Comment by SwellJoe | Hacker News Reader

Comment by SwellJoe | Hacker News Reader

Parent Full thread

I still, currently, recommend WordPress, despite its flaws.

I don't recommend doing ecommerce (directly) with it, or anything that could gather sensitive information, but for "just a website" with a bunch of cool stuff, WordPress is pretty much impossible to beat for the sheer amount of "cool stuff" you can do without ever writing code. The plugin ecosystem is tremendous.

The automated updates, so far, mostly stay ahead of the curve on exploits in the wild. We have a large pool of users to draw information from (thousands of servers running all manner of web apps), and we're far more likely to see exploits of systems that are harder to update; Drupal, Joomla, and especially a bunch of little apps that have tiny market share and small maintenance teams and cranky update processes. Having an easy and automated system for updates is just incredibly valuable for security.

What really needs to happen is everyone making web applications needs to start shipping a command line client for updates, that is safe/reliable enough to be run from cron. Best of both worlds: you don't need the app files to be write-able from the app itself (which is one of the big security concerns raised by this post) and you're always running the latest version even on systems that aren't being worked on daily. There's still the command line element to the problem, but it could be mostly automated away by control panels and installer tools (of which there are many).

There are a lot of forgotten CMS installations out there, and those are the biggest security problem, IMHO.

> I don't recommend doing ecommerce (directly) with it, or anything that could gather sensitive information, but for "just a website" with a bunch of cool stuff, WordPress is pretty much impossible to beat for the sheer amount of "cool stuff" you can do without ever writing code.

Yes, basically don't store anything like this in the WordPress database. There are tons of services you can use, like Hubspot for forms, that allow you to abstract all of these things away from your site and still use WordPress.

WordPress now has a pretty good command line tool: wp-cli [1]

You can run `wp-cli core update` to update the core WP files. It can also update plugins.

[1] http://wp-cli.org/

Unfortunately this doesn't solve the problem that WordPress needs to be able to write to itself. It's game over once every skid in the world can pop a web shell in /var/www.

I believe you can do pretty much everything from command line for Drupal with drush

> I don't recommend doing ecommerce...or anything that could gather sensitive information

The problem with this kind of thinking is that if I can get remote code execution, or even just content control over your no-ecommerce-or-sensitive-information blog, I can have a great time. Sure, it's not as valuable as CC info, but the potential for malware distribution, credential phishing (password reuse for the win!), various kinds of social engineering, or even just as an anonymizing host to hide illegal activity, is still huge.

When did you last use Joomla?

2016 Joomla is as easy as WP to update, and easier than WP to install.

Several years ago. We briefly used it for our company website, in between OpenACS and Drupal 6. But, it was short-lived, maybe a year, as it was just incredibly difficult to maintain and enhance and the various bridged in applications led to a really inconsistent user experience (multiple notifications configurations, etc.). I've heard from customers that it has improved, but I haven't had reason to look at it lately.

But, I'm glad to hear they've improved the update experience; though I can't imagine how it could be easier than WordPress, since WP will update automatically with no user intervention, if you let it. Easy and reliable updates are perhaps the single biggest security feature, if the team behind the project is pro-active about security bugs.

Reply on news.ycombinator.com