3 ms·

If you have arguments, then make them. This is just saying stuff for the sake of it.

• thedevilslawyer 7mo ago
  The post literally does that. it talks about how plugin access to core is handled. So to be explicit: if you don't see that as a very significant security improvement over WP's open world, then it may help to understand why. The post also talks about WP ecosystem downside due to this.
  • Yokohiii 7mo ago
    | "network:fetch" // ctx.http is available (host-restricted via allowedHosts) | "network:fetch:any" // ctx.http is available (unrestricted outbound — use for user-configured URLs) | "read:content" // ctx.content.get/list available | "write:content" // ctx.content.create/update/delete available | "read:media" // ctx.media.get/list available | "write:media" // ctx.media.getUploadUrl/delete available | "read:users" // ctx.users is available | "email:send" // ctx.email is available (when a provider is configured) | "email:provide" // can register email:deliver exclusive hook (transport provider) | "email:intercept" // can register email:beforeSend / email:afterSend hooks | "page:inject"; // can register page:fragments hook (inject scripts/styles into pages) That are the plugin capabilities. I have no clue how it could replace any serious WP plugin. Of course it's secure ;)
    • thedevilslawyer 7mo ago
      > I have no clue how it could replace any serious WP plugin. I'll repeat: your knowledge of security has a gap. You can specifically look up on "Principle of least privilege" as is widely used in apps and browsers too.