or... another way to look at it. Wordpress releases security updates at astounding frequency without waiting to lump all those security updates in to one large

or... another way to look at it. Wordpress releases security updates at astounding frequency without waiting to lump all those security updates in to one large update like most other large software tends to do. It's an artifact of their development practices and code quality that requires such frequent updates, not a desire to provide regular small patch sets. See tptacek's comment on their implementation quality: http://news.ycombinator.com/item?id=806910 http://news.ycombinator.com/item?id=806910 You can also compare the quantity and severity of vulnerabilities against MediaWiki: http://www.securityfocus.com/cgi-bin/index.cgi?o=0&l=30&c=12&op=display_list&vendor=MediaWiki&version=&title=&CVE= http://www.securityfocus.com/cgi-bin/index.cgi?o=0&l=30&...