> Don't Critics hide under the authoritativeness of "best practices"? That's true! Just calling something a best practice does not make it so. That also has to

> Don't Critics hide under the authoritativeness of "best practices"? That's true! Just calling something a best practice does not make it so. That also has to be argued for, by demonstrating the consequences of one practice over another. > I trust the wordpress developer's ability to know how to write software that works than someone who doesn't know how or has ever written successful software but knows how to avoid security issues. Criticism being easier to state than address does not invalidate the criticism. "Sure, this extension may be full of SQL injection bugs, but that's easier said than fixed, so it doesn't matter. I'm going to install it anyway."