4 ms·
I don't see why Django CMS will be more secure than WordPress or other way. From a coding point of view, the more people works on it, the more chance the secur
by kureikain 10y ago
I don't see why Django CMS will be more secure than WordPress or other way.
From a coding point of view, the more people works on it, the more chance the security issue will be noticed and fixed. Rails, Django or any framework in general always have security issues at some time.
The issue of WordPress is come from the easy to use. The ability to install plugin require write permission from the user that run WordPress.
Second, many WordPress plugin expose executable-php file in plugin folder that is invokeable via hitting directly that url.
So if Django CMS has that ability, allow downloading 3rd-code and run it, I'm not sure if it's more secure than WordPress.
WordPress is just as secure as any Rails or Django app. Bug happens, people fix.
- deleted 10y ago[deleted]
- est 10y ago> Rails, Django or any framework in general always have security issues at some time. No. Rails & Django have vast smaller attack surface than PHP's default.
- lima 10y agoAlso, when was the last time you could compromise a Django install or even get remote code execution?
- DanieleProcida 10y agoIt's ironic that what's behind WordPress's fabled ease-of-deployment (i.e. allowing third-party code to be downloaded an executed) is also what's behind many of its security weaknesses. Doing that is pretty much impossible in Django.
- acoard 10y agoShopify's EmbeddedSDK does plugins (or "apps") very securely, but it comes at a development price. Instead of getting write access and running code on the server directly, you basically interact with an API via an embedded web page. Basically an Iframe. The API is more secure than getting to execute arbitrary code; but it is more restricting as a developer. Not perfect, but much better.