4 ms·

What an absurd comparison... The linux kernel has 16 million lines of code, Wordpress has 300k. Yet Wordpress[1] has had nearly as many security vulnerabiliti

by moe 12y ago

What an absurd comparison... The linux kernel has 16 million lines of code, Wordpress has 300k. Yet Wordpress[1] has had nearly as many security vulnerabilities as the kernel[2]; 194 vs 257 exploits. Wordpress is one of the most exploited software packages ever created. It is the textbook example of bad programming. Just mentioning the kernel when talking about Wordpress is pretty ridiculous. [1] http://www.cvedetails.com/vulnerability-list/vendor_id-2337/product_id-4096/Wordpress-Wordpress.html http://www.cvedetails.com/vulnerability-list/vendor_id-2337/... [2] http://www.cvedetails.com/vulnerability-list/vendor_id-33/product_id-47/cvssscoremin-7/cvssscoremax-7.99/Linux-Linux-Kernel.html http://www.cvedetails.com/vulnerability-list/vendor_id-33/pr...

jordanlev 12y ago
I am no fan of wordpress, and I agree that it is a textbook example of bad programming... but it is also a textbook example of good community management and success at empowering non-programmers to have their own web presence. And I believe that the amount of exploits has as much to do (if not moreso) with its sheer popularity as it does with the code.
maratd 12y ago
> Wordpress is one of the most exploited software packages ever created. Hyperbole much? It's one of the most popular software packages installed on the web. It's not surprising it has a lot of eyes on it.
- moe 12y ago
  This has nothing to do with eyes. Dozens of other packages have a much larger install base than Wordpress. Wordpress has 32(!) CVE's tagged with "Exec Code" (remote code execution) alone. The last one a mere 6 months old. If you know another project that comes even remotely close to that then I'd be genuinely curious which one that would be?
  - maratd 12y ago
    > This has nothing to do with eyes. Yeah, it does. You can write a crappy piece of software that nobody uses and because nobody has interest in it, it has no known security issues! Big deal. I'm not saying that Wordpress has a great code-base or that there's no correlation, but that popularity is a substantial variable in that equation. > Dozens of other packages have a much larger install base than Wordpress. Name one web based software suite that's installed more often.
    - moe 12y ago
      Name one web based software suite that's installed more often. What does "web based" have to do with anything? Do you think SSH, Postfix, nginx, Apache & Co don't get the same amount of scrutiny? Each of them has a significantly larger install base than Wordpress.
      - maratd 12y ago
        > Do you think SSH, Postfix, nginx, Apache & Co don't get the same amount of scrutiny? NO! Because they're behind a firewall AND each operates on a very restricted protocol! It has nothing to do with quality of codebase. If Wordpress was behind a firewall and only restricted to text-based input per spec, you wouldn't find many vulnerabilities either. > What does "web based" have to do with anything? Because "web based" is the client. It has to be flexible and with flexibility, comes complexity, and with complexity come exploits. Try getting a CRM going on Postfix or all the myriad other things Wordpress is being used for.
        moe 12y ago
        NO! Because they're behind a firewall Huh? SSH, Postfix and nginx are usually not firewalled. Because "web based" is the client. It has to be flexible and with flexibility... If "flexibility and complexity equal vulnerability" then why does the linux kernel, 53x the size of Wordpress and a tad more complex than a CMS, not have about 53x more exploits? And why does no other CMS system or framework come even close to the number of critical vulnerabilities in Wordpress?

by moe 12y ago

jordanlev 12y ago

I am no fan of wordpress, and I agree that it is a textbook example of bad programming... but it is also a textbook example of good community management and success at empowering non-programmers to have their own web presence. And I believe that the amount of exploits has as much to do (if not moreso) with its sheer popularity as it does with the code.

maratd 12y ago

> Wordpress is one of the most exploited software packages ever created. Hyperbole much? It's one of the most popular software packages installed on the web. It's not surprising it has a lot of eyes on it.

moe 12y ago
This has nothing to do with eyes. Dozens of other packages have a much larger install base than Wordpress. Wordpress has 32(!) CVE's tagged with "Exec Code" (remote code execution) alone. The last one a mere 6 months old. If you know another project that comes even remotely close to that then I'd be genuinely curious which one that would be?
- maratd 12y ago
  > This has nothing to do with eyes. Yeah, it does. You can write a crappy piece of software that nobody uses and because nobody has interest in it, it has no known security issues! Big deal. I'm not saying that Wordpress has a great code-base or that there's no correlation, but that popularity is a substantial variable in that equation. > Dozens of other packages have a much larger install base than Wordpress. Name one web based software suite that's installed more often.
  - moe 12y ago
    Name one web based software suite that's installed more often. What does "web based" have to do with anything? Do you think SSH, Postfix, nginx, Apache & Co don't get the same amount of scrutiny? Each of them has a significantly larger install base than Wordpress.
    - maratd 12y ago
      > Do you think SSH, Postfix, nginx, Apache & Co don't get the same amount of scrutiny? NO! Because they're behind a firewall AND each operates on a very restricted protocol! It has nothing to do with quality of codebase. If Wordpress was behind a firewall and only restricted to text-based input per spec, you wouldn't find many vulnerabilities either. > What does "web based" have to do with anything? Because "web based" is the client. It has to be flexible and with flexibility, comes complexity, and with complexity come exploits. Try getting a CRM going on Postfix or all the myriad other things Wordpress is being used for.
      - moe 12y ago
        NO! Because they're behind a firewall Huh? SSH, Postfix and nginx are usually not firewalled. Because "web based" is the client. It has to be flexible and with flexibility... If "flexibility and complexity equal vulnerability" then why does the linux kernel, 53x the size of Wordpress and a tad more complex than a CMS, not have about 53x more exploits? And why does no other CMS system or framework come even close to the number of critical vulnerabilities in Wordpress?