3 ms·

No, my point is that not everything that WordPress does is evil. Its auto-updates protect a very large part of internet-facing websites of getting hacked. And

• x0x0 11y ago
  Other cms have taken the less-trodden path of not being a bug-ridden security debacle and ignoring security reports until researchers release them [0]. -- Yet another wordpress hack victim. [0] http://klikki.fi/adv/wordpress2.html http://klikki.fi/adv/wordpress2.html
• marcosdumay 11y ago
  Wordpress being secure would protect those sites from being hacked. All that auto-updates do is creating yet another vulnerability, and fixing problems some time after they are public known. Want to get into an Wordpress installation? just wait until next week's problem becomes public, and be faster than the auto-updater. By the way, Drupal has an auto-updater too.
• falcolas 11y ago
  Self updating requires overwriting its own files (or access to your FTP credentials). Enabling this goes against almost every website/server hardening guidebook out there. It also requires allowing loopback HTTP requests in response to every incoming request to implement a pseudo cron system. There's a good reason most other CMSes don't implement automatic updating.
  • mst 11y ago
    If an attacker has code execution, I've already lost. Whether they have to inject it every time or can write it to the filesystem isn't really the point. The current system is better than no automatic updates. One that uses a separate user that has write access would be superior, but many users don't actually have a separate user to cron that job as.
    • toast0 11y ago
      If the webserver can write to the web root, that means an vulnerability that allows arbitrary writing can be escalated to code injection. In a same environment, the web user wouldn't be able to write to the file system at all, much less the web root. Sanity being rate doesn't really justify only offering auto updates to the insane.
      • mst 11y ago
        They created something that makes the most common sort of deployment more secure. This is a net improvement and therefore entirely justified.
        • falcolas 11y ago
          > This is a net improvement and therefore entirely justified. The first does not imply the second. "Our bank is secure because we change out the locks every few days. To facilitate this, all of the locks have their screws on the outside - it was too much work to have someone around to open the doors for the locksmiths all the time." Interested in hearing how many recent vulnerabilities in WordPress were prevented by not allowing arbitrary writes, whitelisting URLs, and blocking a whole mess of WordPress set headers? All of them which have occurred in the last year. We've kept up-to-date with our updates, but every security vulnerability which has triggered a major or minor update was prevented not by WordPress updates, but by sensible system security.
          • dfcowell 11y ago
            I don't think anyone is suggesting that you should compromise your security to enable auto-updating. Automatic updates are never better than correct file permissions. The point here is that a large number of WordPress sites are running with file permissions such that the web server can write to the web root. By trying to auto update, those sites with poor file permissions get a minor security benefit (shorter time between patch release and patch application) while all of the installations running with safe file permissions are entirely unaffected. There's no downside to a secure site having the automatic update code. There's a small upside to an insecure site having it.