3 ms·

If this was your personal site or a custom CMS, odds are there wouldn't be enough community support to report bugs (or exploits) like this one. You'd simply go

If this was your personal site or a custom CMS, odds are there wouldn't be enough community support to report bugs (or exploits) like this one. You'd simply go about your business thinking your site was secure.

idlewords 17y ago
If it was my personal site, I would serve flat files. The fundamental problem with Wordpress is a design decision to have live code serving what could easily be static content. If there is no code, there's no exploit.
wildmXranat 17y ago
I know he didn't state which direction he chose, but assuming that he's incompetent is pretty bad on your part. I remember few months ago, wordpress had a bug where an attacker could keep on resetting administrators account password. He might actually have a point
- jqueryin 17y ago
  Incompetence has nothing to do with it. It's just all too common that we overlook something in our code. All software inherently has bugs as no developer is perfect. There's alot to be said about having millions of prying eyes nitpicking your source code. I'd much assume millions of people critiqued my code as opposed to none at all.
  - shrughes 17y ago
    Have you looked at the code? When I started using WordPress on my personal site, people warned me not to look behind the curtains. It seems pretty notorious for being a mess.
erlanger 17y ago
Some software needs more of this sort of assistance than others.
tptacek 17y ago
Wordpress is many good things. Secure is not one of them. It has a genuinely weak design.
oscardelben 17y ago
Personally, the reason is that there are often many security issues related with wordpress. I know that no software is perfect, but if I write the software I can be responsible for it, while if I rely on other people software I'm still responsible but for something I don't truly understand. I think wordpress is a fantastic blogging platform, but from a security perspective it's not.

idlewords 17y ago

If it was my personal site, I would serve flat files. The fundamental problem with Wordpress is a design decision to have live code serving what could easily be static content. If there is no code, there's no exploit.

wildmXranat 17y ago

I know he didn't state which direction he chose, but assuming that he's incompetent is pretty bad on your part. I remember few months ago, wordpress had a bug where an attacker could keep on resetting administrators account password. He might actually have a point

jqueryin 17y ago
Incompetence has nothing to do with it. It's just all too common that we overlook something in our code. All software inherently has bugs as no developer is perfect. There's alot to be said about having millions of prying eyes nitpicking your source code. I'd much assume millions of people critiqued my code as opposed to none at all.
- shrughes 17y ago
  Have you looked at the code? When I started using WordPress on my personal site, people warned me not to look behind the curtains. It seems pretty notorious for being a mess.

erlanger 17y ago

Some software needs more of this sort of assistance than others.

tptacek 17y ago

Wordpress is many good things. Secure is not one of them. It has a genuinely weak design.

oscardelben 17y ago

Personally, the reason is that there are often many security issues related with wordpress. I know that no software is perfect, but if I write the software I can be responsible for it, while if I rely on other people software I'm still responsible but for something I don't truly understand. I think wordpress is a fantastic blogging platform, but from a security perspective it's not.