3 ms·
They created something that makes the most common sort of deployment more secure. This is a net improvement and therefore entirely justified.
by mst 11y ago
They created something that makes the most common sort of deployment more secure.
This is a net improvement and therefore entirely justified.
- falcolas 11y ago> This is a net improvement and therefore entirely justified. The first does not imply the second. "Our bank is secure because we change out the locks every few days. To facilitate this, all of the locks have their screws on the outside - it was too much work to have someone around to open the doors for the locksmiths all the time." Interested in hearing how many recent vulnerabilities in WordPress were prevented by not allowing arbitrary writes, whitelisting URLs, and blocking a whole mess of WordPress set headers? All of them which have occurred in the last year. We've kept up-to-date with our updates, but every security vulnerability which has triggered a major or minor update was prevented not by WordPress updates, but by sensible system security.
- dfcowell 11y agoI don't think anyone is suggesting that you should compromise your security to enable auto-updating. Automatic updates are never better than correct file permissions. The point here is that a large number of WordPress sites are running with file permissions such that the web server can write to the web root. By trying to auto update, those sites with poor file permissions get a minor security benefit (shorter time between patch release and patch application) while all of the installations running with safe file permissions are entirely unaffected. There's no downside to a secure site having the automatic update code. There's a small upside to an insecure site having it.