How To Not Get Your Blog Hacked

http://idlewords.com/2009/09/how_to_not_get_your_blog_hacked.htm

by baha_man • 17 years ago

16 25 17 years ago

>If you listen to the WordPress people, the answer to this is 'be extremely zealous about updating your software', which is the same as saying, devote half your life to learning and understanding WordPress administration.

Apparently this person has not used a recent build of Wordpress.

bmj• 17 years ago

I was going to post the very same thing. I went from 2.6 to the latest version in about 10 minutes, at least half of which was downloading the update, the pushing it up to the server.

reedlaw3• 17 years ago

Obviously not. Otherwise he would have known about WordPress' automatic upgrade feature: http://codex.wordpress.org/Upgrading_WordPress

Plugins can also be upgraded with a single click.

idlewords3• 17 years ago

The recommended procedure for "automatic" upgrades, as described on that page, is to back up your entire database and disable all plugins beforehand.

goodkarma2• 17 years ago

But they've got a point. Even if it takes "only 10 minutes" to upgrade, there have been so many new versions and so many security issues that it gets kind of old after a while. Especially if you have multiple sites all running it.

ionfish• 17 years ago

  svn update

Not a complex command to run! I hear there are these things called cronjobs too, so you don't even have to run it yourself. Just pick the latest stable branch and svn switch when a new major version comes out.

brandnewlow• 17 years ago

It's WP's fault that he's not aware of how much easier it is update current releases, not his.

chaosprophet2• 17 years ago

I would disagree. If he had done the update then it would have been obvious how easy it is becoming with each release.

AdamGibbins• 17 years ago

A static version of your blog? That would be all well and good if it were not for comments...

nirmal2• 17 years ago

I have a static blog and used to have Disqus for comments. I've since disabled Disqus, no fault of theirs, I just decided that I didn't want comments.

unalone• 17 years ago

So can you put Disqus up on HTML pages?

dtf• 17 years ago

Sounded like an interesting proposition. Would it be possible to do this and use Disqus?

idlewords3• 17 years ago

You should be able to pull in comments from an outside service using a <script> tag. And if that service doesn't exist, hey, startup idea!

psadauskas• 17 years ago

Sure, its even easy. Go grab jekyll http://github.com/mojombo/jekyll/tree/master, which can turn your haml/sass, textile or even markdown into static html pages with links. Host it yourself or on github, and use one of the comment hosting services, or throw a link to any technical-ish post here on HN, and people can comment on it.

bcl• 17 years ago

This advice is just silly. In other words throw out all of the advances of using php, python, ruby, etc. server side because software has bugs. Or rely on a centralized managed blog host that is also susceptible to bugs, except that when they are exploited there they can effect many more people at once.

My advice? If you host your own web apps at least take the responsibility to administer them. Wordpress has made huge improvements in their update process.

My upgrade process is this: * dump a copy of the database * disable plugins * copy the current public_html directory to a backup (just in case) * untar new release over the top of the old * run /wp-admin/upgrade.php * reenable plugins

idlewords3• 17 years ago

What great advances is this approach throwing out?

Most bloggers have a very simple use case: publish stuff that looks nice, generates an RSS feed, and maybe allows a comment thread. Most bloggers are not, and have no interest in becoming, sysadmins or DBAs.

My contention is that it is easy to set things up so you can blog with whatever app you want without leaving your data at the mercy of the next person to find an exploit.

tptacek• 17 years ago

Unless you check up on your blog several times a day --- and most people don't even check up on their blog several times a week --- it doesn't matter how streamlined WordPress has made its upgrade process.

How To Not Get Your Blog Hacked

Related Stories