News for hackers. Stuff that matters.
Re:WordPress themes, plugins backdoored in supply chain attack by john-doe on Sunday January 23, 2022 @03:53AM (#30044683)
> The attack was discovered by researchers at Jetpack, the creators of a security and optimization tool for WordPress sites.

It’s a deceitful way to present it. Jetpack and WordPress are the same company.

Re:WordPress themes, plugins backdoored in supply chain attack by withinboredom on Sunday January 23, 2022 @04:15AM (#30044766)
That’s simply not true. Jetpack is owned by Automattic. Automattic has an exclusive license to the name “WordPress” from the WordPress Foundation but WordPress is owned, operated, and managed by the WordPress Foundation and is a totally separate entity.

Source: I work at Automattic and used to work on a Jetpack team.

Re:WordPress themes, plugins backdoored in supply chain attack by freebreakfast on Sunday January 23, 2022 @12:43PM (#30048297)
This is true, but it's also important to note that Matt Mullenweg founded/co-founded and leads both organizations.[0][1]

0. https://www.linkedin.com/in/mattm/

1. https://www.guidestar.org/profile/20-5498932

Re:WordPress themes, plugins backdoored in supply chain attack by john-doe on Sunday January 23, 2022 @05:24AM (#30045072)
Thanks for the clarification, it's not that easy to understand when one looks at the Automattic website.
Re:WordPress themes, plugins backdoored in supply chain attack by monkey_monkey on Sunday January 23, 2022 @04:14AM (#30044761)
It's not deceitful at all. Anyone who's in the WP ecosystem understands this.

Jetpack is part of Automattic. Automattic's main thing is wordpress.com (the hosted platform). Automattic and WP.org are not the same thing even though ( as with many open source projects that have commercial implications) the lines are somewhat blurred.

Presenting this as "deceitful" is really quite the over-reaction.

Re:WordPress themes, plugins backdoored in supply chain attack by john-doe on Sunday January 23, 2022 @08:30AM (#30045999)
If the lines are somewhat blurred, you can understand my initial confusion, not being “in the WP ecosystem” myself.
Re:WordPress themes, plugins backdoored in supply chain attack by monkey_monkey on Sunday January 23, 2022 @11:41AM (#30047584)
Sure. but perhaps think about the use of emotive words like "deceitful" when you don't fully understand what's going on?
Re:WordPress themes, plugins backdoored in supply chain attack by john-doe on Sunday January 23, 2022 @04:59PM (#30050925)
English as third language, so let’s say I didn’t realise it was such a strong word.
Re:WordPress themes, plugins backdoored in supply chain attack by Kye on Sunday January 23, 2022 @05:02PM (#30050954)
English is a mess.

Deceitful implies intention. Qualifiers help. "Unintentionally misleading" fits better. It's like the difference between manslaughter (whoopsiedeath) and murder (intentional).

Re:WordPress themes, plugins backdoored in supply chain attack by kjs3 on Sunday January 23, 2022 @05:41PM (#30051299)
You have to understand that this sort of intentional obfuscation of ownership and responsibility under a single root of ownership is in most areas of business a pretty good indication of ill intent (even if it is depressingly common).