> I don't recommend doing ecommerce...or anything that could gather sensitive information

The problem with this kind of thinking is that if I can get remote code execution, or even just content control over your no-ecommerce-or-sensitive-information blog, I can have a great time. Sure, it's not as valuable as CC info, but the potential for malware distribution, credential phishing (password reuse for the win!), various kinds of social engineering, or even just as an anonymizing host to hide illegal activity, is still huge.