6 ms·

I'm looking at the "dead" comment by PravlageTiem. I understand that PravlageTiem was being sarcastic, and some people feel that sarcasm undermines the tone tha

I'm looking at the "dead" comment by PravlageTiem. I understand that PravlageTiem was being sarcastic, and some people feel that sarcasm undermines the tone that is supposed to prevail on Hacker News. But still, PravlageTiem raises an important point: WordPress has historically been a security nightmare. Possibly there was a tone of anger in the way PravlageTiem expressed themselves, but the security flaws in WordPress are worth discussing any time that WordPress is discussed. Certainly, when I have a freelance client, and they ask me "Should we use WordPress?" I typically answer with some long version of "It has a good admin section for non-technical users, and also designers love it, but it also has a lot of security flaws."

teach 10y ago
That's why wpengine is such an excellent choice for a lot of users. On the topic of PravlageTiem, the issue of WordPress' security flaws seems to be incidental to his attempt to accuse Sam Altman of censorship. If I had to guess, that would be why the comment is dead. I wouldn't call that sarcasm.
- sean_patel 10y ago
  > wpengine is such an excellent choice for a lot of users. Here we go! Like I stated in my comment, companies like WP Engine, Sucuri and other can easily charge 100$ + for what costs < 5$ to host, because it's wordpress and they "guarantee" a secure un-hackable website. Fear is a great motivator.
  - CPLX 10y ago
    Another great motivator is that $30 or $100 is utterly trivial in the context of any website that has some actual business value and investment in its content and design. I know we're all conditioned to think web services should be nearly costless but I happily pay my WPengine bill for multiple sites every month and consider them keeping an eye on things a very good value for my fairly nominal expenditure.
- jasonbarone 10y ago
  Even with WPengine, security issues are a very common thing. WPengine can keep some things up to date, but plugins and themes are exploited often. Worse, an enterprise deployment at scale is a huge nightmare. Exploiting WP sites on HackerOne can be a very profitable business for many.
  - XparXnoiAx 10y ago
    Not to mention, it doesn't matter if things are kept up to date when Wordpress takes months to issue a patch for critical security problems.
sean_patel 10y ago
> WordPress has historically been a security nightmare. This. And all this started around the same time - in 2006 -- when Stefan Esse, the PHP security expert "resigned". In a blog post in 2006 (that can no longer be found) Esse was quoted as saying he quit > "because among other things they were resistant to his finding bugs in PHP, and had refused to patch some of the bugs he found." Source(s) http://www.darkreading.com/risk/php-security-expert-quits/d/d-id/1128486 http://www.darkreading.com/risk/php-security-expert-quits/d/...? https://preilly.me/2006/11/09/php-security-expert-resigns/ https://preilly.me/2006/11/09/php-security-expert-resigns/ PHP is the backbone of WordPress and none of the core team members have taken any of it's security holes seriously, many of which can be traced back to PHP's security hole. They simply come out with "It's the Plugin-Developer's fault" every few months when a security hole is found. I don't think it's in their best (business) interest to fix WordPress' security holes any time soon. Because Matt Mullenweg, and other "Wordpress Security" companies like Sucuri Security, even WP Engine, all charge an arm and a length (WP Engine is 100$ a month for a simple blog serving < 25K pageviews a month) by selling "Peace of Mind" security with Wordpress if you use them / host with them.
- wilsonfiifi 10y ago
  I believe you're referring to Stefan Esser. The blog post in question can be found here[0] [0]https://web.archive.org/web/20061215080243/http://blog.php-security.org/archives/61-Retired-from-securityphp.net.html
- umbrai_nation 10y ago
  $25/mo. The $100/mo package includes up to 10 sites. https://wpengine.com/plans/ https://wpengine.com/plans/
- AstroJetson 10y ago
  > WordPress has historically been a security nightmare. And the Sistine Chapel is a country church. The bad guys of the world do nothing but find new Wordpress installs and take them over. It's a mess. I'd love to see the next year of Wordpress releases spent on nothing but fixing internal security issues and dealing with some of the upstream PHP stuff. 50% of my inbound traffic is people trying exploits.
nice_byte 10y ago
For context, here's what the dead comment says: """ Because it's ability to generate a limitless supply of zero-days makes it easier for us in San Francisco to go after blogs we don't politically agree with. Isn't that right, Mr. Altman. :D """
XparXnoiAx 10y ago
Yeah, I wish I could recommend WordPress to people because it's really nice at what it does, but the security flaws are too serious.The fact that it takes months for them to fix serious vulns reported to them only makes it worse. Seriously, there are youtube tutorials about 'How to Hack Wordpress.' It can't get much worse than that: https://www.youtube.com/results?q=wordpress+hack https://www.youtube.com/results?q=wordpress+hack
- deleted 10y ago
  [deleted]
- WhiteSource1 10y ago
  How about putting a tool like Incapsula on top (free option offers 2 factor authentication) which makes hacking just a bit harder.
  - XparXnoiAx 10y ago
    2 factor authentication is great, but it won't stop an attacker from using an XSS attack to get the authentication cookie. In general, security isn't something that can be tacked on as an afterthought, it has to be built in from the beginning.
nathancahill 10y ago
I'd love to move client's mostly static sites to Pelican or Hugo. But that means that every time they want to tweak something that isn't content, I get a phone call. So I stick with locked-down* versions of Wordpress, configured to automatically update, and hope for the best. So far, I haven't had any trouble, but if a site did get hacked, I have backups on hand to deploy a new server in seconds. *Besides best security practices for the server, database and Wordpress install, and clients aren't allowed to install new plugins or tweak the actual source code. The lightweight UI customization that themes provide is usually enough.
- laktek 10y ago
  This is exactly the reason why I'm building Pragma (it's a static site builder with client focused UX) http://www.laktek.com/2016/11/29/introducing-pragma/ http://www.laktek.com/2016/11/29/introducing-pragma/
  - nathancahill 10y ago
    Awesome. Signed up for the beta.
    - nsp 10y ago
      Cloudcannon provides a similar service for Jekyll, which we use for our public facing site
rmccue 10y ago
WordPress out-of-the-box is pretty secure, and there's a team who actively work on security, including a specific security lead. The main issues most people run into are with security of plugins and themes. This is basically a result of plugins and themes being run as part of the main process (they're just regular PHP code), which is practically-speaking unavoidable. That's not to say that WP is 100% impenetrable, and any large and mature software is going to have bugs, some of which may turn out to be security-related. The best defence against that is regular updates (inc. auto-updates, which are built in). (I work at an enterprise WordPress agency where we build large sites for large clients (media orgs, banks, etc). I'm also a committer to WP core, and hence on the WP security team. I'm also one of the leads on the WP REST API project, and was running the HackerOne project until the API was merged into WP.)

teach 10y ago

That's why wpengine is such an excellent choice for a lot of users. On the topic of PravlageTiem, the issue of WordPress' security flaws seems to be incidental to his attempt to accuse Sam Altman of censorship. If I had to guess, that would be why the comment is dead. I wouldn't call that sarcasm.

sean_patel 10y ago
> wpengine is such an excellent choice for a lot of users. Here we go! Like I stated in my comment, companies like WP Engine, Sucuri and other can easily charge 100$ + for what costs < 5$ to host, because it's wordpress and they "guarantee" a secure un-hackable website. Fear is a great motivator.
- CPLX 10y ago
  Another great motivator is that $30 or $100 is utterly trivial in the context of any website that has some actual business value and investment in its content and design. I know we're all conditioned to think web services should be nearly costless but I happily pay my WPengine bill for multiple sites every month and consider them keeping an eye on things a very good value for my fairly nominal expenditure.
jasonbarone 10y ago
Even with WPengine, security issues are a very common thing. WPengine can keep some things up to date, but plugins and themes are exploited often. Worse, an enterprise deployment at scale is a huge nightmare. Exploiting WP sites on HackerOne can be a very profitable business for many.
- XparXnoiAx 10y ago
  Not to mention, it doesn't matter if things are kept up to date when Wordpress takes months to issue a patch for critical security problems.

sean_patel 10y ago

> WordPress has historically been a security nightmare. This. And all this started around the same time - in 2006 -- when Stefan Esse, the PHP security expert "resigned". In a blog post in 2006 (that can no longer be found) Esse was quoted as saying he quit > "because among other things they were resistant to his finding bugs in PHP, and had refused to patch some of the bugs he found." Source(s) http://www.darkreading.com/risk/php-security-expert-quits/d/d-id/1128486 http://www.darkreading.com/risk/php-security-expert-quits/d/...? https://preilly.me/2006/11/09/php-security-expert-resigns/ https://preilly.me/2006/11/09/php-security-expert-resigns/ PHP is the backbone of WordPress and none of the core team members have taken any of it's security holes seriously, many of which can be traced back to PHP's security hole. They simply come out with "It's the Plugin-Developer's fault" every few months when a security hole is found. I don't think it's in their best (business) interest to fix WordPress' security holes any time soon. Because Matt Mullenweg, and other "Wordpress Security" companies like Sucuri Security, even WP Engine, all charge an arm and a length (WP Engine is 100$ a month for a simple blog serving < 25K pageviews a month) by selling "Peace of Mind" security with Wordpress if you use them / host with them.

wilsonfiifi 10y ago
I believe you're referring to Stefan Esser. The blog post in question can be found here[0] [0]https://web.archive.org/web/20061215080243/http://blog.php-security.org/archives/61-Retired-from-securityphp.net.html
umbrai_nation 10y ago
$25/mo. The $100/mo package includes up to 10 sites. https://wpengine.com/plans/ https://wpengine.com/plans/
AstroJetson 10y ago
> WordPress has historically been a security nightmare. And the Sistine Chapel is a country church. The bad guys of the world do nothing but find new Wordpress installs and take them over. It's a mess. I'd love to see the next year of Wordpress releases spent on nothing but fixing internal security issues and dealing with some of the upstream PHP stuff. 50% of my inbound traffic is people trying exploits.

nice_byte 10y ago

For context, here's what the dead comment says: """ Because it's ability to generate a limitless supply of zero-days makes it easier for us in San Francisco to go after blogs we don't politically agree with. Isn't that right, Mr. Altman. :D """

XparXnoiAx 10y ago

Yeah, I wish I could recommend WordPress to people because it's really nice at what it does, but the security flaws are too serious.The fact that it takes months for them to fix serious vulns reported to them only makes it worse. Seriously, there are youtube tutorials about 'How to Hack Wordpress.' It can't get much worse than that: https://www.youtube.com/results?q=wordpress+hack https://www.youtube.com/results?q=wordpress+hack

deleted 10y ago
[deleted]
WhiteSource1 10y ago
How about putting a tool like Incapsula on top (free option offers 2 factor authentication) which makes hacking just a bit harder.
- XparXnoiAx 10y ago
  2 factor authentication is great, but it won't stop an attacker from using an XSS attack to get the authentication cookie. In general, security isn't something that can be tacked on as an afterthought, it has to be built in from the beginning.

nathancahill 10y ago

I'd love to move client's mostly static sites to Pelican or Hugo. But that means that every time they want to tweak something that isn't content, I get a phone call. So I stick with locked-down* versions of Wordpress, configured to automatically update, and hope for the best. So far, I haven't had any trouble, but if a site did get hacked, I have backups on hand to deploy a new server in seconds. *Besides best security practices for the server, database and Wordpress install, and clients aren't allowed to install new plugins or tweak the actual source code. The lightweight UI customization that themes provide is usually enough.

laktek 10y ago
This is exactly the reason why I'm building Pragma (it's a static site builder with client focused UX) http://www.laktek.com/2016/11/29/introducing-pragma/ http://www.laktek.com/2016/11/29/introducing-pragma/
- nathancahill 10y ago
  Awesome. Signed up for the beta.
  - nsp 10y ago
    Cloudcannon provides a similar service for Jekyll, which we use for our public facing site

rmccue 10y ago

WordPress out-of-the-box is pretty secure, and there's a team who actively work on security, including a specific security lead. The main issues most people run into are with security of plugins and themes. This is basically a result of plugins and themes being run as part of the main process (they're just regular PHP code), which is practically-speaking unavoidable. That's not to say that WP is 100% impenetrable, and any large and mature software is going to have bugs, some of which may turn out to be security-related. The best defence against that is regular updates (inc. auto-updates, which are built in). (I work at an enterprise WordPress agency where we build large sites for large clients (media orgs, banks, etc). I'm also a committer to WP core, and hence on the WP security team. I'm also one of the leads on the WP REST API project, and was running the HackerOne project until the API was merged into WP.)