Re:I don’t feel safe with Wordpress, hackers broke in and to...
by moe on Saturday September 05, 2009 @11:38PM
(#807435)
security will be a cat and mouse game
From a security standpoint Wordpress is a trivial application because it's almost entirely read-only, except for the comments. Making a plugin-architecture bullet proof is a different story, but as I understand it most of these issues affect the very core, i.e. a vanilla wordpress install.
There is no excuse for their sorry state of affairs.
Re:I don’t feel safe with Wordpress, hackers broke in and to...
by redcap on Saturday September 05, 2009 @11:25PM
(#807424)
I'd argue that the frequency of security updates points to a fairly immature security architecture - it might be ages before they get anywhere near other sufficiently secure open source projects (although comparing it with linux is a bit like comparing apples and bananas).
For me the problem is not that they release frequent updates - I would have a problem if they didn't release frequent updates to known severe vulnerabilities. If you look at their release logs you will see that most of their security updates has 24-48 hours of turnaround from the time of the vulnerability detection.
The recent vulnerability that this blog and most others (ie, smashing magazine) got affected has been fixed 2 releases before the current release. People who are affected didn't update for the last 3 release and someone developed a script out there that automatically scans for that vuln. and takes advantage of it.