Similarly, the xz breach was uncovered by a diligent developer looking at quirky SSH login performance regressions.
But we are getting so much faster, and networks are doing so much weird inscrutable stuff now that it’s a lot harder at baseline. And, of course, the baddies are getting sneakier, too, and we are building systems from more components from more diverse sources.
I worry about the long term picture a lot; does all of infrastructure become a little untrustworthy at baseline?
Isn’t that a scenario that is better?
If you stop trusting potentially insecure systems you start developing hard and solid ones.
I don’t worry about deepfakes or AI malware, I welcome it. It’s stupid that we have insecure systems like unencrypted emails, social security cards, unsigned documents, passwords in PIN codes alone, etc.
Nonce is also British slang for alleged or convicted sex offenders, especially ones involving children.
The most recent update at the top of the page should probably be "Update 7-12-2025 06:00 UTC" instead of the current future date of 08-11-2025. I think the author incremented the wrong digit.
> one of the plugins that they are trying to download from the official gravityforms.com domain
It’s common for certain plugins to have… plugins of their own. For example if you have a form created with gravityforms and you want to connect it to a CRM or something, there is a screen inside the plugin settings to install it. Which is why I asked. (I don’t know if that’s the case with gravityforms.)
It also would be a lot less useful. A lot of content is published through WordPress.
I suspect an effective approach would be encouraging ways to make WP more secure, or publish a secure platform that can easily be transitioned from WP.
I didn’t see anything in the article but I may have missed it.