Episode 29 – Robert Abela  🔗 **Source:** [Episode 29 – Robert Abela](https://www.youtube.com/watch?v=GywmBUQY6ow) > [!note]+ Document Notes > tags: [community-and-code, wordpress-security, plugin-repository, social-engineering, two-factor-authentication, plugin-ecosystem] > author: Robert Abela > source: Community & Code > reference: https://www.youtube.com/watch?v=GywmBUQY6ow > date created: 2026-09-22 > > > [!info] Generated analysis — not the author's words. Sections below are machine-written > > from the captured source. Only text inside `> [!quote]` blocks is verbatim from the author. > > Do not quote or attribute any other line to the named author. > > # 🏷️ Title: Episode 29 – Robert Abela > <!-- deep-read:sections start --> ## 🧭 Table of Contents - [📝 Summary](#-summary) - [📖 Main Content](#-main-content) - [🗒️ Notes](#️-notes) - [📚 References](#-references) - [🗣️ Paraphrase](#️-paraphrase) - [📰 Newsletter](#-newsletter) - [✅ Action Items](#-action-items) - [🧪 Hypotheses](#-hypotheses) - [📊 Methodology](#-methodology) - [❓ Questions](#-questions) - [🔮 Future Research](#-future-research) - [💡 Implications](#-implications) - [🧠 Learning Styles Assessment](#-learning-styles-assessment) - [📊 Accessibility Assessment](#-accessibility-assessment) - [🌍 DEIB Assessment](#-deib-assessment) - [✅ Logical Validity](#-logical-validity) - [🛡️ DARVO Analysis](#-darvo-analysis) - [🎯 Conclusion](#-conclusion) ### 🔗 References - [Episode on YouTube](https://www.youtube.com/watch?v=GywmBUQY6ow) - [Melapress](https://melapress.com/) — guest's company (WP Activity Log, WP 2FA, Melapress Login Security) - [Have I Been Pwned](https://haveibeenpwned.com/) — Troy Hunt's breach-notification service, discussed at 10:30 - [Patchstack](https://patchstack.com/) — WordPress vulnerability database cited throughout ## 📝 Summary - **What happened:** Host Chris Reynolds interviews Robert Abela, founder and CEO of Melapress (formerly WP White Security, per the guest), in episode 29 of Community & Code (53:24). They cover the company name, Melapress's non-firewall security products, the guest's path from 1990s-era hacking into 14 years at security startups, WordPress's security reputation, how non-technical owners should pick plugins, and whether the WordPress.org plugin directory needs stricter rules. - **Why it matters:** Abela argues the WordPress attack surface has moved from code to people — phishing, reused passwords, and unpatched plugins — so the fixes are login policy, 2FA, and update discipline, not more firewalls. - **Key stakeholders:** site owners without technical staff ("the baker"), plugin vendors, the WordPress.org Plugin Review Team, vulnerability-disclosure firms (Patchstack, Sucuri), and outside critics comparing WordPress to newer CMSs. - **Risks and tradeoffs:** Abela recommends commercial plugins partly because a paying relationship raises the odds of support; he sells commercial plugins, so that advice carries a disclosed-by-context interest. His proposed repo purge (close plugins whose owners don't answer a six-month check) trades noise reduction against breaking existing installs, which he names himself. - **Bottom line:** WordPress core is secure in the guest's view; the recurring failures are user hygiene and abandoned plugins, and the directory's rules haven't kept pace with a platform the host and guest put at 40–43% of the web. ## 📖 Main Content - **Security that complements, not competes.** Melapress's three premium products — WP Activity Log (records what logged-in users do), WP 2FA (enforced two-factor and passkeys), and Melapress Login Security (login policies by role, time windows, new-device alerts) — target the account layer. The product list is confirmed on melapress.com; the rebrand from "WP White Security" is the guest's account. The guest says conference visitors kept asking how they compared to Wordfence and Sucuri, and the answer was that they don't do that kind of security. - **Users are the soft target.** Citing CloudFest talks, Abela says hacking a site through its users is getting easier while exploiting technical vulnerabilities gets harder, and that AI-written phishing now looks "better than the legitimate emails" (a line he attributes to a CloudFest speaker). Troy Hunt, who runs Have I Been Pwned, fell for a phishing attack, per the guest — "it can happen to the best of us." - **Vulnerability counts measure scrutiny.** Abela frames each found-and-fixed vulnerability as the software getting more secure; every major plugin (he names Yoast and WooCommerce) has had its share. What worries him is vendor response time and whether users apply the patch. - **The reputation problem.** Three causes, per the guest: early core vulnerabilities, media and vendor headlines that inflate reach ("200,000 websites vulnerable" for a plugin on 0.01% of sites), and a public that lumps core, commercial plugins, and abandoned hobby plugins into one box. - **Ease of use cuts both ways.** Low setup cost democratizes publishing but brings owners who never log in or update. Reynolds compares this to Windows 98 running on point-of-sale kiosks long after its prime; nobody says "don't use Windows." - **Picking plugins.** Abela's heuristic: active installs, support-ticket resolution rate and speed, and ratings; for business sites, prefer a commercial plugin even when you don't need the paid features, because a vendor has a business reason to respond. - **Directory policy.** Abela would raise the bar: require at least an annual update or tested-up-to bump, and contact owners every six months, closing plugins with no response. He cites a Patchstack-linked hackathon after which plugins were closed because owners never answered — he gives 2,000 at 25:30 and 30,000 at 46:00; the figures conflict and neither is verified here. - **Competition vs. collaboration.** Reynolds contrasts DrupalCon's merge-your-modules culture with WordPress's commercial competition. Abela prefers WordPress's model: more options mean more innovation, at the cost of a choice problem. - **Uncertain proper nouns (auto-captions):** "MD dash" (Cloudflare's new CMS, 23:00) is unverified; "Pekk/Pesk/Patch sec" is read here as Patchstack; "Oliver from Pekk" is unverified; "impseed … renamed to seed" is likely Inpsyde → Syde, unverified; the friend at GFI ("Sand") and the guest's personal site URL are unverified. ### 🗒️ Notes #### ⏱️ [00:00](https://www.youtube.com/watch?v=GywmBUQY6ow&t=0s) Cold open - Chris Reynolds introduces the episode: hacking nostalgia (war driving, phone phreaking), the Maltese meaning of "mela" (yes, no, or maybe), and the guest sharing a name with Malta's prime minister. #### ⏱️ [02:00](https://www.youtube.com/watch?v=GywmBUQY6ow&t=120s) Guest intro and the Melapress name - Maltese, living in the Netherlands for seven years, married, three children; WordPress started as a hobby. - Rebranded from "WP White Security" because the name was long and implied firewall/antimalware. Paid two or three naming firms; the name came from a conversation with a Maltese colleague (Joel). - Reynolds: naming is one of the hardest problems; cites an agency rename whose staff pronounced the new name differently. #### ⏱️ [07:30](https://www.youtube.com/watch?v=GywmBUQY6ow&t=450s) What Melapress builds - WP Activity Log is the flagship; WP 2FA enforces two-factor and passkeys; Melapress Login Security sets policies by role, time, and device. - Rationale: attackers go through users now; AI use lowers users' guard, per talks at CloudFest. #### ⏱️ [09:30](https://www.youtube.com/watch?v=GywmBUQY6ow&t=570s) Credential leaks and 2FA - Reynolds: breach lists are constant; you can only control password uniqueness and 2FA. - Abela: Have I Been Pwned alerts arrive almost daily; password managers plus 2FA blunt reuse. - Troy Hunt was phished, per the guest; Reynolds recalls Hunt's rogue Wi-Fi demo at a Pluralsight author summit. #### ⏱️ [13:30](https://www.youtube.com/watch?v=GywmBUQY6ow&t=810s) Career path - 14 years at security software startups (tester, systems engineer, product management), never a developer; wrote scripts. - Entered WordPress 13–14 years ago when his employer needed a blog; an early SaaS attempt at web file monitoring "was a bit of a flop." #### ⏱️ [16:30](https://www.youtube.com/watch?v=GywmBUQY6ow&t=990s) Old-school hacking - Started at 19: war driving, a Maltese payphone internet bypass using open ports and netcat. - A CloudFest capture-the-flag team solved nine challenges in 18 minutes after 10 minutes of AI setup — "not fun," in his view. - Recommends Kevin Mitnick's *Ghost in the Wires*; recalls the Captain Crunch whistle and phone switching. #### ⏱️ [21:00](https://www.youtube.com/watch?v=GywmBUQY6ow&t=1260s) Social engineering - Tailgating into staff-only rooms; walking into a Malta–Gozo ferry engine room in a high-visibility vest. Politeness and low awareness make it work; training is the remedy he names. #### ⏱️ [23:00](https://www.youtube.com/watch?v=GywmBUQY6ow&t=1380s) WordPress's security reputation - Outsiders see WordPress as hobbyist; a recruiter asked if full-time WordPress businesses exist. - Every software has early vulnerabilities; found-and-fixed means more secure. - Media and vendor headlines inflate reach; abandoned hobby plugins get closed and the closures become marketing. - On Matt Mullenweg's response to Cloudflare's CMS: plugins changing any behavior is a feature; sandboxing fits an operating system more than a CMS, per the guest. #### ⏱️ [28:30](https://www.youtube.com/watch?v=GywmBUQY6ow&t=1710s) The Windows comparison - Reynolds: more users mean more eyes and more fixes; Windows 98 ran grocery self-checkout and photo kiosks long past its time. - Abela: banks run old OS versions they can't upgrade while imposing compliance on everyone else. #### ⏱️ [32:00](https://www.youtube.com/watch?v=GywmBUQY6ow&t=1920s) Ease of use as a double-edged sword - Easy setup brings owners focused on their business who never update; that gets blamed on WordPress. #### ⏱️ [33:30](https://www.youtube.com/watch?v=GywmBUQY6ow&t=2010s) How sites get hacked now - Reynolds: file-permission injection used to dominate; now privilege escalation after access. - Abela cites the Patchstack/Sucuri state-of-security report: the top two issues are passwords and outdated software. - A low-privilege customer account is "one foot in the door"; escalation needs a vulnerable plugin, which updates close. #### ⏱️ [38:00](https://www.youtube.com/watch?v=GywmBUQY6ow&t=2280s) Choosing a trustworthy plugin - 60,000 plugins create a choice dilemma (kitchen-shopping anecdote). - Check active installs, support-ticket resolution, ratings; for business use, pay for a commercial plugin. #### ⏱️ [42:00](https://www.youtube.com/watch?v=GywmBUQY6ow&t=2520s) Competition vs. collaboration - Reynolds: Drupal merges overlapping modules; WordPress vendors guard IP. - Abela: pros and cons; open markets drive innovation; merging produces a "kitchen sink." #### ⏱️ [44:00](https://www.youtube.com/watch?v=GywmBUQY6ow&t=2640s) Stricter directory rules - Force at least a yearly update; the current "not tested with the last three major releases" notice still leaves plugins downloadable. - Six-month owner contact check; unresponsive plugins closed. Backward compatibility for existing installs is the unsolved part. #### ⏱️ [47:30](https://www.youtube.com/watch?v=GywmBUQY6ow&t=2850s) The directory grew up slower than WordPress - Reynolds recalls joke plugins (a friend's "login roulette," his own disapproving-GIF stale-content nag) from a pre-GitHub era. - Abela: the directory changed but not as fast as the platform; plugins stuck at 10–50 installs deserve case-by-case review; the directory runs on volunteers. #### ⏱️ [51:30](https://www.youtube.com/watch?v=GywmBUQY6ow&t=3090s) Where to find Robert - LinkedIn, X, melapress.com, and a personal site he built to experiment with AI coding ("sub-agents, skills"). Search "Robert Abela WordPress" to avoid the prime minister. ## 📚 References - [Community & Code, Episode 29 – Robert Abela](https://www.youtube.com/watch?v=GywmBUQY6ow) - [Melapress](https://melapress.com/) — product names verified 2026-09-22 - [Have I Been Pwned](https://haveibeenpwned.com/) - [Patchstack](https://patchstack.com/) — state-of-security reports and plugin-closure figures cited by the guest (numbers not verified here) - [WordPress.org Plugin Directory](https://wordpress.org/plugins/) - Kevin Mitnick, *Ghost in the Wires* (2011) — recommended by the guest ## 🗣️ Paraphrase - Melapress took its name from a Maltese word that means yes, no, or maybe depending on tone, after paid naming agencies failed to find one. - Its plugins secure the account layer: logs of user actions, enforced 2FA, and login rules. They sit beside firewall products, not against them. - Breaking in through people is getting easier and breaking in through code is getting harder; AI makes phishing more convincing. - Every piece of software has vulnerabilities; the question is when they're found and how fast the vendor ships a fix. - WordPress's reputation comes from early core bugs, inflated headlines, and abandoned hobby plugins lumped in with maintained ones. - Easy setup is why WordPress spread and why so many unmaintained sites get hacked. - Most compromises trace to weak passwords and outdated plugins, both user-side. - To choose a plugin, check installs, support responsiveness, and ratings; for a business, buy commercial for the support relationship. - The directory should require periodic updates and prove a live owner every six months, while handling sites that already run a closed plugin. ## 📰 Newsletter - **"Not a question of which, but when."** On [Community & Code episode 29](https://www.youtube.com/watch?v=GywmBUQY6ow), Chris Reynolds talks with [Melapress](https://melapress.com/) founder Robert Abela about why WordPress security stories keep landing on the platform when the causes are reused passwords and plugins nobody updated. Abela's pitch for the plugin directory: ping every plugin owner twice a year and close the ones that don't answer. - Useful for anyone who fields "is WordPress secure?" from clients: his three-signal plugin check (active installs, how fast support threads get resolved, ratings) fits on a sticky note. - Bonus: a rebrand story involving a Maltese word that means yes, no, *and* maybe, plus a recommendation to finally read Kevin Mitnick's *Ghost in the Wires*. ## ✅ Action Items #### DevRel - Developer advocacy: talk angle — "vulnerability counts measure scrutiny, not insecurity," with Patchstack data as evidence. - Education: a 30-minute workshop for site owners on 2FA, password managers, and update cadence. - Developer experience: a one-page plugin-vetting checklist built from the three signals in this episode. - Developer marketing: not applicable to this source — no campaign content. - Community management: collect examples of inflated vulnerability headlines vs. actual install counts. - Internal/external/cross-project: coordinate with disclosure firms on headline wording that states install share. #### OSPO - Policy & Governance: draft a maintainer-liveness policy for internally published plugins (six-month contact check). - License Compliance: not applicable to this source — licensing isn't discussed. - Security Management: define a patch-response SLO; the guest names response speed as the trust signal. - Software Inventory: flag dependencies whose maintainers haven't responded in six months. - Developer Support: office hours on login policies and 2FA enforcement for client sites. - Community Engagement: fund volunteer plugin reviewers; the guest notes the directory runs on volunteers. - Strategic Alignment: KPI candidate — median days from disclosure to patch for plugins you ship. #### Community - Maintainers: publish a security contact and response window in every plugin readme. - Contributors: onboarding task — triage abandoned-plugin reports. - Sponsors: not applicable to this source. - Ecosystem: coordinated messaging when a closed plugin still has active installs. #### WordPress - Core: evaluate an opt-in core prompt for 2FA on administrator accounts. - Core Performance: not applicable to this source. - Core AI: phishing-awareness copy for AI-generated admin notices; the guest ties AI to lowered user vigilance. - **Core Program Team:** track the directory-policy proposal (periodic update, owner liveness) across Meta and Plugins. - Mobile: not applicable to this source. - Playground: a Playground demo of a hijacked low-privilege account attempting escalation against an outdated plugin. - Community: WordCamp session on social engineering (tailgating, hi-vis vest) for site owners. - Training: Learn WordPress lesson "choosing a plugin you can trust." - Marketing: counter-narrative on WordPress security using found-and-fixed framing. - Support: forum canned reply for hacked sites that checks password reuse and outdated plugins first. - Design: surface "last updated" and support-resolution rate more prominently on plugin cards. - Documentation: HelpHub page on login hardening and activity logging. - Photos: not applicable to this source. - TV: add this episode's security segment (23:00–38:00) as a talk candidate. - Polyglots: not applicable to this source. - Accessibility: not applicable to this source. - Meta: prototype the six-month owner-contact check against plugins with a security report on file. - CLI: `wp plugin list` output flagging plugins closed on WordPress.org. - Hosting: default-on auto-updates for plugins with known vulnerabilities. - Tide: not applicable to this source. - Openverse: not applicable to this source. - Themes: apply the same liveness rule to the theme directory. - Plugins: require at least a yearly update or tested-up-to bump, as the guest proposes. #### The WPOCC - Programs: microgrant for a maintainer-liveness tooling pilot. - Projects: documentation sprint — plain-language security guide for small-business site owners. - Funding experiments: not applicable to this source. ### FAIR - Technical independence: include maintainer-liveness metadata in package records. - Policies and covenants: define what happens to installs of a delisted package. - Productized governance artifacts: a package trust scorecard (installs, response time, last update). ## 🧪 Hypotheses - H1: Sites with enforced 2FA for administrators have a lower compromise rate than comparable sites without it. - H2: Plugins whose owners fail a six-month contact check account for a larger share of unpatched vulnerabilities than their share of installs. - H3: Vulnerability headlines overstate affected sites relative to active-install counts on WordPress.org. - H4: Among plugins with a disclosed vulnerability, commercial-backed plugins ship patches faster than hobby plugins. - H5: Support-thread resolution rate predicts patch response time better than rating does. ## 📊 Methodology - H1: compare incident data from a host or security vendor across sites with and without enforced 2FA, matched on plugin count and update cadence. - H2/H4: join Patchstack disclosure data with WordPress.org plugin metadata (installs, last update, commercial link) and measure days to patch. - H3: sample 50 vulnerability headlines and compare stated affected-site counts to active installs at disclosure time. - H5: scrape support-forum resolution stats and correlate with patch latency. ## ❓ Questions - How would a liveness check handle sites still running a closed plugin — forced replacement, notice, or nothing? - Does commercial backing actually shorten patch time, or does it reflect install size? - How much of the "users are the weak point" claim is measured vs. conference consensus? - Which directory rules could run automatically, given the review team is volunteer-staffed? ## 🔮 Future Research - Longitudinal data on AI-generated phishing success against CMS admins. - The effect of the directory's "not tested with recent releases" notice on install decisions. - Outcomes of past mass plugin closures for sites that kept running the closed code. ## 💡 Implications - **Practice:** hosts and agencies should treat 2FA and update discipline as the first security layer for small-business sites. - **Policy:** directory policy needs a lifecycle for unmaintained plugins, not just intake review. - **Security:** headlines should report install share; disclosure firms have a commercial interest in alarm, which the guest names. - **Education:** non-technical owners need a short vetting checklist more than a threat taxonomy. - **Funding models:** paying for plugins funds the support relationship, per the guest; volunteer review capacity limits any stricter directory rule. ## 🧠 Learning Styles Assessment - Reading level estimate: conversational speech, roughly Flesch-Kincaid grade 8 (estimated, not computed); auto-caption disfluencies lower readability of the transcript itself. #### 👀 Visual learners - Present: frames weren't checked; this analysis uses the transcript only. - Improve: a chart of attack vectors (credentials, outdated plugins, core) from the cited report. #### 🔊 Aural learners - Present: full audio conversation. - Improve: chapter markers per segment. #### 🗣️ Verbal learners - Present: anecdotes (Mitnick, Troy Hunt, ferry engine room) and analogies (kitchen shopping, Windows 98). - Improve: a glossary for 2FA, privilege escalation, war driving, phone phreaking. #### 🧩 Kinesthetic learners - Present: none. - Improve: a checklist to enable 2FA and audit plugin update status on your own site. #### 🧠 Logical learners - Present: the three-signal plugin heuristic; the cause list for WordPress's reputation. - Improve: a decision tree for "free vs. commercial plugin." #### 🧑‍🤝‍🧑 Social learners - Present: two-person dialogue with disagreement on Drupal vs. WordPress models. - Improve: discussion prompt on the six-month liveness proposal. #### 🧘‍♀️ Solitary learners - Present: book recommendation. - Improve: self-audit questions on password reuse. #### 🌿 Naturalistic learners - Present: ecosystem framing of the plugin directory's growth. - Improve: not applicable to this source beyond lifecycle thinking for plugins. ## 📊 Accessibility Assessment #### Screen reader semantics - Present: not assessable from the transcript. - Improve: not applicable to this source (YouTube player chrome is outside the content). #### Keyboard navigation - Present: not assessable from the transcript. - Improve: not applicable to this source. #### Contrast and readability - Present: not assessable; frames weren't checked. - Improve: not applicable to this source. #### Text resizing and reflow - Present: not assessable. - Improve: not applicable to this source. #### Media and captions - Present: auto-generated captions exist; they garble names (Melapress, Patchstack, Abela, Gozo). - Improve: publish a corrected transcript and edited captions (WCAG 1.2.2 Captions, prerecorded). #### Forms and interactions - Present: none. - Improve: not applicable to this source. #### Standards reference - Main gap: 1.2.2 caption accuracy for proper nouns. ## 🌍 DEIB Assessment #### Cultural breadth - Present: Maltese guest living in the Netherlands, US host; Maltese language and places discussed. - Improve: examples of WordPress security in non-English markets. #### Inclusive language - Present: mostly plain; jargon (war driving, netcat, DMZ) is undefined. - Improve: define terms on first use in show notes. #### Neurodiversity support - Present: conversational tangents; no chapter markers in the captured source. - Improve: timestamped chapters. #### Representation - Present: two speakers, host and guest; the guest uses "he" once for a hypothetical hobby developer (41:00). - Improve: gender-neutral hypotheticals. #### Psychological safety - Present: frames phishing victims without blame ("it can happen to the best of us"). - Improve: not applicable to this source. ## ✅ Logical Validity #### Strong reasoning - Inductive: found-and-fixed vulnerabilities as a sign of maturing software (24:00), supported by examples across top plugins. - Causal: privilege escalation requires a vulnerable component, so updates close the path even after account takeover (37:30). - Analogical: the Windows comparison shows popularity attracts both attacks and scrutiny without anyone abandoning the platform. - Self-aware tradeoff: Abela names backward compatibility as the cost of his own purge proposal. #### Fallacies - **Blame shifting / false dichotomy (mild)** — "it's not WordPress is the problem. The users maintaining the websites are the problem" (38:00). Platform defaults (auto-updates, 2FA prompts) sit between the two. Fix: name platform defaults as a shared responsibility. - **Appeal to authority (mild)** — repeated "at CloudFest someone said" claims about AI lowering cognitive ability, with no study named. Fix: cite the talk or data. - **Inconsistent figures** — 2,000 closed plugins (25:30) vs. 30,000 (46:00) for what sounds like the same event. Fix: check Patchstack's report. - **Conflict of interest (unstated)** — recommending commercial plugins while selling them. Fix: disclose, and pair with non-commercial signals. #### Tone of voice - Conversational, nostalgic, good-humored; the guest is measured about competitors and critics. ## 🛡️ DARVO Analysis - Deny: the guest minimizes platform responsibility for insecure outcomes, placing it on users; this is a defensive framing of WordPress, not a denial of wrongdoing by a person. - Attack: media and some vendors are described as sensationalizing for marketing; stated as critique, not a personal attack. - Reverse victim/offender: none identified. - Not applicable to this source in the interpersonal sense — no accusation or dispute between parties. ## 🎯 Conclusion - Bottom line: per Abela, WordPress's security problem is account hygiene and abandoned plugins, and the fixes are 2FA, login policy, prompt updates, and a directory that retires plugins without a responsive owner. - Next step: run the three-signal check on every plugin on a site you manage and turn on 2FA for all administrator accounts. ## 🔄 Refactor Appendix — Episode 29 – Robert Abela ### 📚 Literature Atoms (H3) #### [H1] Attacks shift from code exploits to users > [!quote] ID:rw_01m34j1dqpmqgbqr7thc68pvgf > want to hack someone, it's becoming way easier going through their users. It's much it's becoming more difficult to exploit technical vulnerabilities **Context & use**: - 08:59, explaining why Melapress builds login and 2FA tools. - Supports prioritizing account hygiene over firewall add-ons for small sites. **Tags**: #xref **Highlight**: [view highlight](https://read.readwise.io/read/01m34j1dqpmqgbqr7thc68pvgf) <!-- atomicity: 1 idea ✓ --> #### [H2] Vendor response speed is the trust signal > [!quote] ID:rw_01m34j1h0yap1mg6q6ypf8ezzc > what worries me is how how quickly does the vendor um respond? Do they release a patch? **Context & use**: - 36:20, in the state-of-security discussion. - Moves plugin evaluation from "has it had vulnerabilities" to "how fast were they fixed." **Tags**: #xref #addendum **Highlight**: [view highlight](https://read.readwise.io/read/01m34j1h0yap1mg6q6ypf8ezzc) <!-- atomicity: 1 idea ✓ --> #### [H3] Installs, support resolution, and ratings vet plugins > [!quote] ID:rw_01m34j1j523v9fz7bf4yy626p9 > you have the number of active installations. If you just look at the number of active installations, if you look at the support tickets **Context & use**: - 39:50, answering how a non-technical owner picks a trusted plugin. - Short checklist for client education. **Tags**: #xref #share **Highlight**: [view highlight](https://read.readwise.io/read/01m34j1j523v9fz7bf4yy626p9) <!-- atomicity: 1 idea ✓ --> #### [H4] Plugin directory should verify owners every six months > [!quote] ID:rw_01m34j1k5yf32rp8c7ssztgjxp > Every six months, send make sure there's a contact. If there's no contact, you're getting off of off the repository **Context & use**: - 46:57, proposed directory policy. - Pairs with the backward-compatibility caveat he raises immediately after. **Tags**: #xref #articleseed **Highlight**: [view highlight](https://read.readwise.io/read/01m34j1k5yf32rp8c7ssztgjxp) <!-- atomicity: 1 idea ✓ --> ### 🧠 Permanent Candidates (H4) #### [P1] A vulnerability count measures scrutiny, not insecurity **Claim** (one sentence, Courtney's voice): A long list of fixed vulnerabilities tells you people are looking at the code and the vendor is shipping fixes, so response time is the number to judge, not the count. **Evidence pointer**: [[#[H2] Vendor response speed is the trust signal]] > [!quote] ID:rw_01m34j1ese6fxzcya31vskssyw > every vulnerability that's found and report it and fix that software is becoming more and more secure. **Scope & conditions**: holds when fixes ship and users apply them; fails for abandoned code, where a found vulnerability stays open. **Links**: - [[Alarm fatigue before adding alarms]] — because contrasts on counts vs. change as a signal - [[wp-audit]] — because applies-in plugin security reviews <!-- atomicity: 1 idea ✓ --> ### ✏️ Fleeting Queue - [F1] Check Patchstack's report for the actual number of plugins closed after its hackathon (guest said 2,000 and 30,000) — https://patchstack.com/ #fleeting #inbox - [F2] Confirm the Cloudflare CMS name captioned as "MD dash" and Matt Mullenweg's response — 23:00 #fleeting #inbox - [F3] "Not a question of which, but when" — pair with media-sensationalism point (ID:rw_01m34j1fw6vhvsc4nhpayk7713) #fleeting #inbox ### → Things 3 (max 2 actions) - [ ] Draft a one-page plugin-vetting checklist (installs, support resolution, ratings, patch speed) for site-owner clients — from Community & Code ep. 29 #things <!-- deep-read:sections end --> 📄 **Full text:** [[Full Document Contents/Articles/Episode 29 – Robert Abela.md|Episode 29 – Robert Abela by Robert Abela]] ## Highlights - want to hack someone, it's becoming way easier going through their users. It's much it's becoming more difficult to exploit technical vulnerabilities, trying to bypass a firewall and stuff like that. And because we're using more ([View Highlight](https://read.readwise.io/read/01m34j1dqpmqgbqr7thc68pvgf)) - Note: Attack surface shifts from code to users: phishing and credential abuse beat firewall bypass. Basis for Melapress's 2FA/login-policy focus. - Tags: atom/literature/h1 - vulnerabilities, so it's insecure. Or you can look at it every vulnerability that's found and report it and fix that software is becoming more and more secure. So every software has to go to ([View Highlight](https://read.readwise.io/read/01m34j1ese6fxzcya31vskssyw)) - Note: Reframe: a vulnerability count measures scrutiny and fixes, not insecurity. Candidate permanent note. - Tags: atom/zettel/z1 - WordPress. Every software guaranteed has vulnerabilities. It's it's not a question of which doesn't have, it's a question of when they will be found. So, so but the media unfortunately gives ([View Highlight](https://read.readwise.io/read/01m34j1fw6vhvsc4nhpayk7713)) - Note: Pair with the media-sensationalism point (install counts inflated in headlines). - Tags: atom/fleeting/f1 - and because not because because even a plug-in has vulnerabilities that doesn't worries me what worries me is how how quickly does the vendor um respond? Do they release a patch? That's all good. But even then, like most people don't ([View Highlight](https://read.readwise.io/read/01m34j1h0yap1mg6q6ypf8ezzc)) - Note: Vendor response time, not vulnerability existence, is the trust signal. - Tags: atom/literature/h2 - number of statistics that help you. I mean you have the number of active installations. If you just look at the number of active installations, if you look at the support tickets, how many support tickets were resolved etc. Uh and how quick they are resolved. And if ([View Highlight](https://read.readwise.io/read/01m34j1j523v9fz7bf4yy626p9)) - Note: Three-signal plugin vetting heuristic for non-technical site owners: active installs, support resolution, ratings. - Tags: action/h1 - owner and the owner never responds. For example, that could be a simple test. Every six months, send make sure there's a contact. If there's no contact, you're getting off of off the repository, you ([View Highlight](https://read.readwise.io/read/01m34j1k5yf32rp8c7ssztgjxp)) - Note: Proposed repo policy: six-month maintainer liveness check; unanswered plugins get closed. Backward-compat for existing installs is the open problem. - Tags: atom/literature/h3