this is my favorite kind of pump you
give because that eight of you that are
here are here on purpose you want to
hear all of this so this is this is my
favorite my favorite kind of i'm also oh
it's okay for me to drink rolling up
team which is really really great also
because no conference that i ever see
dad is a hundred percent come for that
so here's also you do that with this
will eventually and cheers thank you so
the next approximately 20 minutes i'm
going to talk to you about wordpress
polyfill is a very dry terrible subject
that i will try to make it as
entertaining for the hustla camp this is
me if you would like to be friends with
me on the Internet Paula my love follow
me on the gate hugs you know whoever my
job as it were is as an industry sponsor
WordPress professional people pay me to
work on WordPress whole time which is
pretty great took a while to get there
and as WordPress is an open source piece
of software wasn't always in that kind
of ice but it isn't so great angle so
for my list of accolades as to why I'm
all I to talk to you today I've a number
of the WordPress security team for a
number of years I maintained by a press
meeting press I'm also a component
maintainer or WordPress is roles and
capabilities which is kind of a big deal
you care about access control to various
things on the web and again the
companies that pay me early hour campeon
occasionally companies that unless your
WordPress versity probably maybe never
heard of but they're really really great
and so I will always give them a heads
up in there they're two seconds on the
screen or a rope aann you know if you
want to perhaps support me and things
that it is i like the solutions that
ideal to try to give away to the web
they are all GPL license available for
free you can use them and not pay me a
dime but if you would like to support
the future developments you can go to
plugins loaded calm and use
even the wordpress plugin that I help
till they do also is a neat little
things inside WordPress moving on from
the plugs so I'm going to talk to you to
try and make this is kind of skew Lee
applicable to taper kind of again about
wordpress poly bills and if you are
unaware of what about evil is or why it
matters or why you should be happy that
WordPress has them for the most part
they are shim they are little pieces of
code inside of wordpress that we choose
to include with it so that we can
improve the security of WordPress itself
even in environments are on platforms
that may not be capable of that level of
security going forward it sort of
interesting to think of WordPress is a
piece of software that's about 14 years
old now also running on 10-year old
hardware or software PHP 5.2 point 3 is
10 years old HP it at 7.1 at this point
it's really great but there are lots of
my most bluehost remotes Go Daddy many
of them I can name them there's an
infinite list that have lots of websites
that are hosted using old versions of
PHP and that's okay any days I I'm
really okay but I get why that is the
way that things work and so eventually
what sometimes happens is a PHP gets
better but companies don't deploy new
versions of PHP but they do deploy new
versions of wordpress and wordpress will
auto update itself for Maya releases
which means we can silently pre
secretively improve the security of
things of every 12 or 24 hours on
wordpress for us to do version of itself
and so Holly those help us do that the
first place if you cared about the code
again I'm going to there will be code in
my slides that it won't be all that SME
so don't be scared but the first place
that you could look if you care to look
is in WordPress is includes folder in
compact
that PHP that aisle is full of weird
little functions that are new to new
versions of PHP that we provide
basically 141 compatibility with some of
these are hashing functions salts keys
weird things anyways the neat thing
about compatible ah'd of the functions
in it as well as the functions that come
with pluggable that PHP which is like
one of my favorite file that most people
that develop with WordPress absolutely
hate the thing with pluggable and
compact up eh p is all of the functions
that are in those two files can be
overwritten if you have a better
solution for yourself or you run a type
of WordPress installation that requires
you to have different hashing functions
more encryptions weirder keys longer
salts whatever the thing is WordPress
wants to be flexible and lots to let you
manipulate those things or improve those
things so I'm going to go over a few of
the more common functions that are
overwritten or that our that we include
that are sort of polyfills implausible
that if you run a wordpress installation
and you care about security and for some
reason you don't like the default
security that wordpress comes bundled
with you can take these functions write
your own version of them make it better
on your own and honestly if you're
willing to make it better it would be
really great to submit a patch back into
wordpress to help everybody else's
wordpress is get better as you versions
come on so the first thing that work
that does to keep the web secure if you
will is when you install wordpress it
goes out and trying to get from api
wordpress.org a randomly generated Kiev
nsel's and so these straightens could be
anything they are randomly generated and
all sorts of weird but the neat thing is
that these are unique for
wordpress installation I mean is unique
is we can make these hashes be not
trying to keep a log of everybody else's
unique ashes so sorry we know if they're
unique but probably likely that they're
going to be pretty unique and so going
forward all the functions that I'm going
to show up to you I'm going to use these
keys results as a base for running their
hashing through to make sure that when
new things are generated that they're
generated based on these salts that are
unique to your WordPress and so it is
really really really unlikely like
billions and billions of billions
unlikely that someone else's word press
to and somehow have the exact same weird
hashes are not different things that you
are wordpress for them and because these
in PHP if you're unfamiliar with the
syntax for confidence you can change
them at any time you can request your
keys from api to wordpress better work
or you couldn't really insert them with
whatever the things are that you want
magically to be in here to make
wordpress refresh and kill all the other
things that i use as he takes form so
the first function that lots of things
in wordpress that are related to you
know hashes and ciphers and security is
WP ran now random number generators are
not super great writing the world of
security runs a lot on random number
generators but if we rely on PHP es
would mean that WordPress would be
unable to take advantage of new versions
of ran when you versions are old
versions of PHP article and somebody
server or if you have for some reason of
multiple web servers and each one of
those servers might be accidentally
running a different version of PHP if we
relied on PHP frames we would have
environments that are generating
different random numbers and so
WordPress juices of very specifically to
have its own random number generator to
go through and provide a pluggable
override amol but still
as secure as we can make it version of
that if you are familiar with the code
and what you're looking at it's kind of
terrible actually I mean the thing is
that WordPress has to do to be
compatible with versions of PHP that go
back to five point two point three to be
cautious of people passing really long
numbers that aren't actually integers as
integers and then try and rehash and
remap some of the three cast some of
those things there are all these weird
little dashes of isms that over the
course of WordPress being a mature piece
of software has had to solve that are
for the benefit of everyone that uses to
use WordPress is there engine to power
their website so some of these if you
keep looking if we go forward again we
have the EP hash which is really using
by default md5 which we all know is a
not super great when it comes to
creating hashes for things but the fact
that it's pluggable if you see function
exists WP hash if you have your own
function that comes first before
wordpress logo you can find your own WP
hash function you want to use some other
hashing algorithm WordPress would yield
to what you defined so if your WP hash
function return something other than any
time it will let you override that and
provide better security now the reason
we seek without d5 is because it's a
relatively Universal across many
platforms all over the place it provides
adequate enough security for your 8020
rule of people who really care versus
people to know and if you do really care
we want for you to be able to override
it with something that is more secure
for what your application designers and
so it's nice to be able to have an own
some of this functionality made it's
like maintenance burden and at open
source people could see it whatever else
closing pounds but it's really nice to
have this functionality and even cash
hmm if you're familiar with how PHP
works I wasn't available until recent
versions of PHP and so WordPress comes
with its own version of hash HVAC as a
polyfill to say okay if you're using an
old version PHP including like
or 15 year old version the PHP where
Chris will still work on it okay you
might get the occasional like debug
notice there's some care law but if
you've got WT debug turned on but what
present won't stop working some pieces
will break but for the most part will
work okay and one that is used quite
often is WP hash password again a
portable function you can define this
for yourself but actually asteroids for
users or password protected posts or
whatever else is really really important
and so it alternatively the wp hashed
password or in addition to hashed
password we also have like on a hash
brown sort of validate have sweeping out
the function to undo this hashing and
verify that what's behind it is correct
but we include a password hash library
that's actually written by the folks
that make phpmailer it has another open
source GPL license piece of software
that were able to inherit inside of
wordpress because it happens if it would
eat those and the license and they've
solved that problem for us alright the
only maintenance version process is
updating new versions of PHP mailer and
House pradesh the name of these new
versions of their software then
ultimately we can reviews new version
their new packages of wordpress with
their version of password hash or page
80 mailers this doesn't happen really as
often as you might think uh and
WordPress is kind of interesting as a
piece of software because it it uncle's
many other open source packages and
pieces of software requests ap mailer a
single pilot the list goes on and on and
on and on along with that is WP generate
password know the thing I like about PHP
I feel like I'm cheating sometimes
because it mostly live most of my world
in PHP and I feel like it's pretty
syntactically simple it's kind of like
basic like it kind of easy like you
married left the right top to bottom we
go like oh this this and that
writers makes most least most makes
reading mostly pretty much make some
sense but in addition to this function
being portable wordpress comes with a
pretty sophisticated actions and filters
ap on until the very bottom of this
function you'll see we do apply filters
and then we pass that straight through
level which means if you were an
enterprising plug-in developer or PHP
developer who wanted to override
generate password you could filter
random password with your own return
value and intercept that on purpose with
something else and so if you can't get
ahead of this function we want you to be
able to at least get behind to validate
it to look at what the result is and
then be able to do something with that
value so in many ways WordPress is sort
of silently designed to be as flexible
from every direction as it possibly can
be and so there are as you could imagine
security implications are concerning
occasionally with this but when security
issues come up in WordPress is literally
this filters and things at not usually
the thing that happens it's usually
logic error it's usually developer who
with good intentions wrote some piece of
code that ended up to be vulnerable
sufferable to something that they didn't
activator everything that WordPress
employees literally all over the place
except for when you're a logged out user
the second you are off if you are logged
in the WordPress uses what's called with
nuts it uses kind of a poor man's
version of an ounce no manam stands for
tradition too terrible acronym but
number only used once in WordPress
doesn't keep a table of numbers so it's
not like they're unique and only use
one's ever in the history of WordPress
and generally speaking announces are
usually good for 12 or 24 hours so they
might actually perpetuate through a user
session or so
else but if you don't want them to stay
static with your login session you want
announcer to be fresher and every single
page load its global function that you
can override and I just happened we do
that on wordpress.org to make sure that
everything that you're doing is invoked
with the ultimate of possible intentions
you can have and that's what nonsense
you a check for user retention they say
this link this URL on the web is unique
for this user if the NOC doesn't match
then you're not allowed to do those
things and the way that works it's an
intention jacquard did you mean to
logout yes or hell if you need to delete
that post yes or no if you need to doing
that user that site that content yes or
no they're not doesn't match or scale or
you had the browser open for longer than
an ounce would take to expire then word
prices are going to trust that request
and at Knoxville fail will not validate
and that request will now proceed and so
it's a way for workers to protect your
content to your users in your posts and
everything else and in the world of
WordPress where there are 60,000 plugins
and about 5,000 active free themes and
the public repository even though we try
really hard to a code review and look at
what it was doing and releasing and
they'll announces are one of the things
that are really easy to forget because
you're deep in the code and sort of
trying to make your plug-in or thing
team do its thing and this is one of
those things that you need to forget we
have lots of functions to make it easy
but it's still easy to forget that you
have to evaluate what if the users are
doing and we use a WP not stick and then
we use any hash which are also both
political functions you can have your
own algorithms for generating unique
numbers across all of your WordPress
installation if you really want to in
addition to having of themselves to keep
the last thing that i have for wordpress
poly notes is the random compact holder
and so this is something that wordpress
chose the back part from PHP 7 and
include
with WordPress it so it's a bunch of
weird random compatibility library that
PHP said that came with the generate
numbers and randomization of all sorts
of things PHP 7 comes with this by
default we have lots of plug-in
developers and themes that are using and
relying on PHP 7 related functions and
so we want to provide that functionality
regardless of the version of PHP that
someone might be using on their server
you never know and so what happens is if
I write a plug-in ever live at PHP 7
function and someone downloads that
plug-in and it's all done on a server
that's running PHP by if WordPress
breaks also have your users is that for
me as they have a wordpress because it
looks sad it looks like something
happened that shouldn't have happened
and have a piece of software we're sort
of that I developers we know we can
include compatibility for these really
critical important things and make sure
that everyone that is trying to do their
best to keep WordPress here has the
ability to do so in addition to this
sense start to run out of time and you
have time for questions if y'all have
any and I figure this is somewhat
relevant for the audience wordpress
historically has only had an inbox and
email address for piloting or letting us
know about security issues we still have
that security at wordpress.org you can
use it it will come to us we will
respond to you and you know help you out
and figure out what it is and that's
really great that's worked really well
for us for really long time but the
problem with an email address like that
or a inbox is that is very few eyes that
are allowed to see it only trusted
individuals like really trusted
individuals are on the inbox lists that
are going to get security issues forward
to them which is sort of problematic
because the thing with security in
general is you do want more eyes on the
things that are critically important
it's just hard to get to a point we know
who ability to do with a good and what
attentions are everything else and so
over the course of recent months and a
company that I worked at a long time ago
automatic uses hacker one for wordpress
com but wordpress.org buddypress baby
Prescott breasts all of the
wordpress.org sites have all switched
over to using hacker one after one is
essentially a you know sort of social
ish network ish thing or about being the
bounty program for white hat hackers
that want to responsibly disclose carry
issues in a way that lets open source
close source project 22 facebook users
that their game to use a bit of to be
able to save epon to plug in your
software we're letting you know
privately we have potentially patching
this bug or you privately and letting
you assign about me to it to get any
couple of bucks in some cases thousands
of dollars sometimes 1337 dollars
because it's kind of that awesome of
above and so if you haven't used after
one you haven't heard anybody i would
check it out it's pretty sweet actually
they've made a lot of adjustments and
changes based on our feedback and other
people skate that over the course of the
past two years so the people who run
hacker one are doing really good job and
so we have nothing look really good and
stephen and so that is relevant they
think to most of you and then Michael in
a statement the reason that we use
polish builds in general this is now a
responsibility to keep the website or
crisis all over the place or cry
scholars part of the New York Times
their address powers part of ZN
wordpress powers all sorts of weird
website to you would never know or care
about powering and so if we don't keep
it secure that we don't let other people
keep it more secure and we don't provide
polyfill functionality to let other
people make it better then we're doing
the web a huge huge disservice and so we
include polyfill to make things buggalo
so that the web is literally as safe as
we can possibly make it my closing ish
statement is a quote from one of the
UNIX philosophy which I will let you
gloss over
and all of its glory which i think is
sort of part of the way that word price
and a piece of software letterhead good
or bad reputation what have you heard
whatever happens is applicable and so if
you are building something if you're a
tinkerer your engineer if you love build
myself you want to open source and
release it to the world I think this is
really really relevant it's important to
get something out there it's important
your ship it it doesn't have to
necessarily be perfect but once it's out
and people are enjoying it you've got
lots of time it's a native letter and
that's what we do in Holly bills we try
our best to make wordpress better every
day and thank you for your time and I
have four minutes for questions if
anybody has any how does to do even
about security a wordpress of security
of scaling web and security about 39
broken both wordpress com and oregon
accidents and take it a whole thing down
for minutes at a time how can you share
any of those stories ok every time ok
how did i break wordpress com
wordpress.com is it interesting beast in
that it still runs wordpress wordpress
multi-site but it reversed the load
order of a lot of code because it was
lovely section of the current user play
super early are you logged in are you
admin on wordpress com can you see stuff
most people can't and so knowing that i
was like i was really cool that we have
this but it's totally wrong I guess not
the way that requests works and so I
spent some time cleaning up some really
old terrible wordpress com code and the
process of that accidentally allowed
every spam blog to get visited I on
authenticated users and so I get a ping
from very abrahamson which you don't
want to get a painting from very heey
talks on the web brilliant brilliant
systems
friend of mine who's like you need to
revert that last play why what did I
it's totally a queue miss there's
nothing in there and very says yeah
you've exposed all the spam blogs lines
okay well over at that real quick so
that didn't necessarily take all workers
calm down but it's like traffic on every
single one of the auto 3000 web servers
across the world that our WordPress the
comments on so I bet also with
wordpress.org of wordpress.org we
trusted or buprestid or gore camp or
guat breasts all these websites are on a
network of about forty servers I think
even API don't wordpress.org is on there
which is incredible because it serves a
good site amount of traffic when workers
update but they all share users tables
and the user and user meta database
tables are global and they have their
own database server clusters now
surgeons way that power all the users
table concessions for wordpress.org and
we're kind of a constant that you can
define to not let WordPress update
global tables ever which means a data
schema change we had a column we have I
kind of column and make it a bigger
advantage or whatever it is that we
choose to do don't update those tables
so the interesting thing with that
setting is it only has really checked on
multi-site installations of WordPress
and we were pretty confident that that
was like all building across all of
WordPress adoring everywhere there was
one site that was a single site
installed WordPress that was using those
users tables and so I on the sandbox
Jesus life data run it commits it deploy
it update ed presador which at that
point was a single site title and
hearing on my sandbox to watch it go
through the thing and instantly na geo
starts paying IRC crazy servers of the
whole like all of wordpress.org all
decides API everything white screen
everybody's across the entire
I mean we have that constant set except
super deep then everybody sandboxes and
configs I kind of hadn't even thought
about it probably five years that like
that was a problem that I would ever
have in my life it was like a thing I'm
very did you look great user tables
that's all right i did but totally not a
purpose can i can watch it happen so
clearly i did but oops and so its up 10
minutes 48 million rows and probably 100
million user better roads like a new
scheme of a mysql and chug through it
lots to go away and after the slave to
catch up and you know go through all the
thing and so that was my horror story of
taking all for customer with them
because in one line literally women ago
that you know whoops so I've got zero
zero minutes so thank you for time
appreciate ur
[Applause]