4 ms·
> What could go wrong. Well, after several years not much went wrong. There was a single case where the updated broke the update process, thus forcing users to
by hannob 9y ago
> What could go wrong.
Well, after several years not much went wrong. There was a single case where the updated broke the update process, thus forcing users to a single manual (still one-click) update.
I.e. the worst that happened is that in one instance wordpress was as bad as any other major CMS by not having working automated updates.
What went right however is that probably thousands of wordpress infections have been prevented by automated updates that work 99% of the time.
Wordpress surely isn't perfect, but the fact that they have automated updates that work most of the time means they're more secure than any of their major competitors for now.
- snowwrestler 9y ago> Well, after several years not much went wrong. You're talking about whether something has gone wrong with the auto-update system, specifically. However, the parent comment was referencing the risk inherent in granting a PHP application write permissions on its own files. Doing so means that almost any exploit in the application can result in persistence, because malware can be written into (hidden in) core Wordpress files. You would not necessarily know how often this happens, because it happens to individual sites. The Wordpress community decided that the risk of not patching quickly outweighed the risk of allowing Wordpress to write its own files. I happen to agree with them; unpatched vulnerabilities are like candy for script kiddies and fall easily to automated attacks. And most people running Wordpress are not sophisticated. That said, for teams that are on the ball about managing updates, running Wordpress with locked down filed/directory permissions is definitely more secure.