4 ms·

I wonder if Wordpress is especially poor security-wise or simply it's popularity attacts too much bad attention.

• deleted 16y ago
  [deleted]
• jerf 16y ago
  I wanted to snark "yes", but truthfully, the problem is that Wordpress' security has been average, not especially bad. The problem is that average is terrible. Most average products don't get hit with this level of scrutiny, but certainly the sort of errors that Wordpress makes with frightening regularity are made by numerous other commercial and open source projects as well.
  • tptacek 16y ago
    There are unforced errors in Wordpress. Every web application will have a cross-site scripting mistake. It takes a special one to have "anonymous commenter" -> "admin" privilege escalation, or executable style templates.
    • jerf 16y ago
      Alas, I could (but won't) name fairly equivalent errors made at a place that I may or may not work. (If not worse than the ones you mention.) I think the only place we differ here is our exact level of cynicism. "More cynical than tptacek" probably means I need to tone it down.
      • tptacek 16y ago
        That is my favorite Hacker News comment sentence of the year. Thanks.