3 ms·

I respect the work these researchers are doing. But to be blunt: if I had that kind of sensitive data, there is no way I'd even consider having a WordPress on

by bhauer 11y ago

I respect the work these researchers are doing. But to be blunt: if I had that kind of sensitive data, there is no way I'd even consider having a WordPress on the same network. I'm not a security expert, but I like to think I avoid the most obvious pitfalls. And WordPress strikes me as a security pit the size of a continent and there are many reasonable alternatives.

CM30 11y ago
To be fair, you're pretty much gonna hit trouble if you're using third party plugins and themes for any script. That's because they're made by just about everyone and anyone and often not vetted for security or code quality purposes. WordPress on its own can be kept moderately secure, as can any other major script in this market. But if you're installing themes and plugins without knowing exactly what they're doing, then you're gonna have security problems regardless of the script. Doesn't matter if its WordPress, Drupal, Joomla, Magento or anything else, third party plugins and themes are usually the weakest part of the site.
creullin 11y ago
Eh, it wasn't WordPress per se, but a plugin. This plugin's vulnerability was also posted YEARS ago. So I wouldn't blame WP (in this case). As a dev, I've come across plenty of out of date CMS/ modules/ plugins that had huge security holes in them. It's part of the 'build and forget' mentality that seems to be widespread these days.
- technion 11y ago
  As much as I'll be the first to say "update your damned plugins" to every Wordpress dev, there's more to it than that. Revslider is a "premium" plugin, which means you buy the plugin, and then, optionally, ongoing support, which includes updates. You can logon to Wordpress and there's a big "click here to update all your plugins" button. And you press it, and it will say "you are fully updated now!" or something to that effect. To update revslider, you're supposed to use your support agreement to logon to the distributor's website, and go download and install an update separately. I've seen dozens of revslider deployments and I've never yet had a developer believe there was anything more to it than pressing the "automatic update" button, which basically lies to you in the case of premium plugins. I'm perfectly happy blaming Wordpress - because it needs a mechanism of saying "nope, this plugin requires a support agreement. It is however, vulnerable".
ArnoldP 11y ago
It's ridiculous that they had so much information online at all.

by bhauer 11y ago

CM30 11y ago

To be fair, you're pretty much gonna hit trouble if you're using third party plugins and themes for any script. That's because they're made by just about everyone and anyone and often not vetted for security or code quality purposes. WordPress on its own can be kept moderately secure, as can any other major script in this market. But if you're installing themes and plugins without knowing exactly what they're doing, then you're gonna have security problems regardless of the script. Doesn't matter if its WordPress, Drupal, Joomla, Magento or anything else, third party plugins and themes are usually the weakest part of the site.

creullin 11y ago

Eh, it wasn't WordPress per se, but a plugin. This plugin's vulnerability was also posted YEARS ago. So I wouldn't blame WP (in this case). As a dev, I've come across plenty of out of date CMS/ modules/ plugins that had huge security holes in them. It's part of the 'build and forget' mentality that seems to be widespread these days.

technion 11y ago
As much as I'll be the first to say "update your damned plugins" to every Wordpress dev, there's more to it than that. Revslider is a "premium" plugin, which means you buy the plugin, and then, optionally, ongoing support, which includes updates. You can logon to Wordpress and there's a big "click here to update all your plugins" button. And you press it, and it will say "you are fully updated now!" or something to that effect. To update revslider, you're supposed to use your support agreement to logon to the distributor's website, and go download and install an update separately. I've seen dozens of revslider deployments and I've never yet had a developer believe there was anything more to it than pressing the "automatic update" button, which basically lies to you in the case of premium plugins. I'm perfectly happy blaming Wordpress - because it needs a mechanism of saying "nope, this plugin requires a support agreement. It is however, vulnerable".

ArnoldP 11y ago

It's ridiculous that they had so much information online at all.