3 ms·

A lot of people here are talking right past each other. Is it good that WordPress has automatic security updates? Yes. Is it bad that WordPress vulnerabilitie

A lot of people here are talking right past each other. Is it good that WordPress has automatic security updates? Yes. Is it bad that WordPress vulnerabilities are still so common? Yes. Are Drupal, Joomla, or Magento better at this? It sounds like the answer is probably no. Does that excuse WordPress because it is better than other frameworks with marginal track records? No. For such a widely used framework, WordPress' security record is dismal. Automatic updates are a great feature, but they don't replace the need for the framework to be a lot more secure. For someone hosting their personal blog on a $5/month VPS this is probably good enough. For a bank to run WordPress is borderline professional negligence at this point [1]. A lot of the comments seem to be assuming that because the update was rolled out withing a few hours, that their window of exposure was pretty small. The window of exposure to WordPress vulnerabilities isn't from the time the patch is released until you are updated, it is from when an attacker discovers the vulnerability and you are updated. [1]: http://ma.tt/2015/04/a-bank-website-on-wordpress/ http://ma.tt/2015/04/a-bank-website-on-wordpress/.

pyre 11y ago
Someone should do a study on where these security bugs are coming from. Are they in new features? Introduced from refactors of old code? Are they due to the plugin infrastructure? Is it all in old code?
- BorisMelnik 11y ago
  they should, for sure. from what I've seen over the past few years it is really all of the above although plugins are notoriously horrible.
- punjabisingh 11y ago
  The bugs are coming from everywhere. In my view, the worst ones are the ones coming from core. They've come from old code (i.e. the comments XSS due to overly large comments) or from including other libraries (i.e. genericons vulnerability). I think this sort of stuff is bound to happen since WordPress is slowly becoming the kitchen sink trying to keep up with all demands of the users. The good part is: * They are increasing their unit tests coverage. * With auto-updates, the huge amount of sites that use WordPress are not left in the dark. So I consider it a feature even if it comes at a price. When the software is being used at the scale that WordPress is, it is a needed feature.

pyre 11y ago

Someone should do a study on where these security bugs are coming from. Are they in new features? Introduced from refactors of old code? Are they due to the plugin infrastructure? Is it all in old code?

BorisMelnik 11y ago
they should, for sure. from what I've seen over the past few years it is really all of the above although plugins are notoriously horrible.
punjabisingh 11y ago
The bugs are coming from everywhere. In my view, the worst ones are the ones coming from core. They've come from old code (i.e. the comments XSS due to overly large comments) or from including other libraries (i.e. genericons vulnerability). I think this sort of stuff is bound to happen since WordPress is slowly becoming the kitchen sink trying to keep up with all demands of the users. The good part is: * They are increasing their unit tests coverage. * With auto-updates, the huge amount of sites that use WordPress are not left in the dark. So I consider it a feature even if it comes at a price. When the software is being used at the scale that WordPress is, it is a needed feature.