David G. Johnson

14.3K posts

David G. Johnson banner
David G. Johnson

David G. Johnson

@TheDavidJohnson

Brand Bard @StellarWP / @LiquidWeb / @Nexcess connoisseur of caffeine | neurodivergent | occasionally behind a microphone

Southern California 가입일 Kasım 2008
14.2K 팔로잉16.3K 팔로워
David G. Johnson
David G. Johnson@TheDavidJohnson·
A new — and entirely *not* new — attack on WordPress sites: buy commercial plugins, insert sneaky backdoors, then wait to activate them. Check your sites for these 30+ plugins. H/T: @kathyzant
Austin Ginder@austinginder

Backdoor was planted in 30+ WordPress plugins from Essential Plugin (formerly WP Online Support). If you have any of their plugins installed be sure to patch them and check if your wp-config.php was compromised. anchor.host/someone-bought…

English
0
0
2
126
David G. Johnson 리트윗함
PressConf
PressConf@Press__Conf·
“Is there a future for WordPress plugins?” 👀 @learnwithmattc took the stage at #PressConf2026 and asked the question many are thinking, but few are saying out loud. A session that challenged assumptions and opened the door for real conversation. #PressConf #WordPress #WPcommunity
PressConf tweet mediaPressConf tweet mediaPressConf tweet media
English
3
3
17
2.2K
David G. Johnson 리트윗함
The Repository
The Repository@therepositorywp·
Cloudflare has launched EmDash, a new CMS it's calling the "spiritual successor to WordPress," drawing swift pushback from co-founder Matt Mullenweg and much of the community. therepository.email/cloudflare-lau…
English
0
4
16
4.4K
David G. Johnson 리트윗함
Proton Pass
Proton Pass@Proton_Pass·
did you know, the purple in the chrome logo signifies protecting privacy?
Proton Pass tweet media
English
58
59
929
43.9K
David G. Johnson 리트윗함
:Cromwell:
:Cromwell:@learnwithmattc·
We have the authors of the EmDash project LIVE on WP Product Talk tomorrow, live from @Press__Conf . This should be an exciting and highly topical conversation you won't want to miss. Special time alert 9:30am Pacific! Tune in live to ask your own questions.
WP Product Talk@WPProductTalk

We're excited to host @MattieTK and Matt Kane from @Cloudflare tomorrow LIVE on to talk all about EmDash. Is EmDash a threat to the WP ecosystem, or an opportunity? Tune in live tomorrow at a special time: 9:30am Pacific, 12:30pm Eastern, 5:30pm GMT youtube.com/watch?v=etL7Ke…

English
3
6
22
1.4K
David G. Johnson
David G. Johnson@TheDavidJohnson·
@benUNC This was a life changer at my house! The one... I... no longer live in 😭
English
0
0
1
44
Ben Meredith
Ben Meredith@benUNC·
I just crimped my first CAT6 wire and I may have unleashed an actual monster. I'm about to wire every room in this house with an ethernet port.
English
2
0
6
183
David G. Johnson 리트윗함
Reid Wiseman
Reid Wiseman@astro_reid·
There are no words.
Reid Wiseman tweet media
English
7.9K
86.3K
649.3K
38.3M
David G. Johnson
David G. Johnson@TheDavidJohnson·
Downloading the same Google Doc as .docx, .odt., and .pdf all work as expected as well.
English
0
0
1
25
David G. Johnson
David G. Johnson@TheDavidJohnson·
Hey @googledocs is there a file size limitation on the Download as Markdown functionality? Recently started getting empty (as in 0 bytes) .md files downloaded to my machine when using the "All Tabs" option for a larger (> 20MB) Docs file. "Current Tab" continues to work fine.
English
1
0
1
101
David G. Johnson
David G. Johnson@TheDavidJohnson·
Maybe this is something for @AskWorkspace as this is for a Google Workspace account?
David G. Johnson@TheDavidJohnson

Hey @googledocs is there a file size limitation on the Download as Markdown functionality? Recently started getting empty (as in 0 bytes) .md files downloaded to my machine when using the "All Tabs" option for a larger (> 20MB) Docs file. "Current Tab" continues to work fine.

English
0
0
0
56
David G. Johnson
David G. Johnson@TheDavidJohnson·
@davepl1968 also ruthlessly stick to the knitting and defend the quality of the product —even to the point of being offensive about it.
English
0
0
0
446
David G. Johnson
David G. Johnson@TheDavidJohnson·
A funny artifact of moving to the west coast of the US is that many April Fool's posts are timestamped on March 31st, which creates mild cognitive dissonance as of course by habit I check the date on ridiculous-sounding shit.
English
0
0
1
46
David G. Johnson 리트윗함
Dave W Plummer
Dave W Plummer@davepl1968·
Axios Explained Let's say you’re writing a server that talks to some API. In your code, you include an authentication token so the API knows the request is coming from you. Under normal circumstances, this is completely fine. You send a request to something like api.myapp.com, Axios attaches your Authorization header, and everything behaves as expected. The problem starts when the URL you’re calling is no longer fully under your control. If your code allows a user to influence the URL, maybe through a query parameter, a form field, or some configuration, then an attacker can change where Axios sends the request. Instead of calling your trusted API, your server might end up making a request to a domain controlled by the attacker. Axios doesn’t inherently know which domains are safe and which aren’t; it just sends the request to whatever URL it’s given. If your code also attaches sensitive headers like API tokens or cookies, those get sent along for the ride. At that point, you’ve effectively handed your credentials to the attacker. There’s an even subtler version of this involving redirects. Even if your code hardcodes a “safe” URL, the server you contact can respond with a redirect (like an HTTP 302) pointing somewhere else. Axios, by default, follows redirects automatically. In some cases, it may continue sending headers like Authorization when following that redirect. If the redirect points to a malicious domain, your sensitive data can leak without you ever explicitly calling that domain in your code. This class of issue is dangerous because it turns your server into a kind of proxy that the attacker can control. It’s often categorized as server-side request forgery (SSRF), and when combined with credential leakage, it can lead to account compromise or access to internal systems. The root problem isn’t that Axios itself is broken. It’s that it behaves EXACTLY as instructed. It doesn’t enforce trust boundaries for you. If untrusted input controls the destination, or if redirects aren’t handled carefully, Axios will faithfully deliver your request (and your secrets) to wherever it gets pointed. The fix is to explicitly enforce those trust boundaries in YOUR code. Only allow requests to known, trusted domains. Validate and parse URLs before using them. Attach sensitive headers only when you’re sure the destination is allowed. And, if necessary, restrict or disable automatic redirects so you can verify where a request is actually going before continuing. The key takeaway is simple: when using Axios (or any HTTP client), you have to treat the destination URL as a security-critical input. If you don’t control it, you don’t control where your secrets go.
English
4
17
180
18.6K
David G. Johnson
David G. Johnson@TheDavidJohnson·
Just grabbed my ticket for the Web Agency Summit 6 this year (the biggest event in our space) - See you there?? It's free and it's always amazing! atarim.io/summit @atarim_io
English
0
0
3
366
David G. Johnson
David G. Johnson@TheDavidJohnson·
Because that's what people do. They leap. And hope to God they can fly. 'Cause otherwise, we just... drop like a rock... wondering the whole way down, "Why in the HELL did I jump?"
English
0
0
1
39