WordPress 2.3 Does Not Spy On Users [UPDATED] 229
Marilyn Miller writes "Popular open-source blogging engine WordPress has been upgraded to 2.3 — with some unexpected nasties in the mix. As of version 2.3, WordPress now periodically (every 12 hours) sends personally identifying information (blog name & URI) to the mothership, along with an alarming amount of information including $_SERVER dumps, a list of installed plugins, and your current PHP/MySQL settings. Most unfortunately, it does not provide any way of disabling this functionality, and WordPress does not have any privacy policy protecting this information. In a thread about the issue, lead developer Matt Mullenweg defends his actions and staunchly refuses to add an opt-in interface, telling users to 'fork WordPress' if they aren't willing to put up with this behavior." Update: 09/25 17:52 GMT by KD : This article is misleading enough to be called "just wrong." Matt Mullenweg writes: "As mentioned in our release announcement, the update notification sends your blog URL, plugins, and version info when it checks api.wordpress.org for new and compatible updates. It does not include $_SERVER dumps, or any settings beyond version numbers (for checking compatibility), or your blog name, or your credit card number. We do provide a way of disabling this feature; in fact I link to one of the plugins in the release announcement and in my original response to Morty's thread."
Surprised/ (Score:2)
Re:Surprised/ (Score:5, Funny)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
=Smidge=
Re:Surprised/ (Score:5, Informative)
disable WordPress version check [wordpress.org] and disable plugin version check [wordpress.org], both of which were mentioned by Matt in the thread above.
Re: (Score:3, Insightful)
What if someone has an issue with this information being transmitted? What if WP transmits the info before they are able to install the plug-in?
Guys, the issue here is not what info is being sent, it's that the information is being transmitted without asking for permission of the person running WP.
However, one of the best points brought up in the mailing list about what info is being sent is t
Re: (Score:3, Interesting)
This is likely to occur in version 2.3.1. In fact, I'm advocating [wordpress.org] for just such a change, in true Open Source fashion.
The problem here is less one of malice and more one of poor timing. The WordPress project has been trying to stick to a rigorous, rigid schedule for releases (see: Fedora Project, Ubuntu, etc.) and this issue cropped up about 1.5 days before release. You can argue that the r
Re: (Score:2)
Re: (Score:3, Funny)
Suggestion (Score:5, Funny)
Fork (Score:5, Insightful)
No point -- insecure codebase (Score:2, Troll)
Please, don't fork it unless you plan on completely rewriting the entire
Alternatives, in that case? (Score:5, Interesting)
Anyway, i googled and found this link:
http://www.mitchelaneous.com/2007/09/19/9-wordpress-alternatives/ [mitchelaneous.com]
Now, my question is - how secure are they for you, sethawoolley? Which one would you choose?
Re: (Score:2)
Wrong. Open source has nothing to do with *taking* someone else's code. The principle is that the software is built by collaboration, taking a little from column "A" and a little from column "B", to build your project. Because you use a variety of sources and collaborators, a great part of your work is "non original". Now this isn't a perfect way of doing things: you get people who contri
This thread would be longer... (Score:5, Funny)
fork (Score:3, Interesting)
Consider it done.
I nominate the fork name to be: (Score:5, Funny)
well (Score:5, Interesting)
and wordpress isn't that complicated that this is something that no one but the most hard core will do. tons of wordpress users regularly go in and tweak it for their own uses. i haven't moved to this new versions with my site yet - i always wait a bit for things to shake out, and stuff like this is why. when i do upgrade, i'll just fix my install.
Re: (Score:3, Insightful)
Or take the even easier path and set up your firewall to block all packets from this application.
But neither of those options solve the underlying problem - the whole point of FLOSS is to prevent this from happening in the first place. If I have to take any extraordinary steps to secure myself against a free software application I'm using, if I have to go and turn an enemy into a friend through manual effort and each other user
Re: (Score:2)
Easier? Do you mean block all outgoing HTTP traffic? If not, how do you plan to block packets from a specific set of PHP scripts?
Re: (Score:2)
Re: (Score:2)
Re: (Score:3, Insightful)
Why? Well anything else is supporting this developers decision, albeit indirectly.
He has every right to decide to do this, but users have every right to not use his code.
Let him be right and eat crow at the same time.
Ignorant bugger needs to learn a few hard lessons apparently.
Re: (Score:2)
I'm not sure how using the software, but not enabling this functionality would be supporting the developer. But if by that you mean in essence saying to them, "I support you but not in regards to this one feature." then I'm cool with that. I don't think everything has to be all or nothing. I don't think that the developers of Wordpress have to match my every id
Re: (Score:2)
In light of that, I'd have to agree with you.
Re: (Score:2)
Re: (Score:2)
I think that it would have been better if they had been up front and said themselves right off the bat, 'hey we have this in there - and if you want it off, you will have to do it yourself'. But aside from that I don't thin
Re: (Score:2)
You mean like in the announcement of the 2.3 release [wordpress.org] where Matt said
? (emphasis mine)
Re: (Score:2)
Re: (Score:2)
IN MY OPINION ONLY, not saying anyone actually is doing something like this, this whole thing smells like a way to generate money by reselling the information somehow.
Therefore, it make a lot of sense to either 1) Demand a way to shut the damn thing off, or if that fails, 2) Ensure the data is not very resellable by filling it with bogus data. Data resellers don't pay much for ba
Re: (Score:2)
This isn't like having to download the source of open office to remove something and then recompile the whole deal from scratch. I don't need an ide or know about libraries,
Re: (Score:2)
su root /etc/hosts
:wq
vi
i
wordpress.com 127.0.0.1
There - fixed it for you!
Re: (Score:2)
Re: (Score:3, Informative)
"> you fixed it for people running wordpress on a machine where they have root privileges. which i'm sure is a good number, but i'm not in that group. thanks anyway."
In that case: fgrep -n 1 "api.wordpress.org" *.php > lines_of_code_I_might_want_to_change.txt
Guys, the information is all really essential... (Score:5, Insightful)
The blog's URL
A list of all plugins and versions
A list of the $_SERVER env variables
How is this information not necessary for a robust autoupdating/autonotifying infrastructure? Since the plugns are the source of so many vulnerabilities, you need to know their versions etc.
Since so much incompatibility may be caused by funky $_SERVER variables, you need to know their contents.
And the blog URL tells you who it is.
Windows Update has to send far MORE intrusive information.
Re:Guys, the information is all really essential.. (Score:5, Insightful)
Re: (Score:3, Informative)
Re:Guys, the information is all really essential.. (Score:3, Insightful)
Re: (Score:2)
On the one hand, security through obscurity is a very bad default and sole security policy. On the other hand it can be a nice extra layer of security on top of an already well planned and established security policy.
Let's see what kind of details $_SERVER contains:
1. Absolute path to document_root on server
2. Absolute path to script being executed to process request
3. Contents of $PATH
4. SERVER_ADMIN which is an e-mail address that may not be public information - and apache can be configured, an
Re:Guys, the information is all really essential.. (Score:3, Interesting)
It isn't what information they are looking at but how. If they want the information and it will make the software better, fine, but do they really have to go about it in such a sneaky and under-handed way? Even Microsoft allows you to control how your system is updated (I never let it run automatically; I prefer to know what it's trying to put on my system.). As to the "fork" comment, while I thin the generic blogging community will be clueless and have no idea what this is all about, this will drive the OS
Re:Guys, the information is all really essential.. (Score:2)
This guy is arrogant and his attitudes are potentially dangerous. If he was a truly good developer, this would not be an issue whatsoever.
Sheesh, and trying to justify this behavior based on what MS does for an entire OS...a) this is not an OS and b) it's a bad MS practice which certainly does not make it right for others to do.
It'd be one thing if it was opt in, but this is just pathetic.
Re: (Score:2)
Thanks for the flamebait there kdawson. That's about the worst case of it I've ever seen on
There is possibly an issue here, but not even remotely on the scale that this was made out to be.
Re: (Score:2)
This guy is arrogant and his attitudes are potentially dangerous. If he was a truly good developer, this would not be an issue whatsoever.
Sheesh, and trying to justify this behavior based on what MS does for an entire OS...a) this is not an OS and b) it's a bad MS practice which certainly does not make it right for others to do.
It'd be one thing if it was opt in, but this is just pathetic.
I
Re:Guys, the information is all really essential.. (Score:2)
You probably meant "convenient" or "useful for monetizing."
Re:Guys, the information is all really essential.. (Score:2)
Windows Update might need the information, because it deals with a lot of programs and I guess it would be impractical to send a 2Mb+ list of current versions. There are no such limitations in case of wordpress. As far as I'm concerned the update checking tool shouldn't send anything at all, just r
Re:Guys, the information is all really essential.. (Score:3, Insightful)
Absolutely. However, you are assuming that I want my Wordpress installation to automatically update, and further that I am willing to give up a lot of sensitive information in order to get that done.
There should be a way to turn this feature off, plain and simple. There is no excuse whatsoever for forcing this down users throats. None. Yes, comment spam and other vulnerabilities are something that needs dealing with
Re:Guys, the information is all really essential.. (Score:2)
The argument is not that the information is unnecessary for an autoupdate/autonotify feature. The argument is that people should be able to easily opt-out from this feature. Having said that, the contents of $_SERVER seem unnecessary. That can leak things like usernames and paths.
Why does anybo
Re:Guys, the information is all really essential.. (Score:2)
Good god man, you're not using Windows Update as a way of justifying intrusive behaviour are you?
If that's the kind of standard which you're judging against, what hope is there for rest of the world.
"It's better than Windows" has never been a good enough excuse in my books.
Re:Guys, the information is all really essential.. (Score:2)
Re:Guys, the information is all really essential.. (Score:2)
Since the plugins are the source of so many vulnerabilities, you need to know their versions etc.
The auto-updater code needs to know the version of the locally installed software, and it needs to download the version of the current release, so it can compare the two. It does NOT need to send the local version to the vendor.
Since so much incompatibility may be caused by funky $_SERVER variables, you need to know their contents.
What exactly do you need this for? I've read the linked thread, and the software author himself can't even come up with a concrete reason for sending the $_SERVER variables. Elsewhere in the thread, someone else claims that the system works just fine when it doesn't send this data,
Correction (Score:2)
The reason it sends those variables is that it does so when somebody submits a comment to your blog. Those variables and the comment are sent to the Akismet servers which send back a pass/fail for spam ide
Pyblosxom (Score:5, Interesting)
- its really light and fast
- I can edit posts in a text editor rather than a web based interface
- its in Python and very easy to customise
- theming far simpler, just rip your HTML template into a header and footer, rather than having to make 12 files with Wordpress.
Plug over... Move along...
Re: (Score:2)
You don't have to split it into 12 files. You can use one index.php file for the whole thing if you really want to.
That product is doomed (Score:4, Funny)
I mean, really, WTF. They might as well have named it slakdfjalskdjflaskjdf!
Re: (Score:2)
Breathless Hyperbole. (Score:5, Informative)
Matt Mullenweg is being very reasonable and reasoned in dealing with a small but vocal groups paranoia. In the same breath that he mentioned forking Wordpress, he also mentioned that another option is using a plugin that disables this behavior.
The submitter should be ashamed.
Re:Breathless Hyperbole. (Score:4, Insightful)
It should be easy to turn on and off.
It should default to off.
It can ask one time during the upgrade, or first login after the upgrade, to be turned on, with an explanation of what it does and why he thinks it can be turned on.
There is no good reason the above cannot or should not be accomodated.
Re: (Score:3, Insightful)
It should default to off.
If windos auto-update would conform to those standards, we'd have a billion spam bots out there.
Instead of the half-a-billion we have now.
Re:Breathless Hyperbole. (Score:4, Insightful)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
"Your logic is flawed. You assume that someone looking to exploit won't
attack the latest version. This is usually untrue. If a serious exploit is
found, hackers usually just Google for "WordPress" (it's already on your
site for "powered by WordPress") or like wp-login.php and then attempt to
exploit it, regardless of version. If some database somewhere somehow did
get leaked, then all it'd do is just
Re:Breathless Hyperbole. WRONG (Score:2)
Id that were the case, then rather than sending this information out secretly every 12 hours, pop a box up to the user and tell them that their software is obsolete, and a potential security problem, and these are the particular items in question.
Isn't this the point of FOSS? (Score:4, Insightful)
OTOH, the idea of using FOSS (good!) as a venue for spyware (bad!) is enough to make a guy's head explode...
What Matt wrote (Score:5, Informative)
Re: (Score:2)
Re:What Matt wrote (Score:5, Insightful)
Thanks for your flamebait kdawson, really mature and appreciated.
WTF.
Rip out the code? (Score:2)
Fork we shall (Score:3, Informative)
The second way that the open source model has won, is that users who disagree with the direction the application is heading in can now fork. In fact, the head developer of the project suggests it. I'm pretty confident that this will happen and happen fast. Given that people "fork" (some say hack/crack) closed source software all the time to leave out all of the "evil" modules (See Kazaa > Kazaa Lite > Kazaa Lite K++; and don't forget cracked Windows XP) forking an open source project to leave out all of the "evil" modules should be pretty easy. I'm no developer, but I could see this being as simple as taking the original source, commenting out/removing the bad stuff, and then redistributing.
Re: (Score:2)
This is SENSATIONALISM (not Sparta) (Score:5, Insightful)
As to what the summary refers to, where Matt suggests a person fork Wordpress:
Again, he gives the solution to the original poster's complaint (Moritz 'Morty' Strube). If this Moritz is really concerned, he can fork and remove the new code that transmits this information - or if he isn't too concerned, just install the plugins matt suggested.
This is making something out of nothing. Definitely nothing to see here, please move along.
INCLUDE POST IN SUMMERY (Score:2)
Basically, this is FUD.
Re: (Score:3, Insightful)
LOL... I almost spit my coffee on the keyboard when I read this. I think some bloggers need to take off their tinfoil hat and step away from the keyboard... If you don't want anyone to find out your blog URL, then WTF are you doing blogging? Isn't the whole point for as many people as possible to find your blog URL?
Why is this even an issue? (Score:2)
You have the source code, right?
If you don't like the way the software behaves, you can change it. This is one of the fundamental freedoms the FSF endorses. In fact, I would say this is a perfect example of the open source model in action:
The sad thing is that Microsoft and other proprietary vendors have been so successful at convincing the general public that they should be a
Where did he say to just go fork?! (Score:5, Insightful)
So - did I miss something, or did everyone else not RTFA?
Re: (Score:2)
You're new here, aren't you?
The Actual Quote (Score:2, Informative)
> If you don't trust wordpress.org, I suggest you do one of the following:
> 1. Use different software.
> 2. Fork WordPress.
> 3. Install one of the aforementioned plugins.
Don't worry (Score:4, Funny)
So... As a rule spying on users is always a security concern =P (name it WordPress or Windows Update).
Fork This! (Score:2)
I think I'd rather "fork" him -- right in a tender spot.
It's bad enough to do it in the first place.
It's worse to do it in secret. (Did he really think it wouldn't be discovered?)
It's worst of all to actually defend it afterwards. (Who does the think he is? Dan Rather?)
You can't program people (Score:2)
Fork (Score:2)
If you can't wait for a Fork, there's a nice package called Textpattern [textpattern.com] that I used to use. It's kinda like WordPress. I liked it. Give it a spin and see if it works for you. :D (End shameless plug for favorite php app).
Google Cloaking (Score:5, Informative)
Summary Is A Troll (Score:5, Informative)
Actually RTFA Matt's reasoning gives the opposite impression of the summary. Fork the submitter and Kdawson for greenlighting this.
--
BMO
Well that makes it easy for me (Score:2)
Privacy?! (Score:2)
I can understand the complaints about how this may be an additional security risk, or at least would make an assholes job a bit easier if they hacked that central WP database. What I find somewhat irritating is that some people have voiced privacy concerns over this. I was under the impression that if you're running a blog, it means you're one of those Web 2.0 exhibitionists that tell everyone in the whole wide world all their daily activities in embarrassing detail anyway. Am I missing something?
A little php snippet (Score:2)
wouldnt be too long until someone produces a 'fix'.
I'm glad Matt updated us on this... (Score:3, Informative)
Up here, we (being the government) can't buy any software package that stores the data in the USA. I can only imagine the tens of millions of lost dollars in contracts because of the Patriot Act. I would of hate to have added Matt's awesome editor to that list. Rock on Matt!
Re: (Score:3, Informative)
Re: (Score:2)
Before you keep going off half cocked I suggest you read the mail list messages.
"Simply put, if you really insist on wearing a tin foil hat, it's uber easy
to disable the automatic update checker. For the other 99.99999% of people
out there, this feature will be a godsend to them in both terms of new
features and more importantly, the _only_ real way to make sure your site
doesn't get hacked -- by running the latest version. "
If you don't like it then take it out. You have the source for
Re: (Score:2)
Okay, I'll bite. Which, pray tell, "real language" would be better?
Re: (Score:3, Insightful)
And everyone knows that this can done equally well by having the client request the current version number, and then the client can decide based on that whether an upgrade is needed. There is no reason for the server to need to know the version number to support an autoupdate feature.
and the $_SERVER and php/database settings are (I imagine) used to figure out what wordpress settings are common. How soon they can remove support for old versions of mysq
Re: (Score:3, Informative)
Thank you Mr. Did-Not-Read-The-Fscking-Article.
Re: (Score:2)
http://blog.plasticmind.com/cms/why-you-should-upgrade-to-mt4/ [plasticmind.com]
Re: (Score:2)
I thought... (Score:4, Insightful)
Re: (Score:3)
Re: (Score:2)
It's pretty much inevitable at this point. Lead developer looks like an ass because of an overblown headline on a site with over 100,000 visitors a day who are known for not reading the article, which is the only thing that shows that it's Slashdot that's screwed up. Somebody is going to fork it. Later, they'll realize they overreacted to an overreaction, but have a lame justification for their position and continue anyway, before eventually falling dead after pulling a few developers away from WP.
Re: (Score:2)
Re: (Score:2)