It’s not the product, it’s the cavalier consumption of unsigned add-ons despite knowing better.
Comment on Backdoor slipped into multiple WordPress plugins in ongoing supply-chain attack
0x0@programming.dev 4 months ago
If i were to take a shot every time vulnerabilities are found in the WordPress ecosystem i’d be comatose by now…
corsicanguppy@lemmy.ca 4 months ago
Fredselfish@lemmy.world 4 months ago
What are alternatives of WordPress if I wanted to add something to my website?
IsThisAnAI@lemmy.world 4 months ago
Drupal, but you are getting into a different type of complex syfony code built on years and years of drupalism’s. It’s powerful and pretty well maintained though.
sugar_in_your_tea@sh.itjust.works 4 months ago
What are you trying to achieve?
- static site like a blog? - Hugo
- add comments? - Commento paid, or you can self-host
- cloud stuff (e.g. Google Drive replacement) - NextCloud
There’s a ton you can do, you don’t need WordPress just because you want a website. Figure out what you want your website to do, then look for tools to do that.
thejml@lemm.ee 4 months ago
I’ve used getgrav.org for a while and it’s been pretty solid.
0x0@programming.dev 4 months ago
If you want to add something to your website then you’re already running WordPress, no?
Fredselfish@lemmy.world 4 months ago
No, I haven’t added nothing. I was going code a basic html 5 page but I wanted a blog like atmosphere, since the website is all about my writing.
maynarkh@feddit.nl 4 months ago
I’d guess it’s not because of the inherent insecurity of WordPress, but the sheer size of the ecosystem and the fact that like 40% of the Internet is WordPress sites.
sugar_in_your_tea@sh.itjust.works 4 months ago
And Internet insecurity. It wasn’t designed to be secure, it was designed to be full-featured, so it has a pretty big attack surface.
maynarkh@feddit.nl 4 months ago
That’s the ecosystem. WordPress itself is pretty basic, these things attack plugins, and their often not-very-experienced creators and users. The thing with WordPress is that this kind of vulnerability comes with the problem space, not the particular solution. If there was a different product in the same space, it would not fare better by default.
Also, I’d bet that a ton of CVEs are filed for C++ libraries, yet nobody is harping on about how insecure C++ is.
sugar_in_your_tea@sh.itjust.works 4 months ago
Exactly. A plug-in architecture is a feature, and it’s really hard to secure. Instead of going that route, they should have instead solved specific problems. When you make it easy to add someone else’s code, you also make it easy to forget to remove it later, or to not stay updated on which plugins are deprecated/abandoned.
A plug-in system is insecure by design for a public-facing service. YAGNI, so pick a handful of stuff you actually need.