4 ms·

The title literally made me laugh out loud. What drama! What intrigue! Can't wait to see what happens next. Honestly, I have no horse in the race, so to speak.

The title literally made me laugh out loud. What drama! What intrigue! Can't wait to see what happens next. Honestly, I have no horse in the race, so to speak. I think the people responsible for Wordpress code still suck because they still, in 2024, want the software itself to be able to write to where the software itself lives and runs, which is just bananas. It violates the first two rules of anything and everything on the web that I learned in the '90s: * do not allow writing to anywhere that's executable * do not allow execution anywhere that's writable

rmbyrro 2y ago
Yea, Wordpress has always been a nightmare... But it makes things so convenient and that's what most people care about.
- linotype 2y ago
  Isn’t that a good thing to want though? Something easy to use if you only care about content?
  - anon7000 2y ago
    I mean does it matter if whether it’s a good thing to want? WordPress powers 40% of the web because it was convenient, powerful, and easy for someone with basic web skills to hack around with. The same things that people complain about today made it so popular! Besides, read-only file systems can be used to handle massive sites that need better security (like nasa.gov). And those types sites are either writing their own plugins or heavily auditing which plugins they use.
    - deleted 2y ago
      [deleted]
lioeters 2y ago
Indeed it's completely insane that any plugin can create a file in the site folder, and a public URL will execute it. And a site can have a dozen (or dozens in some cases) of plugins from various authors. It's a security nightmare, and I don't know of any (modern) language that allows such a situation other than PHP.
- Sander_Marechal 2y ago
  That has absolutely zero to do with PHP itself and everything with the abysmal state of Wordpress code.
  - lolc 2y ago
    Wordpress probably still enforces magic quotes which made me bail the hell out when I looked into it ten years ago.
- deleted 2y ago
  [deleted]
AlienRobot 2y ago
Just chmod -w
beaconify 2y ago
Which is also why it is successful! You can get powerful plugins that way. Is it much different from a windows app installer asking admin permissions then editing the registry and can plaster files anywhere.

rmbyrro 2y ago

Yea, Wordpress has always been a nightmare... But it makes things so convenient and that's what most people care about.

linotype 2y ago
Isn’t that a good thing to want though? Something easy to use if you only care about content?
- anon7000 2y ago
  I mean does it matter if whether it’s a good thing to want? WordPress powers 40% of the web because it was convenient, powerful, and easy for someone with basic web skills to hack around with. The same things that people complain about today made it so popular! Besides, read-only file systems can be used to handle massive sites that need better security (like nasa.gov). And those types sites are either writing their own plugins or heavily auditing which plugins they use.
  - deleted 2y ago
    [deleted]

lioeters 2y ago

Indeed it's completely insane that any plugin can create a file in the site folder, and a public URL will execute it. And a site can have a dozen (or dozens in some cases) of plugins from various authors. It's a security nightmare, and I don't know of any (modern) language that allows such a situation other than PHP.

Sander_Marechal 2y ago
That has absolutely zero to do with PHP itself and everything with the abysmal state of Wordpress code.
- lolc 2y ago
  Wordpress probably still enforces magic quotes which made me bail the hell out when I looked into it ten years ago.
deleted 2y ago
[deleted]

AlienRobot 2y ago

Just chmod -w

beaconify 2y ago

Which is also why it is successful! You can get powerful plugins that way. Is it much different from a windows app installer asking admin permissions then editing the registry and can plaster files anywhere.