In Defence of WordPress

https://ma.ttias.be/in-defence-of-wordpress/

62 98 11 years ago

ma.ttias.be

stephentmcm3• 11 years ago

Yawn. More excuses for using a big old pile of spaghetti code with no testing or dependency management. Auto-updates? big deal, any decent framework can roll out updates on composer.

Mojah3• 11 years ago

Yet here we are; - Drupal 7: manual updates, or funky drush commands - Magento: requires running shell scripts (!!) to patch at the CLI - Joomla: no auto updates - Typo 3: no auto updates - ...

Composer helps, but it helps developers. It does not help the average user that has no clue on how to apply those patches.

People download a CMS from the internet, throw it on a cheap host and expect it to work. Updates? What are those?

marcosdumay2• 11 years ago

Drupal 7 can auto-update by cron.

stephentmcm3• 11 years ago

And that's the problem they shouldn't be doing that. Hosting a website is not a fun weekend project you get from Target/Walmart as a DIY kit.

People wouldn't be happy if I started building my own car to just drive around where ever I felt like, making it 'easy' and 'safe' to just throw up a website anywhere is an excellent way to get hacked.

tsewlliw• 11 years ago

I'm with you on this. WordPress is acknowledging the actual behavior of the people who use it and aiming to be secure inside that reality instead of telling people they are doing it wrong and to learn how to internet. That is absolutely laudable and in practice prevents a lot of real problems and lifts people up instead of puts them down.

cothomps• 11 years ago

Nice!

As much as Wordpress gets bad pub, there is certainly the open ways in which security is handled and patches are distributed. Far better in most ways to commercial CMS (and even some open source) where systems seem to run unpatched until a system upgrade or a security incident.

JeremyMorgan3• 11 years ago

clearly some folks are downvoting because unpopular opinion.

Come on, folks.

themartorana3• 11 years ago

Seriously! It's not even civil dissent, most of it is mean grandstanding.

Wordpress is ubiquitous. There are more technically challenged users than technically inclined. So here are your options - auto updates, or I'm guessing millions of outdated, incredibly vulnerable sites sitting on shared hosting boxes out there. I like my Webfaction account, I'd prefer the other tenants on my server to be as up to date as possible.

Just such unnecessary snark. The guy wrote a blog post. He's being skewered for it.

Nyr• 11 years ago

What's up with this nag? https://i.nyr.es/Captura-de-pantalla-2015-05-15-a-las-3.07.3...

Your site is a simple WordPress blog, I'm sure you can perfectly host it for $1/month.

Mojah3• 11 years ago

You are absolutely right, I've removed the notice. It was an experiment, but it did not have the desired outcome. Blockers gonna block.

themartorana3• 11 years ago

Seems unnecessarily snarky, unless I should have read some implied smilie emoticon...

mahouse2• 11 years ago

Not snarky at all. That popup was an unnecessary annoyance.

mahouse2• 11 years ago

So your point is that it does not matter that WordPress is a huge mess as long as it updates automatically?

Mojah3• 11 years ago

No, my point is that not everything that WordPress does is evil.

Its auto-updates protect a very large part of internet-facing websites of getting hacked. And it's not something a lot of other CMS's have integrated.

x0x0• 11 years ago

Other cms have taken the less-trodden path of not being a bug-ridden security debacle and ignoring security reports until researchers release them [0].

-- Yet another wordpress hack victim.

[0] http://klikki.fi/adv/wordpress2.html

marcosdumay2• 11 years ago

Wordpress being secure would protect those sites from being hacked. All that auto-updates do is creating yet another vulnerability, and fixing problems some time after they are public known.

Want to get into an Wordpress installation? just wait until next week's problem becomes public, and be faster than the auto-updater.

By the way, Drupal has an auto-updater too.

falcolas4• 11 years ago

Self updating requires overwriting its own files (or access to your FTP credentials). Enabling this goes against almost every website/server hardening guidebook out there.

It also requires allowing loopback HTTP requests in response to every incoming request to implement a pseudo cron system.

There's a good reason most other CMSes don't implement automatic updating.

falcolas4• 11 years ago

So, your website can auto update itself. Know what that infers? A compromised WordPress instance can also update itself, to be whatever the attacker wants it to be. Hey, look, DB credentials as well, in an executable file (which can be "updated" right alongside the rest of Wordpress).

And how do these updates happen? Via a cron system, built into WordPress. It also has its own storage system (whose functionality can be altered at runtime by plugins), dynamic content management (via PHP (!) stored in the DB), its own networking stack, and more abstractions than you could shake a branch at.

Hell, I can't even figure out how to turn off cron requests (despite explicitly setting DISABLE_WP_CRON in wp_config.php). I block those at the nginx layer, but the noise is aggravating.

So many vectors of attack, so few ways to protect yourself.

mst3• 11 years ago

A compromised WordPress instance can also update itself, to be whatever the attacker wants it to be

By this point, you're already on the other side of the airtight hatchway.

http://blogs.msdn.com/b/oldnewthing/archive/2006/05/08/59235...

is a good example of this point.

The goal here is to avoid the compromise in the first place, so the attacker stays on the correct side of the hatchway.

There are plenty of logical reasons to hate wordpress, but I don't see that this is one of them.

falcolas4• 11 years ago

By this point, you're already on the other side of the airtight hatchway

Not really. Having the ability for a web process to write its to files which it then executes actually opens up whole new vulnerabilities. For example: one popular PHP exploit is writing a PHP file, then executing it on the remote system. Can't write a file? Can't execute the exploit.

Reading and executing PHP out of the DB, and also writing user input to that same database? Same problem. Triggering system-altering actions based on an unsigned token? That's a vulnerability.

Letting an application be able to do more on a system than is absolutely necessary to operate is a great way to give control and information over to others.

myhf• 11 years ago

The problem is that WordPress is designed as one big airtight hatchway. Any attack that gets through the first hatch has no further obstacles to persistence.

Compare that to any application with a fully-reproducible build step. If it gets compromised, you can discard the container and replace it with a freshly-built one.

tptacek• 11 years ago

OT: The listener infers, the speaker implies.

girvo8• 11 years ago

I like PHP.

Right, yes, I know, that makes me crazy, but modern PHP is a fine language. HHVM, Hack, Composer, Packagist, the PSR standards: all of that comes together for a nice development workflow. PHP's shared-nothing architecture by default makes horizontal scaling an exercise in simplicity.

But: I don't like WordPress. Yes, it can autoupdate -- and that's certainly better than how things were prior, however WordPress' core code is horrendous. There's a reason why security issues are consistently found.

The bigger issue is the sorry state of most plugins; the bulk of vulnerabilities that end in compromise of WordPress sites are not from the core itself, but the plugins. An autoupdater for those certainly exists, but it doesn't help you if the people writing the plugins to begin with have no clue how to write not-insecure software.

These days, I avoid WordPress like the plague. When I do have to work with it, I've dragged it kicking and screaming into 2015: It lives in a Docker container, is fully 12-factor, completely managed through Composer (including Wordpress' core itself) and all code that I write for it is proper unit tested, PSR-4 autoloaded namespaced classes; this allows me to avoid crappily written plugins and rely on battle-tested libraries instead.

If and when it gets compromised, I can restore the Docker image within seconds, or lock it down as straight HTML by exporting it as a static site temporarily. WordPress can be decent if forced to be, but it's a lot of work and I'd much rather use something that doesn't have so much cruft clogging it up.

I mean heck; you still can't run the latest version of WP on anything other than MySQL, despite technically having a DBAL. Absolutely crazy, considering we have Doctrine or Propel!

PebblesHD3• 11 years ago

Fear not, PHP when used appropriately can be fantastically useful. Pretty much every argument against it that I've read has centered around trying to do something it wasn't meant to do and not being very good at it. As a web scripting language, it works as advertised :-)

pyre2• 11 years ago

I've heard that it's not very good at the "web app" paradigm vs. the "cgi script" paradigm that it was created in. Is that really true?

imakesnowflakes2• 11 years ago

PHP when used appropriately

'using php appropriately' involves keeping a large number of gotchas and weird behaviors in your head, when you are writing every single line of PHP.

pcunite• 11 years ago

giro, I agree, but what are the alternatives? I'm coding my own, personally.

8ig82• 11 years ago

Knowing about WordPress and the typical use case, what do you use instead?

ceejayoz3• 11 years ago

Most people would be fine with a static site generator like Jekyll and a third-party commenting system like Facebook or Disqus. As a bonus, it costs pennies to host such a thing on S3.

sluckxz• 11 years ago

Ghost is coming along very nicely. From what I have followed from their development I have seen very thoughtful developers from the start.

edit to add https://github.com/TryGhost/Ghost

girvo8• 11 years ago

That's the problem. For some clients, there simply isn't a decent alternative.

That said, if I was forced to choose a "user friendly" CMS, I'd go with Drupal 8 (when it's released). The reasoning? It still has the client-facing tooling that non techy users expect, but is built on top of the Symfony core, following all relevant standards.

It's a little while away though, unfortunately. Depending on the site, my answer nowadays is a Silex API for the data they want to work on, and a React + Flux front-end. That's too much work for a $2k site however; WordPress is so entrenched that any replacement needs to be able to answer the plugins question successfully to overtake it.

cyri• 11 years ago

I'm using the blazing fast http://gohugo.io/ Hugo static site generator (written in GoLang 8-) )

And that plugin can help you with the migration: https://github.com/SchumacherFM/wordpress-to-hugo-exporter

Hugo is more for nerds than the average WordPress blogger.

JonLim3• 11 years ago

Honest question: for the rest of us who can't write our own blogging platforms but are able to roll out our own hosting for a blog, which one would you recommend?

dotBen• 11 years ago

WP Engine (http://WPEngine.com) laregly solves any of these lingering concerns, or makes them irrelevant. It is also relied on by many, many Fortune 500's through to YC Startups. (Disclosure, I'm a confounder but not actively involved in the company these days)

thesimon• 11 years ago

Not OP, but http://jekyllrb.com/ and ghost are both great.

NDizzle• 11 years ago

I was wary of the Wordpress auto update changes starting with I think 3.8.

Right out of the gate they updated the $post object in a way that broke existing installations.

That was what got me off wpengine and off wordpress entirely. I was tired of the updates breaking existing functionality in a way that made me have to think about it.

imakesnowflakes2• 11 years ago

modern PHP is a fine language.

I am sorry, but bolting on a ton of 'modern' features on a broken language does not make it not-broken. If it does anything, it is to put up an appearance of being modern, while remaining rotten on the inside, and hence all the more dangerous.

Remember, the most broken aspect of the language is also reason for it's very defining feature (No or very little learning required to get started). Hence one cannot hope that PHP will be fixed at some point in the future. Because fixing the language thus will actually involve killing it and designing it from the ground up, at which point you can just use Python 3.

And that is even considering that the PHP community is competent enough to identify the flaws of the language. But I think what happens inevitably is that, people who can really see how broken the language also see the hopelessness of the situation and immediately switch to something else or use it only to pay their bills.

If you think I am not familer with modern PHP, here is a tool I wrote some time back in php, for php programmers to deal with the pain of working with namespaces and also provide intelligent auto completion for editors like vim..

https://bitbucket.org/sras/cliche

girvo8• 11 years ago

If it does anything, it is to put up an appearance of being modern, while remaining rotten on the inside, and hence all the more dangerous.

But what's rotten that you have to use in the day-to-day? PHP still has it's quirks, sure, but when I write modern PHP nearly all of those melt away. Also, well done Cliche, that's pretty neat; there are some other implementations of this idea nowadays that do similar things and are very useful.[0]

One of the reasons I love HHVM is that Hack is basically PHP-the-good-parts-with-other-awesome-good-parts-added. Static analysis? No problem. Autocomplete? Built into the default tooling! Having to remember dirty array method parameter ordering? No need -- use Collections and use methods on the primitives!

[0] https://github.com/nikic/PHP-Parser

JeremyMorgan3• 11 years ago

I'm with you. Though I'm a .Net developer by trade I spent years in the PHP trenches. C# and .Net provide better solutions in my opinion for the enterprise. But for shops with low funds and projects that needed to be done yesterday, PHP really shines.

It's not the language as much as it is the programmer. I've seen some very secure, well written programs in PHP.

jcroll• 11 years ago

Are there any examples of someone trying to refactor Wordpress on the Symfony HttpKernel or basically moving Wordpress Core to some type of more modern architecture?

dantiberian• 11 years ago

A lot of people here are talking right past each other.

Is it good that WordPress has automatic security updates? Yes.

Is it bad that WordPress vulnerabilities are still so common? Yes.

Are Drupal, Joomla, or Magento better at this? It sounds like the answer is probably no.

Does that excuse WordPress because it is better than other frameworks with marginal track records? No.

For such a widely used framework, WordPress' security record is dismal. Automatic updates are a great feature, but they don't replace the need for the framework to be a lot more secure.

For someone hosting their personal blog on a $5/month VPS this is probably good enough. For a bank to run WordPress is borderline professional negligence at this point [1]. A lot of the comments seem to be assuming that because the update was rolled out withing a few hours, that their window of exposure was pretty small. The window of exposure to WordPress vulnerabilities isn't from the time the patch is released until you are updated, it is from when an attacker discovers the vulnerability and you are updated.

[1] http://ma.tt/2015/04/a-bank-website-on-wordpress/.

pyre2• 11 years ago

Someone should do a study on where these security bugs are coming from. Are they in new features? Introduced from refactors of old code? Are they due to the plugin infrastructure? Is it all in old code?

BorisMelnik2• 11 years ago

they should, for sure. from what I've seen over the past few years it is really all of the above although plugins are notoriously horrible.

punjabisingh• 11 years ago

The bugs are coming from everywhere.

In my view, the worst ones are the ones coming from core. They've come from old code (i.e. the comments XSS due to overly large comments) or from including other libraries (i.e. genericons vulnerability).

I think this sort of stuff is bound to happen since WordPress is slowly becoming the kitchen sink trying to keep up with all demands of the users.

The good part is:

* They are increasing their unit tests coverage.

* With auto-updates, the huge amount of sites that use WordPress are not left in the dark. So I consider it a feature even if it comes at a price. When the software is being used at the scale that WordPress is, it is a needed feature.

bovermyer• 11 years ago

WordPress's code is badly designed and written in a language that I no longer believe serves the best interests of the Internet in general.

WordPress as a globally managed app is FANTASTIC. Automattic does a superb job of keeping on top of just about everything that comes its way. They do great work over there, and I'm really proud of that whole team.

coldtea3• 11 years ago

WordPress's code is badly designed and written in a language that I no longer believe serves the best interests of the Internet in general.

It's 2015. This is not your grandparents PHP.

Besides PHP serves the largest website on Earth (Facebook) and a good 20% or more of the rest (via Wordpres, Drupal et al).

gnaritas3• 11 years ago

Besides PHP serves the largest website on Earth (Facebook) and a good 20% or more of the rest (via Wordpres, Drupal et al).

Popular != good. None of those points mean anything, PHP is still a badly designed language that lacks consistency and makes language designers feel like puking. It's a collection of hacks more than a language.

donatj• 11 years ago

I've heard closer to 60%, but I agree wholeheartedly. I've worked in many other languages but when I want something done, to work, and I'm not doing something so large I need to squeeze every last drop of memory - I do it in PHP. It's a wonderful scripting language. I write more CLI scripts in it than web apps at this point.

wodenokoto• 11 years ago

So what happened to Wordpress? Their slogan used to be "Code is poetry" and today they are the punchline of every bad code anecdote told.

fsk4• 11 years ago

The only projects that nobody ridicules are the ones that nobody uses.

BorisMelnik2• 11 years ago

Let's ask one question: what CMS, CRM, programming language, operating system, etc doesn't come out with major security flaws every once in a while?

All of them, even OpenBSD. Software has bugs, and security flaws. It is not how buggy they are, but how well we patch them from a larger scale and that, WordPress does extremely well.

krapp• 11 years ago

One of the biggest strengths of Wordpress is also a fatal flaw - the flexibility of its plugin system, and how easy it makes finding and installing plugins and themes. Each is its own self-contained web application that runs with the same permissions as the application itself.

Yes, this applies to any open source application, but given how huge Wordpress' plugin landscape is, it's a big problem even if you assume the core application itself is secure (for the sake of argument.) Almost nobody pores over every line of code in every plugin before they install it (much less each update) - at best they just check to see if it has a high rating.

notlisted3• 11 years ago

I was never a big a fan of WP, but… I agree the ease of updates is an extremely important feature, especially for non-technical users. I'm working on a small conversion project migrating content from a Joomla site to Wordpress. The original site was running on Joomla 1.5 (Support for this version ended in Sept. 2012!). The upgrade path was too cumbersome so the clients just "took the risk". It was compromised several times but "cleaned up as best we could". Needless to say, we're ditching that server.

Still not a fan of WP self-installs, but hosted on WPEgine with smart tech support, automatic daily snapshots with the option for non-technical people to back up or revert the whole thing with a single-click is super simple. For added security and performance we'll be using cloudflare DNS, applied a plugin to hide any evidence of wordpress use and use just a few well-known and maintained plugins. Nothing is perfect, but ease of use, ease of upgrades and ease of maintenance go a loooooong way. It's mighty budget-friendly too.

edgarvaldes• 11 years ago

What plugin are you using to "hide" Wordpress?

jbeales• 11 years ago

It doesn't matter because it won't help much, if at all. The script kiddies are running scripts that check for known files in several popular CMSs, so unless the plugin makes major changes to WP's behaviour, WordPress will still be findable.

notlisted3• 11 years ago

This one: http://codecanyon.net/item/hide-my-wp-no-one-can-know-you-us...

jqm• 11 years ago

Updating plugins often breaks things. For instance, I updated our AD plugin for a company blog a few days ago and no one could log in. I had to do some research and eventually the plugin was rolled back from backup.

Can't wait to see what auto update breaks.

Not a fan of Wordpress. It's a lot more work than it's worth.

DigitalSea• 11 years ago

I think Wordpress gets a lot of unfair blame. I often see the size of its code-base touted as one of the reasons to avoid its use. It seems the general consensus amongst a lot of developers out there is that Wordpress isn't OOP. Seriously when was the last time someone building a Wordpress website had to do anything outside of the wp-content folder? I have been working with it for like 8 years now. I used it before it even had half the CMS features that it has now. Making Wordpress completely OOP isn't going to make it any better than it already is, nor will it make more people visit your website or make you breakfast in the morning.

I don't care if the Wordpress code-base is a mixture of procedural and object-oriented PHP code, I use the hooks/actions system to change things, I never have a need to go into the wp-includes folder unless I am trying to work out how a new feature works that isn't fully documented (which is extremely rare). I also see people calling PHP a bad language because of the way Wordpress was built on-top of it, like some can't make the distinction between the language and the prolific CMS built on-top of it.

When a Wordpress website gets hacked, you know who should also shoulder the blame? The developer that set it up and or the server admin that setup the server. If you're setting up Wordpress on a server that doesn't have the appropriate folder permissions set, the wp-config file moved back one level from root (and thus not publicly accessible), you're using the default "wp_" database table prefix and you use FTP to move files to and from the server because setting up SSH access intimidates you, then it is your fault as well. A properly secured Wordpress installation is very difficult to attack. Sure it doesn't protect you from all attack vectors, but it goes a long way. Making sure your username in Wordpress isn't admin always goes a long way. On all Wordpress sites that I monitor I see numerous brute force scripts being run trying to guess the password for a user named "admin" jokes on them, no such user even exists, so they just instantly IP banned (which is annoying because some seem to cycle through thousands of IP addresses). Running an old version of Wordpress and you get attacked, is it Wordpress' fault or your own?

People love to bash Wordpress, but you want to know the harsh reality? There is no better alternative (trust me, I tried looking once, I legitimately spent weeks trying alternatives and found nothing better). Wordpress is the number #1 CMS because it is the best, regardless of its code-base, nothing else compares. Some people will try telling you to use Drupal, but they generally don't know what they are on about. "Oh, don't use Wordpress it gets hacked all of the time" - no, it doesn't. Your lack of technical competency is the reason you get hacked all of the time. A bad workman blames his tools.

My personal blog gets 3k hits per day, I see numerous attempts to hack my site and in the 5 years I have been running Wordpress on my personal blog alone, I have never been successfully hacked once. Because I don't just set Wordpress up using the default settings, I use strong passwords, I use unique usernames, I lock file and folder permissions, I move credentials out of the root directory.

Wordpress is slightly cursed in that it has a low learning curve, it makes it incredibly easy for just about anyone to setup their own self-hosted Wordpress installation. While exploits are not the users fault, a lot of the most common hacks you see on Wordpress were in part due to the fact the user kept a default setting or set something up incorrectly.

The auto update functionality is great in Wordpress, I don't think this feature alone is a big selling point for the CMS. The auto-update functionality in Wordpress doesn't always work, but it is better than nothing. As the author points out, particular Drupal and Magento are both so complicated (even though they have clean code-bases) that they make it difficult to perform updates or do basic tasks people take for granted in Wordpress.

Compared to the number of times I have been infected with malware and viruses over the years as a Windows user (many times due to my own fault), Wordpress does not even register on the Richter scale of insecurity and annoyance in comparison.

Lets start taking responsibility for our own actions, developers. We can't blame PHP and Wordpress for all security issues. Somewhere along the line you need to make some effort and not assume a CMS or framework has your best interests at heart or has covered every possible angle.

cthalupa• 11 years ago

People always beat up on software that has security vulnerabilities.

The thing is, the auto update feature is not an affirmative defense for the criticism. There are probably plenty of legitimate defenses out there - developing secure software is quite obviously something that is hard to get right.

But offering auto-updating is only a defense against arguments claiming that updating WordPress is a pain in the ass, not people claiming that the codebase has lots of security flaws.

You also can't use other software being garbage as a defense for why some other piece of software isn't garbage.

You have to evaluate the actual merits of WordPress in regards to the code quality, chance of being exploited, etc. It updating automatically when exploits are made public is not the same thing as not being vulnerable to frequent exploitation, nor are other frameworks failing in some other way exoneration for any failings WordPress might have.

To be clear: I don't care about WordPress, and do not have a stance on whether or not it's great or awful. All I know for sure is that it is certainly quite popular.

But this article is built upon a shaky premise and lots of logical fallacies. If you want to write about how awesome it is that WordPress auto-updates, then write about it. Just don't try to use that as a defense for criticism about other aspects of the codebase.

ac29• 11 years ago

The article and many commenters miss a critical flaw: wordpress only auto-updates minor releases. 4.1.0 will be updated to 4.1.x, but not 4.2.x or beyond.

I built a WP site about 6 months ago on 4.0.x (current at the time), since then it has required 2 manual updates to get to 4.2.x.

As many others have noted, plugins are a bigger problem. They often break on new major releases and update less frequently. There is a lot good about wordpress, but the update cycle and security problems are a huge maintenance issue.

JeremyMorgan3• 11 years ago

Ok, I'll be the devil's advocate here. I hate Wordpress, I really do. But there is a reason it's so successful.

Show me another similar CMS (if that's what you want to call it) that's as easy to install and use, in any language or platform.

Django and DotNetNuke are the only ones I can think of that come close, and neither of them are as easy to install and work with as Wordpress. That's why it's so popular.

Sure most HN visitors are developers working with better stuff and wouldn't be caught dead using WP but if you're a non developer business person looking for a quick solution it can't be beat!

We should all be working on an easy to use, yet more secure alternative.

In Defence of WordPress

Related Stories