Plugin Update Cooldown

BraveWalrus

wordpress.org is temporarily delaying all plugin and theme updates by 24 hours before they're pushed out to auto-updaters.

This looks like a prudent buffer in light of the recent supply chain issues.

ivanvallejo

I think 24 hours isn't long enough to make it through any kind of human review - especially with that many plugins (78,000, by my count).

I've read about some recent plugin hijack cases - the malicious updates were live for weeks before anyone noticed that they'd been compromised.

One quick question, what would a 24 hour wait have caught in those cases?

MaxLarsson

And - if I read correctly, would it not delay important security patches as well by a day?

John-Cohen

This is only for auto updates.

For me to manually update the plugin, I can update it instantly in the plugin page.

This seems like a temporary fix.

ivanvallejo

The point is really giving the automated scanners a day before the update hits sites auto-updated to see if that change looks malicious in a diff. It's not about human review!

SamuelJohnson

After the podcast episode, we just turned off plugin auto-updates on all client sites.

Now I review the plugin change logs weekly instead.

There's always one that I thought, "Man.

This ain't normal.!" and it was just a bug fix.

ioan

As a shop without developer on standby, with auto-updates off we probably see a bug fix from a plugin in that first week - then go months without a security patch for an issue that could impact us without us being able to do anything.

The bigger risk is probably missing a security fix not getting a bug.

If I get a plugin update, I have an easy chance to close a security hole. So it's best I take the chance. But with auto-updates off I don't get it (for months). So I am at more risk of problems.

BraveWalrus

It's a 24 hour "scan-able" window not a review.

And I've got auto-updates on for the exact reason described above.