If i were to take a shot every time vulnerabilities are found in the WordPress ecosystem i’d be comatose by now…
Backdoor slipped into multiple WordPress plugins in ongoing supply-chain attack
Submitted 4 months ago by otter@lemmy.ca to technology@lemmy.world
Comments
0x0@programming.dev 4 months ago
maynarkh@feddit.nl 4 months ago
I’d guess it’s not because of the inherent insecurity of WordPress, but the sheer size of the ecosystem and the fact that like 40% of the Internet is WordPress sites.
sugar_in_your_tea@sh.itjust.works 4 months ago
And Internet insecurity. It wasn’t designed to be secure, it was designed to be full-featured, so it has a pretty big attack surface.
corsicanguppy@lemmy.ca 4 months ago
It’s not the product, it’s the cavalier consumption of unsigned add-ons despite knowing better.
Fredselfish@lemmy.world 4 months ago
What are alternatives of WordPress if I wanted to add something to my website?
IsThisAnAI@lemmy.world 4 months ago
Drupal, but you are getting into a different type of complex syfony code built on years and years of drupalism’s. It’s powerful and pretty well maintained though.
sugar_in_your_tea@sh.itjust.works 4 months ago
What are you trying to achieve?
- static site like a blog? - Hugo
- add comments? - Commento paid, or you can self-host
- cloud stuff (e.g. Google Drive replacement) - NextCloud
There’s a ton you can do, you don’t need WordPress just because you want a website. Figure out what you want your website to do, then look for tools to do that.
0x0@programming.dev 4 months ago
If you want to add something to your website then you’re already running WordPress, no?
555_1@lemmy.world 4 months ago
People still use Wordpress? lol
eskimofry@lemmy.world 4 months ago
Its convenient. Not everyone wants to waste their life centering divs you know
unexpectedteapot@lemmy.ml 4 months ago
Right, because the only alternative to using spaghetti old code is making your own, not using one of the many actively maintained free software.
Among many others you’d easily find if you give up on the hivemind of taking the most popular approach.
Downcount@lemmy.world 4 months ago
As if wordpress would be the only CMS out there.
wagoner@infosec.pub 4 months ago
Laziest common response to things like this. People still use Windows? People still use cars? WordPress is insanely popular and there’s no indication that’s going to change. Not even after you’ve chosem to signal to all of us here that you don’t use it. Good for you, though!
gofsckyourself@lemmy.world 4 months ago
Over the past few years WordPress usage has grown from 39% to 43.3% [W3 Techs]
As much as I hate so much about WordPress, yes it is the most used CMS. Period. Your comment is just ignorant.
Anon518@sh.itjust.works 4 months ago
What would you use instead?
555_1@lemmy.world 4 months ago
Something that gets built on my machine and pushed up to the site and doesn’t allow third party code to execute on the backend.
It really depends on what the website is.
If you have a use case, I can be more detailed.
sugar_in_your_tea@sh.itjust.works 4 months ago
Wordpress does a lot of things. You need to specify which things you want to do in order to narrow down a replacement. For example:
- static site? - Hugo, Jekyll, etc - just generates regular HTML
- personal cloud? - NextCloud/OwnCloud
- ecommerce? - consider nopCommerce or OpenCard
The more you can narrow your requirements, the easier it will be to find a secure solution.
Alphane_Moon@lemmy.world 4 months ago
You’re asking for trouble is you’re using such random plugins on a production sites.
Pechente@feddit.org 4 months ago
oh boy, the average wordpress site has like 30 plugins and the top bar is getting cluttered with so many plugin upsells that it fills the whole screen. There’s a huge industry of people making wordpress sites who shouldn’t.
It’s quite frustrating to be asked as a dev to “fix” people’s site as my usual response is “shut it off and redo it well”.
bjoern_tantau@swg-empire.de 4 months ago
It’s really a shame because by now WordPress itself actually works quite well. Sure, it’s fueled by unspeakably ugly spaghetti code. But at least it’s unspeakably ugly spaghetti code that works and receives regular automatic updates.
And other than putting up a verification program I don’t see what they could do to improve the plugin situation.
maynarkh@feddit.nl 4 months ago
And this is why I hate the state of the whole hacking scene and that now nation states are also carrying out en masse attacks. Everyone should be free to make a site on Wordpress or whatever. If they can’t, that’s how we get everyone on like 3 corporate platforms like Facebook.
Alphane_Moon@lemmy.world 4 months ago
Funnily enough, I was hearing this from developers in the early 2010s when I was just starting my career (IT adjacent, but not a developer).