3 ms·

While I agree with the overall assertion that Wordpress is ridiculously bloated, slow and insecure, a lot of the specific things you mentioned have nothing to d

by romaniv 12y ago

While I agree with the overall assertion that Wordpress is ridiculously bloated, slow and insecure, a lot of the specific things you mentioned have nothing to do with it and actually are pretty sensible features for websites of a certain size. For example, the built-in Cron thing is invaluable for smaller shared hosting installations, which do not allow you to schedule actual Cron jobs. Moreover, it allows you to copy Wordpress (or unroll if from a database backup) without having to worry about recreating those Cron jobs. Not everyone has root access to their hosting. Heck, not everyone has shell access to their hosting. Even people who do do not always have time and expertise to set up, maintain and use Docker/Puppet/openVZ or whatever you use for sysops. one PHP file which rules them all What do you mean?

falcolas 12y ago
> What do you mean? `/index.php` is the default handler for most requests which go through Wordpress, so even if you block access to a .php file further down the tree, there are generally ways to gain access to that file via `/index.php`. > the built-in Cron thing is invaluable for smaller shared hosting installations I don't disagree that it's useful; after all, reading Email is a useful feature for quite a few different pieces of software. The problem lies in that features like this also makes larger, dedicated hosting installations significantly harder to secure, and opens up a number of potential attack vectors. > Not everyone has root access to their hosting. No. And again, what makes a piece of software valuable for an individual can make it a liability for a corporation. Since I work for a corporation, having to deal with WordPress is a pain.
- mikeschinkel 12y ago
  I don't understand why you say WordPress is difficult to secure. Just disconnect the ethernet cable, turn off the wifi and lock the machine in a steel box. Or you can go with absolute security and just disconnect the power cable from the machine; problem solved.
smacktoward 12y ago
He/she is referring to WordPress' use of the Front Controller design pattern (http://en.wikipedia.org/wiki/Front_Controller_pattern http://en.wikipedia.org/wiki/Front_Controller_pattern), which of all the things about WordPress you could choose to hyperventilate over seems like a strange one to go with.
- kmz 12y ago
  Isn't this a decent amount of PHP frameworks? I mean taken from the Wiki link; * MVC frameworks written in PHP. For example Yii, CakePHP, Laravel, Symfony, CodeIgniter and Zend Framework * Drupal * Microsoft's ASP.NET MVC Framework. * Spring Framework * Cairngorm framework in Adobe Flex. * Yesod web application framework written in Haskell. So is this a knock on WordPress, or any application that uses the Front Controller Pattern
- falcolas 12y ago
  Looks like that's the one. > which of all the things about WordPress you could choose to hyperventilate over seems like a strange one to go with. Straw, camel, back, etc. Anything that makes it harder to secure against access against arbitrary code execution makes for an aggravating day.

by romaniv 12y ago

falcolas 12y ago

> What do you mean? `/index.php` is the default handler for most requests which go through Wordpress, so even if you block access to a .php file further down the tree, there are generally ways to gain access to that file via `/index.php`. > the built-in Cron thing is invaluable for smaller shared hosting installations I don't disagree that it's useful; after all, reading Email is a useful feature for quite a few different pieces of software. The problem lies in that features like this also makes larger, dedicated hosting installations significantly harder to secure, and opens up a number of potential attack vectors. > Not everyone has root access to their hosting. No. And again, what makes a piece of software valuable for an individual can make it a liability for a corporation. Since I work for a corporation, having to deal with WordPress is a pain.

mikeschinkel 12y ago
I don't understand why you say WordPress is difficult to secure. Just disconnect the ethernet cable, turn off the wifi and lock the machine in a steel box. Or you can go with absolute security and just disconnect the power cable from the machine; problem solved.

smacktoward 12y ago

He/she is referring to WordPress' use of the Front Controller design pattern (http://en.wikipedia.org/wiki/Front_Controller_pattern http://en.wikipedia.org/wiki/Front_Controller_pattern), which of all the things about WordPress you could choose to hyperventilate over seems like a strange one to go with.

kmz 12y ago
Isn't this a decent amount of PHP frameworks? I mean taken from the Wiki link; * MVC frameworks written in PHP. For example Yii, CakePHP, Laravel, Symfony, CodeIgniter and Zend Framework * Drupal * Microsoft's ASP.NET MVC Framework. * Spring Framework * Cairngorm framework in Adobe Flex. * Yesod web application framework written in Haskell. So is this a knock on WordPress, or any application that uses the Front Controller Pattern
falcolas 12y ago
Looks like that's the one. > which of all the things about WordPress you could choose to hyperventilate over seems like a strange one to go with. Straw, camel, back, etc. Anything that makes it harder to secure against access against arbitrary code execution makes for an aggravating day.