Hacker News Reader

While you can't make software perfectly secure you can make security updates as easy as possible. Drupal is exceptionally bad at this. IMHO Wordpress does the right thing with its auto updates. That still doesn't solve the problem for plugins, but it's probably prevented a lot of hacked sites. I think a CMS without an autoupdate functionality cannot be recommended for general use these days.

View on HN

Drupal has a built-in update mechanism and it's been around for years. Administrators receive update notifications via email, they're surfaced in the status page, and there's a site-wide admin notification on every page when there's a security release available.

You can update both core and modules (similar to plugins for WordPress) using the web interface, which is included with core, or use a command-line utilities like Drush for Drupal 7, or Composer in Drupal 8.

There's lots of very valid reasons to be critical of Drupal, but:

> Drupal is exceptionally bad at this.

I don't think that's accurate.

Reply on news.ycombinator.com