Hacker News Reader

Comment by jlgaddis | Hacker News Reader

I am so glad I quit using Drupal years ago (due to its recurring security issues, coincidentally) and "banned" it in our organization.

(Yes, I realize these issues are in third-party/contributed modules.)

View on HN

If you found software to switch to that is free of security issues, I imagine we would all be interested to know what it is.

While you can't make software perfectly secure you can make security updates as easy as possible. Drupal is exceptionally bad at this. IMHO Wordpress does the right thing with its auto updates. That still doesn't solve the problem for plugins, but it's probably prevented a lot of hacked sites. I think a CMS without an autoupdate functionality cannot be recommended for general use these days.

Drupal has a built-in update mechanism and it's been around for years. Administrators receive update notifications via email, they're surfaced in the status page, and there's a site-wide admin notification on every page when there's a security release available.

You can update both core and modules (similar to plugins for WordPress) using the web interface, which is included with core, or use a command-line utilities like Drush for Drupal 7, or Composer in Drupal 8.

There's lots of very valid reasons to be critical of Drupal, but:

> Drupal is exceptionally bad at this.

I don't think that's accurate.

The audacity of having a system for secure reporting of security issues, with the follow-through on fix development and mitigation, release coordination and announcements, and transparency? That's an asinine reason to "ban" it.

Reply on news.ycombinator.com