Comment on Backdoor slipped into multiple WordPress plugins in ongoing supply-chain attack

0x0@programming.dev ⁨6⁩ ⁨days⁩ ago

• maynarkh@feddit.nl ⁨5⁩ ⁨days⁩ ago

  I’d guess it’s not because of the inherent insecurity of WordPress, but the sheer size of the ecosystem and the fact that like 40% of the Internet is WordPress sites.

  source

  • sugar_in_your_tea@sh.itjust.works ⁨5⁩ ⁨days⁩ ago

    And Internet insecurity. It wasn’t designed to be secure, it was designed to be full-featured, so it has a pretty big attack surface.

    source

    • maynarkh@feddit.nl ⁨5⁩ ⁨days⁩ ago

      That’s the ecosystem. WordPress itself is pretty basic, these things attack plugins, and their often not-very-experienced creators and users. The thing with WordPress is that this kind of vulnerability comes with the problem space, not the particular solution. If there was a different product in the same space, it would not fare better by default.

      Also, I’d bet that a ton of CVEs are filed for C++ libraries, yet nobody is harping on about how insecure C++ is.

      source

      • sugar_in_your_tea@sh.itjust.works ⁨5⁩ ⁨days⁩ ago

        Exactly. A plug-in architecture is a feature, and it’s really hard to secure. Instead of going that route, they should have instead solved specific problems. When you make it easy to add someone else’s code, you also make it easy to forget to remove it later, or to not stay updated on which plugins are deprecated/abandoned.

        A plug-in system is insecure by design for a public-facing service. YAGNI, so pick a handful of stuff you actually need.

        source
• corsicanguppy@lemmy.ca ⁨4⁩ ⁨days⁩ ago

  It’s not the product, it’s the cavalier consumption of unsigned add-ons despite knowing better.

  source
• Fredselfish@lemmy.world ⁨5⁩ ⁨days⁩ ago

  What are alternatives of WordPress if I wanted to add something to my website?

  source

  • IsThisAnAI@lemmy.world ⁨5⁩ ⁨days⁩ ago

    Drupal, but you are getting into a different type of complex syfony code built on years and years of drupalism’s. It’s powerful and pretty well maintained though.

    source
  • sugar_in_your_tea@sh.itjust.works ⁨5⁩ ⁨days⁩ ago

    What are you trying to achieve?

    • static site like a blog? - Hugo
    • add comments? - Commento paid, or you can self-host
    • cloud stuff (e.g. Google Drive replacement) - NextCloud

    There’s a ton you can do, you don’t need WordPress just because you want a website. Figure out what you want your website to do, then look for tools to do that.

    source

    • thejml@lemm.ee ⁨5⁩ ⁨days⁩ ago

      I’ve used getgrav.org for a while and it’s been pretty solid.

      source
  • 0x0@programming.dev ⁨5⁩ ⁨days⁩ ago

    If you want to add something to your website then you’re already running WordPress, no?

    source

    • Fredselfish@lemmy.world ⁨5⁩ ⁨days⁩ ago

      No, I haven’t added nothing. I was going code a basic html 5 page but I wanted a blog like atmosphere, since the website is all about my writing.

      source