4 ms·

It can be coaxed into performing outbound requests, whether it is related to this specific issue I wouldn't know. http://blog.sucuri.net/2014/03/more-than-1620

• 0x0 13y ago
  That's rough. I bet there are a lot of sloppy wordpress installs that never bother patch the heartbleed thing "since they're not using SSL". e: "sloppily maintained", if you will
  • rabino 13y ago
    As far as I understand, the sloppy ones are the sysadmin behind those sites, not the WordPress installs. And as far as I know, lazy sysadmins don't discriminate regarding what technology they are lazy with.
    • lambda 13y ago
      Actually, they do generally discriminate. Software which is easy to set up initially, but hard to upgrade, tends to be much more likely to be out of date than software which is easier to upgrade. Things that consist of "a big blob of PHP plus a lot of extensions" tend to fall into this camp. PHP apps are generally very easy to get set up the first time, and popular ones like Wordpress have lots of extensions you can add on; but then once you've been running that for a while, you discover that if you upgrade, these n extensions all break, and rather than bothering to find replacements, you just don't bother upgrading. How do you fix this? Make upgrading easy, don't rely on extensions, or make sure you have bulletproof, stable APIs so that no one worries "if I upgrade, all these things are going to break."
      • rabino 13y ago
        Since 3.7 WordPress auto-upgrades itself in the background (for minor versions), like Chrome does. So not sure what are you talking about.