Hey, welcome back to Community & Code.
I'm your host, Chris Reynolds.
And have you ever talked to a real
live hacker?
When I was a teenager,
I loved reading articles about the early
days of hacking,
even when I was just a little bit
too late and maybe a little too
intimidated to try most of the actual
techniques myself.
Still the terms war-driving and
phone-freaking ring in my ears with a
nostalgia for the wild,
weird days of the early internet.
start in
information security as a result of
following in the footsteps of the
legendary early pioneers of computer
hacking.
His current company, Mela Press,
pays homage to his Maltese heritage.
Mela can mean yes, no, and maybe,
depending on the context.
And its founder, Robert Abella,
shares a name with the Prime Minister of
Malta,
which means he occasionally catches strays
from CNN or the BBC on X for
things that he distinctly did not do.
We talk about Melapress,
which focuses on security plugins that
compliment the other solutions that are
out there, things like activity logs,
two-factor auth, and login policies.
And we talk about what security actually
looks like for WordPress when it occupies
forty-three percent of the web.
Who's really responsible when things go
wrong,
how AI is making phishing attacks more
convincing than ever,
and whether the WordPress.org plugin
repository has kept pace with the platform
that it serves.
Without further ado, Robert Abella.
Welcome to Community & Code,
the podcast where we talk to the human
beings behind the commits.
I'm here today with Robert Abella,
the CER and founder of Mela Press.
Robert,
welcome to the show and tell us about
yourself.
Thank you very much for having me for
the invites.
Yeah,
I'm a bit about myself as a person.
I'm not the professional life.
I'm Maltese.
I'm originally from Malta.
I live in the Netherlands.
I've been living in the Netherlands for
the last seven years.
I've lived in a number of countries in
Europe.
I'm married.
I have two children.
And basically,
WordPress years ago was my hobby.
And now it became my full time the
last few years.
Well,
I want to talk about what you do,
but before you even get into that,
I was looking at the website for Melapress
and I feel like I want to give
you the opportunity to talk about the name
because there's a whole page that's about
the name Melapress.
What is the vibe of Melapress just as
a company,
but also where does the name come from?
Very good.
Originally,
the name was WP White Security because we
develop a number of security plugins.
However, we don't develop the typical,
you know, like firewall and the malware,
etc.
We develop like logs to authentication
hard link and similar stuff.
So whenever we started...
sponsoring word camps and similar stuff a
lot of people were coming up to us
especially those who don't know about us
like how do you compare yourself to you
know world fans sukuri because this so it
was yeah it was a bit frustrating because
even though we do security we don't do
that type of security actually our
products complement those services not we
don't compete with them also the name was
a bit too long wp white security so
yeah so we started um the rebrand it
was quite difficult to find the name i
wanted
as i said i'm originally from malta so
i wanted to yeah put something from malta
or at least my language there uh we
tried different things because we have a
lot of words which are kind of like
simple can be easily read
um by english people and non-english
native speakers because sometimes
especially because english and the way
they pronounce some words it was difficult
to find the right words and we even
paid a number of companies i think towards
the companies where they suggest names and
we just couldn't get about it and then
i was talking back then to a colleague
of mine joel who was who is maltese
as well um
And yeah, I said something like, yeah,
Mela, Mela.
Because we use Mela as a Maltese word.
It's very difficult for foreigners to get,
because depending on the tone,
especially when your mother uses it,
it means either yes, no, or maybe.
So it's really difficult.
It's pretty much the whole spectrum right
there.
Yes, it's like when someone does,
you know, it's like, is it a yes?
Is it a no?
It's something very similar.
So it depends on the pronunciation,
how you pronounce it.
And the tone is like, okay,
it can mean a lot of things.
And yeah, it fits in really well.
Like, okay, and just,
so we wasted a bit of money paying
companies and just it came over
discussion.
So yeah, that's the origin of the name.
So there's a piece of Maltese in the
name.
It's often confused because, of course,
we are close to Italy.
Mela in Italian is Mela, which is apple.
So many people think it's apple.
But no, it's actually...
It's a Maltese word.
And in terms of company... I mean,
Apple Press isn't that bad either.
True.
Is there a company?
No, I don't think so.
Well, it's been Mela Press.
Yeah.
If you're Italian, it means Apple Press.
Yeah.
Yeah, no,
one of the hardest things in software
engineering, right, is naming things.
And finding a name that is easy for
English speakers to pronounce,
it just reminds me of, what was it,
last year when the
the agency imp side renamed or imp seed
uh renamed to just seed uh which is
spelled s-y-d-e which still i think is
problematic because i think half half the
world is going to read that as side
um but like that was the same thing
and they had a they had a really
funny video um as they were as they
were rebranding
where they I think they were actually even
asking all of their employees how they
pronounce it and everybody had a different
pronunciation.
So like even internally in the company,
they couldn't pronounce it.
So yes,
settling on something that is easy to
pronounce is probably a key thing in
developing any sort of product.
yes it's it's very difficult because even
once you start reading about you know like
brand names and stuff there are so many
um hints like try to for example come
up with a name that starts with a
so when there's a whenever there's a
listing of companies you're always you
know all these type of optimization but
yeah you can only go so far and
there are there are so many companies out
there and and trying to find something
that sounds like a
okay well okay to pronounce um and yeah
and that fits and that works with everyone
it's quite difficult you know it's about
pronunciation it's about the length a lot
of stuff so and there are so many
companies out there so you have to find
something unique which is it's very
difficult it can take a few it took
us a few months actually
Yeah, yeah.
We'll talk about what Melapress actually
does,
especially since you noted that it doesn't
do security for WordPress in the way that
most people consider WordPress security
sort of plugins or platforms or whatever.
So like, what is it that,
what solution are you providing?
Yes,
typically when people talk about security,
they think of either hardening,
like hardening the website,
some sort of protection, firewalls,
or some type of scanning,
or anti-malware cleaning, et cetera.
We do none of that.
Our flagship product is WP Activity Log,
which basically keeps a log of what logged
in users are doing on your website.
Someone installed a plugin,
someone changed some content, et cetera.
We also have WP-to-FA,
which is a plugin that allows you to
enforce.
It is a sort of hiding,
but you know, the typical firewall.
It allows you to enforce authentication,
even pass keys and similar stuff.
So it's login hardening.
And we have Malapress Login Security,
which allows you to configure a number of
login security policies.
It's not just about the failed login,
but also a number of things.
For example,
you can control or configure policies to
limit when users can log in,
range of time or which dates,
by user role,
use specific number of machines.
So when they try to use a new
machine, they are alerted.
You know,
a lot of these kind of like helping
users.
And the reason why we went that way,
because...
First of all,
we started with activity log years ago.
But also, the more time passes,
the more I'm realizing.
Last week, I was at CloudFest.
And most of these presentations,
that's what they were talking about.
Unfortunately, it's becoming way easier
If you want to hack someone,
it's becoming way easier going through
their users.
It's becoming more difficult to exploit
technical vulnerabilities,
trying to bypass a firewall and stuff like
that.
And because we are using more and more
AI,
it seems like the cognitive abilities of
users are lowered nowadays.
So it's much easier to launch a phishing
attack and all this stuff.
So hopefully, with using two FA,
maybe a bit more login policies and stuff
like that,
you and training the users and helping the
users
get alerted when a new machine is used
or the user was used somewhere else.
Yeah,
that hopefully hardens that part of
WordPress security as well.
Yeah.
Well,
and multi-factor authentication is
crucial, right?
Especially, like,
since there are so many databases out
there now, like, you know,
it used to be, like,
every other week or at least once a
month there would be some new
vulnerability disclosure that, like,
there's a database of, like,
fifty thousand two million different
username and passwords that were scraped
from some, you know,
Google or like some ridiculously large
company and all that.
And and because people reuse passwords,
then like if you're on a list somewhere
like I mean,
I it's impossible to follow it.
Right.
It's like I can't even I can't even
worry about my my email address being on
a list like that because there's so like
obviously it's out there.
I can only worry about like
making sure that like my passwords are
secure,
that I'm using two factor authentication
so that when somebody does inevitably find
my email address on the list,
the password they get isn't matching with
the password that I'm using on an actually
important site.
exactly yeah i mean if if i don't
know if you've ever heard of the website
have i been punt oh yeah um if
you subscribe to that one you receive
quite a few alerts because yeah there are
i think you find data leakages almost on
a daily there are data leakages almost on
a daily basis so it's quite um frustrating
then of course um ideally you shouldn't
use the same passwords for different
websites that's why there are password
managers but yeah of course to fba
eases that process so yeah even if you
use the same password at least yeah the
the attackers if they guess your password
they cannot log in because they need one
time code either from your email address
or from your mobile device etc so yeah
in terms of credentials yeah as you said
like you'll find your email address almost
nowadays in a lot of lists it's funny
talking about heaven being point because
and because we're talking about fishing
etc uh that website is maintained by troy
hunt he's a very popular infrastructure
researcher it's funny talking about at
texas because last year he has a blog
post about it in fact
He was a victim of a phishing attack,
and his MailChimp list was stolen.
So it's a bit.
A security speaker at CloudFest had this
really funny comment, because he said,
with AI especially,
Phishing attacks are becoming so good,
they actually look better than the
legitimate emails.
So it can happen to the best of
us.
You can be Troy Hunt and it can
still happen to you.
Yeah, I met Troy many, many,
many years ago.
Back in the day,
I was doing online developer training
courses for Pluralsight.
And Troy was also doing courses for
Pluralsight and all of his stuff was on
security.
And so Pluralsight held these sort of
author summits.
So they get all the Pluralsight authors to
hang out and talk to each other and
compare notes and stuff.
And so I've met him.
And one of the things I remember,
he did a presentation and he put like
a Wi-Fi like router in the room and
basically like
The idea was to see how much data
he could get by people just jumping onto
a freely available Wi-Fi node and then
showed it in the demo.
And this is all the information that I
got from your computer because you just
happened to jump on this free Wi-Fi that
is like,
that I put here for this purpose that
looks legitimate, but is actually not.
Yeah.
And then that was about the time when
he, when he had actually even launched,
have I been an opponent?
So, yeah, well, very, very big fan of,
of Troy's work over the years.
But what, so,
so have you always been interested in sort
of the security side of,
of web development or what sort of brought
you to the point at which you decided
that, that this product, this set of,
plug into whatever that you're building
with MeloPress is the thing that you want
to be doing.
I've always been into security.
Before working with WordPress,
which I started thirteen years ago,
in my previous career,
I worked fourteen years for a number of
different startups,
and they were all security startups.
Security software startups.
I had a different number of roles.
I started as a software tester,
systems engineer, product management.
I was never a developer.
I can write a bit of code.
I used to write, of course,
when I was systems engineer,
a lot of bash scripts and try to
automate all this stuff.
So I have an idea,
a good concept of these things.
But yeah,
since I worked always with security
software companies and startups,
Yeah,
it's what I heard for fourteen years
about, you know, like security,
what can happen, etc.
So it's a field I know very well,
basically.
And most of my friends,
some of my friends,
which I still have from back in those
days, they also have security.
For example, a friend of mine, Sandra,
has a penetration testing company.
So, yeah,
I'm always surrounded with security.
It's something I've done from day one,
basically.
um so yeah that that's where the security
is coming from in fact we jumped i
jumped into wordpress because the last
full-time job i had we needed a blog
um it was this was um um years
ago we needed a blog we started looking
i've learned about wordpress and back then
wordpress yeah there were
security was still very weak.
It's not the core, it's always the same,
you know, like the reputation it had,
et cetera.
But there weren't a lot of security
solutions either.
In fact, I remember Sucuri starting,
you know, back then it was,
they just used to do free scans,
like an Nmap scan and stuff like that.
And, yeah, we tried to,
because it was a security company already,
we used to develop a web vulnerability
scanner.
We tried to develop a SaaS for WordPress
back then, a security file monitoring,
et cetera.
It was a bit of a flop.
Nothing with the technology,
it's just the way we managed it,
et cetera.
And anyway,
then it was time I was working for
fourteen years for four different software
companies,
but always the same founder and CEO.
I worked with him at Chetra through my
career and it was time to move on.
And anyway, just after fourteen years,
I started my own thing because we just
started working a lot with WordPress,
even through my previous full time job.
I met a few friends from WordPress and
yeah, it just became,
it's something I liked, you know,
I really liked it.
So yeah,
security is coming since day one I started
working in IT just because mostly I've
worked with security software companies.
What brought you into security to sort of
begin with?
Like where did that sort of interest
develop?
It's...
This started when I was nineteen years
old.
Back then it was different, of course.
Hacking is still cool.
Back then it was a bit,
in my opinion, it was cooler.
Nowadays,
I was just at the Cloud Fest capture
the flag.
uh the winning team i think within they
they uh captured the flag in nine
challenges in all the nine challenges
within eighteen minutes because all they
did spend ten minutes set up the ai
net framework and then the rest just was
just automated so it's nice from
technology point of view but it's not fun
back then i remember in my early days
i used to go with my friend you
know like world driving capturing wi-fi
packets and stuff it was much different
you know we also had this hack with
um
There used to be more of these public
phones where you had internet access if
you used a telecard.
But a friend of mine found a bypass
without the card.
Just like scanning for open ports,
you try to use netcat and all this
stuff.
So back then, it was much more different.
so yes um when i was a gfi
when i became systems engineer as i said
it was a security software company so we
always was this learning a lot about
security but then i was i was sharing
an office with sandra this friend of mine
and who was the security engineer for gfi
back then so
nine ten hours a day just talking about
security um was helping me back then you
know like configuring the firewalls the
routers and all this stuff and learning
about back then dmz and all this stuff
so yeah of course then that's the potato
but it's it's it's something that's very
interesting uh it's much more interesting
than just systems engineering and yeah
it's just also
what the companies I worked for were doing
in security.
So it's just,
I literally always been in this,
since I was nineteen,
I've always worked in this field in
security.
Yeah,
I remember being a nerd in the nineties
and early, early two thousands.
And I never,
I never did all of the cool old
school analog hacking things that I read
about.
But I do remember reading about the things
where like,
like the whatever device that you get that
you can,
that like simulates the sound that a coin
makes in a pay phone so that you
can steal the, and then like,
like being able to like rig up like,
Off of that,
connect it to a modem and then use
that to dial up.
There's no...
Kids these days will never understand the
amount of ingenuity that goes into all of
the really old school analog...
hacking, which is actually like literal,
like not hacking on the computer,
but like with hardware devices that you
had to like physically hold in your hand
and go to actual like places in the
world,
not just from behind a laptop screen.
That telephone thing you're mentioning,
if I'm not mistaken,
it used to be a whistle with some
Syrian America, Captain Crunch, I think.
And if you blow this whistle on a
public telephone,
it used to have this specific tone and
the...
center, whatever it's called,
the switchboard switch center.
I used to hear this tone and detect
it as something.
So yeah, it used to root.
I forgot how it is exactly, but yeah,
it was much different back then.
And in fact, I just found,
because I was just cleaning,
a bit of spring cleaning,
I found the book.
I have...
book behind the wires from kevin mitnick
uh signed it's and i remember reading
those stories like when you read if most
probably young people some might know who
kevin mitnick is if you don't know who
he is find his book goes behind the
wires amazing story so basically kevin
mitnick is the first
popular mainstream hacker, basically.
And yeah, he spent, after he was hacking,
he spent a number of years,
I don't know how much exactly, I forgot,
five, six, or four years, I don't know,
with the FBI following him,
and he was tracing the FBI,
so he was always a step ahead of
them.
And this story is amazing.
Ghost in the Wires is definitely a
must-read, and as you said,
it will at least will give
hackers of today a bit of an understanding
how different it was back then because
nowadays it's just yeah automation i mean
there's still some development and skills
in it but back then it was much
more much more fun much more interesting
at least in my opinion
Yeah, well,
I feel like right now you get more
mileage out of social engineering.
You get more mileage out of deep fakes
or convincing someone to willingly hand
over information rather than actually
using any sort of brute force methods to
infiltrate a system anymore.
Yeah.
Yes.
People are not aware of these things until
it is there.
It's not the first time.
I try it just for fun.
For example, I don't know.
I walk into a supermarket.
You see some employees walking into some
office.
You know,
there's this sign and stuff only.
And you walk behind them like, oh, sorry,
can I watch it?
And no one asks questions like,
why are you coming in?
It's just they're so used, you know,
like because you're being nice.
Oh, yes, come in.
You know,
like people are not aware about these
things.
So it's very...
It's very easy.
It's still very easy to,
I don't know if it's coming from because
of politeness,
but also as someone said at CloudFest,
also because of the, we are,
especially people working in IT,
we are relying so much on AI that
our cognitive abilities are being lowered
because, so yeah,
people need training about, yeah,
what's social engineering,
what type of issues there can be.
I remember, again,
back in my early twenties,
We used to, in Malta,
there is this ferry between Malta and
Gozo, two islands.
And yeah, it was,
and most probably even nowadays,
it was so easy to go down to
the engine room.
No one asks you anything,
especially if you just buy a high
visibility vest, just put it on,
hang any type of id and just walk
in no one no one will even ask
you anything there are some youtube videos
actually about this there are some people
which just get by a high-visibility vest a
helmet and a leather and they just walk
into offices and see what they can do
and
There are some cases where they are
stopped, but the majority,
they just walk in and no one questions
them.
It's amazing.
Yeah, for sure.
Well,
from the perspective of an old school
hacker and from the perspective of
somebody who's been working in security
for a long time, I know that like...
the thing that everybody from the outside
of the wordpress community always sees or
hears when they think about wordpress or
they hear stories about wordpress and even
even in cloudflare's announcement of their
new cms mdash they mentioned they talk
about like oh
The security is a problem or specifically
like security of WordPress plugins are a
fundamental problem in the security of
WordPress as a whole.
So I'm interested to hear what your sort
of take on or perspective is on WordPress
security since like you've kind of you've
been outside of that system.
Now you're working within WordPress and
making security things for WordPress.
Yes, unfortunately,
there are a number of factors which give
WordPress this really bad reputation.
First of all, even to this day,
whenever I speak to people outside the
WordPress community, the security people,
they do look down on WordPress.
Like, oh, it's just a script kitty,
just some hobbyist application.
A few months ago,
I was talking to a recruiter.
Because we're looking for people.
And he asked me,
are there full-time businesses working
with WordPress?
Yeah, duh, of course there are.
Anyway,
but I think the reputation is coming.
Yes, back in the early days,
WordPress had a number of...
core vulnerabilities.
By the way, it's not unique to WordPress.
Every other software,
especially in the early years,
they have these vulnerabilities,
which is nice because, of course,
you can look at it differently.
You can look at it like, say, oh,
that software had a lot of
vulnerabilities, so it's insecure.
Or you can look at it,
every vulnerability that's found and
reported and fixed,
that software is becoming more and more
secure.
So every software has to go to that
phase where they find the number of MLTs
and then becomes more secure.
Even our plugins,
even all the top plugins,
look at all the top plugins, Yoast,
WooCommerce,
they all had their fair share,
which is normal.
So I think the reputation is coming from
there.
Secondly, the media doesn't help.
Matt Mullenweg mentioned it.
He wrote something about M-Dash.
And yes, like unfortunately,
when there's a vulnerability in a plugin
that is installed on zero point zero one
percent of the websites,
we start seeing the media, emails,
even some vendors like two hundred
thousand websites vulnerable to.
So that doesn't help.
So people, of course,
have this impression.
Last but not least, yes,
everyone can develop plugins.
Now, the problem which I see,
like people put all the plugins,
WordPress core in one box,
but they're not.
I mean, you have a number of plugins,
a small percentage of plugins,
which are maintained by commercial
companies.
It's not always perfect,
but they will always have issues.
But yeah, there's someone behind them.
They are being maintained.
Of course, they will have vulnerabilities,
but they are being fixed.
But then, of course,
you have a number of plugins
that are from hobbyists or maybe for
someone who's still learning and they have
security issues.
And unfortunately they are never
maintained.
I think PatchSec, not last year,
the year before,
or last year,
they had a hackathon and I don't know
how many vulnerabilities they found,
but because of these issues,
two thousand plugins were closed on the
repository because when the repository
tried to find the authors,
they never got back to them.
So you have to close them.
And then of course,
these stories are used for marketing,
but they are sensationalized sometimes.
and people don't read how many good
plugins are people read oh two thousand
plugins were closed oh uh especially
nowadays with vibe coding uh i think
oliver from page tech just posted in in
feb in march they received uh two thousand
vulnerabilities uh reports about two
thousand varieties um they still have to
check them at chat and verify them but
yeah like unfortunately the bad news are
still are used
Right.
So sometimes for marketing,
but sometimes are sensationalized.
And these, they don't have the WordPress.
Even like, as I said,
like whenever there is a vulnerability,
you receive all these newsletters,
like three hundred thousand websites.
In regards to comparison to Amdash,
because Amdash mentioned that they're
going to
The plugins will be sandboxed, et cetera.
Matt mentioned, looked at it differently.
He said the fact that,
I'm going to butcher it roughly,
but the fact that plugins can change every
feature of every functionality of
WordPress,
that's actually a feature because you give
them so much.
I think it really depends on things.
I mean, if you know what you're doing,
and use reliable plugins.
Yeah, it's not an issue.
Of course, by design,
especially if you try to compare WordPress
to an operating system, like Linux, etc.
Yes, you have permissions and sandbox,
but
We're talking about a CMS to run a
website, not an operating system.
So personally,
are there things that can be improved?
Some things, but in general,
it's always like core at this stage is
very, very secure.
Many plugins nowadays are developed by
seasoned developers.
There are seasoned companies.
that's been around for a few years they
have the experience so if you use the
right plugins and uh do the right research
use the right plugins and keep your
software up to date in general you're
pretty much safe however as i said people
are uh there are six thousand plugins
Guaranteed,
some of them are insecure or have some
security issues.
And whenever one of these have an issue,
yeah, the media essentially manages that.
So, of course,
we are getting that impression.
By the way,
it's very important to point out,
this is not just an issue with WordPress.
Every software guaranteed has
vulnerabilities.
It's not a question of who doesn't have,
it's a question of when they will be
found.
So...
But the media, unfortunately,
gives that impression.
And those outside WordPress look at
WordPress like, oh,
it's a hobbyist script.
Someone's a few scripts and running this.
So it's not that secure.
Yeah, I mean,
the thing that occurs to me about that
whole thing really is, like, I mean,
I've been interested in and involved in
open source for, I don't know,
twenty-ish years, right?
So, like, and, like, before WordPress,
it was other things, and I was, like,
you know, looking at, like,
and using Linux, and, you know, the size,
the more people that use a particular
piece of software,
particularly a piece of open source
software, the more eyes there are on it,
which means when you have more eyes on
a thing,
then it's more likely to actually get
fixed than if you have not as many.
And the other thing that occurs to me
is no one says don't use Microsoft Windows
because you need to run mcafee on it
or something you know like yeah like
windows had lots of viruses and bugs and
like you know exploits and and and that
was the operating system of every business
industry like every everyone was using
windows or windows like long past when
they should have been using those
operating systems and like
there, I mean, it's, it's, I remember how,
like, I used to work in,
I used to do tech support for,
for a grocery chain, and we had,
we had,
it was when we were rolling out, like,
the self-checkouts and things, and, and,
like, photo kiosks and stuff,
and they all ran, like,
Windows
I think the version that was modern then
was, like, probably Vista or whatever,
maybe Windows seven or something.
But, like...
It was just because it was easy to
write Windows ninety five or Windows
ninety eight software,
and that was just like what they had
licenses for or whatever.
But like and like arguably,
it's probably a problem that a point of
sale system is running an outdated
operating system because it wouldn't be
that hard to like they're connected to the
Internet, they're connected to wireless,
they're connected to the network in the in
the store like you could get into it
like, you know,
like these are things that actually run
things where there's a cash payment system
attached to the actual physical device,
right?
And those are far more impactful than
someone's website.
Yeah.
It's still an issue nowadays, by the way.
You can find a lot of articles where
they explain how especially main big
frameworks,
especially in the banking system,
because of some old software,
they still use some old versions of
Windows or Linux, et cetera,
and they cannot update.
And it's funny.
I remember this meme quite a few years
ago,
like someone laughing from behind the
curtains.
And it's like the devil...
laughing from behind the curtain the idea
is like because banks are all the time
imposing all these compliance regulations
and stuff and then when you look at
this their networks because of some old
software they cannot upgrade so their
networks is their networks are much more
insecure than all the software out there
so yeah it it is still a common
issue and i agree with you no one
says don't use windows and windows has and
still has a fair share of issues quite
frankly um but yeah it's it's just
I don't know.
I think maybe WordPress is picked on
because, as I said,
the news in general doesn't help.
We really sensationalize it.
Yes,
can there be improvements in the way
plugins interface with the core?
Can you maybe segregate that in a way?
Yes, there can be ways,
but it also depends on how you use
it.
I think one of the biggest...
I have always said that one of the
biggest issues with WordPress is...
is the fact that it's easy to use.
As in, it's a bit of a ..
As in,
the fact that it's easy to use is
what made it popular, which is great.
And so it truly democratizes publishing.
However, also, when it's easy to use,
you have a lot of people who start
their own website.
And yeah, they have no idea.
Maybe, I don't know, you're a baker,
and you have your own small business,
and you want to set up a website.
So it's very easy nowadays by hosting.
install some plugins, et cetera.
However, these people, yeah,
their focus is business.
It's not like technical stuff.
So they have no idea what it takes
to maintain a website.
So yeah, they install a few plugins.
They never log into the website.
They never update their plugins.
So of course, they're going to get hacked.
It's not WordPress issue because they had
some old plugins or maybe they use some
plugin, which I don't know.
Maybe it's not that reliable, et cetera.
They never update it.
So yeah, of course,
we're going to see all these websites
hacked.
And that one...
It's a bit of a double-edged sword because
it's very easy to use.
So it democratizes the web.
But just because it's easy to use,
also you get all these inexperienced users
using it.
So then it gets this better reputation.
So it's a bit of a, yeah.
Well,
and I think a trend that I've noticed
looking at some of like Patchstack's
reports and their state of security in
WordPress sort of things that, you know,
once upon a time, especially, you know,
when I was like freelancing very early on
in my WordPress career,
like the mechanism by which a site would
get hacked was very frequently related to
uh file system permissions and also like
the security of the hosts such that like
if you got access you could find it
you could sort of like cd into like
the right directory and then we inject an
actual file because the file the file
permissions on your folder were not secure
enough so another user could drop a file
there and then that would like write some
other file or you know you'd get some
something where it would execute and then
you have this like base-sxty-four encoded
bullshit
So it's really fundamentally like, oh,
you did your permissions wrong and now
somebody was able to physically write to
your file system, which is obviously bad.
But that sort of attack isn't as common,
I don't think,
as now it's more like privilege
escalation.
It's more about like, oh,
if you can get access in the first
place, which again, as we've said,
there are weak points your your your
website your your computer is only as
secure as the weakest password um so like
if you can get access to the system
then once you once you're in you can
do all sorts of different things and then
it's like and that becomes that's both
like oh well if you have access to
my website then I'm sort of tanked anyway
but on the other hand like
I that's,
that's where a lot of the risks are
in it.
And it,
you really need to think about like the,
how you're enforcing a good,
secure hygiene for just managing a system
like that.
Like it's not even WordPress specific.
It's like any, any system,
a network or a web, like a computer,
like anything needs is only as secure as,
as the weakest password in the link.
Yes, I mean, first of all,
WordPress powers, yeah,
forty percent plus of the website.
So that's a big chunk of the internet.
So, of course, yeah, I mean,
it will be the most targeted platform.
Secondly, as you're saying, yeah,
mostly are user issues.
If you look at the state of security
from PeshTech and the one of Rust,
there was in the early beginning of the
year was a joint report between Sucuri and
PeshTech.
The two biggest issues are user issues.
Password is still the same old story.
And outdated software.
And that's why people are able to find
exploitable vulnerabilities in plugins.
Because even if a plugin has
vulnerabilities, that doesn't worry me.
What worries me is how quickly does the
vendor respond?
Do they release a patch?
That's all good.
But even then,
most people don't update their plugins.
And that is a user problem.
And that is PatchSec's main business.
I mean, like,
they have specific firewall rules for the
specific number of plugins you have on
your website.
Don't get me wrong,
it's a very good business model.
It's a very good solution.
But yeah, the premise is like,
if everyone really keeps their plugin up
to date and keep their software up to
date, PatchSec will run off the business,
in theory.
But yeah, so if you look at them,
user issues because even if there's a
privilege escalation issue most probably
if so let's say you have an e-commerce
store and someone hacks a customer account
hijacks a customer account some people
tell you like it's a low privilege account
yeah fine it's true but first of all
once once you have access to a website
through an account regardless of
privileges you have one foot in the door
it's easier to launch social engineering
attacks however even if um
you try to exploit something in a
privilege escalation you can do it most
most probably because you can do it only
if there's a plugin or there's a software
that is vulnerable and allows you to do
it because if you have a customer account
and all your software is up to date
you cannot escalate your privileges so
easily you know so again it always
revolves around user issues if you keep
your plugin up to date and have some
basic user security hygiene then all these
problems will be solved but there are
again many websites which are abandoned
they are never locked in and and yeah
again we get the oh wordpress is a
problem now actually it's not where is the
problem the users maintaining the websites
are the problem
You mentioned earlier about how if you get
the right plugins,
if you find trusted plugins and you do
your research and things like that,
but with sixty thousand or however many
plugins there are in the WordPress
repository,
and like you do a search for any
given string, you know,
for I want this type of plugin,
you're going to get dozens of results.
So do you have thoughts around like I
know how I evaluate plugins when I'm for
myself,
but I'm
been doing this for twenty years and i
go to the conferences and i talk to
all the people and i know who i
trust right so how do how does a
person who is a baker or whatever like
who's doing this thing who's trying to do
their best to to get like trusted software
packages on their website how do they
evaluate what uh like what what things
would you suggest to help them evaluate
like what the best way of of
finding a trusted plugin author when
they're looking for a particular solution
for their site?
Yes.
Yeah, very quick question.
First of all,
the fact that there are sixty thousand
plugins,
it's already a bit of a problem because
you have this choice dilemma.
I remember, by the way,
when I got married,
we were doing our house.
My wife wanted to go to like four
or five different vendors to choose the
kitchen.
I was like, oh,
it would be nice if there was only
one vendor and just go for one kitchen.
It makes life easier.
And the same with plugins.
But yeah, there are a few rules.
The repository,
there are a number of statistics that help
you.
I mean,
you have the number of active
installations.
If you just look at the number of
active installations,
if you look at the support tickets,
how many support tickets were resolved,
et cetera,
and how quick they are resolved.
And if you look at the ratings,
those are really like three good things.
You have the number of active
installations.
the the support and the reviews of course
if you look at those it will be
difficult for new new starter plugins to
reach the but that's that's how it works
you know like a plugin which has two
hundred thousand active installations
first of all or four hundred or more
it means it's reliable it means a lot
of people use it and most probably it's
been around for a few years and yes
it's very maintained another another one i
would say it will depend but usually i
prefer especially if i'm using it
if I'm using my website for business,
I mean, if it's a hobby,
it's one thing, but if it's for business,
I would opt to go for a commercial
plugin.
And the simple reason is this,
even if I don't need the commercial
features,
I typically go for the commercial plugin
because when you have a commercial entity
behind the plugin, well,
every business can go bankrupt, granted,
but the chances of you being supported,
getting support when there are issues
being reported that vendor is going to
respond and fix it are much higher.
When you have a plugin which is,
completely free.
There's nothing wrong with it.
But if it's especially someone's hobby,
even if there are issues or not,
or if there is support, yeah,
maybe this person only, yeah,
it's a hobby.
So he can only give two,
three hours a week, for example.
So he only replies on support issues on
Saturday evening.
So if you are using it for business
and something happens, like,
are you willing to wait for a week
for a fix?
So by using commercial plugins,
you are supporting vendors and you are
encouraging higher quality of plugins.
But you're also guaranteed,
you're never guaranteed,
but there's a higher chance of that plugin
being maintained.
So yeah,
I would say number of active
installations, look at the reviews,
look at the support tickets,
and optionally, but nice to have,
if there's an option to buy a commercial
plugin,
it helps because there's a certain level
of service, basically.
Yeah, yeah, for sure.
It's in the business's best interest for
you to leave as a good customer,
for you to have a good experience.
It's literally their livelihood.
So they're financially motivated to
support you.
Exactly, yeah.
Yeah,
if it's my plugin that I just threw
up on WordPress.org five years ago and
don't look at,
I'm less inclined to respond to support
tickets.
Exactly.
One of the things that...
Yeah,
you mentioned having so many options is a
problem.
A thing that I observed when I first
went to my first DrupalCon that was
distinct about the Drupal community versus
the WordPress community was that because
we have this sort of commercial
marketplace,
this sort of
this e-commerce infrastructure around
WordPress as a platform.
There's this thing that happens in
WordPress that doesn't happen in Drupal,
which is
if I have an idea for a security
plugin and you have an idea for a
security plugin,
we're essentially competitors.
So we're less likely to share notes,
we're less likely to work together,
because I want to hold onto my IP
and you want to hold onto your IP.
Whereas in Drupal,
if you have two separate sort of plugins
that both are modules that kind of do
the same sort of thing,
there's more of a culture of like, well,
let's put our ideas together and
collaborate and make this a single
solution that is better for everyone.
As a result, there are fewer options,
but also as a result,
there's less potential in the Drupal
ecosystem as a whole to go out and
sell that thing because everyone's trying
to collectively build
like the best thing,
the single best thing,
but also I can't take that idea and
then sell it, you know, because like,
yeah, it's, it's, it's, it's,
and so that's the, they've like,
they've struggled to sort of like product
ties,
the pieces of Drupal that the WordPress
ecosystem has sort of naturally.
And there's like pros and cons there.
Like there's,
there's a trade-off in terms of like
collaboration versus competition and,
and all sorts of,
and then also just having so many options.
Yes,
I think there are pros and cons to
both models.
Personally, I prefer the WordPress.
If I could change one thing in the
WordPress ecosystem, I would maybe,
for example,
if you look at the WordPress repository,
Maybe set the bar a bit higher,
for example.
Yeah, if a plugin, I mean,
I understand some plugins don't need to be
updated so often because they're just like
a few lines of code.
They do a very specific function.
But still, I would force at least, yeah,
the plugin to be updated once a year
at least, for example.
Or even if you just update supported
version.
Nowadays, of course,
the repository has notifications.
Like when a plugin hasn't been updated for
the last three major versions,
you get a notification.
But it's still there.
It's still there.
People can still download it.
It can still lead to issues.
So I think by having some kind of
like
stricter regulations when it comes to the
repository maybe we'll have a bit less
plugins and the quality might go a bit
uh not necessarily improve the quality but
we will have less noise let's put this
less like all these small plugins etc uh
merging of
of plugins in functionality it's i think
it really depends on on yeah on what
the people are doing uh the fact that
you have that wordpress has all these many
options it's also a good sign it means
uh there are a lot of both business
and opportunities and it also usually
leads the more free the market is the
more open the market is it leads to
more innovation typically because once
you're going to merge things then yeah
they're working towards certain direction
and other competition
if someone has another idea they're not
even it feels like you're not encouraged
because now you have two people working
together or two groups working together so
starting something new is going to be
difficult more difficult etc so yeah I
don't get the kitchen sink problem right
you get like exactly piled into one thing
that you don't necessarily yeah so so I
don't think there's
One better than the other.
But yeah,
I think if the .org repository has some
sort of stricter rules,
it makes life easier.
Even when PestSec did the hackathon two
years ago and they closed two thousand
plugins,
the reason why they closed them is not
because they had security issues.
It's because there were much more plugins
which had security issues.
But when the repositories tried to contact
the owners of that plugin,
the owners never got back to them.
a simple test which is quite fascinating
last time i was speaking to someone i
forgot who at cloudfest who used to work
uh help with the plugin review scene and
it's always surprising how many plugins
there are that they try to contact the
owner and the owner never responds for
example that could be a simple test every
six months send make sure there's a
contact if there's no contact you're
getting off of the repository you know now
of course there's the question of
backward compatibility because if there
are people who has this plugin installed
what's going to happen with them now um
i don't know notification proposal
replacement but yes but by a lot by
opening this door of course you allow more
innovation but you're also creating
problems so there is no better good or
wrong but yeah it's a bit of a
like to find the right balance
It's an interesting point because I feel
like some of this has to do with
where WordPress was when it started in
contrast to where it is now.
Because what you're talking about is a
more mature way of identifying trustworthy
packages for a robust product that powers
forty percent of the Internet.
But when the WordPress repository existed,
it was just like
hey, I've got a cool idea.
I had a weird hacky thing that seems
funny,
and I'm going to put up this kind
of jokey plugin.
I had a friend that wrote a plugin
called Login Roulette,
which just on a random sequence,
it'll just log you out on any given
page load of the admin.
Just like,
You know, like just dumb stuff, right?
That was just silly and like jokey and
whatever.
I have a plugin that I wrote called,
what's it called?
Oh, updates.
I can't remember what I called it,
but it basically like,
it basically annoyed you.
It gave you like,
there is a GIF that would be like
a really disapproving GIF if you had pages
on your site that hadn't been updated in
a period of time.
and it would get progressively more
annoying the longer those pages were left
un-updated.
And, like, that's, you know,
back then there wasn't even,
I don't think GitHub really existed then.
So, like,
there wasn't even an outlet for sharing
these sorts of things to other people to
use, even as a joke.
But now we've got this framework,
the WordPress.org repository,
it still has all that stuff,
but now we're also needing it to power
of the internet and the infrastructure
around that.
So it's almost like we've moved so far,
we've come so close to the sun and
there's still these fundamental issues
that were part of the openness and the
freedom and the weirdness of the internet
when WordPress was young,
but now we need something more mature.
Yes, I mean, as you're saying,
when WordPress started,
when the .org repository started as well,
it was for a different time and different
CMS.
The WordPress was much smaller,
powered much less.
But now, yeah, it's much more popular.
It's much more stable.
It does much more different things.
It's used for so much more many things
and other solutions.
But the dot org repository, of course,
there have been changes.
But it seems it didn't move as fast
and it's not where it is.
I mean, as I said, I think...
um as you said like you had this
plugin like it just shows you the annoying
gif it's nice it's it's a nice thing
to have even as a hobby but yeah
just because the number as you said there
are sixty thousand and many people
I wouldn't say look dumb, but yeah,
just because when they see that number,
like, oh, there are too many plugins,
they might get overwhelmed,
there are too many choices,
and they don't even try, you know?
So yeah,
by having some sort of stricter
regulations,
stricter policies when it comes to what
can be submitted, what not,
or at least everything can be submitted,
but if after, I don't know,
a year or two,
there are a lot of plugins which still
have ten, fifteen installations, like,
So are they really useful?
Maybe we should find a solution.
Maybe they are useful for those fifty
websites.
Don't get me wrong.
But maybe at that stage we need to
look on a case-by-case basis what these
are and try to help those websites.
Again,
I know the repository is all running on
a voluntary basis,
so it's not as easy as said and
done.
But yeah, we definitely can
I'm sure the repository can be cleaned a
bit.
As I said,
even just sending an email every six
months to the plugin owners, like, hey,
are you still there?
I'm pretty sure we'll be closing quite a
lot of plugins if we do that.
Yeah, for sure.
Well, thank you, Robert, for coming on.
Thank you for talking about cool security
things.
Where can people find you on the internet
if they are looking for you?
Yes, I'm on LinkedIn.
If you search for Robert Abella on Google,
search for Robert Abella WordPress,
because Robert Abella is also the prime
minister of Malta.
And he ranks better than me,
unfortunately.
It's funny because on Twitter,
quite often I get tagged or sent messages
from BBC, CNN, you know,
like all this stuff.
So I'm not that Robert Abella,
I'm another one.
yeah because i i have the my twitter
handle is robert abella but the prime
minister is robert abella underscore pm or
something like that i was i was on
twitter x sorry before him so um so
yeah um yeah um i'm on linkedin robert
abella x as well and if we have
the website malapres.com i also by the way
a few months ago launched my own website
robertabella.me.me
The simple reason, honestly,
is like everyone else,
there is this huge AI hype and I
needed an excuse to play with it.
I mean,
I can develop my own team and stuff,
but might as well.
Let's try a bit of vibe coding,
you know,
play around with sub-agent skills and just
play around with it.
So yeah, my website robertabella.me,
LinkedIn or malapris.com are the best way
to find more about me.
Awesome.
Well, again, thank you for coming on.
Thank everyone for watching or listening
to this in the future.
And we'll see you on the internet.
Thank you very much, Chris.
Thanks for having me.