this post was submitted on 25 Jun 2024
311 points (99.1% liked)

Technology

60055 readers
3410 users here now

This is a most excellent place for technology news and articles.


Our Rules


  1. Follow the lemmy.world rules.
  2. Only tech related content.
  3. Be excellent to each another!
  4. Mod approved content bots can post up to 10 articles per day.
  5. Threads asking for personal tech support may be deleted.
  6. Politics threads may be removed.
  7. No memes allowed as posts, OK to post as comments.
  8. Only approved bots from the list below, to ask if your bot can be added please contact us.
  9. Check for duplicates before posting, duplicates may be removed

Approved Bots


founded 2 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
[–] [email protected] 42 points 6 months ago (3 children)

If i were to take a shot every time vulnerabilities are found in the WordPress ecosystem i'd be comatose by now...

[–] [email protected] 26 points 6 months ago (1 children)

I'd guess it's not because of the inherent insecurity of WordPress, but the sheer size of the ecosystem and the fact that like 40% of the Internet is WordPress sites.

[–] [email protected] 10 points 6 months ago* (last edited 6 months ago) (1 children)

And inherent insecurity. It wasn't designed to be secure, it was designed to be full-featured, so it has a pretty big attack surface.

[–] [email protected] 13 points 6 months ago (1 children)

That's the ecosystem. WordPress itself is pretty basic, these things attack plugins, and their often not-very-experienced creators and users. The thing with WordPress is that this kind of vulnerability comes with the problem space, not the particular solution. If there was a different product in the same space, it would not fare better by default.

Also, I'd bet that a ton of CVEs are filed for C++ libraries, yet nobody is harping on about how insecure C++ is.

[–] [email protected] 3 points 6 months ago

Exactly. A plug-in architecture is a feature, and it's really hard to secure. Instead of going that route, they should have instead solved specific problems. When you make it easy to add someone else's code, you also make it easy to forget to remove it later, or to not stay updated on which plugins are deprecated/abandoned.

A plug-in system is insecure by design for a public-facing service. YAGNI, so pick a handful of stuff you actually need.

[–] [email protected] 6 points 6 months ago

It's not the product, it's the cavalier consumption of unsigned add-ons despite knowing better.

[–] [email protected] 2 points 6 months ago (4 children)

What are alternatives of WordPress if I wanted to add something to my website?

[–] [email protected] 9 points 6 months ago* (last edited 6 months ago)

Drupal, but you are getting into a different type of complex symfony code built on years and years of drupalism's. It's powerful and pretty well maintained though.

[–] [email protected] 4 points 6 months ago (2 children)

What are you trying to achieve?

  • static site like a blog? - Hugo
  • add comments? - Commento paid, or you can self-host
  • cloud stuff (e.g. Google Drive replacement) - NextCloud

There's a ton you can do, you don't need WordPress just because you want a website. Figure out what you want your website to do, then look for tools to do that.

[–] [email protected] 9 points 6 months ago

Just a side note, Commento is kinda dead on the self-hosting front at least as it's been years since an update, which is probably not great for a public service.

However, Comentario is a updated fork that's being maintained.

[–] [email protected] 2 points 6 months ago

I’ve used https://getgrav.org for a while and it’s been pretty solid.

[–] [email protected] 1 points 6 months ago

If you want a mostly straightforward WordPress-alike that's not WordPress, you probably should at least consider Ghost. I'm using it for my blog and it's got a slightly weird focus on "paid blog members", but it's super solid and doesn't have a multi-decade history of endless security problems.

And, soon, it'll be a happy member of the Fediverse.

[–] [email protected] 1 points 6 months ago (1 children)

If you want to add something to your website then you're already running WordPress, no?

[–] [email protected] 1 points 6 months ago

No, I haven't added nothing. I was going code a basic html 5 page but I wanted a blog like atmosphere, since the website is all about my writing.