17 ms·

This has nothing to do with eyes. Dozens of other packages have a much larger install base than Wordpress. Wordpress has 32(!) CVE's tagged with "Exec Code" (

by moe 12y ago

This has nothing to do with eyes. Dozens of other packages have a much larger install base than Wordpress. Wordpress has 32(!) CVE's tagged with "Exec Code" (remote code execution) alone. The last one a mere 6 months old. If you know another project that comes even remotely close to that then I'd be genuinely curious which one that would be?

maratd 12y ago
> This has nothing to do with eyes. Yeah, it does. You can write a crappy piece of software that nobody uses and because nobody has interest in it, it has no known security issues! Big deal. I'm not saying that Wordpress has a great code-base or that there's no correlation, but that popularity is a substantial variable in that equation. > Dozens of other packages have a much larger install base than Wordpress. Name one web based software suite that's installed more often.
- moe 12y ago
  Name one web based software suite that's installed more often. What does "web based" have to do with anything? Do you think SSH, Postfix, nginx, Apache & Co don't get the same amount of scrutiny? Each of them has a significantly larger install base than Wordpress.
  - maratd 12y ago
    > Do you think SSH, Postfix, nginx, Apache & Co don't get the same amount of scrutiny? NO! Because they're behind a firewall AND each operates on a very restricted protocol! It has nothing to do with quality of codebase. If Wordpress was behind a firewall and only restricted to text-based input per spec, you wouldn't find many vulnerabilities either. > What does "web based" have to do with anything? Because "web based" is the client. It has to be flexible and with flexibility, comes complexity, and with complexity come exploits. Try getting a CRM going on Postfix or all the myriad other things Wordpress is being used for.
    - moe 12y ago
      NO! Because they're behind a firewall Huh? SSH, Postfix and nginx are usually not firewalled. Because "web based" is the client. It has to be flexible and with flexibility... If "flexibility and complexity equal vulnerability" then why does the linux kernel, 53x the size of Wordpress and a tad more complex than a CMS, not have about 53x more exploits? And why does no other CMS system or framework come even close to the number of critical vulnerabilities in Wordpress?
      - maratd 12y ago
        > And why does no other CMS system or framework come even close to the number of critical vulnerabilities in Wordpress? Because no other CMS or framework has as many deployments. Not even close. > If "flexibility and complexity equal vulnerability" then why does the linux kernel, 53x the size of Wordpress and a tad more complex than a CMS, not have about 53x more exploits? Because it's behind a firewall. Do I really need to keep repeating myself? If I could send remote commands to your kernel, don't you think there would be a few more exploits kicking around? > Huh? SSH, Postfix and nginx are usually not firewalled. If you're not restricting access to SSH using a firewall, then you're a bigger idiot than I thought you were.
        cthalupa 12y ago
        >If you're not restricting access to SSH using a firewall, then you're a bigger idiot than I thought you were. I'm not sure name calling is really appropriate here. Yes, firewalling stuff is certainly appropriate, particularly administrative things, but key based auth is pretty secure, firewall or no. You're also nitpicking on a single point when he mentions other things that are definitely not usually firewalled. Your mail and web servers are generally open to the world, regardless of whether or not SSH is.
    - xorcist 12y ago
      If you think that sshd gets restricted to "text-based input per spec", you should get out more. Or at least check your logs more.

by moe 12y ago

maratd 12y ago

> This has nothing to do with eyes. Yeah, it does. You can write a crappy piece of software that nobody uses and because nobody has interest in it, it has no known security issues! Big deal. I'm not saying that Wordpress has a great code-base or that there's no correlation, but that popularity is a substantial variable in that equation. > Dozens of other packages have a much larger install base than Wordpress. Name one web based software suite that's installed more often.

moe 12y ago
Name one web based software suite that's installed more often. What does "web based" have to do with anything? Do you think SSH, Postfix, nginx, Apache & Co don't get the same amount of scrutiny? Each of them has a significantly larger install base than Wordpress.
- maratd 12y ago
  > Do you think SSH, Postfix, nginx, Apache & Co don't get the same amount of scrutiny? NO! Because they're behind a firewall AND each operates on a very restricted protocol! It has nothing to do with quality of codebase. If Wordpress was behind a firewall and only restricted to text-based input per spec, you wouldn't find many vulnerabilities either. > What does "web based" have to do with anything? Because "web based" is the client. It has to be flexible and with flexibility, comes complexity, and with complexity come exploits. Try getting a CRM going on Postfix or all the myriad other things Wordpress is being used for.
  - moe 12y ago
    NO! Because they're behind a firewall Huh? SSH, Postfix and nginx are usually not firewalled. Because "web based" is the client. It has to be flexible and with flexibility... If "flexibility and complexity equal vulnerability" then why does the linux kernel, 53x the size of Wordpress and a tad more complex than a CMS, not have about 53x more exploits? And why does no other CMS system or framework come even close to the number of critical vulnerabilities in Wordpress?
    - maratd 12y ago
      > And why does no other CMS system or framework come even close to the number of critical vulnerabilities in Wordpress? Because no other CMS or framework has as many deployments. Not even close. > If "flexibility and complexity equal vulnerability" then why does the linux kernel, 53x the size of Wordpress and a tad more complex than a CMS, not have about 53x more exploits? Because it's behind a firewall. Do I really need to keep repeating myself? If I could send remote commands to your kernel, don't you think there would be a few more exploits kicking around? > Huh? SSH, Postfix and nginx are usually not firewalled. If you're not restricting access to SSH using a firewall, then you're a bigger idiot than I thought you were.
      - cthalupa 12y ago
        >If you're not restricting access to SSH using a firewall, then you're a bigger idiot than I thought you were. I'm not sure name calling is really appropriate here. Yes, firewalling stuff is certainly appropriate, particularly administrative things, but key based auth is pretty secure, firewall or no. You're also nitpicking on a single point when he mentions other things that are definitely not usually firewalled. Your mail and web servers are generally open to the world, regardless of whether or not SSH is.
  - xorcist 12y ago
    If you think that sshd gets restricted to "text-based input per spec", you should get out more. Or at least check your logs more.