News for hackers. Stuff that matters.

A comment on Ask HN: Why has nobody built a better Wordpress?. Parent comment

Re:Ask HN: Why has nobody built a better Wordpress? by dr_hercules on Wednesday July 01, 2015 @06:27PM (#9815683)
With respect to a software like Wordpress which is:

- huge and powerful

- vividly maintained and extended by lots of developers

- rarely features security issues which aren't fixed immediately

... the question arises whether the quality of its code base is in this case maybe rather an academic issue.

[ Parent | on HN ]
Re:Ask HN: Why has nobody built a better Wordpress? by liviu- on Thursday July 02, 2015 @04:23AM (#9817507)
>- rarely features security issues which aren't fixed immediately

I tried to use WordPress once. I downloaded a theme from wordpress.org with the assumption that themes are reviewed before making there. Nevertheless, I did some basic pentesting before putting my app live, and I quickly found a XSS vulnerability in the search bar of the theme (their paid version featured the same vulnerability). Maybe my experience is not to be generalised to WordPress in general, but it put me off.

[ Parent | on HN ]
Re:Ask HN: Why has nobody built a better Wordpress? by dr_hercules on Thursday July 02, 2015 @04:34AM (#9817540)
> Maybe my experience is not to be generalised to WordPress in general, but it put me off.

WordPress plug ins are - as far as I know - not reviewed. You're at the mercy of the respective developer.

[ Parent | on HN ]
Re:Ask HN: Why has nobody built a better Wordpress? by liviu- on Thursday July 02, 2015 @05:02AM (#9817629)
They are, as this link seem to indicate: https://wordpress.org/plugins/add/

>Currently there are 224 plugins in the review queue, 198 of which are awaiting their initial review.

[ Parent | on HN ]
Re:Ask HN: Why has nobody built a better Wordpress? by dr_hercules on Thursday July 02, 2015 @05:19AM (#9817699)
There are more than 38k plug ins available (https://en.wordpress.org/plugins/). And also from what I have seen so far - there is no extensive (if any) reviewing done regarding safety and quality.
[ Parent | on HN ]
Re:Ask HN: Why has nobody built a better Wordpress? by lucaspiller on Tuesday July 07, 2015 @03:48AM (#9844092)
When you first add a new plugin it is reviewed, but once it's been accepted you are free to push out whatever changes you want without review.
[ Parent | on HN ]