Bonum Certa Men Certa

Back Door (Automatic Update) in WordPress and What It Means to Techrights

Matt Mullenweg
Author: Ronny Siegel



Summary: Techrights is moving to Drupal now that WordPress introduces back doors as part of the core package

Techrights was always a WordPress-based Web site. I have been with the WordPress for nearly a decade and I met its co-founder (Mike Little) for coffee about 8 years ago, back when I was more actively involved in the development side. That was around the time this Web site started. It used WordPress 2.0 for quite a few years (and since the very start) because this version was a long-term support release (as required for inclusion in Debian GNU/Linux software respositories). Contrary to some smears and lies, Techrights never got cracked in any way whatsoever. It's build very securely and only DDOS attacks took it down. Around 2009 there was an upgrade which resulted in very little change to the site's appearance as consistency was a priority. In response to DDOS attacks it also added a cache proxy and more CPU cores. To the outsider (visitor), this site today looks very similar to how it looked 7 years ago. But this aging look makes it less suitable for its breadth. In fact, a blogging platform was outgrown when we added a Wiki (later in the same year) and now we deal with issues of organisational nature. WordPress has just had a release with automatic updates [1,2] (security risk in itself, but it's toggled off by default, for now) and there is already a bugfix release [3], which in many cases will get installed automatically even though it has no security-related fixes. This can be risky if the update mechanism gets hijacked (as has happened before to other companies). Governments can compel companies to misuse this mechanism or secretly take over it* in order to install Trojan horses in the background (targeting particular sites). In any event, automatic updates come with risks that are backdoor-like; Drupal, a European project, does not have this issue, at least not yet. The front page of this site is now Drupal-powered and it is a sign of things to come. The plan is -- one way or another -- to make Drupal the primary component of the site without disrupting or even changing the old pages. The transition can be slow, but we're determined to make it happen.

____ * The NSA is good at covert action and Automattic would be easy pickings for it, not just because it's US-based (packets can be sniffed and decrypted for passwords). While I have enormous trust and respect for Matt Mullenweg, who is a charming man of integrity, I very much doubt he can challenge his government technically and legally. An intervention-free remote update mechanism is a trade-off between security and so-called 'national security' (the oppressors' power). Remember that WordPress got backdoored once before (core -- not plugins -- in version 2.1.1). Linux too was a victim, a few years earlier (it was developed and hosted in the United States at the time). The very existence of backdoor-like mechanism is begging to be abused. Experience teaches that it does get abused, and far more often than most of us choose to believe. The more subversive sites become, the bigger a target they become for authorities' 'legalised' cracking teams.

Related/contextual items from the news:



  1. WordPress 3.7 introduces automatic updates
    The WordPress team has announced the release of version 3.7 which makes WordPress more secure. The release is named “Basie” in honor of Count Basie.


  2. WordPress 3.7 Debuts, Improving Security for Millions


  3. WordPress 3.7.1 Maintenance Release


Recent Techrights' Posts

Saving the Planet With Honesty, Transparency, and Sharing (Not Only of Computer Code)
GAFAM is destroying the only habitat humans and other animals have and it'll only get worse
Disinformation About Election Outcomes Even Before Any Election Outcomes (or Election/Voting!)
seeding doubt about election outcomes
Against Outsourcing of Sites and E-mail
Software Freedom is great, but it is not enough if you let someone else do it 'for you'
Drew DeVault: People Talking About My Attack Site (Against the Founder of GNU/Linux) is "Spam"
"Spam on sr.ht mailing lists"
"Oppose the Fascist"
what the founder of GNU/Linux said
Halloween, All Saints Day & Swiss citizenship
Reprinted with permission from Daniel Pocock
 
How Voting Does Not Work
You cannot vote from an "app"
Links 05/11/2024: Bluesky and Enshittification, Pugad Baboy, and Lots of Disinformation Flooding the Web
Links for the day
[Meme] Sweaty Under the Belly
"OK, my critics are 'spam'"
Microsoft Bribing Canonical (to Stop Competing) and Bribing Users to Shun the Competition
Canonical is worth shunning
[Meme] The 2024 'Info Bros'
And prehistoric googling
Computers Getting Worse (for the User) Over Time
This is like Windows-ism coming to "Linux" through the hardware
[Meme] How NOT to Vote
Another form of (mostly-unspoken-of) election interference
An LLM Inside a 'Search' Engine Means That Companies Tell You What They Want, Not What Web Pages to Visit
The future of 'googling' things might be as unreliable as using Social Control Media as a source of information
Google's Debt Has Increased and 'Cash on Hand' Fell by 22.27% This Past Year
These are the numbers that the corporate media intentionally leaves out
Over at Tux Machines...
GNU/Linux news for the past day
IRC Proceedings: Monday, November 04, 2024
IRC logs for Monday, November 04, 2024
There's a Reason Why Techrights is Turning 18 and Tux Machines Will Turn 20.5 Next Month
I started advocating GNU/Linux when I was a teenager
Techrights Has a Long History of Fighting to Expose 'Team Mono' or Microsofters Inside GNOME
Never downplay the malice of Microsoft and its operatives
Gemini Links 05/11/2024: Halloween Over, Intention and Implementation, Bookmark Syncing
Links for the day
Microsoft Lost Nearly Half of Its 'Cash Reserves' This Past Year
Is Microsoft (MSFT) the next Intel (INTC)?
The Year Isn't Over Yet, There Will be More Waves of Microsoft Layoffs
Nowadays Microsoft just tries to conflate/equate its energy waste with "value"
The Corporate Media Blasted Bitcoin for Destroying the Planet and Must Do the Same to Incite the Public Against the 'Great Rigging of Wall Street' (Under the Guise of "AI", the Latest Gold Rush)
"AI" is the next "metaverse" (trailing by a few months)
[Video] Richard Stallman is Back to Halo and Gown (in Peru) With 2+ Hours of a Public Talk
The globetrotting Richard Stallman gave many talks at the end of last month
Going Strong Against the Wind
the abuse serves to emphasise or affirm the importance of what we do
Links 04/11/2024: Squashing More Software Patents and Taiwan at Risk
Links for the day
Gemini Links 04/11/2024: Typing vs Writing and a Smol (Net) Pub
Links for the day
Links 04/11/2024: LibreOffice Had Adopted PeerTube, "Hey Hi" Hype is a Threat to the Energy Grids (Worse Than Fake-Coins)
Links for the day
[Meme] Social Control Telescreens With Microphone
Nineteen Eighty-Four
Shout-out to Christine From FOSSForce
Who noticed our short story
Not Boycotting Apple (Yet)?
"Apple Forces The Signing Of Applications In MacOS Sequoia 15.1"
statCounter This Month: Android Has Nearly Become Twice as Big as Windows
If it happened, it would be an unprecedented milestone
Why Technical Sites Need Not Make Political Recommendations or Endorsements
Except perhaps when it's for some purely technical role, e.g. FCC chief
[Meme] Apple Freedom
Freedom is... the ability to purchase as many 'i' things as you want
Apple's MacOS Shows Us the Vision of Computing That GAFAM Has for Us (Digital Prisons)
Freedom means "we the people" should be in control, not people being controlled by corporations (contemporary slaveowners)
"Active" as in One URL, One Emoji, and 4 Words in One Week
Diversity community in Fedora
Apple Vision Pro Has Failed, Just Like "Metaverse"
Vision Pro lacks software
Things That Can Improve Election Integrity
the first two relate to "tech"
Rigging Elections is Difficult, Cheating a Little is Not
Avoid social control media, it is the biggest rigger of all
"People who live in glass houses shouldn't throw stones"
On throwing stones in a glass house
Our Stance on Electronic (or Digital) Voting Machines
The simple activity of voting and counting ballots does not require thousands of complex machines with hundreds of millions of transistors and hundreds of millions of lines of code
Microsoft and "Retrospective Re-writing of History..."
in YouTube anyone can make stuff up (as one goes along)
This Coming Week
Go exercise your right to vote
Over at Tux Machines...
GNU/Linux news for the past day
IRC Proceedings: Sunday, November 03, 2024
IRC logs for Sunday, November 03, 2024
Reddit is (Still) Lying and Faking
Don't fall for this phony idea that the above sites are grassroots or edgy; they're not
GNU/Linux Users Are Not Cheaters
The bottom line is, most cheaters use Windows
Links 04/11/2024: FCC, Broadband Industry Spar Over Net Neutrality; Software Patent Squashed
Links for the day
Gemini Links 03/11/2024: Official MyGemini.Space Announcement
Links for the day
Gemini Links 03/11/2024: Election Thoughts, Plagiarism, and LLM Slop
Links for the day
Links 03/11/2024: Deere 'Right to Repair' (RoR) and "Threads Bans Anyone For Mentioning Hitler"
Links for the day
[Video] "El Movimiento del Software Libre y el Sistema Operativo GNU" by Richard M. Stallman
The footage is a bit jittery (taken with a phone apparently, and there's no tripod available), but the sound is OK and the words (in Spanish) are comprehensible
Android at New Highs (47%), Windows at New Lows (24%), Suggests Latest Data From statCounter
So the market share of Android is about double that of Windows
[Video] Richard Stallman's Talk in Spanish (in Peru Last Week)
Alternative URLs too
The Media Focuses on the Wrong Scandal
The real scandal at MIT was Gates
Gemini Links 03/11/2024: Fantasy Life Day and Worship
Links for the day
[Meme] Write Us Drivers and GTFO!
When you realise sanctioning BRICS devs goes against the community
Decommissioning Copper Lines Makes Us Less Safe
We've essentially degraded the robustness or reliability of critical systems
Life of an Addicted Lolicon Who Can Also Code
Personal blog as an open diary
[Meme] Reporting Crime is Not a Crime
Obviously!
Manchester Party for Techrights
If you choose to come, of course we'll cover the cost of the food and treats (but not travel)
Privacy is Not a Crime (in Places Where It is a Crime the Regime is Typically Very Rogue)
Also, criminals lack "privacy rights" to hide their crimes from the public
GNU/Linux "Market Share" in Lebanon More Than Doubled in a Few Months
Maybe it's a reaction to something? Assassination in Haret Hreik was in July.
Over at Tux Machines...
GNU/Linux news for the past day
IRC Proceedings: Saturday, November 02, 2024
IRC logs for Saturday, November 02, 2024
Nearly 40 Years Without Security Incidents
People who use Windows have come to sort of "accept" that security incidents are part of life or "normal"
[Meme] The Streisand Effect
Simon says, don't bother trying to suppress facts
Streisand Effect at IBM?
Trying to silence your workers isn't the best approach. It only makes colleagues even more curious.
Microsoft is a Gift That Keeps Giving (Future Stories to Techrights)
Microsoft has been trying to silence me using dirty tricks for nearly 20 years
Elon Musk Has Trashed Twitter for Ideological Reasons (and Propping Up Trump in Exchange for Financial and Political Favours Once in Public Office)
In case you didn't leave Twitter already, consider the fact that Twitter's (or "X"... whatever!) future is uncertain
Wall Street Has Demoted Intel, Seeing There May be No Future to Intel
Intel's loss isn't a loss to us
Free Software Licence Compliance is About Security Too
Linux as de facto proprietary off-the-shelf platform