I don’t feel safe with Wordpress, hackers broke in and took things

http://scobleizer.com/2009/09/05/i-dont-feel-safe-with-wordpress-hackers-broke-in-and-took-things/

by mjfern • 17 years ago

24 28 17 years ago

jakarta• 17 years ago

So let's get this straight:

He's complaining about Wordpress and their vulnerabilities when he:

1. hadn't upgraded wordpress in months 2. hadn't performed any backups of his posts

It's hard to be sympathetic to him or TechCrunch. If they're going to use custom features like third-party plugins and specially designed pages, they should have developers on staff to actively work to make sure that their customizations will work after an upgrade. By not doing that they're begging to be attacked.

antonovka2• 17 years ago

Seeing as WordPress requires security updates with genuinely astounding regularity, I'm hesitant to blame the user. WordPress' excessive vulnerability count clearly demonstrates an endemic issue in the software itself.

See also:

http://www.securityfocus.com/cgi-bin/index.cgi?o=0&l=30&...

pavs4• 17 years ago

or... another way to look at it. Wordpress releases security updates at astounding frequency without waiting to lump all those security updates in to one large update like most other large software tends to do.

Yes, I admit frequent updates can be a nuisance, but when they are literally spoon feeding you the update process (less than 10 seconds and one click in most cases), its stupidity - really.

See also: http://www.securityfocus.com/cgi-bin/index.cgi?o=0&l=30&...

Drupal CMS less popular - more vulnerability.

ajg19772• 17 years ago

In many ways the extremely high frequency of Wordpress security updates completely works against them.

Whenever a security update is released it is utterly trivial to do a diff against the previous package and get a vector to exploitable vulnerabilities in the previous version (in many cases the changelogs themselves are a good hint). The default Wordpress headers also make it easy to quickly tell which version of WP a site is running and whether it's worth attacking.

I give Wordpress credit for the advances they've made in automating parts of the upgrade process - it's now one click from the dashboard and if you are a popular site there really is no excuse for running an out of date version.

However it's not enough. Wordpress need to move to minor/major versions where minor versions, that consist of security updates, are automatically updated to when detected by a blog. (Major updates that feature changes likely to break plugins should still require user input).

dchest• 17 years ago

WordPress developers don't issue security upgrades, they only release new versions, which break compatibility. This is why users don't update.

pavs4• 17 years ago

Anyone who has been using wordpress for couple of years, and actually bothers to read the release notes of each version, will tell you that a vast majority of those increment updates are security fixes. Since around 2.7 upgrades are as easy as clicking a button - both for plugins and wordpress core updates.

Instead of playing the "poor me" game, say it the way it is; you failed at keeping your wordpress install up to date and secure and you failed at having a backup.

Smashing magazine got compromised last week and came out straight and admitted their failure on keeping it safe by not upgrading.

This scoobie guy sounds a lot like arrington - no wonder they are best friends.

mechanical_fish• 17 years ago

Since around 2.7 upgrades are as easy as clicking a button - both for plugins and wordpress core updates.

Which is, in itself, a fruitful source of potential security holes: To accomplish this feature, Wordpress has to have permission to overwrite its own executables.

russss• 17 years ago

Not to mention the only way they support this is via FTP - and I'm not that keen on enabling an FTP server purely for Wordpress's needs, thank.

joechung• 17 years ago

Scoble's got a new blog on Posterous: http://scobleizer.posterous.com/

ElbertF• 17 years ago

I bet his uses the same password on Posterous as on Wordpress.

Maro• 17 years ago

My old wordpress installation was hacked some time ago, so (following the lead of cperciva) I wrote a minimal blogging script which doesn't require PHP/Mysql and just generates HTML. The admin interface is vi.

photomatt3• 17 years ago

You should check out Bloxsom.

jhancock• 17 years ago

I've been very happy with dreamhost. Their control panel handles wordpress backups and upgrades seamlessly. I just backed up and upgraded three wp sites, it took less than 5 minutes.

oscardelben• 17 years ago

I wonder if wordpress has unit tests at least