4 ms·
For a widely popular software like wordpress, security will be a cat and mouse game - until it reaches a level of maturity like other open source projects (ie,
by pavs 17y ago
For a widely popular software like wordpress, security will be a cat and mouse game - until it reaches a level of maturity like other open source projects (ie, linux).
For me the problem is not that they release frequent updates - I would have a problem if they didn't release frequent updates to known severe vulnerabilities. If you look at their release logs you will see that most of their security updates has 24-48 hours of turnaround from the time of the vulnerability detection.
The recent vulnerability that this blog and most others (ie, smashing magazine) got affected has been fixed 2 releases before the current release. People who are affected didn't update for the last 3 release and someone developed a script out there that automatically scans for that vuln. and takes advantage of it.
- redcap 17y agoI'd argue that the frequency of security updates points to a fairly immature security architecture - it might be ages before they get anywhere near other sufficiently secure open source projects (although comparing it with linux is a bit like comparing apples and bananas).
- moe 17y agosecurity will be a cat and mouse game From a security standpoint Wordpress is a trivial application because it's almost entirely read-only, except for the comments. Making a plugin-architecture bullet proof is a different story, but as I understand it most of these issues affect the very core, i.e. a vanilla wordpress install. There is no excuse for their sorry state of affairs.