3 ms·

And none of these posts you're referencing are at all relevant to the issue at hand (unless you're taking the position that PHP is Pure Evil as a language, whic

by nbpoole 16y ago

And none of these posts you're referencing are at all relevant to the issue at hand (unless you're taking the position that PHP is Pure Evil as a language, which is an entirely separate issue)! ;-) The question at hand isn't whether it's easy or hard for someone to write secure code in PHP (my opinion: it's not easy, but it's certainly possible). The issue brought up in the article is that a lot of the top search results for "Free Wordpress Templates" lead you to templates containing obfuscated code, some of it malicious. That isn't a language issue: as many people have pointed out to you, it's a consequence of running untrusted code. Now, you can certainly debate whether or not this is a Wordpress issue. On the one hand, the Wordpress team could choose to write their own custom templating language that doesn't include the ability to do things like eval base64 strings. But if they did go down that path, they would also be severely restricting what theme developers are capable of doing (and that wouldn't solve any issues with JavaScript or any number of other subtle issues that malicious authors could introduce). My personal take is that this is a case befitting the quote "with great power comes great responsibility." That is, the people running Wordpress blogs need to be aware of the risks when they install plugins or themes. The Wordpress team has built tools into Wordpress that encourage people to download and update plugins and themes from Wordpress.org, which is seemingly more legitimate than these random sites (I'm not sure if there's a formal evaluation process for plugins/themes submitted there). Beyond that though, I don't think it's the fault of the Wordpress developers if people choose, whether out of ignorance or carelessness, to download and install random themes from the Internet. I mean, I don't blame Microsoft if I go searching for "free [software name]" and end up downloading a virus. ;-)

lkrubner 16y ago
"with great power comes great responsibility" is an idea that applies to the WordPress development team too. "Great power" is not how I would describe some random blogger who wants to start a blog about their dog. "Great Power" might be more applicable to Automattic. Certainly, if they want to leverage WordPress commercially, they have large responsibilities.
- nbpoole 16y ago
  And they do so, in the form of Wordpress.com. If what you want is a blog about your dog, you can have it for free with Wordpress software that you never have to manage the code for or pay for. I have a number of friends who use it and they couldn't be happier. In fact, there are plenty of other SaaS vendors out there who are equally happy to provide you with a place to write about your dog. On the other hand, if you're running your own web application, you're responsible for it, just the same way you're responsible for your computer. As I said, I don't blame Microsoft if I download random software and that software does malicious things. Similarly, I don't blame Wordpress or Automattic if I download a random theme and it contains malicious code.
  - lkrubner 16y ago
    I can not follow what logic keeps you from blaming Microsoft for the security lapses in the Microsoft operating system. Of course they have cleaned up their act in recent years, but they had a solid 25 year run (both DOS and Windows) where they were absolutely notorious for poor security. They faced sharp criticism for the many flaws in their OS, and for the low priority that they gave to implementing something better. Do you want me to google some of the many articles on this theme? Here is one from a few thousand results that I could pick from: http://sec-soapbox.blogspot.com/2007/03/why-is-windows-insecure.html http://sec-soapbox.blogspot.com/2007/03/why-is-windows-insec... My criticism of the WordPress team follows the same logic as the criticism of Microsoft. Since Microsoft came up with an OS that had a lot of security flaws, it was reasonable for people to criticize Microsoft for those flaws. And since the WordPress team is producing software that also has flaws, it is reasonable to criticize the WordPress team for the flaws in the software they produce.

by nbpoole 16y ago

lkrubner 16y ago

"with great power comes great responsibility" is an idea that applies to the WordPress development team too. "Great power" is not how I would describe some random blogger who wants to start a blog about their dog. "Great Power" might be more applicable to Automattic. Certainly, if they want to leverage WordPress commercially, they have large responsibilities.

nbpoole 16y ago
And they do so, in the form of Wordpress.com. If what you want is a blog about your dog, you can have it for free with Wordpress software that you never have to manage the code for or pay for. I have a number of friends who use it and they couldn't be happier. In fact, there are plenty of other SaaS vendors out there who are equally happy to provide you with a place to write about your dog. On the other hand, if you're running your own web application, you're responsible for it, just the same way you're responsible for your computer. As I said, I don't blame Microsoft if I download random software and that software does malicious things. Similarly, I don't blame Wordpress or Automattic if I download a random theme and it contains malicious code.
- lkrubner 16y ago
  I can not follow what logic keeps you from blaming Microsoft for the security lapses in the Microsoft operating system. Of course they have cleaned up their act in recent years, but they had a solid 25 year run (both DOS and Windows) where they were absolutely notorious for poor security. They faced sharp criticism for the many flaws in their OS, and for the low priority that they gave to implementing something better. Do you want me to google some of the many articles on this theme? Here is one from a few thousand results that I could pick from: http://sec-soapbox.blogspot.com/2007/03/why-is-windows-insecure.html http://sec-soapbox.blogspot.com/2007/03/why-is-windows-insec... My criticism of the WordPress team follows the same logic as the criticism of Microsoft. Since Microsoft came up with an OS that had a lot of security flaws, it was reasonable for people to criticize Microsoft for those flaws. And since the WordPress team is producing software that also has flaws, it is reasonable to criticize the WordPress team for the flaws in the software they produce.