Someone Bought 30 WordPress Plugins and Planted a Backdoor in All of Them

Re:Someone Bought 30 WordPress Plugins and Planted a Backdoo... by thrance on Monday April 13, 2026 @04:56PM (#47757707)

I've been toying with the idea of a language whose packages have to declare which "permissions" they require (file io, network access, shell...) and devs have to specify which permissions they give to their dependencies.

[ Parent | on HN ]

Re:Someone Bought 30 WordPress Plugins and Planted a Backdoo... by xmcqdpt2 on Tuesday April 14, 2026 @07:39AM (#47764285)

Java has Security Managers. I've never seen anyone use it in practice though, so it probably doesn't work very well.

I think it would be hard to get any kind of usable capability system without algebraic effects like those of Koka or Scala libraries.

EDIT: Apparently Security Managers are deprecated and slated for removal.

[ Parent | on HN ]