Things That Matter Most

Things That Matter Most

Introducing Secure Updates for WordPress

by 6 Comments

Skip to the announcement …

One of the earliest conversations I had in the WordPress community almost saw me immediately leave and never return. I’d released some code in a few plugins and was just finally starting to get ramped up as a (very sub-par) developer. I hung around on IRC, subscribed to the various mailing lists, and tried my hardest to learn, improve, and contribute. Then someone pointed out that I’d never internationalized my plugins. Then they proceeded to go on a rant about how any developer who didn’t internationalize their UI was doing a disservice to the community and was betraying their personal bias against and hatred towards non-English speakers. I was horrified. I came to the development world from marketing. I used Windows. I was very comfortable with graphical (often skeuomorphic) interfaces and could work my way around things easily with a mouse. I didn’t understand the command line. I barely understood code. It took me months (and several misfires) just to learn enough Subversion to get my plugins out in the first place. All of the tools for internationalizing a plugin were, at the time, heavy into a command line that I didn’t understand and couldn’t use. I took a break and, ironically, this experience is what started me blogging. My break let me get some distance and gave me the chance to connect with other developers who did understand the command line tools. They taught me things I didn’t know and I came back a much stronger dev. One of my most popular blog posts today is an old introduction I wrote for developers who wanted to use GUI tools to publish a WordPress plugin. Honestly, though, I wrote the walk through more to remind myself how to do things than anyone else … and that’s how I got started with most of my blogging work. A topic I’ve focused on more recently has been cryptography. More specifically, using cryptographic tools to ensure the integrity of various packages and messages. It’s a heady topic, and a lot of the tools available for end users are painfully focused on power users who fully understand command line utilities. I want to change this.

Code Signing

There’s been a lot of talk about the security of the WordPress updater. Primarily, the updater checks the MD5 hash of a package’s contents before proceeding to ensure its integrity, but that’s the only test it runs. Consider what might happen if a malicious party were able to somehow breach the WordPress.org update server and present their own download package. This could potentially inject malicious code onto more than a quarter of the Internet all at once! Considering such a breach has happened with a few plugins in the past, it’s not outside the realm of possibility. Now imagine if a hacker were able to drop themselves somehow between your server and the WordPress.org update system. Such an attacker could impersonate the updater and serve you whatever package they want. Your system wouldn’t know the difference. In the middle of last year, I said I was working on a solution to bring formal code signing to WordPress. I held off for a while because it looked like the WordPress community might bring this feature to core. That didn’t happen. So today, I’m proud to announce the release of DGXPCO: Digital Guarantees for eXplicitly Permitted Core Operations. This plugin integrates directly with the WordPress core updater and requires that any core package have a valid signature in order for installation. For the moment, I am personally signing the contents of every core package distribution and maintaining the collection of signatures in a separate repository that I serve through a secure CDN powered by Amazon Web Services. Every WordPress release includes both the core download fornew installations as well as “partial” upgrade packages for anyone coming from an older install. I’m signing all of these and keeping a record in one spot so that everything from new installs to partial minor updates to major updates can benefit from the added security of checking a signature. The signatures are leverage an Ed25519 public/private keypair and Libsodium to sign the files’ contents. I keep the private key offline, but have published the public key so everyone can keep an eye on things. This key will not change, and if anything is signed by a different key, you can be sure something is amiss. That public key, encoded in Hex, is 5d4c696e571307b4a47626ae0bf9a7a229403c46657b4a9e832fee47e253bc5b. Every commit to the release hashes repository is also signed with my personal PGP key so you can verify that I’m the one who added the new code.

Next Steps

Is this fool-proof? Probably not. It is, however, a huge step forward in terms of WordPress security. There’s quite a bit more we can do, and I want to outline some of my grand plan here. The first release of the plugin checks signatures upon update only, but WordPress will still tell you about an update even if the signature check fails. The next release will not even surface an update unless a signature is available. At the moment, this plugin only secures WordPress core updates. A future release will also secure plugin updates as well, in an opt-in fashion. I’ll start by securing my own plugins as a proof of concept, then allow for other developers to opt-in to the stronger security moving forward. Today, I am the only one allowed to sign release packages. This is OK for the short term, but is not a sustainable model. As I prove out the update system, I’ll also begin adding sets of public keys that are scoped to specific sets of packages. This will, for example, allow me to whitelist a small number of trusted developers to also sign core packages. It might also empower plugin developers to sign their own releases (but not anyone else’s). At the end of the day, I’m looking now for feedback. We don’t have this functionality in WordPress core yet, but DGXPCO is evidence that we can add it. We should add it. So let’s work on the feature together. As I mentioned in my initial post last year, if you want to help with this endeavor, please let me know! If you want to contribute financially,donations are always gladly accepted. This is the first project I’m launching under the name of my new WordPress-related business, Displace Technologies, LLC.

Open Letter to the Democratic Party of Washington County

by

Dear Washington County Dems,

I write to inform you of my resignation as a Precinct Committee Person (PCP) for Precinct 428, effective immediately.

Being elected to represent my precinct in 2016 was exciting. I was given opportunity to better connect with my neighbors and coordinate on policy recommendations with other Democrats in the county. Everyone was respectful, polite, and organized. I was incredibly dismayed when this proved to be a facade that quickly faded over the next several months.

Committee meetings quickly devolved to infighting. My formerly respectful peers were reduced to literally screaming at one another. The party of which I’ve been a member for over 16 years did not turn out to be the example of civility it’s claimed to be.

Our meetings purport to follow Robert’s Rules of Order but frequently depart from the rules and drag on as no one knows what to expect. Meetings are frequently filled with moral grandstanding and debates that turn into classist and ageist arguments rather than respectful discussions.

I will not continue sacrificing my time in service of a party that cannot respect one another.

On a national level, the party has also proven to be in decline. Democratic politicians speak with a level of arrogance and always presume the moral high ground. Even after being proven in the minority, they refuse to cooperate across party lines. An election that switches the alignment of the majority is a sign of constituent disappointment, not a call to resist.

While I will still vote for and donate to Democrats, it will be on the merits of their character; not their party affiliation. I cannot remain with a clear conscience as a member of this party.

This letter will be copied to the Washington County Clerk in accordance with ORS 248.024.

Sincerely,
Eric Mann

The Value of Repetition

by Leave a Comment

I took martial arts classes in college. They were a blast! Well, until the instructor decided I was his favorite demonstration tool and kept throwing me around the room to teach the class how to arrest falls.

Other than that, it was an exciting few terms of energetic classes and faux sparring with friends. One of the most memorable parts of the courses, though, were the forms we had to memorize.

These were patterns of moves that are used to judge skill and the level of expertise of the participant. Had I continued my studies past two terms of courses, I'm sure I would have learned many different forms as I progressed through the ranks.

Each form is a set pattern and is, at least among the lower levels, easy to memorize and repeat. For quite a while, practicing my forms became a daily routine. I'd repeat the same moves over and over again, turning them from a conscious effort at reproducing the pattern into subconscious muscle memory.

Repetition is the key to memorizing forms. It's the key to memorizing most anything, really.

Code Katas

Several developers have started cultivating a practice of completing daily or weekly code katas. These are specific challenges meant to test some of the more rudimentary skills developers need to hone to be good at their jobs.

This isn't to say that specific code katas are simple. Many are difficult and very challenging, but every one of them exercises the parts of our brains that solve coding problems on a daily basis. Practicing code katas regularly has the same effect on a developer as practicing forms does on a martial artist.

Converting something you need to think about into muscle memory.

Practice Makes Perfect

Whenever I see a coding interview, it usually involves a developer struggling to remember the correct boilerplate to bootstrap a project. Or searching for the correct argument order for a method in the language's standard library. Or re-deriving a common algorithm. Or … the list goes on.

But practicing these skills helps to perfect them. It gives you the ability to, from memory, bootstrap a method or an algorithm or design an interface. You've done this before, it's easier to do it again. It's easier still because you don't have to think, you can just do.

Practicing also helps you to learn and improve. Developers don't often have time available to refactor production code. But there's nothing that says you can't spend a few minutes each day practicing and rewriting a small component just for the sake of learning. You might even stumble upon an extra optimization that will make a difference in production.

Or you might just learn a new pattern that will save time and energy the next time you build a similar system.

The Value of Fiction

by Leave a Comment

I read a lot. By "a lot" I mean I read over 50 books in 2017. Some was fiction, some was non fiction, but all of it was enjoyable.

Every time I plow through a new book series, people stop to ask me why I bother with it at all. I read a fair amount of technical books, but I love to spend my time reading through various fiction stories as well. It's a bit of an escape for me, but definitely serves a greater purpose as well.

Fiction as an Analog

Almost everyone loves Star Wars. It's a great story that covers everything from action to philosophy to the hero's journey, with even a bit of romance thrown in. The original trilogy was groundbreaking filmmaking and has shaped the way many of us view movies ever since.

But one of the more brilliant elements of Star Wars was how it could be somewhat critical of world events without explicitly referencing world events.

The original trilogy features the evil Empire and their armies of stormtroopers bent on dominating the galaxy under a ruthless dictatorship. Without giving too much away for those who live under rocks and haven't seen it, when the Empire falls, we're left with a galaxy at peace for long into the future.

Until The Force Awakens, when we discover a new group has risen from the ashes of the Empire and is resurrecting the old ways to once again dominate the galaxy.

Consider that the Empire was less-than-loosely based on the history of Nazi Germany. Now consider what it would look like to have a new generation of people trying to follow in the footsteps of a defunct, evil dictatorship. Taking on their imagery, their names, their slogans, and trying to convince the world that said dictatorship was right in their worldview. That is the story of the new trilogy's "First Order."

And it's remarkably similar to contemporary veins of neo-fascists we're confronting in the real world today. Except, if you talk about current events, you'll likely end up in an argument. If you talk about Star Wars, well, you might still end up arguing, but about porgs rather than which side is the bad guys.

Creative Expansion

The value in having these somewhat abstracted conversations is that they stretch the bounds with which you can envision others' viewpoints. It's one thing to ask you to think from the perspective of someone who disagrees with you about something specific – say politics. It's another thing to try to describe the various leanings and motives of a political system you're not even a part of.

A (non-fiction) book I read a while back talked about this concept from the perspective of people studying religion. There are, ultimately, two groups: balconeers sitting in a balcony above a busy street and travelers walking on the street below.

The balconeers can overhear everything the travelers talk about. They can observe their behavior and opine on what's going on. They're onlookers; completely separated from the action but with a high-level view of everything and, possibly, an objective opinion on various matters the travelers are experiencing.

The travelers, on the other hand, are right in the fray. They have to decide where to go and when, and that decision matters to them. It determines where they sleep, if they get lost, when they get to eat, etc. They're intimately involved with a specific journey and can only see it from a subjective viewpoint.

We're all travelers in life. What we do, what we say, where we go – these all have ramifications for the outcomes of our lives. Fiction gives us the chance to be balconners observing someone else's travel and taking a higher, more objective view of things.

But the true value in fiction is when we draw parallels between the travelers in a story and ourselves as travelers in life. We can begin to apply the detached, objective view we gained as an onlooker to a more involved, subjective situation in our day-to-day.

Creative fiction gives us the ability to expand the conversation and view situations from viewpoints that would otherwise have been hidden from us. It's a very valuable tool, and one I treasure.

Software Vulnerabilities, Disclosure, and Marketing

by Leave a Comment

When news about Heartbleed broke, many in the security community rolled their eyes. Not at the bug or the potential attack surface it exposed, but the fact that a software bug had a name, a logo, and its own website.

Most documented bugs are cataloged already with a CVE number and detailed technical description. That this bug required its own branding seemed ridiculous and, since then, has heralded the age where just about every bug disclosure requires a marketing effort.

But it's not actually a bad thing.

Consumer Awareness

Just before Heartbleed broke, another critical security bug had been discovered in Apple's products. Now known as "goto fail," this was a coding mistake in Apple's TLS implementation that allowed a potential attacker to trick a computer into skipping verification of certificates.

As a developer, I understand how easy this kind of mistake can be. It also yielded several rounds of updates to various best practices documents to help developers avoid exactly this kind of error in the future. As a developer, I also saw easily how a bug like this could be exploited.

In fact, I learned about the bug when a friend demonstrated against my machine how it could be used to bypass proper security checks. I immediately encouraged everyone to update their systems to apply the patch.

Not everyone listened.

Consumers have a certain amount of upgrade fatigue. They're bombarded with application, OS, and other updates on an almost daily basis. Many of these updates either add unwanted features, remove heavily used ones, or break expected functionality entirely. It's not uncommon for end users to ignore an update notification for months to avoid the frustration that comes with trying to fix something that worked before the update.

The patch for "goto fail" was one such update. A couple of friends of mine – who happen to be fairly tech savvy on their own – ignored the update. It didn't make sense and the last update for their computers had broken some of the apps they used for work. Why upgrade?

Over coffee, they explained how they'd seen my "please update" email and, though they respected my opinion, couldn't risk their workday productivity. They did, however, want to know how much of an impact Heartbleed would have. Why hadn't I told them to patch that bug? Could I upgrade their machines in the cafe?

Heartbleed affects servers. Goto fail affects consumer desktops/laptops and phones. One had branding, one did not. Consumers were more aware of the one that hand branding – the one that didn't affect the machines for which they are directly responsible.

Why Marketing?

Heartbleed was fixed almost immediately. The more recently disclosed Meltdown and Spectre bugs also had patches available for most systems almost immediately. Apple's latest #iamroot bug had a patch deployed the same day as the disclosure – then another patch the next day to fix the new bugs introduced by the previous one.

As laughable as it might be from a security engineering perspective, good marketing around an exploit is vital to getting it addressed in a timely manner. I'm personally aware of several critical bugs that have gone unpatched for years because the development team thinks no one cares.

Every time I show someone a proof-of-concept exploit against a known issue, they can't believe it hasn't been fixed. When I point out the age of the first disclosure (usually a blog post heavily criticized for not contacting security@wherever directly), they shake their heads in frustration.

Still, until we as developers can get better at not breaking things when we release an update, consumers won't fully trust us with silent, background upgrades. Software should always be a transparent aid to the end user, not a cumbersome tool non-developers need to maintain.

Private Variables in JavaScript

by Leave a Comment

I love writing in JavaScript. It's a flexible, dynamic language with a lot of nifty features and a great, evented runtime. JS gets a bad rep because of how often people use it poorly, and I think that's a very deserved reputation. Still, it's fun to work with and one of the first tools I reach for when fleshing out a quick proof-of-concept in code.

Working on larger codebases, however, means I want to have a prettier setup. I configure Babel so I can write the latest, greatest version of JS and have it automatically transpiled to work with older engines. I lint my code. I configure specific types for data encapsulation and force strict typing.

This all results in clean, maintainable, (usually) highly-documented libraries for my personal use and for work. However, there's one feature I'm used to in other languages that's missing in JS.

Privacy.

JavaScript Classes

ECMAScript 2015 (aka ES6) introduced classes to JavaScript. Older versions of the language would allow you to define an object type directly using function constructors, but didn't truly support object-oriented inheritance the way developers are used to.

Part of this is due to the fact that JavaScript is a prototypal language, not an object-oriented language. Or at least older versions weren't.

ES6 gave us classes with proper constructors, methods, properties, and inheritance. Instead of defining a rough object-like function in old-school JS:



function Rect(height, width) {

  this.height = height;

  this.width = width;

}

You could define a real class in ES6 and reuse it the same way you would a type in any other language:



class Rectangle {

  constructor(height, width) {

    this.height = height;

    this.width = width;

  }

}

The biggest unfortunate element of this class definition, though, is that there are no privacy modifiers. The constructor, methods, and properties of a JS class are all public by default. There's no nature of a protected method or a private property. At all.

A First Attempt

At one point in time, though, I discovered a quirky artifact of the way ES6 modules are defined. If it's not exposed directly, any "global" function or variable is really private to the module itself! The following code, for example, would expose a client instance for use elsewhere, but keep a database handle private.



let db = null;



class Client {

  constructor(dbHandle) {

    db = dbHandle

  }



  doQuery(query) {

    db.exec(query)

  }

}

The db variable inside this module is completely inaccessible to any code outside the module, yet it allows us to keep track of our database handle directly. This is exactly what we want, right?

Nope.

Since it's outside the class definition, this variable is treated as a static property. Yes, it's private to our module, but there's only one copy available. If we make multiple instances of our Client above, we'll overwrite db each time; the last instantiation will win and define the database handle used by all of the instances.

That's not what we want at all.

A Hacky Solution

While we don't necessarily want a shared database handle, the idea of a private, static property in our class definition does give us something to work with. Instead of defining our private properties directly within the module, we can define a container to house them and access it instead.



let container = {}



class Client {

  constructor(dbHandle) {

    this._id = Math.random().toString(36).substr(2, 9)

    container[this._id] = {}

    container[this._id].db = dbHandle

  }



  doQuery(query) {

    let db = container[this._id].db

    db.exec(query)

  }

}

Now, the container is a shared object between instances of our class. Instances can then look up their own "private" properties housed within this container and use them during runtime.

The biggest drawbacks of this approach are:

  • The syntax isn't the prettiest
  • Every instance can, really, access the "private" data of any other instance of the class
  • JavaScript doesn't feature the notion of class destructors, so you'll have to implement your own garbage collection routine to clean up and stored data when a class is destroyed

What other solutions have you implemented for class privacy in JavaScript?