6 ms·

The automatic background updates feature might be the most important feature of all in 3.7. Hopefully this goes a long way to plug some of the rampant security

The automatic background updates feature might be the most important feature of all in 3.7. Hopefully this goes a long way to plug some of the rampant security issues that plague the CMS because of failure to update to a later version. The new date querying features are also a welcome addition as it has been notoriously hacky in prior versions querying advanced date values in Wordpress and finally we search has been given a little love and is no longer so horrible that it requires a third party plugin to fill the void. Best version of Wordpress to date by far, wonder how they can top this list in 3.8.

gregd 13y ago
Ugh. I'm extremely skeptical of auto-updates. My servers don't auto-update, my workstation doesn't auto-update..nothing I own, auto-updates if it's capable of it. Can anyone tell me if it can be turned off? All I'm seeing is this: For developers there are lots of options around how to control the new updates feature, including allowing it to handle major upgrades as well as minor ones, more sophisticated date query support, and multisite improvements. I've been burned one too many times. I see a MASSIVE WP failure in the near future where an update gets pushed out and takes millions of Wordpress sites offline... It's happened with Bitdefender. It's happened with AVG. It's happened with Windows 8.1 RT.
- joshsegall 13y ago
  As long as there's a switch to turn it off, you'll be just fine. Meanwhile millions of poorly monitored sites will be less vulnerable to attack at the cost of what I suspect will be relatively infrequent update snafus. All security is a tradeoff and this is a good one.
  - gregd 13y ago
    I just updated a test site to 3.7 and I'm not seeing anywhere this can be turned off.
    - gregd 13y ago
      Found it! In order to disable it you have to add define( 'AUTOMATIC_UPDATER_DISABLED', true ); to your wp-config.php file
- desas 13y ago
  There's a constant so that you can turn it off. In the linked article, the first paragraph in the section about auto-updates links to the wordpress wiki page about it, the constant is basically point 1a on that page.
- xdissent 13y ago
  @nacin responded to me on Twitter saying the auto-updates are automatically disabled if WP detects that it's being run from within some source control repositories. I asked if it's smart enough to know if it lives deeper within a repository and haven't yet received an answer.
  - rmccue 13y ago
    It is smart enough, it'll keep traversing upwards and check every parent directory.
- xdissent 13y ago
  @nacin says the WP auto-updates are disabled if the WP code is contained in any repository, up to the root folder. http://make.wordpress.org/core/2013/09/24/automatic-core-updates/ http://make.wordpress.org/core/2013/09/24/automatic-core-upd...
- 8ig8 13y ago
  I'm fine with it, but i understand the concern. It sounds pretty easy to disable the feature... > The simplest way to disable it is to add define( 'AUTOMATIC_UPDATER_DISABLED', true ); to your wp-config.php file
  - poissonpie 13y ago
    Urg. It should be off by default in my opinion. You should have to explicitly turn it on.
    - zeroDivisible 13y ago
      I think it should ask the user, explicitly giving him information about what's wrong with both approaches.
- krogsgard 13y ago
  There are filters to turn off auto-updates easily. Also keep in mind it's currently for minor updates only, which basically never break a site. And in beta and RC testing, there were no hard failures, only some instances where the update stopped because it detected a potential issue. It's a pretty clean setup, and overall really good for the security of millions of websites.
- aaroncampbell 13y ago
  By default it only updates minor releases, which are only used to fix security issues and regressions. So it's only automating the the safest updates, and I think the good it will do by keeping sites secure outweighs the risk.
- nyordanov 13y ago
  http://make.wordpress.org/core/2013/10/25/the-definitive-guide-to-disabling-auto-updates-in-wordpress-3-7/ http://make.wordpress.org/core/2013/10/25/the-definitive-gui...
dotBen 13y ago
Yes, we've (http://wpengine.com http://wpengine.com) decided to disable the auto-updates as we want to perform our client account-specific tests before upgrading future versions BUT I welcome the addition of auto-updates given that the majority of WordPress installs do not live at Managed WordPress Hosts.
- ericclemmons 13y ago
  Likewise for the Genesis/WordPress project. It's great and will probably be enabled for local development, but changes to plugins, themes, and the core will need deployment. Besides, updating WP within the GUI seems to skip/ignore certain files compared to downloading the latest release and merging.
e12e 13y ago
Auto-update? It shouldn't be able to auto-update. It shouldn't have write-privileges to the folders running code! Granted, I generally don't do php, and cerainly not wordpress -- but with all these php projects having a run-once-magically-write-a-config-php-thingy -- they also generally throw a warning if that config is writable after initial setup. Do the chgrp-dance when installing/upgrading: chgrp www-data -R php-dir;chmod g+rwX -R php-dir;#set up via web installer;chmod g-w -R php-dir;chgrp not-the-web-server -R php-dir; #fix permissions on any upload-folders
- nisa 13y ago
  This is effective but unfortunately there is already malware that plants itself inside the database. If you are able to execute code remotely you can also almost always write to /tmp
  - e12e 13y ago
    Yes, but code being written to data areas (or rather, written/stored in such a way that it can/will be executed later) generally is a bug. Allowing a server to overwrite itself is just a bad idea (hence the NX bit for memory).
snowwrestler 13y ago
Auto update is itself a security issue because it means the app can overwrite itself. This is not a security concern with client apps like browsers because they don't run on a publicly listening server. Wordpress does.

gregd 13y ago

Ugh. I'm extremely skeptical of auto-updates. My servers don't auto-update, my workstation doesn't auto-update..nothing I own, auto-updates if it's capable of it. Can anyone tell me if it can be turned off? All I'm seeing is this: For developers there are lots of options around how to control the new updates feature, including allowing it to handle major upgrades as well as minor ones, more sophisticated date query support, and multisite improvements. I've been burned one too many times. I see a MASSIVE WP failure in the near future where an update gets pushed out and takes millions of Wordpress sites offline... It's happened with Bitdefender. It's happened with AVG. It's happened with Windows 8.1 RT.

joshsegall 13y ago
As long as there's a switch to turn it off, you'll be just fine. Meanwhile millions of poorly monitored sites will be less vulnerable to attack at the cost of what I suspect will be relatively infrequent update snafus. All security is a tradeoff and this is a good one.
- gregd 13y ago
  I just updated a test site to 3.7 and I'm not seeing anywhere this can be turned off.
  - gregd 13y ago
    Found it! In order to disable it you have to add define( 'AUTOMATIC_UPDATER_DISABLED', true ); to your wp-config.php file
desas 13y ago
There's a constant so that you can turn it off. In the linked article, the first paragraph in the section about auto-updates links to the wordpress wiki page about it, the constant is basically point 1a on that page.
xdissent 13y ago
@nacin responded to me on Twitter saying the auto-updates are automatically disabled if WP detects that it's being run from within some source control repositories. I asked if it's smart enough to know if it lives deeper within a repository and haven't yet received an answer.
- rmccue 13y ago
  It is smart enough, it'll keep traversing upwards and check every parent directory.
xdissent 13y ago
@nacin says the WP auto-updates are disabled if the WP code is contained in any repository, up to the root folder. http://make.wordpress.org/core/2013/09/24/automatic-core-updates/ http://make.wordpress.org/core/2013/09/24/automatic-core-upd...
8ig8 13y ago
I'm fine with it, but i understand the concern. It sounds pretty easy to disable the feature... > The simplest way to disable it is to add define( 'AUTOMATIC_UPDATER_DISABLED', true ); to your wp-config.php file
- poissonpie 13y ago
  Urg. It should be off by default in my opinion. You should have to explicitly turn it on.
  - zeroDivisible 13y ago
    I think it should ask the user, explicitly giving him information about what's wrong with both approaches.
krogsgard 13y ago
There are filters to turn off auto-updates easily. Also keep in mind it's currently for minor updates only, which basically never break a site. And in beta and RC testing, there were no hard failures, only some instances where the update stopped because it detected a potential issue. It's a pretty clean setup, and overall really good for the security of millions of websites.
aaroncampbell 13y ago
By default it only updates minor releases, which are only used to fix security issues and regressions. So it's only automating the the safest updates, and I think the good it will do by keeping sites secure outweighs the risk.
nyordanov 13y ago
http://make.wordpress.org/core/2013/10/25/the-definitive-guide-to-disabling-auto-updates-in-wordpress-3-7/ http://make.wordpress.org/core/2013/10/25/the-definitive-gui...

dotBen 13y ago

Yes, we've (http://wpengine.com http://wpengine.com) decided to disable the auto-updates as we want to perform our client account-specific tests before upgrading future versions BUT I welcome the addition of auto-updates given that the majority of WordPress installs do not live at Managed WordPress Hosts.

ericclemmons 13y ago
Likewise for the Genesis/WordPress project. It's great and will probably be enabled for local development, but changes to plugins, themes, and the core will need deployment. Besides, updating WP within the GUI seems to skip/ignore certain files compared to downloading the latest release and merging.

e12e 13y ago

Auto-update? It shouldn't be able to auto-update. It shouldn't have write-privileges to the folders running code! Granted, I generally don't do php, and cerainly not wordpress -- but with all these php projects having a run-once-magically-write-a-config-php-thingy -- they also generally throw a warning if that config is writable after initial setup. Do the chgrp-dance when installing/upgrading: chgrp www-data -R php-dir;chmod g+rwX -R php-dir;#set up via web installer;chmod g-w -R php-dir;chgrp not-the-web-server -R php-dir; #fix permissions on any upload-folders

nisa 13y ago
This is effective but unfortunately there is already malware that plants itself inside the database. If you are able to execute code remotely you can also almost always write to /tmp
- e12e 13y ago
  Yes, but code being written to data areas (or rather, written/stored in such a way that it can/will be executed later) generally is a bug. Allowing a server to overwrite itself is just a bad idea (hence the NX bit for memory).

snowwrestler 13y ago

Auto update is itself a security issue because it means the app can overwrite itself. This is not a security concern with client apps like browsers because they don't run on a publicly listening server. Wordpress does.