Hacker News Reader

Comment by johnklos | Hacker News Reader

The title literally made me laugh out loud. What drama! What intrigue! Can't wait to see what happens next.

Honestly, I have no horse in the race, so to speak. I think the people responsible for Wordpress code still suck because they still, in 2024, want the software itself to be able to write to where the software itself lives and runs, which is just bananas. It violates the first two rules of anything and everything on the web that I learned in the '90s:

* do not allow writing to anywhere that's executable

* do not allow execution anywhere that's writable

View on HN

Indeed it's completely insane that any plugin can create a file in the site folder, and a public URL will execute it. And a site can have a dozen (or dozens in some cases) of plugins from various authors. It's a security nightmare, and I don't know of any (modern) language that allows such a situation other than PHP.

That has absolutely zero to do with PHP itself and everything with the abysmal state of Wordpress code.

Wordpress probably still enforces magic quotes which made me bail the hell out when I looked into it ten years ago.

Yea, Wordpress has always been a nightmare... But it makes things so convenient and that's what most people care about.

Isn’t that a good thing to want though? Something easy to use if you only care about content?

I mean does it matter if whether it’s a good thing to want? WordPress powers 40% of the web because it was convenient, powerful, and easy for someone with basic web skills to hack around with. The same things that people complain about today made it so popular!

Besides, read-only file systems can be used to handle massive sites that need better security (like nasa.gov). And those types sites are either writing their own plugins or heavily auditing which plugins they use.

Which is also why it is successful! You can get powerful plugins that way.

Is it much different from a windows app installer asking admin permissions then editing the registry and can plaster files anywhere.

Just chmod -w

Reply on news.ycombinator.com