4 ms·

I don't understand - there was a hole for X months, it was found (once) and responsibly disclosed. Everyone was vulnerable for those X months. We don't know if

by e12e 3y ago

I don't understand - there was a hole for X months, it was found (once) and responsibly disclosed. Everyone was vulnerable for those X months. We don't know if anyone else found that hole in those X months? Your vulnerable WordPress install wasn't "secure" for those X months, it just wasn't wide open to script kiddies? So making WordPress "secure" isn't "just install updates as they come out". That's just "don't be criminally negligent".

snowwrestler 3y ago
You’re right, but the thing you’re right about is true for all software, not just Wordpress. Every piece of software out there has exploitable bugs sitting in the code just waiting to be found. Software is, fundamentally and essentially, insecure in that it is built by humans who make mistakes. A static HTML site does not protect against this since it’s still being served by a flawed software stack. Nginx has undiscovered bugs; Linux has undiscovered bugs. For sure. But from a practical perspective, anyone running a site just wants to keep the bad guys out today, by resisting the intrusion attempts they directly experience. And for the vast majority of Wordpress sites, that is achievable with correct file and directory permissions, strong passwords, and prompt patching.