News for hackers. Stuff that matters.

A comment on WordPress 18. Parent comment

Re:WordPress 18 by mavhc on Friday May 28, 2021 @05:44AM (#27313402)
Is it impossible to make a secure CMS? I'd think step 1 would be to not have the admin stuff with the same access as the public website, and step 2 would be to have a way to sandbox plugins, but are those things possible?
[ Parent | on HN ]
Re:WordPress 18 by lmm on Sunday May 30, 2021 @10:51PM (#27339511)
Step 1 is possible nowadays (with SNI) but was hard until recently, and I don't think practices have really caught up with that yet.

Step 2 is difficult to even define properly. What is a plugin supposed to be able to do, and what is a plugin supposed to not be able to do? If you can answer that question precisely, then you can solve the problem, but if you can answer that question precisely then you probably don't need plugins in the first place.

[ Parent | on HN ]