7 ms·

For better of for worse, wordpress can at this point be considered critical infrastructure.

by turminal 5y ago

cblconfederate 5y ago
why would it be for worse?
- deleted 5y ago
  [deleted]
- puskavi 5y ago
  Its too easy to setup and forget
- howdydoo 5y ago
  Ideally our critical infrastructure would have a better security track record
  - deleted 5y ago
    [deleted]
  - micromacrofoot 5y ago
    yeah and maybe companies will start paying for open source software, but I’m not holding my breath
    - edgyquant 5y ago
      The difference is that it is bad for business reputation when some of the largest companies on planet are regularly leaking data through exploits. Testing will become an economic requirement over time.
forinti 5y ago
I don't like PHP or MySQL, but WP is a pretty decent piece of software.
- lolinder 5y ago
  The trouble with WordPress is that it makes it too easy to set up and far too easy to install random plugins. People spin up a WordPress instance for their blog that they're totally going to use every day, install a bunch of plugins and a fancy theme, then within a few months have completely forgotten about it. Meanwhile, vulnerabilities are discovered in the plugins they installed. Maybe they're patched and maybe they're not, but either way their server doesn't get updated. Within a few months it's hacked, and the ex-blogger probably doesn't know until they get an email from their hosting service complaining about malware being served from their blog. This is made worse by the fact that, since WordPress is everywhere, it's worth the time for bad actors to write scripts to exploit vulnerabilities in outdated versions of popular plugins. It doesn't matter how obscure your site is, if it's written in WordPress and not up-to-date, it's as good as hacked.
  - Gigachad 5y ago
    The value of managed solutions for the every day person/company is almost priceless. Squarespace / hosted email / cloud storage etc should be standard vs Wordpress/self hosted email/ a shared drive on the local network. Unless hosting the product is your core business model, let someone else do it, because then there will be one or more people dedicated to making sure it works perfect and is regularly updated.
  - mattkevan 5y ago
    After building some sites with Wordpress recently, I think another problem is the business model of most plug-in vendors. They all seem to charge $90 for a year of updates. Gets steep quickly- theme, backups, layout builder etc. Fine for the first year but probably don’t get renewed and then the plug-ins don’t get updated. I’d love to see a list of fully featured open source plug-ins.
  - behringer 5y ago
    wordpress now allows auto updates,but this does require setup and you still need to monitor for bad auto updates.
marginalia_nu 5y ago
In my search engine work, I found an enormous cluster of websites that had a huge number of pages with link spam on them, but with a seemingly legit front page. Sometimes linkfarms will have some sort of a facade, but this was more elaborate. More confusing still, they were all on .net and .com-domains. I just couldn't figure out what was going on, .com-domains are expensive, typically link farms are on .xyz, .icu or something similarly cheap. I don't have the number, but I'm certain I identified tens of thousands of them, if not a hundred thousand. That's close to a million dollars in domain fees. The numbers didn't add up, who would spend that sort of money on link farms? They were also hosted all over, not just on Chinese clouds like most spam offenders are. It finally dawned upon me: What I was looking at was hacked wordpress instances. Holy crap there's a lot of them floating around.
- earthboundkid 5y ago
  If you follow WordPress sites on RSS, you see that they all eventually get hacked if they go dormant. It's just a fact of life.
- tomrod 5y ago
  Consider publishing the list to ublock origin or something?
  - marginalia_nu 5y ago
    It's mostly a problem for search engines, they typically don't want human visitors. Many of these wordpress installs are innocent small businesses that just haven't realized they're hacked.
- hsbauauvhabzb 5y ago
  What is a link farm? How do they make money?
  - marginalia_nu 5y ago
    Wikipedia has an article: https://en.wikipedia.org/wiki/Link_farm https://en.wikipedia.org/wiki/Link_farm But TL;DR: It's a form of search engine manipulation. The theory is that if you put a bunch of links to your low-ranking domain on a high ranking domain, search engines will think your content is more valuable and be more likely to crop up as top results. You set up a lot of these so they promote each other, making it look like your shady website is popular when it is not. It used to be more effective than it is today, but it's still relatively common. Search engine manipulation doesn't need to be on these link farms, it's also relatively common to for example have a shady online casino raise their ranking by sponsoring open source projects, which reward them by linking to the online casino. That way the popularity of those projects will "rub off" on the online casino.
ARandomerDude 5y ago
> For better of for worse For worse. > wordpress can at this point be considered critical infrastructure. True, sadly, though I'm thankful that after yet another security incident the mid-size company I work for has decided to officially end WordPress use across all our domains. Hopefully, others will begin to do the same.
- lordofgibbons 5y ago
  What is the company moving to for a replacement?
  - _HMCB_ 5y ago
    None better: https://processwire.com/ https://processwire.com/
sneak 5y ago
Every WP site in the world could go down for a few hours and nothing bad would happen. That can't be said about critical infrastructure. "critical" means something. If the water system or the power grid goes down for a few hours, the world has a major problem. If everything widely used is "critical infrastructure", then nothing is.
- thakoppno 5y ago
  humor me: what are the most critical pieces of internet infrastructure? i think i agree with you but then started to think that huge whole parts of the Internet may not qualify by your definition.
- withinboredom 5y ago
  Heh, so much of the web runs WordPress. There are Facebook domains running it, huge news sites, banks, budgeting software, etc.
rlt 5y ago
It kind of boggles the mind, given vulnerability after vulnerability throughout the 2000s and 2010s.
- poink 5y ago
  Considering the other things we rely on, does it?

For better of for worse, wordpress can at this point be considered critical infrastructure.

cblconfederate 5y ago

why would it be for worse?

deleted 5y ago
[deleted]
puskavi 5y ago
Its too easy to setup and forget
howdydoo 5y ago
Ideally our critical infrastructure would have a better security track record
- deleted 5y ago
  [deleted]
- micromacrofoot 5y ago
  yeah and maybe companies will start paying for open source software, but I’m not holding my breath
  - edgyquant 5y ago
    The difference is that it is bad for business reputation when some of the largest companies on planet are regularly leaking data through exploits. Testing will become an economic requirement over time.

forinti 5y ago

I don't like PHP or MySQL, but WP is a pretty decent piece of software.

lolinder 5y ago
The trouble with WordPress is that it makes it too easy to set up and far too easy to install random plugins. People spin up a WordPress instance for their blog that they're totally going to use every day, install a bunch of plugins and a fancy theme, then within a few months have completely forgotten about it. Meanwhile, vulnerabilities are discovered in the plugins they installed. Maybe they're patched and maybe they're not, but either way their server doesn't get updated. Within a few months it's hacked, and the ex-blogger probably doesn't know until they get an email from their hosting service complaining about malware being served from their blog. This is made worse by the fact that, since WordPress is everywhere, it's worth the time for bad actors to write scripts to exploit vulnerabilities in outdated versions of popular plugins. It doesn't matter how obscure your site is, if it's written in WordPress and not up-to-date, it's as good as hacked.
- Gigachad 5y ago
  The value of managed solutions for the every day person/company is almost priceless. Squarespace / hosted email / cloud storage etc should be standard vs Wordpress/self hosted email/ a shared drive on the local network. Unless hosting the product is your core business model, let someone else do it, because then there will be one or more people dedicated to making sure it works perfect and is regularly updated.
- mattkevan 5y ago
  After building some sites with Wordpress recently, I think another problem is the business model of most plug-in vendors. They all seem to charge $90 for a year of updates. Gets steep quickly- theme, backups, layout builder etc. Fine for the first year but probably don’t get renewed and then the plug-ins don’t get updated. I’d love to see a list of fully featured open source plug-ins.
- behringer 5y ago
  wordpress now allows auto updates,but this does require setup and you still need to monitor for bad auto updates.

marginalia_nu 5y ago

In my search engine work, I found an enormous cluster of websites that had a huge number of pages with link spam on them, but with a seemingly legit front page. Sometimes linkfarms will have some sort of a facade, but this was more elaborate. More confusing still, they were all on .net and .com-domains. I just couldn't figure out what was going on, .com-domains are expensive, typically link farms are on .xyz, .icu or something similarly cheap. I don't have the number, but I'm certain I identified tens of thousands of them, if not a hundred thousand. That's close to a million dollars in domain fees. The numbers didn't add up, who would spend that sort of money on link farms? They were also hosted all over, not just on Chinese clouds like most spam offenders are. It finally dawned upon me: What I was looking at was hacked wordpress instances. Holy crap there's a lot of them floating around.

earthboundkid 5y ago
If you follow WordPress sites on RSS, you see that they all eventually get hacked if they go dormant. It's just a fact of life.
tomrod 5y ago
Consider publishing the list to ublock origin or something?
- marginalia_nu 5y ago
  It's mostly a problem for search engines, they typically don't want human visitors. Many of these wordpress installs are innocent small businesses that just haven't realized they're hacked.
hsbauauvhabzb 5y ago
What is a link farm? How do they make money?
- marginalia_nu 5y ago
  Wikipedia has an article: https://en.wikipedia.org/wiki/Link_farm https://en.wikipedia.org/wiki/Link_farm But TL;DR: It's a form of search engine manipulation. The theory is that if you put a bunch of links to your low-ranking domain on a high ranking domain, search engines will think your content is more valuable and be more likely to crop up as top results. You set up a lot of these so they promote each other, making it look like your shady website is popular when it is not. It used to be more effective than it is today, but it's still relatively common. Search engine manipulation doesn't need to be on these link farms, it's also relatively common to for example have a shady online casino raise their ranking by sponsoring open source projects, which reward them by linking to the online casino. That way the popularity of those projects will "rub off" on the online casino.

ARandomerDude 5y ago

> For better of for worse For worse. > wordpress can at this point be considered critical infrastructure. True, sadly, though I'm thankful that after yet another security incident the mid-size company I work for has decided to officially end WordPress use across all our domains. Hopefully, others will begin to do the same.

lordofgibbons 5y ago
What is the company moving to for a replacement?
- _HMCB_ 5y ago
  None better: https://processwire.com/ https://processwire.com/

sneak 5y ago

Every WP site in the world could go down for a few hours and nothing bad would happen. That can't be said about critical infrastructure. "critical" means something. If the water system or the power grid goes down for a few hours, the world has a major problem. If everything widely used is "critical infrastructure", then nothing is.

thakoppno 5y ago
humor me: what are the most critical pieces of internet infrastructure? i think i agree with you but then started to think that huge whole parts of the Internet may not qualify by your definition.
withinboredom 5y ago
Heh, so much of the web runs WordPress. There are Facebook domains running it, huge news sites, banks, budgeting software, etc.

rlt 5y ago

It kind of boggles the mind, given vulnerability after vulnerability throughout the 2000s and 2010s.

poink 5y ago
Considering the other things we rely on, does it?