Hacker News Reader

Comment by crote | Hacker News Reader

The author of a library has lost all control over the codebase, and a third party is now making changes to it. That's pretty much the textbook definition of stage one of a supply chain attack.

Considering what Matt has already done, it wouldn't even remotely come as a surprise if a future ACF update would, say, brick all WP installations using ACF on a WP Engine host.

View on HN

> brick all WP installations using ACF on a WP Engine host

That tactic would work, if WP Engine had access to the update server hosted at wordpress.org.

It's like claiming going to the bank is stage one in a robbery. So if you go to the bank you're a thief.

WordPress have the rights, just like the responsibility and possible liability of everything distrubted on their platform.

It's more like gaining backdoor access to the bank's server.

At this stage no attack has happened(but can happen)

They didn't gain access anywhere, it's their platform.

If the bank starts fiddling with the numbers in your account: "I'm not being attacked, it's their database"

> bank starts fiddling with the numbers in your account

If a bank messes with your money, you ask for your money when that happens. Not defame the bank based that they updated their database, business as usual, but you liked the old one.

how exactly did they mess with your stuff? where's the attack you're speaking about? where's physical harm?

The database says you have zero money, in fact you are not even a customer and never were, good day sir.

The paid version of AFC is not affected, so I'm not sure what are you talking about?

What money? who did you pay? for what?

Reply on news.ycombinator.com