News for hackers. Stuff that matters.
Re:How To Not Get Your Blog Hacked by lucumo on Sunday September 06, 2009 @11:20AM (#807865)
Not as bad as phpBB's "automatic" upgrade, which gives you a tar-ball of changed files which you're supposed to unpack...
Re:How To Not Get Your Blog Hacked by reedlaw on Sunday September 06, 2009 @11:26AM (#807871)
Exactly. I give WP a lot of credit since it's the only web application I know of that can be upgraded from its own interface without the need to ever login to a shell or manually FTP files to the server.
Re:How To Not Get Your Blog Hacked by jasonneal on Sunday September 06, 2009 @12:37PM (#807916)
That's what I love about WP. Joomla 1.6 (about to go into Beta) also has this feature as a built in component (which is also installable to Joomla 1.5.

When I read the article right at the first paragraph I was appalled. Quote: "...devote half your life to learning and understanding WordPress administration..." Really? Half your life to learn how to click ONE link? I don't get it, has the author here never even upgraded Wordpress?

Re:How To Not Get Your Blog Hacked by amalcon on Sunday September 06, 2009 @01:27PM (#807953)
Call me crazy if you like, but I'd never use a webapp that has that feature. It just opens you up to more potential security problems. For example, it appears to operate over in-the-clear HTTP. Poisoning someone's DNS cache and then somehow triggering an "upgrade" = changing their software to whatever I want.

Also, "Note that your files all need to be owned by the user under which your Apache server executes, or you will receive a dialog box asking for "connection information," and you will find that no matter what you enter, it won't work." That's a security no-no if I've ever seen one.