3 ms·

I think your latter point is true, but it pretty much applies to any LAMP application. Maybe there's slightly more hair-pulling with WP. I still need to do th

I think your latter point is true, but it pretty much applies to any LAMP application. Maybe there's slightly more hair-pulling with WP. I still need to do the same amount of legwork with Drupal. Sure, Drupal's major exploits are less rare, but they do happen. There's no bulletproof CMS and if you believe in bulletproof software, you probably shouldn't be administrating a server. WP wakes people up to the work they should have been doing in the first place. Grumbling about setting permissions, locking down directories, using captchas/honeypots, doing timely updates, running an IPS, running mod_security, etc because "its WP" is unfair. You should be doing those things to all your web applications. The wild-west of the web needs to end. If WP is the wake-up call for securing LAMP servers, then that's actually good in the long run.

falcolas 12y ago
> WP wakes people up to the work they should have been doing in the first place. Well, not really. WordPress doesn't wake anybody up about anything if they are not already security conscious. It will happily serve wp-admin files over a non-SSL connection all day long [0], setting cookies which make the user vulnerable to any number of interception attacks. It will happily suggest [1] you make your WP files all writable by the web server user, to simplify the act of upgrading WordPress. It (with a simple plugin) will be happily allow "authenticated" folks upload anything they want to your S3 account and serve it from there [2]. > There's no bulletproof CMS Actually, there is. It's a CMS which generates static files for the webserver to serve to the public. Sadly, I haven't located it in the real world quite yet. Anybody care to disrupt the CMS scene on behalf of beleaguered sysadmins? [0] SSL Administration requires the manual configuration of wp-config.php files: http://codex.wordpress.org/Administration_Over_SSL http://codex.wordpress.org/Administration_Over_SSL [1] http://codex.wordpress.org/Changing_File_Permissions http://codex.wordpress.org/Changing_File_Permissions [2] https://wordpress.org/plugins/amazon-s3-and-cloudfront/ https://wordpress.org/plugins/amazon-s3-and-cloudfront/
- drzaiusapelord 12y ago
  > Sadly, I haven't located it in the real world quite yet. Static site generators were popular about 10 years ago. I inherited a legacy install of a popular one called Collage. It was more or less a nightmare to work with and a PITA compared to what you can do with a proper CMS. SSG's aren't the solution for most, if any, modern cases. You more or less have all the problems of a CMS, save security, and all the headaches of a deployment system in one, without the ease of things like add-ons or extensions. A lot of your dynamic stuff will be custom code, so you have all the security problems as well, except without a worldwide community of coders reviewing your stuff. I've seen what jr webdevs or rushed sr devs do and its horrible. I'd rather take my chances with WP. From a monetary perspective loading up a module is much easier than constantly reinventing the wheel.

falcolas 12y ago

> WP wakes people up to the work they should have been doing in the first place. Well, not really. WordPress doesn't wake anybody up about anything if they are not already security conscious. It will happily serve wp-admin files over a non-SSL connection all day long [0], setting cookies which make the user vulnerable to any number of interception attacks. It will happily suggest [1] you make your WP files all writable by the web server user, to simplify the act of upgrading WordPress. It (with a simple plugin) will be happily allow "authenticated" folks upload anything they want to your S3 account and serve it from there [2]. > There's no bulletproof CMS Actually, there is. It's a CMS which generates static files for the webserver to serve to the public. Sadly, I haven't located it in the real world quite yet. Anybody care to disrupt the CMS scene on behalf of beleaguered sysadmins? [0] SSL Administration requires the manual configuration of wp-config.php files: http://codex.wordpress.org/Administration_Over_SSL http://codex.wordpress.org/Administration_Over_SSL [1] http://codex.wordpress.org/Changing_File_Permissions http://codex.wordpress.org/Changing_File_Permissions [2] https://wordpress.org/plugins/amazon-s3-and-cloudfront/ https://wordpress.org/plugins/amazon-s3-and-cloudfront/

drzaiusapelord 12y ago
> Sadly, I haven't located it in the real world quite yet. Static site generators were popular about 10 years ago. I inherited a legacy install of a popular one called Collage. It was more or less a nightmare to work with and a PITA compared to what you can do with a proper CMS. SSG's aren't the solution for most, if any, modern cases. You more or less have all the problems of a CMS, save security, and all the headaches of a deployment system in one, without the ease of things like add-ons or extensions. A lot of your dynamic stuff will be custom code, so you have all the security problems as well, except without a worldwide community of coders reviewing your stuff. I've seen what jr webdevs or rushed sr devs do and its horrible. I'd rather take my chances with WP. From a monetary perspective loading up a module is much easier than constantly reinventing the wheel.