As someone who has just spent the last two weeks attempting to secure and standardize a WordPress install, my sincerest condolences to Wi...
As someone who has just spent the last two weeks attempting to secure and standardize a WordPress install, my sincerest condolences to Wired's system administrators. WordPress has achieved the complexity promised by Zawinski's Law, and is a true nightmare to attempt to secure. Not only do you have software which writes its own full URLs (including the scheme), you have software which checks and optionally triggers a built-in cron with every request, one PHP file which rules them all, an average of four cookies for every visit (which messes with some caching attempts), a mish-mash of JS and CSS files, static assets spread throughout the wordpress base, every plugin, and every theme, executable PHP in the DB... It can even install its own plugins, if you give it the credentials to FTP to the server which hosts it. I'm glad this project is nearing its completion. The promises made by Wordpress to content creators is backed by the nightmares of system administrators. Zawinski's Law: “Every program attempts to expand until it can read mail. Those programs which cannot so expand are replaced by ones which can.” EDIT: Dear WordPress Sysadmins: You still have some work to do in securing your site. For example, I can tell just from your headers that you're running on Apache 2.4.6, on PHP 5.6.6, and using Varnish 4 as your caching mechanism from your somewhat verbose headers. Good luck!
Posted by falcolas on Mar 2, 2015, 3:26 PM
Tags
Related issues
- Qt is fully of bugs on Wayland, some of which are unfixable because the API makes guarantees that are impossible to uphold.
- I took the plunge into GrapheneOS a week ago.
- [FEATURE] Multi-device Cowork: Allow concurrent Cowork agents on multiple machines under a single account
- [BUG] Claude Desktop spawns 1.8 GB Hyper-V VM on every launch, even for chat-only use
- Those cheap Bluetooth Tesla coils on AliExpress use A2DP audio as their control signal - a comparator converts the audio into spark pulses.
- [Prisma 7.0.0] TypeScript TS2742 errors with pnpm monorepo - cannot resolve @prisma/client-runtime-utils types
Raise real-world problems, find people facing the same issue, and discuss solutions.7,500 issues0 comments
onboarding (SaaS)
Qt is fully of bugs on Wayland, some of which are unfixable because the API makes guarantees that are impossible to uphold.
I took the plunge into GrapheneOS a week ago.
[FEATURE] Multi-device Cowork: Allow concurrent Cowork agents on multiple machines under a single account
[BUG] Claude Desktop spawns 1.8 GB Hyper-V VM on every launch, even for chat-only use
Those cheap Bluetooth Tesla coils on AliExpress use A2DP audio as their control signal - a comparator converts the audio into spark pulses.
[Prisma 7.0.0] TypeScript TS2742 errors with pnpm monorepo - cannot resolve @prisma/client-runtime-utils types
I built a routine management app for my kids (7 and 10) called "Oh Yah!" after their constant "Oh yah!
> If it is open source, then I can build and install it myself.
As someone who has just spent the last two weeks attempting to secure and standardize a WordPress install, my sincerest condolences to Wi...
As someone who has just spent the last two weeks attempting to secure and standardize a WordPress install, my sincerest condolences to Wired's system administrators. WordPress has achieved the complexity promised by Zawinski's Law, and is a true nightmare to attempt to secure. Not only do you have software which writes its own full URLs (including the scheme), you have software which checks and optionally triggers a built-in cron with every request, one PHP file which rules them all, an average of four cookies for every visit (which messes with some caching attempts), a mish-mash of JS and CSS files, static assets spread throughout the wordpress base, every plugin, and every theme, executable PHP in the DB... It can even install its own plugins, if you give it the credentials to FTP to the server which hosts it. I'm glad this project is nearing its completion. The promises made by Wordpress to content creators is backed by the nightmares of system administrators. Zawinski's Law: “Every program attempts to expand until it can read mail. Those programs which cannot so expand are replaced by ones which can.” EDIT: Dear WordPress Sysadmins: You still have some work to do in securing your site. For example, I can tell just from your headers that you're running on Apache 2.4.6, on PHP 5.6.6, and using Varnish 4 as your caching mechanism from your somewhat verbose headers. Good luck!
Comments (0)
No comments yet. Start the discussion.