• 0x0@programming.dev
    link
    fedilink
    English
    arrow-up
    42
    arrow-down
    1
    ·
    4 months ago

    If i were to take a shot every time vulnerabilities are found in the WordPress ecosystem i’d be comatose by now…

    • maynarkh@feddit.nl
      link
      fedilink
      English
      arrow-up
      27
      arrow-down
      1
      ·
      4 months ago

      I’d guess it’s not because of the inherent insecurity of WordPress, but the sheer size of the ecosystem and the fact that like 40% of the Internet is WordPress sites.

      • sugar_in_your_tea@sh.itjust.works
        link
        fedilink
        English
        arrow-up
        12
        arrow-down
        2
        ·
        edit-2
        4 months ago

        And inherent insecurity. It wasn’t designed to be secure, it was designed to be full-featured, so it has a pretty big attack surface.

        • maynarkh@feddit.nl
          link
          fedilink
          English
          arrow-up
          13
          ·
          4 months ago

          That’s the ecosystem. WordPress itself is pretty basic, these things attack plugins, and their often not-very-experienced creators and users. The thing with WordPress is that this kind of vulnerability comes with the problem space, not the particular solution. If there was a different product in the same space, it would not fare better by default.

          Also, I’d bet that a ton of CVEs are filed for C++ libraries, yet nobody is harping on about how insecure C++ is.

          • sugar_in_your_tea@sh.itjust.works
            link
            fedilink
            English
            arrow-up
            4
            arrow-down
            1
            ·
            4 months ago

            Exactly. A plug-in architecture is a feature, and it’s really hard to secure. Instead of going that route, they should have instead solved specific problems. When you make it easy to add someone else’s code, you also make it easy to forget to remove it later, or to not stay updated on which plugins are deprecated/abandoned.

            A plug-in system is insecure by design for a public-facing service. YAGNI, so pick a handful of stuff you actually need.

    • corsicanguppy@lemmy.ca
      link
      fedilink
      English
      arrow-up
      6
      ·
      4 months ago

      It’s not the product, it’s the cavalier consumption of unsigned add-ons despite knowing better.

      • IsThisAnAI@lemmy.world
        link
        fedilink
        English
        arrow-up
        11
        arrow-down
        2
        ·
        edit-2
        4 months ago

        Drupal, but you are getting into a different type of complex symfony code built on years and years of drupalism’s. It’s powerful and pretty well maintained though.

      • sugar_in_your_tea@sh.itjust.works
        link
        fedilink
        English
        arrow-up
        6
        arrow-down
        2
        ·
        4 months ago

        What are you trying to achieve?

        • static site like a blog? - Hugo
        • add comments? - Commento paid, or you can self-host
        • cloud stuff (e.g. Google Drive replacement) - NextCloud

        There’s a ton you can do, you don’t need WordPress just because you want a website. Figure out what you want your website to do, then look for tools to do that.

      • 0x0@programming.dev
        link
        fedilink
        English
        arrow-up
        2
        arrow-down
        1
        ·
        4 months ago

        If you want to add something to your website then you’re already running WordPress, no?

        • Fredselfish@lemmy.world
          link
          fedilink
          English
          arrow-up
          1
          ·
          4 months ago

          No, I haven’t added nothing. I was going code a basic html 5 page but I wanted a blog like atmosphere, since the website is all about my writing.

      • schizo@forum.uncomfortable.business
        link
        fedilink
        English
        arrow-up
        2
        arrow-down
        1
        ·
        4 months ago

        If you want a mostly straightforward WordPress-alike that’s not WordPress, you probably should at least consider Ghost. I’m using it for my blog and it’s got a slightly weird focus on “paid blog members”, but it’s super solid and doesn’t have a multi-decade history of endless security problems.

        And, soon, it’ll be a happy member of the Fediverse.