4 ms·
Yeah, and WordPress is not outside the mainstream in their views on security either but they're wrong (which is constantly proven by how often WordPress sites g
by ebbv 10y ago
Yeah, and WordPress is not outside the mainstream in their views on security either but they're wrong (which is constantly proven by how often WordPress sites get compromised.)
Part of my comment was directed at the fact that the mainstream standards of security for web developers (speaking as one myself) are too low.
- tptacek 10y agoThis is a non sequitur. Also: WordPress is far outside the mainstream of security practice; they are, and have been for coming up on a full decade, a running joke in the field. Nobody says that about Google.
- ebbv 10y agoWordPress is the mainstream of web development. It's not a non-sequitur because you brought up "the mainstream". If you're saying that you meant the mainstream of security professionals specifically, I'd be interested in what a survey of security professionals had to say about open redirect. For me it's clearly a potential attack vector, and Google's specific implementation is obviously sloppy and lazy. I can't see any security professional worth their salt giving it a pass. As far as Google not being a running joke, that's true and it's all the more reason it's surprising they are so dismissive of concerns about their way too broad whitelist.
- tptacek 10y agoI feel like at this point we both understand the point I was making and don't need to litigate it further. You can and should feel free to disagree with it, but there's a reason pentesters file open redirects sev:lo. (XSS is the canonical sev:medium, for what it's worth).
- throwaway5752 10y agox
- ebbv 10y agoMan if you are afraid to disagree with someone just because of who they are I feel bad for you. I've let pg have it on here when I disagreed with him. It doesn't matter. Everybody's wrong sometimes.
- tptacek 10y agoI'm one of your downvoters. :)
- deleted 10y ago[deleted]
- deleted 10y ago[deleted]
- deleted 10y ago[deleted]
- tnorthcutt 10y agoThis is a bit off-topic, but can you expand on this with regard to WordPress, or possibly link to someone who has? I work with WordPress and would be eager to learn more about where & how it's deficient, and how to guard against those deficiencies better.
- Tushon 10y agoNot your OP and this seems very searchable, but here you go: https://premium.wpmudev.org/blog/wordpress-security-exploits/ https://premium.wpmudev.org/blog/wordpress-security-exploits... https://www.wordfence.com/learn/how-to-protect-yourself-from-wordpress-security-issues/ https://www.wordfence.com/learn/how-to-protect-yourself-from...