPress.org Plugin Directory https://wordpress.org/plugins/ or can be cost-based plugin from a third-party. And yes, we know that’s a galling number.

Were any of them valid users?

We can give you 100% assurance that no, they were not. The counts were inflated, so the number it shows now is much closer to the true active install count.

My plugin was impacted – am I in trouble?

No. If you were the culprit, your plugin would be already closed, your account banned, and you got a stern email from us about why you were banned for doing that, and you’re not welcome here anymore. If all of those aren’t true, we know you didn’t do it, and you have not a single thing to worry about.

Will a big drop in usage hurt my plugin popularity?

Not really, no. Please keep an eye on the big picture for a moment:

If you wants stats to be useful then they have to be accurate, right? Well, we fixed that.
The majority of end users don’t look at the charts that actually show the massive drop, they just look at the full usage count. And no, they don’t remember what you had yesterday.
You can point people here to explain “Someone else was a right prat and messed up stats for a lot of us.”

In the long run, this will even out and no one will notice. If you’re worried about your popularity, make sure you have a good readme that explains why someone wants the plugin and how to use it. That will help you much more than numbers or charts.

Did this impact historical data?

You mean from last month? Yes. Sadly. It’s been going on a while, like for most of the year. We don’t keep old stats like that in a manner that allows us to clean this up, so that’s why it looks like you had a big drop. At best we could force edit everyone impacted and drop them by X amount going back to when we think this started, but that doesn’t really change much, it just moves the weird needle back so it looks like a month or whatever ago, you had a massive drop.

There’s also the fact that the climb was a slow creep. We know the end volume of fake usage only because we saw the drop like you did. We could guess at how much it grew a month that was fake, but you run a higher risk of looking worse, like you were loosing 100s of users a month for a year.

Finally … asking us to manually edit your stats is a pretty terrible precedent. We don’t do that. We should never do that.

Why don’t you keep old data?

Two reasons: Privacy and size. We delete tracking data for your privacy, but also because with millions of sites out there, it’s heckin’ huge! Like “What comes after Petabytes?” huge. (Answer: exabyte, now you know.)

Can you undo this?

According to what I’ve been told, no. By blocking the fake data source, the stats automatically adjusted. The only way anyone would possibly be able to revert it would be to restore the fake data. We feel that is a terrible suggestion, as that would be intentionally lying to your users.

Who did this?

We are not about to disclose that. It’s being handled, and we are not in the business of dog-shaming people, nor encouraging mob-mentality to attack them.

If I didn’t do it, why am I being punished?

You’re not. Your plugin stats changed when we blocked the cause for the inaccurate counts. No one on WordPress.org has manually adjusted numbers. Basically we said “data like this is invalid” and when the counter recounted, which happens every day, those plugins were impacted.

This isn’t fair!

It’s equitable. Everyone who had their stats incorrectly inflated were corrected when we removed the data source.

I have some suggestions and ideas about how to fix this, where can I post those?

I am so glad you asked! The best way is to join us to be part of the ongoing solutions! And the easiest way to do that would be to come on over to help the META team. See, plugin reviews is just plugin reviews. But MetaMeta Meta is a term that refers to the inside workings of a group. For us, this is the team that works on internal WordPress sites like WordCamp Central and Make WordPress.? They do the heavy lifting of making the WordPress.org experience better for everyone. And, perhaps not shockingly at all, it’s mostly PHPPHP PHP (recursive acronym for PHP: Hypertext Preprocessor) is a widely-used open source general-purpose scripting language that is especially suited for web development and can be embedded into HTML. http://php.net/manual/en/intro-whatis.php. and JS. Yes, that’s right, WordPress.org runs on WordPress!

Meta has a meeting every other week in #meta on Slack. You can keep tabs on all meetings via https://make.wordpress.org/meetings/

Also if you have a fully formed idea, that you think is a good proposal, head over to https://meta.trac.wordpress.org/ and make a ticket. If you have detailed screenshots and example code, all the better.

#statistics