Wordpress 3.0.2 security update ... | Hacker News Reader

Wordpress 3.0.2 security update ...

wordpress.org

26 pointsepo12 comments

You can craft a SQL injection by linking to a blog with the right URL, thus causing Wordpress to attempt to ping them and, in doing so, directly execute your SQL statement of choice against the DB.

http://core.trac.wordpress.org/changeset/16625

Wordpress has had lots of security issues; see tptacek's comment: http://news.ycombinator.com/item?id=1328261

Given their prioritization of ease-of-use over security, why would anyone want to run your own WP install, instead of wordpress.com or jekyll (static site) + disqus?

Because of the ease of use.

Those are two separate arguments. Why run my own? Control, customization, cost. Why not use something like Jekyll? Because the people who I collaborate with do not use tools like the command line, textile, and markdown.

The code is a steaming pile, but the ecosystem is amazingly good, and the user experience is heads-and-tails above most CMS systems. You can have a Wordpress-backed site up in minutes, and (for very little money) it will look fabulous and you'll be able to change stuff on it without having to call your nephew who knows lots of stuff about computers.

(I use Wordpress all over the place, including for the marketing site for my new product. It saved at least a week versus having the marketing site also served out of Rails, and decoupling them made my designer's life much easier.)

On this note, are there any other recommended platforms?

A reasonable way to get the best of both worlds is to mirror WP content as static files on a webserver, keeping all of Wordpress --- all of it --- behind a firewall. Most of WP, besides search and commenting, is amenable to scraping.

How would you do that? Would a simple 'wget --recursive' suffice or you're after something more sophisticated?

Turn on Super Cache which uses the file system.

Spider the site to populate the cache files.

Copy them to a public web directory.

The internal links might not work right out of the box, but I'm sure you could massage them into shape.

Remember that you can easily use SVN to update your wordpress installations with a single line. I've yet to have a problem with doing it this way. I wish they'd move to git officially (I know there are some mirrors), but this does the trick for the most part. Someday.

Thanks muchly for the notice.

Can anybody recommend a good 3rd party WP hosting service that lets you run your own custom plugins? I'm tired of spending engineering resources managing our own WP instance.

Reply on news.ycombinator.com