Perhaps,

Weird this article/news pops up as yesterday I was going to write an article on another thread about security. It was a thread about standards. WP Standards and Theme's review.

Some years back we did political webs, campaign sites and elected officials. We used Joomla. We coded an entire framework allowing for workflows. Aka: A news area having editor(s), Publisher(s), Writer(s), Layout, Artist(s) etc. Real workflows, like say CNN has (lesser scale). In regional campaigns there are regional events organizers, support organizations etc. So their workflows quite different as are roles and what they can/cant do. All into one component with several plugins and modules.

This framework to be part of a completely different project, we were going to use Joomla as the CMS and we have a C# MVC ASP.NET enterprise application that the CMS need support for content management. Rather than code one, use one already versatile. In fact, the only reason I am here is we dropped Joomla and are now porting code to WP so we can unit test and see if we can get WP to have enough performance to suit the expectant traffic load.

Anyways... So everything is cool. We even got a call from the then Governor of the state (NY) just floored with our work. We'd integrated ACT! and all sorts of nifty things via C#.

One day we get this call, campaign. FLIPPING OUT!!! Their site was brought down, defaced overnight. They tell us, "Need be back up NOW and we have 24 hours to figure out and close whatever breach occurred or expect about 2 million in lawsuits". Nice! Talk about crappin' ones knickers.

So look at the obvious, logins, the people with access etc. Nuthin'. I went over our codebase, didnt see anything. One of the programmers (of this larger project that the CMS is to support) calls me completely unrelated reasons. I tell him, "Cant talk now, got a emergency". So he asks whats up. I tell him. He says, let me call you back in 10 minutes. I reiterate, "Cant talk now!". Tells me "I will make a call, Xerox will locate the breach". Ooo... OK!

Xerox and HP are pals. Phone rings. They found it. They ran HP's security audit software against the site. But more bad news, there are 5 other insecure areas. EVERY SINGLE SITE we'd made. Every single security flaw due to third party components. The Calendar component being the culprit in this particular breach and its the #1 event component at the time for Joomla and one of the third party display modules made by someone else completely in support of said component. Also breaches in the forms component.

So... I go through that code base. Fix the holes. Next day they run the audit again. We're good. Fixed all the sites (quietly).

Few days later I go speak to council. Ask him, "Hey... we have this limited liability disclaimer signed, dated, notarized etc. that you wrote up for us. Yet, here comes this threat we had", and when talking those figures, believe me, the heart jumps some beats.

He refers me to a friend of his, deals with nothing but IT law.

Two days later I am in his office. He reads over the disclaimer. Asks me what platform we built on. Asks me about any third party codebases. Gives me a "uh huh. Hmmm... Ok... Uh huh". Puts the disclaimer back down in front of me and says, "This is worthless".

"Huh? What?"

Tells me unless ALL third party extensions were mentioned and all signed off on in respect to liability the entire document is useless. WHAT?!?!

He said, "You agreed to xxx component or in WP terms widget, plugin, theme) disclaimer that holds them to no liability from YOU". That DOES NOT mean that your customer or client cannot hold YOU responsible via its usage in your works for them UNLESS they are informed of it IN WRITING and sign off liability or limited liability to it. He also said it does not stop the client or customer from attempting sue the entity who made the codebase.

WHAT?!??! What if the code is free?

He continued, "This does not matter at all. Client and Customer are the same in as far as the USA goes. If someone downloads something for free they are still the customer or if they buy it." Ok. I get that. So he gives me an example. Keurig makes coffee makers. The components in the coffee maker are made by many otehr manufacturers. The heating element in this certain edition of the coffee maker is faulty. It causes a fire. The consumer(s) sue Keurig. Keurig claims its not their fault but that of the heating element. The consumer can sue both or either. If Keurig had a no liability or limited liability agreement with the heating element manufacturer that can still be litigated. But that agreement does hold weight in a court of law. Ultimately however it is up to a judge". He continued, "Your software by NOT disclosing to the customer be that paid, free or not means that any half competent attorney will get your disclaimer null and void in court.".

I am like, "Oh my.... I mean. WT --- F"

He says, "Rick. I'd not even have met with you about this matter had it not be for the referral from my friend and I'd not met with you even if you called me directly as a paid appointment."

Again, I am in the dark. "Why?"

He says, "Because this firm does not represent business entities in regards to defense. He said I am the attorney that goes after businesses as irresponsible as yours who engage in putting out websites and applications resulting in damages to those that entrust them."

Oh my.

He says, "Do you understand?". I said, "Yes I do" and he showed me out.

Now notice. OUR codebase, really complex workflows no breach. Why? Its coded to commercial standards. What ARE commercial standards? It means a closed code base for starters with API and proper API security of access to it.

For example. Lets say we port the workflow codebase to WP. I slap it out there Open Source. Someone goes in and makes changes or additions. They may be opening up holes in it. That simple. If you were to look at the code, you would be looking at it at least 3-4 days to get the gist of its basic (note : BASIC) function. Yet, if I hand you the UML, the class diagrams, the action diagrams etc. in an hour you will know more about how to modify it, add to it, keep it secure than you would ever learn in those days upon days of going through the code.

Thats standard in industry. If I handed the codebase to eBay engineers the FIRST thing they will be asking for are all those details and specifications. If they are not there and I were trying peddle it upon them they'd not budge an inch until they are supplied.

NOW we run EVERYTHING against HP's security audit and every client gets the full hoe down on the codebases used in a blanket agreement.

It is even more complex I found after the fact via yet another party (RIT Professor). Told me that when it comes to say widgets developed overseas, they're areas of litigation and liabilities can vary quite widely as well and most of the time such instances of threats of litigation results in two council's running to and fro from rooms where the client (customer) and web business reps sit working to "cut the deal". He said it reminds him of when someone makes an offer on a house.

He also told me HOW many of the WP/Joomla/DruPal/Portal/Forum sites get hit. And this is even a kicker.

Signatures. A signature can be a comment. So a insecure widget has a comment in the HTML and thus a page can be pulled down by an application (its like 6 lines of code for example to download page source to Visual Studio in C#) searched against and... There it is.

Javascript as again, its coming down to the browser. Its not like some hacker sits there and goes, "Oh here's another one". They have part of an application search for sites that have some form of unique WP in this example signature, then it searches for the signature of the security problem. Bam.

So when I read the "Theme Standards" I was sorta like... Exactly WHAT standards? Of course, I get it, the coding conventions, style perhaps, files for this and that. Real standards do exist but they come with the accompaniment of supporting information(s). Which do you think is better? Being handed a codebase and going through it trying to understand it or having the proper support diagrams and overviews so you DO understand the codebase and thus when looking at modifying it you already have a great understanding of how it works?

But, even with that said, the professor told me happens all the time. Big companies dont like litigate things public as it can distress the brand and little ones cant afford litigate it so it gets settled in this back and forth fray behind closed doors.