3 ms·
Agreed that is a bad stance from a security standpoint. Security updates will always be coming , users can not be relied on to always update so you get sites th
by quags 4y ago
Agreed that is a bad stance from a security standpoint. Security updates will always be coming , users can not be relied on to always update so you get sites that will never be updated and eventually hacked and spam/ scan / redirect to malware and create a bad experience. On your average shared host drupal would be set to write to itself anyway since php will run under the same username of the files. I guess permissions could be set lower to 444 to prevent this - but the fact Wordpress will auto update the core is essentially to security.
- kka 4y agoI'm not very familiar with Wordpress, so don't know how auto-updates work in it. Does it really autoupdate the core remotely automatically, or it is a human who presses the update button?
- technion 4y agoThe default is that is updates automatically. It has a very unique "cron job", wherein pages effectively fork by doing a "curl wp-cron.php". One of those jobs is a daily check for updates, and it will apply one if it exists. I've had people argue that they want to disable they behaviour, and do manual qa before updates. I can see why. But the last person I argued this with had their website replaced with a gore image because they got behind in updates.
- kka 4y agoThanks for explaining how it works.