I’m the CEO of Patchstack. We don’t accept vulnerabilities in our program that require admin privileges (even though there have been real cases where such vulnerabilities cause serious damage to multisite networks). The plugin vulnerability issues in WordPress have become significantly worse, as low severity issues are now chained together that become a severe issue. On top of that, these vulnerabilities are being exploited faster than ever before. WordPress now also has an issue with supply chain attacks - which has started to happen quite a lot more compared to past years.
“Their whole business model is to sign CVEs” - please don’t make up random stuff. We were invited to the CVE program and therefore have an obligation to assign CVEs.
“Get to rank them on Google” - what?
Also, we don’t send press releases about vulnerabilities. There are cases where publications reach out to us and ask for comments when there are severe issues disclosed - but that’s very much different from the picture you’re trying to paint here.
Also, your “get a half decent host with a WAF” argument shows how disconnected you’re from the reality. There are web hosts that say they offer secure hosting when promoting free SSL. We’ve tested the web hosts with independent reviewers and what you’re claiming is a widespread myth that has been debunked: https://patchstack.com/articles/myth-of-secure-hosting-only-...
Most WordPress websites have been holding relatively low value. Most are marketing landing pages and blogs. So the biggest gain for hackers have been the access to server resources to host phishing pages, redirect traffic, inject SEO spam and to build botnets (used to orchestrate DDOS attacks etc).
Now, WordPress 7.0 was just launched where you can connect Anthropic, OpenAI and Google Gemini models to automate pretty much anything on the website. Powerful, but also puts a massive target on its back. The ROI of hacking a random WordPress site just skyrocketed.
We’ll see how this plays out. But if this gets popular and people will start connecting their AI API keys to the sites then the amount of attacks we see against WordPress sites will grow exponentially. There will be new attack vectors invented, more supply chain attacks and significantly more vulnerabilities found in plugins.
7966 vulnerabilities found, 33% unpatched when disclosed. 99.9% of those vulnerabilities are coming from third-party plugins/themes. Plugin developers really need to step up their security game.
I'm not a blockchain developer, nor am I by any means a blockchain or NFT expert (maybe I shouldn't be even talking about this), but I can't figure out why we need blockchain so bad for storing proof of digital assets..
As far as I've understood - NFTs anyways rely on off-blockchain infrastructure that you have to trust your assets to (i.e opensea hosting your picture on their decentralised storage). So isn't the 100% trust/transparency/integrity that you seek from blockchain already somewhat compromised? i.e maybe there's a catastrophic hardware error that wipes all servers where the pictures are stored, big oopsie, no backups.
Meanwhile having blockchain as a storage for ownership records make owning digital assets quite annoying actually. I need to first figure out how to get a wallet, then transfer USD to buy some CC, then potentially pay ridiculous fees to make the transaction and then wait for the transaction to go through. If I invest into NFTs and want to earn return, then probably at one point I need to pay all those fees again to get my USD back. Also there are so many steps where a small typo can ruin your day and also good luck getting your granny to do it. Oh, and all that computing power that is needed.
So... since I already need to trust off-blockchain entity to host my digital asset linked to the NFT, why can't I just trust them (or some other neutral party) to keep a public database of which assets are owned by which public keys. I would still have my wallet of my private keys and can verify my ownership all over the internet.
Maybe it would be a good alternative for NFTs that are for people who don't care about the blockchain and have no problem to trust a third-party organisation to keep track of ownership? In return, it would require less resources (as blockchain could be replaced with any SQL database really), transactions would be instant, fees could be fixed by the marketplace, payments could be made directly with USD or what ever currency. You can still prove your ownership around the web if you own the matching private key... and it's still as "CRYPTO" as NFTs.
Let's say I will make such marketplace. It is maintained by a democratic NGO (funded by marketplace fees) and the database of key/asset ownership is public, it's regularly publicly audited for integrity, etc (basically let's say it's trustworthy enough). Now you can upload any asset and connect ownership to a public key there. If you own the private key, then you can sell/trade, auction, etc the ownership of your item to someone else (just changing the public key who owns the asset on the DB). Would those assets be still as valuable as some of the NFTs are today? Would not using blockchain make these assets somehow less valuable? If the same art would be less valuable on such marketplace, that would open up an entire separate can of worms regarding what is actually creating the value then..
Anyways, I'm not trying to say that blockchain sucks and I wouldn't even have the expertise to make any such claims, but I'm having hard time to understand why do we trust a company to store our assets, but not to storage ownership logs/proof?
Why don't we have an alternative for people who don't have any problems with trusting someone for keeping the database of digital asset ownership. It would be a great alternative that would serve the exact same goal, but would be faster, greener, less expensive, etc.
Some things this non-profit will need to do, no matter how good their intentions:
- Block your account if the US imposes sanctions on your country.
- Delete the NFT you bought if there is a copyright dispute, maybe until such time that the dispute is resolved.
- Delete NFTs that offend the sensibilities, or not allow them in the first place.
- Take away your NFT if there is a dispute between you and the previous owner (if private transfers are even allowed).
Any of these things can happen today, or in 10 years. In other words, your ownership of your NFT is at the pleasure of something else. And remember, NFTs are totally useless - ownership is the only thing they do; they better do it right.
N billion people on this planet. X hundred thousand hodlers. X ten thousand actual active developers/whales/promoters.
Helps keep it in perspective.
> Why don't we have an alternative for people who don't have any problems with trusting someone for keeping the database of digital asset ownership.
Why do we even need a database? I can put a deed into my safe deposit box. I can show it to provide proof of ownership, but how often do I need to do that?
There are very few civilian documents that actually need to be in a database. Your next of kin, so the government can figure out what to do with your stuff. A few records to do with citizenship, identity, ownership of regulated things (cars, houses, certain chemicals and whatnot), taxation: the stuff of basic civilization and democratic society. And anyway, most of it shouldn’t be in a public database.
Pretty much everything else is contractual between private parties, who will want to keep physical copies; perhaps multiple copies, and while they might use databases as well, those aren’t the essential bit nor are they likely to be open to the public.
If you want a public record, you instagram the money transfer and paperwork.
“Their whole business model is to sign CVEs” - please don’t make up random stuff. We were invited to the CVE program and therefore have an obligation to assign CVEs.
“Get to rank them on Google” - what?
Also, we don’t send press releases about vulnerabilities. There are cases where publications reach out to us and ask for comments when there are severe issues disclosed - but that’s very much different from the picture you’re trying to paint here.
Also, your “get a half decent host with a WAF” argument shows how disconnected you’re from the reality. There are web hosts that say they offer secure hosting when promoting free SSL. We’ve tested the web hosts with independent reviewers and what you’re claiming is a widespread myth that has been debunked: https://patchstack.com/articles/myth-of-secure-hosting-only-...
reply