I don’t think we have enough people to review each new release.
What I think is that you should trust the developer to install a plugin, but as you said if a plugin is hosted on a bad hosting it can be hacked and the plugin can be overwritten with malicious code.
The way I intended this to work is by manually updating the current version on the directory dashboard (as a plugin author). What’s easier? … upload my plugin to two directories (WordPress and ClassicPress) or do it once and change the version manually in the other place? well… both require a minute or two.
That could potentially happen… could be a point. Then: stick to “hosted on WordPress, GitHub, GitLab…” sites where the being-hacked probability is low?
As far as I know, it doesn’t matter where the plugin is hosted, you can always edit it in a new version to be a bad person… even on the WordPress directory.
That could potentially happen… could be a point. Then: stick to “hosted on WordPress, GitHub, GitLab…” sites where the being-hacked probability is low?
Yes basically. since CP is a listing every listing should include a field where to point to fetch updates. We can allow updates coming from WP repo (that is SVN), github, gitlab… where the chance to be hacked is low (these repos have strong security measure in place to prevent hacking of their servers).
I agree that a bad dev can update the plugin to include malicious code, but this is a very rare occurrence and if one lists his plugin on WP or CP and it undergoes review one can assume that dev is trusted. If the dev is discovered to put malicious code in its plugins it gets kicked out (this already happens in WP because the bad code is discovered and outed, so we can apply same measure to plugin listed in CP)
This discussion has served its purpose to identify a way to manage updates for WP repo and CP directory plugins/themes. So it will be closed.
However, the WordPress repo as a source discussion will be moved to Github to continue to explore this possibility. Anyone interested (@alvarofranz @joyously) in this discussion can monitor or participate here:
Thanks to everyone who participated, we appreciate your feedback.