3 ms·

This is a pretty poor strawman of an argument. Wordpress Core may be secure, but it's also not what people deploy. Nobody uses "Just Wordpress" - you have to us

by cheald 14y ago

This is a pretty poor strawman of an argument. Wordpress Core may be secure, but it's also not what people deploy. Nobody uses "Just Wordpress" - you have to use a custom theme and a half-dozen plugins just to get a basic Wordpress install into a usable shape, and therein lies the problem - the number of Wordpress installs compromised through these "necessary" plugins is staggeringly huge. Until that stops being a problem, "Wordpress The Product That Has 64 Million Installs" cannot be considered secure, even if wp-core is the most secure product ever written.

arrowroot 14y ago
Actually - I haven't had a single site hacked since implementing regular updates. And I'm managing hundreds of sites. With many plugins..
- cheald 14y ago
  That's great, but all it means is that you just weren't in the crosshairs, not that you were actually secure. Automating updates is a wonderful way to open up an attack vector, as well - for example, a little while back, attackers got into the Wordpress SVN repo and back-doored a bunch of popular plugins[1]. Anyone performing "regular updates" without proper auditing would have installed malicious code that opened them up to full-scale breach. [1] http://wordpress.org/news/2011/06/passwords-reset/ http://wordpress.org/news/2011/06/passwords-reset/
  - smacktoward 14y ago
    It is much more practical to secure a single repo administered by competent techs than it is to secure a zillion web sites run by people with no technical experience.
smacktoward 14y ago
This is just not true. There's lots of people who run their personal sites quite happily using just WP core and one of the bundled themes. I agree that the quality of community-contributed themes and plugins is all over the map, and I fight with clients constantly to try and keep them from installing plugins on a whim for exactly that reason. (It's amazing how many people grab plugins to do stuff that WP can actually do itself, just in a way that isn't immediately obvious to the user.) But it's not impossible to run a site on just WP core.
- dkuntz2 14y ago
  Right, but that's not all 64 million of them. Or even a large fraction of them (provided that number's the self-hosted installs).

by cheald 14y ago

arrowroot 14y ago

Actually - I haven't had a single site hacked since implementing regular updates. And I'm managing hundreds of sites. With many plugins..

cheald 14y ago
That's great, but all it means is that you just weren't in the crosshairs, not that you were actually secure. Automating updates is a wonderful way to open up an attack vector, as well - for example, a little while back, attackers got into the Wordpress SVN repo and back-doored a bunch of popular plugins[1]. Anyone performing "regular updates" without proper auditing would have installed malicious code that opened them up to full-scale breach. [1] http://wordpress.org/news/2011/06/passwords-reset/ http://wordpress.org/news/2011/06/passwords-reset/
- smacktoward 14y ago
  It is much more practical to secure a single repo administered by competent techs than it is to secure a zillion web sites run by people with no technical experience.

smacktoward 14y ago

This is just not true. There's lots of people who run their personal sites quite happily using just WP core and one of the bundled themes. I agree that the quality of community-contributed themes and plugins is all over the map, and I fight with clients constantly to try and keep them from installing plugins on a whim for exactly that reason. (It's amazing how many people grab plugins to do stuff that WP can actually do itself, just in a way that isn't immediately obvious to the user.) But it's not impossible to run a site on just WP core.

dkuntz2 14y ago
Right, but that's not all 64 million of them. Or even a large fraction of them (provided that number's the self-hosted installs).