5 ms·

Seems like that advice is applicable to any software.

• antonovka 17y ago
  Yes, however, perusing the history of vulnerability disclosures in popular software demonstrates that the degree of likelihood of a new issue being found varies to a considerable degree based on the software in question. Given that, software with an exceedingly low historical defect rate could reasonably be considered 'secure'.
• tsally 17y ago
  Except that Wordpress is written in PHP and designed without security as a goal. True, security is all about probability, but Wordpress' odds are not that good.
  • reedlaw 17y ago
    Windows was originally built without security as a major focus, but has been improved vastly. So has WordPress. Except for a few rare cases where security was a primary goal, such as OpenBSD, most software will be discovered to have vulnerabilities at some point in time.
    • iuguy 17y ago
      OpenBSD has had plenty of vulnerabilities, including a couple of remote ones.
      • reedlaw 17y ago
        So it's a good example of software built with security as a primary focus that still has vulnerabilities. I can think of few examples of software that has never had vulnerabilities discovered. OpenSSH maybe?
        • shykes 17y ago
          OpenSSH has had more than its share of vulnerabilities.
          • scythe 17y ago
            seL4! ...wait, that's cheating, isn't it?
    • rincewind 17y ago
      Windows was originally built without security as a major focus. This is misleading. Windows NT was built with security in mind. Windows Xp, Vista and 7 are descended from NT.
      • reedlaw 17y ago
        I meant Windows 95 and 98. NT is one of the vast improvements I had in mind.
  • nir 17y ago
    The fact it's been written in PHP is meaningless. As for "designed without security as a goal", I think you'll find that's true for most web apps.