Comment on Backdoor slipped into multiple WordPress plugins in ongoing supply-chain attack
sugar_in_your_tea@sh.itjust.works 2 months agoAnd Internet insecurity. It wasn’t designed to be secure, it was designed to be full-featured, so it has a pretty big attack surface.
maynarkh@feddit.nl 2 months ago
That’s the ecosystem. WordPress itself is pretty basic, these things attack plugins, and their often not-very-experienced creators and users. The thing with WordPress is that this kind of vulnerability comes with the problem space, not the particular solution. If there was a different product in the same space, it would not fare better by default.
Also, I’d bet that a ton of CVEs are filed for C++ libraries, yet nobody is harping on about how insecure C++ is.
sugar_in_your_tea@sh.itjust.works 2 months ago
Exactly. A plug-in architecture is a feature, and it’s really hard to secure. Instead of going that route, they should have instead solved specific problems. When you make it easy to add someone else’s code, you also make it easy to forget to remove it later, or to not stay updated on which plugins are deprecated/abandoned.
A plug-in system is insecure by design for a public-facing service. YAGNI, so pick a handful of stuff you actually need.