People always beat up on software that has security vulnerabilities. The thing is, the auto update feature is not an affirmative defense for the criticism. The

People always beat up on software that has security vulnerabilities. The thing is, the auto update feature is not an affirmative defense for the criticism. There are probably plenty of legitimate defenses out there - developing secure software is quite obviously something that is hard to get right. But offering auto-updating is only a defense against arguments claiming that updating WordPress is a pain in the ass, not people claiming that the codebase has lots of security flaws. You also can't use other software being garbage as a defense for why some other piece of software isn't garbage. You have to evaluate the actual merits of WordPress in regards to the code quality, chance of being exploited, etc. It updating automatically when exploits are made public is not the same thing as not being vulnerable to frequent exploitation, nor are other frameworks failing in some other way exoneration for any failings WordPress might have. To be clear: I don't care about WordPress, and do not have a stance on whether or not it's great or awful. All I know for sure is that it is certainly quite popular. But this article is built upon a shaky premise and lots of logical fallacies. If you want to write about how awesome it is that WordPress auto-updates, then write about it. Just don't try to use that as a defense for criticism about other aspects of the codebase.