3 ms·

> Anyone who enabled auto-updating for ACF would not be affected by this vulnerability. Pedantic, but you would have been vulnerable if someone else also found

by e12e 3y ago

> Anyone who enabled auto-updating for ACF would not be affected by this vulnerability. Pedantic, but you would have been vulnerable if someone else also found the hole, but kept it secret? Sure, when an exploit makes into metasploit or gets published things are worse if you don't patch - but just because the barn door is closed now with a patch, it doesn't mean you were secure when there was a big hole in the door...

lesuorac 3y ago
Of course, in another completely different scenario that different scenario may play out differently.
- e12e 3y ago
  I don't understand - there was a hole for X months, it was found (once) and responsibly disclosed. Everyone was vulnerable for those X months. We don't know if anyone else found that hole in those X months? Your vulnerable WordPress install wasn't "secure" for those X months, it just wasn't wide open to script kiddies? So making WordPress "secure" isn't "just install updates as they come out". That's just "don't be criminally negligent".
  - snowwrestler 3y ago
    You’re right, but the thing you’re right about is true for all software, not just Wordpress. Every piece of software out there has exploitable bugs sitting in the code just waiting to be found. Software is, fundamentally and essentially, insecure in that it is built by humans who make mistakes. A static HTML site does not protect against this since it’s still being served by a flawed software stack. Nginx has undiscovered bugs; Linux has undiscovered bugs. For sure. But from a practical perspective, anyone running a site just wants to keep the bad guys out today, by resisting the intrusion attempts they directly experience. And for the vast majority of Wordpress sites, that is achievable with correct file and directory permissions, strong passwords, and prompt patching.

3 ms·

> Anyone who enabled auto-updating for ACF would not be affected by this vulnerability. Pedantic, but you would have been vulnerable if someone else also found

by e12e 3y ago

lesuorac 3y ago
Of course, in another completely different scenario that different scenario may play out differently.
- e12e 3y ago
  I don't understand - there was a hole for X months, it was found (once) and responsibly disclosed. Everyone was vulnerable for those X months. We don't know if anyone else found that hole in those X months? Your vulnerable WordPress install wasn't "secure" for those X months, it just wasn't wide open to script kiddies? So making WordPress "secure" isn't "just install updates as they come out". That's just "don't be criminally negligent".
  - snowwrestler 3y ago
    You’re right, but the thing you’re right about is true for all software, not just Wordpress. Every piece of software out there has exploitable bugs sitting in the code just waiting to be found. Software is, fundamentally and essentially, insecure in that it is built by humans who make mistakes. A static HTML site does not protect against this since it’s still being served by a flawed software stack. Nginx has undiscovered bugs; Linux has undiscovered bugs. For sure. But from a practical perspective, anyone running a site just wants to keep the bad guys out today, by resisting the intrusion attempts they directly experience. And for the vast majority of Wordpress sites, that is achievable with correct file and directory permissions, strong passwords, and prompt patching.