Most active commenters
  • CharlesW(3)

←back to thread

Secure Custom Fields by WordPress.org

(wordpress.org)
172 points ValentineC | 14 comments | 12 Oct 24 18:38 UTC | HN request time: 2.147s | source | bottom
Show context
CharlesW ◴[12 Oct 24 19:27 UTC] No.41821726[source]▶
So WordPress-the-org — which is effectively Matt, as far as I can tell — just Sherlocked a developer's plug-in using the developer's own code, ostensibly as retribution for a security issue that the developer had already fixed. https://www.advancedcustomfields.com/blog/acf-6-3-8-security...

What am I missing?

replies(5): >>41821790 #>>41821829 #>>41821872 #>>41821880 #>>41823351 #
1. sureIy ◴[12 Oct 24 19:44 UTC] No.41821872[source]▶
> Sherlocked

The verb you're looking for is stole

Sherloking is when a Walmart is built next to a cornershop. Here the dude tore open the corner shop while claiming to be a victim.

replies(2): >>41821969 #>>41821973 #
2. snapetom ◴[12 Oct 24 19:55 UTC] No.41821969[source]▶
Or, more blatant and accurate, Sherlocking is when Apple literally named their search product "Sherlock" when a popular third party shareware app named "Watson" already existed.
3. CharlesW ◴[12 Oct 24 19:56 UTC] No.41821973[source]▶
When I posted, I was under the impression that ACF was open source. But the GitHub repo doesn’t list one, so if it’s not open source…WTF.
replies(3): >>41822031 #>>41822266 #>>41822313 #
4. ValentineC ◴[12 Oct 24 20:02 UTC] No.41822031[source]▶
> When I posted, I was under the impression that ACF was open source. But the GitHub repo doesn’t list one, so if it’s not open source…WTF.

Isn't it here?

https://github.com/AdvancedCustomFields/acf

If you mean the licence, it's in readme.txt:

https://github.com/AdvancedCustomFields/acf/blob/master/read...

replies(2): >>41822094 #>>41822095 #
5. CharlesW ◴[12 Oct 24 20:10 UTC] No.41822094{3}[source]▶
Thanks! The GitHub app reports it as "None" (https://imgur.com/a/5dyaTfX), but now I see it's "GPLv2 or later".
6. forrestthewoods ◴[12 Oct 24 20:10 UTC] No.41822095{3}[source]▶
Clearly AdvancedCustomFields should have filed a trademark to prohibit Wordpress from fully stealing it.

GPL code, trademarked branding. If you want to fork then you have to actually fork.

Oh the irony.

replies(1): >>41822159 #
7. ValentineC ◴[12 Oct 24 20:17 UTC] No.41822159{4}[source]▶
> Clearly AdvancedCustomFields should have filed a trademark to prohibit Wordpress from fully stealing it.

They did:

Advanced Custom Fields — https://tsdr.uspto.gov/#caseNumber=98321164&caseSearchType=U...

ACF — https://tsdr.uspto.gov/#caseNumber=98321135&caseSearchType=U...

replies(1): >>41823617 #
8. danillonunes ◴[12 Oct 24 20:28 UTC] No.41822266[source]▶
I think being GPL is a requirement to host plugins in wp.org, so yes, that free version available there is (was?) open source.
9. sureIy ◴[12 Oct 24 20:33 UTC] No.41822313[source]▶
Forking isn't the issue. Here they just took the whole ID/address from which existing installations will continue to be updated from. This is theft. I have no doubt it will be added to the lawsuit.

While technically they own the platform and can do whatever they want, there is clearly ill intent here and it'll be used against them.

10. forrestthewoods ◴[12 Oct 24 23:20 UTC] No.41823617{5}[source]▶
Oh nice. Then WordPress shouldn’t be able to take over without renaming, right?
replies(1): >>41825544 #
11. prettymuchnoone ◴[13 Oct 24 05:56 UTC] No.41825544{6}[source]▶
they renamed to "secure custom fields"
replies(1): >>41830955 #
12. everforward ◴[13 Oct 24 19:48 UTC] No.41830955{7}[source]▶
They kept the permalink afaik, which is probably still likely to cause confusion in the marketplace and may still be a trademark issue.

Without knowing this drama, if I found and clicked an ACF link on a 2 year old Reddit post and ended up at Secure Custom Fields, I’m not sure I’d know it wasn’t by the ACF folks. Just their branding for the v2 or whatever. I think customers have a reasonable expectation that permalinks won’t take them to unrelated products.

replies(1): >>41831541 #
13. mthoms ◴[13 Oct 24 20:59 UTC] No.41831541{8}[source]▶
Yep. And the string 'acf' is used throughout the plugin and the plugin download page (in reviews, etc). And 'acf' is indeed a pending trademark registration.

Not good.

replies(1): >>41883933 #
14. saaaaaam ◴[18 Oct 24 22:07 UTC] No.41883933{9}[source]▶
Very much doubt they will be able to trademark “acf”.