3 ms·
Looks nice, but I don't think a CMS is the right place to do things like HPKP (HTTP public key pinning). That's the webserver's job. Any CMS can be used with HP
by kijin 10y ago
Looks nice, but I don't think a CMS is the right place to do things like HPKP (HTTP public key pinning). That's the webserver's job. Any CMS can be used with HPKP if you just add a couple of lines to your Apache/nginx configuration.
Many of the other items on the list are unfair to CMS's with a large and thriving plugin ecosystem. WordPress has a whole bunch of 2FA plugins to choose from. Security is a worthy goal, but when it comes to CMS's, a healthy FOSS ecosystem is just as important to support and nurture. You can't try to do everything in the core.
- CiPHPerCoder 10y ago> Many of the other items on the list are unfair to CMS's with a large and thriving plugin ecosystem. It is explicitly an out-of-the-box comparison. > Security is a worthy goal, but when it comes to CMS's, a healthy FOSS ecosystem is just as important to support and nurture. You can't try to do everything in the core. We agree. Airship is free software and has powerful support for plugins. We just try to solve 99% of the security problems in the core so plugin developers can just use the features we provide and don't have to worry about low-level concerns.