4 ms·

Fundamentally, "X is secure" has no meaning (to me, a non-expert in any security field). If it's a term of art, so be it, but make it clear you're using it as a

Fundamentally, "X is secure" has no meaning (to me, a non-expert in any security field). If it's a term of art, so be it, but make it clear you're using it as a term of art. In the absence of that, I think "X is secure" only makes sense in comparison to other things, not as a standalone statement. What is Wordpress as secure as? This is a flabbergastingly empirical question that could be tackled on different fronts. It hinges on which way(s) you define security. Is security based on the number of users of your application? (I would dismiss that outright, but the author uses it as evidence.) Is security based on the number of publicly disclosed vulnerabilities as compared to competitors? Is security based on some formally-definable metric that can be created by examination of the code itself? Is security based on some financial guarantee from the backers of an application? In the end, I understand that this is a puff piece and so I shouldn't read too much into the article. But saying "X is secure" actually doesn't make it so. (Note that I'm not saying that I think WP is or is not insecure; I just don't feel any better qualified to make that assessment after reading this article.)

dotBen 13y ago
I'm curious, what the answers to the comparisons you mentioned would make you conclude positively in WordPress's favor? Is security based on the number of users of your application? 1 in 6 websites on the Internet runs WordPress. Is security based on the number of publicly disclosed vulnerabilities as compared to competitors? It's open source code so every discovered vulnerability is public knowledge. Many competitors are closed source and may not disclose vulnerabilities (doesn't mean there aren't any). On this point, I'm not sure what could be improved on given it's FOSS or what "winning" would look like. Is security based on some formally-definable metric that can be created by examination of the code itself? If you can come up with the metric, I'm sure it can given the code is FOSS. Perhaps I don't follow what you're looking for here. Is security based on some financial guarantee from the backers of an application? It's Free Open Source Software, no FOSS I know of has a financial guarantee by its very nature. Examples like RHEL are not free (as in beer). The guarantee of FOSS comes from the degree of sunshine placed upon the code that everyone has an aligned interest to disclose vulnerabilities. Perhaps you could elaborate on what would make you feel "X is secure"?
- carbocation 13y ago
  > I'm curious, what the answers to the comparisons you mentioned would make you conclude positively in WordPress's favor? My goal in disqualifying myself at the beginning of my post was to make it clear that, although I find the article to be unconvincing (the reasons for which I tried to explain), I'm not the one (at least, not given how little I've thought about it) to come up with a good way to decide what it should mean to say "X is secure." Unfortunately this means that answering my questions isn't probably a good use of your time, because to me they were off-the-cuff. (Oddly, I had answered one of the questions that you responded to.) The list is not exhaustive. It was a mix of real questions (code metrics) and anti-questions (# of users) that was unfortunately not very logically laid out. They were just what came to mind while waiting for a 5x5' storage unit rental to get cleaned out. To be moved, I think people want to see relevant data. Unfortunately I don't have more to offer about what that looks like than Potter Stewart did.
- tptacek 13y ago
  There is a universe of terribly unsafe open source software. The notion that Wordpress is somehow more secure because it has a different license than phpBB is wishful.
- wglb 13y ago
  It's open source code so every discovered vulnerability is public knowledge. Well, there is public knowledge, and there is actual action. Several examples come to mind. OpenSSL, which has been available for a very long time, does not have that good a track record. There is the example of 10-year old vulnerabilities disclosed in TOSSA that only recently came to light. The BEAST attack's underlying target was written about before. From the point of view of labeling anything to be "secure" (whatever that means), I like to think what Steve Brown used to say about some new output from his science lab: "Not known not to work". Translated to the security world, "Not known to have security vulnerabilities."
blowski 13y ago
You're right, the post is essentially meaningless. If it's secure why doesn't MI5, CIA, and banks use it as their CMS? Oh because it's not that secure. In addition to your questions, I would ask * What types of attack is it secure against? * How much work is involved in doing all the ongoing maintenance? * The risk tends to come from plugins, but those plugins are one of the main selling points of Wordpress. To what extent does this lessen Wordpress's value proposition? * If you do ever get hacked, what kind of auditing is there? What help does it provide for damage limitation? The OP is an overly-simplified response to typical boilerplate comments - [insert language or framework] is [fast/slow/secure/insecure]. Of course Wordpress is secure enough for the average professional site as long as it's maintained, but the OP sounds like a car salesman saying "Sure it's _real_ fast" without telling you the actual speed.
- dotBen 13y ago
  That's kind of an absurd statement - that logic implies that MI5 and CIA use everything that is secure. As it happens, we have a number of Fortune-50 banks and financial institutions as clients who host their WordPress with us <shrugs>
  - blowski 13y ago
    The point is that secure is not an absolute, but a relative value. There will be many Fortune50 projects where Wordpress will be plenty secure enough.

dotBen 13y ago

I'm curious, what the answers to the comparisons you mentioned would make you conclude positively in WordPress's favor? Is security based on the number of users of your application? 1 in 6 websites on the Internet runs WordPress. Is security based on the number of publicly disclosed vulnerabilities as compared to competitors? It's open source code so every discovered vulnerability is public knowledge. Many competitors are closed source and may not disclose vulnerabilities (doesn't mean there aren't any). On this point, I'm not sure what could be improved on given it's FOSS or what "winning" would look like. Is security based on some formally-definable metric that can be created by examination of the code itself? If you can come up with the metric, I'm sure it can given the code is FOSS. Perhaps I don't follow what you're looking for here. Is security based on some financial guarantee from the backers of an application? It's Free Open Source Software, no FOSS I know of has a financial guarantee by its very nature. Examples like RHEL are not free (as in beer). The guarantee of FOSS comes from the degree of sunshine placed upon the code that everyone has an aligned interest to disclose vulnerabilities. Perhaps you could elaborate on what would make you feel "X is secure"?

carbocation 13y ago
> I'm curious, what the answers to the comparisons you mentioned would make you conclude positively in WordPress's favor? My goal in disqualifying myself at the beginning of my post was to make it clear that, although I find the article to be unconvincing (the reasons for which I tried to explain), I'm not the one (at least, not given how little I've thought about it) to come up with a good way to decide what it should mean to say "X is secure." Unfortunately this means that answering my questions isn't probably a good use of your time, because to me they were off-the-cuff. (Oddly, I had answered one of the questions that you responded to.) The list is not exhaustive. It was a mix of real questions (code metrics) and anti-questions (# of users) that was unfortunately not very logically laid out. They were just what came to mind while waiting for a 5x5' storage unit rental to get cleaned out. To be moved, I think people want to see relevant data. Unfortunately I don't have more to offer about what that looks like than Potter Stewart did.
tptacek 13y ago
There is a universe of terribly unsafe open source software. The notion that Wordpress is somehow more secure because it has a different license than phpBB is wishful.
wglb 13y ago
It's open source code so every discovered vulnerability is public knowledge. Well, there is public knowledge, and there is actual action. Several examples come to mind. OpenSSL, which has been available for a very long time, does not have that good a track record. There is the example of 10-year old vulnerabilities disclosed in TOSSA that only recently came to light. The BEAST attack's underlying target was written about before. From the point of view of labeling anything to be "secure" (whatever that means), I like to think what Steve Brown used to say about some new output from his science lab: "Not known not to work". Translated to the security world, "Not known to have security vulnerabilities."

blowski 13y ago

You're right, the post is essentially meaningless. If it's secure why doesn't MI5, CIA, and banks use it as their CMS? Oh because it's not that secure. In addition to your questions, I would ask * What types of attack is it secure against? * How much work is involved in doing all the ongoing maintenance? * The risk tends to come from plugins, but those plugins are one of the main selling points of Wordpress. To what extent does this lessen Wordpress's value proposition? * If you do ever get hacked, what kind of auditing is there? What help does it provide for damage limitation? The OP is an overly-simplified response to typical boilerplate comments - [insert language or framework] is [fast/slow/secure/insecure]. Of course Wordpress is secure enough for the average professional site as long as it's maintained, but the OP sounds like a car salesman saying "Sure it's _real_ fast" without telling you the actual speed.

dotBen 13y ago
That's kind of an absurd statement - that logic implies that MI5 and CIA use everything that is secure. As it happens, we have a number of Fortune-50 banks and financial institutions as clients who host their WordPress with us <shrugs>
- blowski 13y ago
  The point is that secure is not an absolute, but a relative value. There will be many Fortune50 projects where Wordpress will be plenty secure enough.