2 ms·

You write: "Woah there, Captain 'Death to PHP'." I can not imagine what would cause you to write this. I use PHP in almost all of my work. All of my major web

You write: "Woah there, Captain 'Death to PHP'." I can not imagine what would cause you to write this. I use PHP in almost all of my work. All of my major websites are written in PHP. However, I do try to take security seriously. The small regard that the WordPress team has shown for security is unacceptable. To point out that the WordPress team had language options in no way implies that I disagree with the language they chose, it simply shows that their choice was a conscious choice over which they must take responsibility. I was responding to a comment that implied that the WordPress team had no power to make a choice other than what they made. I am curious, too, that you would criticize what I wrote, yet you offer no criticism of "At the time LAMP was pretty much all there was." The sentence I was responding to was flatly, factually wrong. You write: "Absolutely none of those projects, even the ones written in Perl, were as easy to set up as WordPress was (and still is)." That is one of the problems that arises naturally from the use of PHP - it is easy to set up. As such, you end up with a lot of non-technical people using it. And that is one of the biggest reasons why special attention should be paid to security -- the fact that WordPress is the kind of software that appeals to a crowd that is largely non-technical.

lkrubner 16y ago
It is curious that someone would downvote this. Up above jacques_chester wrote: "At the time LAMP was pretty much all there was. For the time their decisions were reasonable." At no point did I suggest that their choice was unreasonable. However, I have suggested that they made a choice, that is, a conscious decision, and one where they had several options. Like any human being who makes an uncoerced decision, they have a responsibility for the decision they have made. In creating the WordPress software, the WordPress team must take responsibility for for any flaw in WordPress, regardless of what layer that flaw arises from. Again, I would quote the very good advice that Sam Ruby gave to Matt Mullenweg: "Yes, you can argue that they brought this upon themselves; but it is worth noting that at this point you are along for the ride. When I’m in similar circumstances, I tend to consider the karma implications of cursing the driver." The statement that ""At the time LAMP was pretty much all there was" is simply wrong -- flatly and factually incorrect. There were options. But the WordPress team built WordPress using PHP. I see nothing wrong with that decision, but having made it, the WordPress team must accept all the consequences of that decision. The underlying issue is the poor security in WordPress. The team in charge of WordPress has not shown a great concern for security. We must criticize them for giving security such a low priority. They need to change their attitude.
- jacques_chester 16y ago
  > The statement that ""At the time LAMP was pretty much all there was" is simply wrong -- flatly and factually incorrect. I could have qualified it better, certainly. "At the time LAMP was the dominant platform and almost every shared host offered LAMP and only LAMP, a condition which has only in the past 3 years begun to change". > The underlying issue is the poor security in WordPress. The team in charge of WordPress has not shown a great concern for security. We must criticize them for giving security such a low priority. They need to change their attitude. And I do. Some of the bugs that get closed are astonishing. Wordpress is developed without automatic tests, security fixes are never backported (you always have to upgrade -- getting new features that might have new bugs -- to get the fix), the focus of effort is almost exclusively on new features and not on closing issues in the tracker (though this seems to be improving).

lkrubner 16y ago

It is curious that someone would downvote this. Up above jacques_chester wrote: "At the time LAMP was pretty much all there was. For the time their decisions were reasonable." At no point did I suggest that their choice was unreasonable. However, I have suggested that they made a choice, that is, a conscious decision, and one where they had several options. Like any human being who makes an uncoerced decision, they have a responsibility for the decision they have made. In creating the WordPress software, the WordPress team must take responsibility for for any flaw in WordPress, regardless of what layer that flaw arises from. Again, I would quote the very good advice that Sam Ruby gave to Matt Mullenweg: "Yes, you can argue that they brought this upon themselves; but it is worth noting that at this point you are along for the ride. When I’m in similar circumstances, I tend to consider the karma implications of cursing the driver." The statement that ""At the time LAMP was pretty much all there was" is simply wrong -- flatly and factually incorrect. There were options. But the WordPress team built WordPress using PHP. I see nothing wrong with that decision, but having made it, the WordPress team must accept all the consequences of that decision. The underlying issue is the poor security in WordPress. The team in charge of WordPress has not shown a great concern for security. We must criticize them for giving security such a low priority. They need to change their attitude.

jacques_chester 16y ago
> The statement that ""At the time LAMP was pretty much all there was" is simply wrong -- flatly and factually incorrect. I could have qualified it better, certainly. "At the time LAMP was the dominant platform and almost every shared host offered LAMP and only LAMP, a condition which has only in the past 3 years begun to change". > The underlying issue is the poor security in WordPress. The team in charge of WordPress has not shown a great concern for security. We must criticize them for giving security such a low priority. They need to change their attitude. And I do. Some of the bugs that get closed are astonishing. Wordpress is developed without automatic tests, security fixes are never backported (you always have to upgrade -- getting new features that might have new bugs -- to get the fix), the focus of effort is almost exclusively on new features and not on closing issues in the tracker (though this seems to be improving).