3 ms·
WP is a perfectly fine tool for many scenarios. There's something nice about having a blogging platform that's easy to install and use. The problem I see if tha
by drzaiusapelord 12y ago
WP is a perfectly fine tool for many scenarios. There's something nice about having a blogging platform that's easy to install and use. The problem I see if that this blogging platform gets shoe-horned into a CMS-like role with half-assed extensions and modifications, many of which are written by amateurs running a freemium-style model and often have little to no community source code review. I find popular extensions are okay, its just when you start looking at more obscure stuff because now your WP needs to be Drupal-light and SugarCRM-like that you run into trouble. WP is pretty much a victim of its own success. Lots of people have made sure the Wrong Way to do things is easy in the WP ecosystem and that hurts the core product.
I'm really surprised to see a site that gets as much traffic as Wired using WP. I could see Drupal taking this role. Drupal, of course, is not without its faults. I've been part of a few Drupal roll-outs and have done development on it, and my god, there's an ugly learning curve here. If money is an issue, you can get a decent WP dev a lot less a Drupal shop would charge you. I imagine Wired, being a print magazine in the age of dying print, probably didn't have a big budget.
Personally, I'd love to see something as solid as Drupal but with the ease of WP. Maybe this middle ground is impossible, but it would be nice to whip up a Drupal instance and have certain roles or templates ready to go, like WP does. Instead, stock Drupal is pretty much nothing out of the box and the dollars/time involved to make it something usable and finished can be significant.
>an average of four cookies for every visit (which messes with some caching attempts)
That's a trivial fix in Varnish. I run Varnish in front of WP for my own personal blog.
>, I can tell just from your headers that you're running on Apache 2.4.6, on PHP 5.6.6, and using Varnish 4
If that's the worst sin they've committed, then I'd say they're doing pretty well. Securing WP isn't that tough. I find most LAMP apps are security nightmares and WP is just the posterboy for this and because of its popularity gets all the attention. If you're not running an IDS/IPS and locking down WP, securing permissions on your server, running SELinux, etc then you're just asking for trouble.
I used to feel pretty confident about Drupal from a security POV until SA-2014-003. Considering how bad that was, it scared me a bit and makes me wonder why no one can make a CMS without major security issues in this day and age. I need to do the same amount of locking down with Drupal as I do WP. From a server admin role, there's not much difference between the two. I still need to do all that security stuff and admins who say, "Oh Drupal is secure I dont need to do that stuff" are the ones who are going to continue to get burned.
- falcolas 12y ago> That's a trivial fix in Varnish. I run Varnish in front of WP for my own personal blog. Yup. We use Nginx, but do something similar. However the point remains that it's something that you have to identify as a problem and secure in the first place. All of the fixes are relatively trivial, but tracking down and solving a hundred trivial problems quickly becomes a big mess. > If that's the worst sin they've committed, then I'd say they're doing pretty well. Agreed. > Securing WP isn't that tough. I disagree. Sure, you could follow the dozen or so different recommendations on the web for securing WordPress, but that only gets you to 90%. That remaining 9.999% is much harder, and is going to depend heavily on how you're using WordPress. As a result, you'll have to be intelligent about which threats this opens you up to, and the best ways to work around them.
- drzaiusapelord 12y agoI think your latter point is true, but it pretty much applies to any LAMP application. Maybe there's slightly more hair-pulling with WP. I still need to do the same amount of legwork with Drupal. Sure, Drupal's major exploits are less rare, but they do happen. There's no bulletproof CMS and if you believe in bulletproof software, you probably shouldn't be administrating a server. WP wakes people up to the work they should have been doing in the first place. Grumbling about setting permissions, locking down directories, using captchas/honeypots, doing timely updates, running an IPS, running mod_security, etc because "its WP" is unfair. You should be doing those things to all your web applications. The wild-west of the web needs to end. If WP is the wake-up call for securing LAMP servers, then that's actually good in the long run.
- falcolas 12y ago> WP wakes people up to the work they should have been doing in the first place. Well, not really. WordPress doesn't wake anybody up about anything if they are not already security conscious. It will happily serve wp-admin files over a non-SSL connection all day long [0], setting cookies which make the user vulnerable to any number of interception attacks. It will happily suggest [1] you make your WP files all writable by the web server user, to simplify the act of upgrading WordPress. It (with a simple plugin) will be happily allow "authenticated" folks upload anything they want to your S3 account and serve it from there [2]. > There's no bulletproof CMS Actually, there is. It's a CMS which generates static files for the webserver to serve to the public. Sadly, I haven't located it in the real world quite yet. Anybody care to disrupt the CMS scene on behalf of beleaguered sysadmins? [0] SSL Administration requires the manual configuration of wp-config.php files: http://codex.wordpress.org/Administration_Over_SSL http://codex.wordpress.org/Administration_Over_SSL [1] http://codex.wordpress.org/Changing_File_Permissions http://codex.wordpress.org/Changing_File_Permissions [2] https://wordpress.org/plugins/amazon-s3-and-cloudfront/ https://wordpress.org/plugins/amazon-s3-and-cloudfront/