Drupal Core – Highly Critical Public Service announcement

Re:Drupal Core – Highly Critical Public Service announcement by pgrote on Wednesday October 29, 2014 @03:24PM (#8529298)

What are you using in place of those? Wouldn't your clients normally pay for maintenance?

The killer here is:

"Consider obtaining a new server, or otherwise remove all the website’s files and database from the server. (Keep a copy safe for later analysis.)"

[ Parent | on HN ]

Re:Drupal Core – Highly Critical Public Service announcement by zippergz on Wednesday October 29, 2014 @04:02PM (#8529538)

I replaced Wordpress with a home-built solution that is drastically simpler. It retains most of the URL compatibility so links wouldn't break, but it has only a tiny fraction of the functionality of Wordpress (most of which we didn't use anyway). It's entirely possible that our solution has vulnerabilities (though we designed it with security in mind, and the code base is much easier to audit due to its simplicity). But at least it's not going to get compromised due to a generic Wordpress exploit.

[ Parent | on HN ]

Re:Drupal Core – Highly Critical Public Service announcement by eksith on Thursday October 30, 2014 @04:12AM (#8531876)

There would be a lot of demand for a much simpler WP alternative built with security in mind. Would you by any chance be open sourcing the project? More eyes on the source couldn't hurt.

[ Parent | on HN ]

Re:Drupal Core – Highly Critical Public Service announcement by NewsReader42 on Thursday October 30, 2014 @07:58AM (#8532405)

We ourselves built a project with speed and security in mind and are working on open sourcing it in 2015

[ Parent | on HN ]

Re:Drupal Core – Highly Critical Public Service announcement by at-fates-hands on Wednesday October 29, 2014 @07:58PM (#8530659)

For my monthly subscribing clients, I use an MS stack (with Azure) with Visual Studio and then have them on the $20/month CloudFlare plan.

Included in their monthly sub is an update service. I maintain a 24 hour turn around on any changes. This way, I get to control my code, then don't break their site, and everybody plays nice.

Lately, I've been using PyroCMS or KeystoneJS for a lightweight CMS when necessary. Most of my CMS customers are one-time dev deals. I design, build and then hand it over to them so I'm not responsible for security or updates - which is something I have in the contract they sign.

By doing so, the clients I need to maintain control over (in a security sense) I can and then I don't have to take chances with WordPress or Drupal. I've been a fan of Drupal, so it's tough to see they got hacked pretty good. Usually its plugins which get hacked, so getting the core of your framework hacked is a huge deal.

[ Parent | on HN ]

Re:Drupal Core – Highly Critical Public Service announcement by walterbell on Wednesday October 29, 2014 @03:42PM (#8529405)

Statically-generated site with client-side customization?

[ Parent | on HN ]

Re:Drupal Core – Highly Critical Public Service announcement by geerlingguy on Wednesday October 29, 2014 @03:47PM (#8529437)

You still have server-level vulnerabilities to contend with. It might be a simpler task to maintain server-layer security and not have to worry as much about application-layer, but security is still something that needs to be dealt with, if you have a server that is powered on and connected to a network.

[ Parent | on HN ]

Re:Drupal Core – Highly Critical Public Service announcement by walterbell on Wednesday October 29, 2014 @05:39PM (#8530156)

Host with a private repo on Github Pages.

[ Parent | on HN ]