Ask HN: Why do people believe “PHP developer” means security ignorance?

Re:Ask HN: Why do people believe “PHP developer” means secur... by sarciszewski on Monday November 17, 2014 @10:10AM (#8618478)

Is WordPress's record really that bad? Most of the vulns I hear about come from shoddy plugins, not WP itself.

[ Parent | on HN ]

Re:Ask HN: Why do people believe “PHP developer” means secur... by debacle on Monday November 17, 2014 @10:16AM (#8618510)

WordPress core for a long time was very vulnerable, probably still has vulnerabilities, and if you're running even a slightly out of date version of the software (which might be a requirement if you've made a lot of customizations or are using a plugin that is no longer supported), you are likely vulnerable and it is almost trivial to identify that you're running WordPress and your WordPress version.

Experience has taught me that no one is going to make a distinction between WP core and a third party plugin when they could instead shit on PHP and PHP programmers.

[ Parent | on HN ]

Re:Ask HN: Why do people believe “PHP developer” means secur... by sarciszewski on Monday November 17, 2014 @10:20AM (#8618535)

Heh. Well, I'm going to be contributing to the WP core soon (making their auto-updater use openssl_verify), I'll fix anything I find there.

The worst thing I spotted when I was looking through it in June was a lack of a CS in their PRNG. I don't consider md5(uniqid(mt_rand())) adequate; urandom or bust :)

[ Parent | on HN ]