9 ms·

Name one web based software suite that's installed more often. What does "web based" have to do with anything? Do you think SSH, Postfix, nginx, Apache & Co d

by moe 12y ago

Name one web based software suite that's installed more often. What does "web based" have to do with anything? Do you think SSH, Postfix, nginx, Apache & Co don't get the same amount of scrutiny? Each of them has a significantly larger install base than Wordpress.

maratd 12y ago
> Do you think SSH, Postfix, nginx, Apache & Co don't get the same amount of scrutiny? NO! Because they're behind a firewall AND each operates on a very restricted protocol! It has nothing to do with quality of codebase. If Wordpress was behind a firewall and only restricted to text-based input per spec, you wouldn't find many vulnerabilities either. > What does "web based" have to do with anything? Because "web based" is the client. It has to be flexible and with flexibility, comes complexity, and with complexity come exploits. Try getting a CRM going on Postfix or all the myriad other things Wordpress is being used for.
- moe 12y ago
  NO! Because they're behind a firewall Huh? SSH, Postfix and nginx are usually not firewalled. Because "web based" is the client. It has to be flexible and with flexibility... If "flexibility and complexity equal vulnerability" then why does the linux kernel, 53x the size of Wordpress and a tad more complex than a CMS, not have about 53x more exploits? And why does no other CMS system or framework come even close to the number of critical vulnerabilities in Wordpress?
  - maratd 12y ago
    > And why does no other CMS system or framework come even close to the number of critical vulnerabilities in Wordpress? Because no other CMS or framework has as many deployments. Not even close. > If "flexibility and complexity equal vulnerability" then why does the linux kernel, 53x the size of Wordpress and a tad more complex than a CMS, not have about 53x more exploits? Because it's behind a firewall. Do I really need to keep repeating myself? If I could send remote commands to your kernel, don't you think there would be a few more exploits kicking around? > Huh? SSH, Postfix and nginx are usually not firewalled. If you're not restricting access to SSH using a firewall, then you're a bigger idiot than I thought you were.
    - cthalupa 12y ago
      >If you're not restricting access to SSH using a firewall, then you're a bigger idiot than I thought you were. I'm not sure name calling is really appropriate here. Yes, firewalling stuff is certainly appropriate, particularly administrative things, but key based auth is pretty secure, firewall or no. You're also nitpicking on a single point when he mentions other things that are definitely not usually firewalled. Your mail and web servers are generally open to the world, regardless of whether or not SSH is.
- xorcist 12y ago
  If you think that sshd gets restricted to "text-based input per spec", you should get out more. Or at least check your logs more.
  - maratd 12y ago
    My logs are clean. Because sshd is restricted to specific ip ranges. Ever hear of a firewall? Apparently the other guy on this thread hasn't either.

by moe 12y ago

maratd 12y ago

> Do you think SSH, Postfix, nginx, Apache & Co don't get the same amount of scrutiny? NO! Because they're behind a firewall AND each operates on a very restricted protocol! It has nothing to do with quality of codebase. If Wordpress was behind a firewall and only restricted to text-based input per spec, you wouldn't find many vulnerabilities either. > What does "web based" have to do with anything? Because "web based" is the client. It has to be flexible and with flexibility, comes complexity, and with complexity come exploits. Try getting a CRM going on Postfix or all the myriad other things Wordpress is being used for.

moe 12y ago
NO! Because they're behind a firewall Huh? SSH, Postfix and nginx are usually not firewalled. Because "web based" is the client. It has to be flexible and with flexibility... If "flexibility and complexity equal vulnerability" then why does the linux kernel, 53x the size of Wordpress and a tad more complex than a CMS, not have about 53x more exploits? And why does no other CMS system or framework come even close to the number of critical vulnerabilities in Wordpress?
- maratd 12y ago
  > And why does no other CMS system or framework come even close to the number of critical vulnerabilities in Wordpress? Because no other CMS or framework has as many deployments. Not even close. > If "flexibility and complexity equal vulnerability" then why does the linux kernel, 53x the size of Wordpress and a tad more complex than a CMS, not have about 53x more exploits? Because it's behind a firewall. Do I really need to keep repeating myself? If I could send remote commands to your kernel, don't you think there would be a few more exploits kicking around? > Huh? SSH, Postfix and nginx are usually not firewalled. If you're not restricting access to SSH using a firewall, then you're a bigger idiot than I thought you were.
  - cthalupa 12y ago
    >If you're not restricting access to SSH using a firewall, then you're a bigger idiot than I thought you were. I'm not sure name calling is really appropriate here. Yes, firewalling stuff is certainly appropriate, particularly administrative things, but key based auth is pretty secure, firewall or no. You're also nitpicking on a single point when he mentions other things that are definitely not usually firewalled. Your mail and web servers are generally open to the world, regardless of whether or not SSH is.
xorcist 12y ago
If you think that sshd gets restricted to "text-based input per spec", you should get out more. Or at least check your logs more.
- maratd 12y ago
  My logs are clean. Because sshd is restricted to specific ip ranges. Ever hear of a firewall? Apparently the other guy on this thread hasn't either.