3 ms·
For at least the last 10 years WordPress has been an OSS tool whose serverside internals make hardened software engineers recoil in horror, but which neverthele
by muglug 5y ago
For at least the last 10 years WordPress has been an OSS tool whose serverside internals make hardened software engineers recoil in horror, but which nevertheless continues to deliver incredible value for the majority of its customer base.
It's a reminder that if you build something that people really want, how you build it doesn't matter, as long as you have plenty of duck tape at the ready.
- ironmagma 5y agoOnly for interesting definitions of "doesn't matter." The number of security exploits for WordPress websites seems to differ. https://www.cvedetails.com/product/4096/Wordpress-Wordpress.html?vendor_id=2337 https://www.cvedetails.com/product/4096/Wordpress-Wordpress....
- AussieWog93 5y agoYou'd probably find just as many exploits in Windows, and people use that every day without a hitch. Just for what it's worth, I haven't experienced any intrusions at all on my WordPress site since moving away from a free shared host 3 years ago (and even then, I don't even think WordPress was the culprit there).
- bdlowery 5y agoThat’s awesome, now can you find one that points to all the plugins that cause these security exploits? Because none of those are from the default WordPress install with the Standard plugins (ACF Pro, CPT UI, etc).
- camillomiller 5y agoTHIS. Impressive how experienced developers and professionals fall for this fallacy all the time because, wait, they don't actually KNOW A THING about wordpress.
- ironmagma 5y agoIt’s an interesting semantic game, but ultimately not very revealing. The platform is what gave you the vulnerability; whether it was core, a theme, or a plug-in is a matter of trivia. Especially considering the plug-in “store” is curated. Contrary to your assessment I’ve deployed quite a few things with Wordpress before.
- danuker 5y agoHere's one from this year: https://www.cvedetails.com/cve/CVE-2022-21664/ https://www.cvedetails.com/cve/CVE-2022-21664/ "SQL injection due to improper sanitization in WP_Meta_Query", fixed in WordPress itself: https://bugzilla.redhat.com/show_bug.cgi?id=2039317 https://bugzilla.redhat.com/show_bug.cgi?id=2039317 https://github.com/WordPress/wordpress-develop/commit/c09ccfbc547d75b392dbccc1ef0b4442ccd3c957 https://github.com/WordPress/wordpress-develop/commit/c09ccf...
- difu_disciple 5y agoThose are all related to Wordpress core. Plugins are categorized separately from WordPress on the CVE website.
- danuker 5y agoI suspect the "doesn't matter" is the limited value lost compared to the value gained. There might not be enough black-hat hackers executing on those exploits :)
- cblconfederate 5y agoWhen you build something a lot of people use, it will require a lot of ducttape. Software represents the diversity of its users.