News for hackers. Stuff that matters.
Re:Whitehouse.gov Chooses WordPress, Again by falcolas on Saturday January 23, 2021 @09:50PM (#25888625)
It is if your users expect to be able to add plugins themselves, or you want it to do automatic version upgrades.

We disabled it (except for the attachments folders), and boy did it throw up all over the logs.

Using a filesystem reset is a nice way around WP's requirements. I'd personally hesitate to rely on it for a popular site, since it still leaves a site vulnerable to code injection for those 24 hours.

Re:Whitehouse.gov Chooses WordPress, Again by ceejayoz on Saturday January 23, 2021 @09:51PM (#25888629)
> It is if your users expect to be able to add plugins themselves, or you want it to do automatic version upgrades.

I'm fairly certain for the White House's sort of use case this is not an issue.

> Using a filesystem reset is a nice way around WP's requirements. I'd personally hesitate to rely on it for a popular site, since it still leaves a site vulnerable to code injection for those 24 hours.

We did not permit it to have write access to its own filesystem, at all. It worked fine. Uploads went straight to S3 via a plugin.

Re:Whitehouse.gov Chooses WordPress, Again by falcolas on Saturday January 23, 2021 @09:56PM (#25888655)
> I'm fairly certain for the White House's sort of use case this is not an issue.

One can only hope.

> We did not permit it to have write access to its own filesystem, at all. It worked fine.

Cool beans - you installed it sanely. But contrary to how WP expects to be installed. I've corrected the original statement.

Re:Whitehouse.gov Chooses WordPress, Again by hluska on Sunday January 24, 2021 @12:05AM (#25889459)
With all due respect, you have demonstrated a shocking lack of knowledge about Wordpress. It’s been a long time since I’ve read so many falsehoods spoken with such certainty. That’s not a good thing.
Re:Whitehouse.gov Chooses WordPress, Again by kortilla on Saturday January 23, 2021 @11:48PM (#25889364)
> But contrary to how WP expects to be installed.

No, this is incorrect. WP is compatible with no write access and recognizes it in the default setup workflow.