In reply to Dan Feidt (hongpong).

Disclaimer: these are my opinions only and don’t necessarily reflect any group that I may be part of.

I’ve been reading the post and the comments. As someone who has been targeted by John’s vitriol and willful misunderstanding (honestly, I think he has a whole tag on his site for me and other moderators and yes, that is creepy as all else) I just want to comment here. Hopefully briefly, probably not.

It’s easy to say something is inadequate without proposing a working solution. It’s quick to comment about that and the indignation and righteous outrage sure is gratifying isn’t it?

Yes, there’s a problem but the current process is within the confines of resources and the fact that WordPress remains a community effort staffed by volunteers. Closing a plugin is the right thing to do, contacting the author in a responsible manner is the right thing to do.

Giving them the opportunity to patch it and get that on an update out to the users is the right thing to do.

Anyone who says “RELEASE AND BE DAMNED! HOLD THE AUTHOR’S FEET AND WORDPRESS TO THE FIRE!” is just being irresponsible and hurting users if there is no patch or way yet to mitigate the problem.

That’s the whole point of the current process. Try not to make the situation worse for the user. It’s not perfect and everyone wishes there was some magic resource wand to wave at it but there isn’t.

That’s not security through obscurity. That’s something else. This is all about responsible disclosure. It’s not a new thing.

(Please avoid replying “BUT, MATT!” because that just propagates the idea that WordPress.ORG is a company. It’s not.)

PluginVulnerabilities is forcing the community to take a harder line, move away from the pernicious and extremely flawed security thru obscurity approach, and secretive de-listings that don’t protect existing sites!

No, he really isn’t.

John’s technical skill set is top notch. His security understanding and tools are fantastic. On that alone I’d recommend him in a heartbeat as a security researcher. It’s a pity there’s other parts of him that are not so professional.

That skill set of his is completely hidden by the fact that he perseverates (look it up please) and can’t let go of the fact that no one is allowed to do what he does in the forums. And I’m not even talking about his toxicity to being told about the rules.

This is part of the text that John posts in the forums.

If you have a problem with this type of full disclosure please contact the leadership of WordPress and let them know that the moderation of this forum needs to be cleaned up, since that is how these full disclosures will end.

How does any rational person not read that as this:

I will keep shooting the hostages one at a time until my demands are met.

This is not, nor ever has been, about responsible security disclosure.

It’s about someone who was told long ago that what they are doing isn’t allowed and that someone throwing a temper tantrum as a result. That John hurts real people doesn’t matter to him. He’s stuck in a loop and just can’t move on or be professional.