8 ms·
Yeah, easy, all you have to do is rewrite WordPress in JavaScript. Now instead of worrying about malware in plugins, you can worry about malware in plugins and
by post-it 5y ago
Yeah, easy, all you have to do is rewrite WordPress in JavaScript. Now instead of worrying about malware in plugins, you can worry about malware in plugins and your npm dependencies!
- fastball 5y agoThe problem with WP is that its being run in a privileged position. A statically generated site is not.
- post-it 5y agoYou shouldn't run your web server as root. I think the most common way of running WordPress is to use nginx in front of Apache, so you can easily run Apache as a special WordPress user for extra security.
- fastball 5y agoSorry, my terminology wasn't clear. Didn't really mean running it as root, meant that WP has direct access to your DB (it must).
- post-it 5y agoEvery backend has access to your DB though. If a WordPress alternative supports plugins, it is just as vulnerable. If it doesn't support plugins, it's not a WordPress alternative for most use cases.
- sdze 5y agoyou don't run your fpm processes as superuser. In general it is run in a jailed environment.
- ekianjo 5y agosounds like much worse than wordpress from the get go