Re:“Drupalgeddon2” touches off arms race to mass-exploit pow...
by snowwrestler on Sunday April 22, 2018 @01:45PM
(#16897344)
This is all true, but it's not unique to CMS software. Everything you write here is true of operating hosted software in general.
Hosting a Drupal site on Pantheon or Acquia does NOT relieve the site owner of testing and applying patches, fixing the site when a patch breaks something, etc.
In terms of hosting, the LAMP stack itself is very stable; setting Linux, Apache, and MySQL to auto-apply stable updates is very unlikely to break Drupal. Even in PHP, going from 5.x to 7.x required some careful testing, but minor updates are generally fine.
The security advantage of open-source CMS software is that the community update process reminds site owners to do this stuff, and gives them the code to do it.
In contrast, a custom-developed CMS can sit there with security holes in it for months or years, and the owner will have no idea until their site is hacked.
Hosting a Drupal site on Pantheon or Acquia does NOT relieve the site owner of testing and applying patches, fixing the site when a patch breaks something, etc.
In terms of hosting, the LAMP stack itself is very stable; setting Linux, Apache, and MySQL to auto-apply stable updates is very unlikely to break Drupal. Even in PHP, going from 5.x to 7.x required some careful testing, but minor updates are generally fine.
The security advantage of open-source CMS software is that the community update process reminds site owners to do this stuff, and gives them the code to do it.
In contrast, a custom-developed CMS can sit there with security holes in it for months or years, and the owner will have no idea until their site is hacked.