Hacker News Reader

> Did you know that for example Wordpress comes with automatic updates

I grant that Debian is not great at webapps. OTOH giving an application write access to itself is inherently risky. It's too bad shared webhosting and its limitations has so warped the PHP application community.

An alternative model: web app has r-x on the app files, and an app specific admin user has rwx to run the check and update script on a regular basis.

View on HN

WP has the ability to use (S)FTP to update the files rather than direct file access.

That said, it's intended for the long-tail of sites. If you know how to run an update script, you're already more advanced than a fairly big chunk of the WP userbase, so you probably should be doing updates that way. Many professionally developed sites will be using source control, so autoupdates are disabled anyway.

> WP has the ability to use (S)FTP to update the files rather than direct file access.

Well that doesn't help at all with security.

Reply on news.ycombinator.com