Thread

1. zelphirkalt · 1790100372 · focus · HN ↗

   These are the reason, why every easily reachable web server will be spammed with /something/something.php?somearg=someval. If I had to guess, which software on the web has been the most exploitable over all of the web's history, WP would surely be among the top candidates. Maybe right after MS Teams or Sharepoint or some stuff like that.

   1. reaperducer · 1790104374 · focus · HN ↗

      If I had to guess, which software on the web has been the most exploitable over all of the web's history, WP would surely be among the top candidates.

      People on HN love to talk smack about WordPress. After all these years, it's as much a reflex as shouting "walled garden!" every time there's an Apple story.

      Yet some of the biggest web sites on the internet run WordPress, and more importantly, some of the biggest hacking targets on the internet run WordPress.

      Prime example: whitehouse.gov.

      If you know what you're doing, WordPress fine. The same is true with every other piece of technology out there.

      But people on HN like to lump the good in with the bad because everything is binary.

      1. spogbiper · 1790105476 · focus · HN ↗

         > If you know what you're doing, WordPress fine.

         Probably true, but for whatever reason Wordpress seems to attract an awful lot of people that do not know what they are doing

         1. otherme123 · 1790107577 · focus · HN ↗

            Anecdote: we contracted a web page, and the guy started saying "it would be a Wordpress. It has very bad press, but it's because it is widely used". Ok, we start developing in the latest version of php, and soon he say "we have to go down a couple phpversions, because x pluging don't work in the latest". Requested version had a dozen critical CVEs. Plugin in question did something really basic, like a preview card with OpenGraph data, or something like that. Something a junior could code in a day.

            And that is insecure Wordpress: people lego-mounting sites without touching code, only with plugins.

            1. type0 · 1790110523 · focus · HN ↗

               > And that is insecure Wordpress: people lego-mounting sites without touching code, only with plugins.

               Works as intended, that's why WP has been so popular

               1. yangm97 · 1790111736 · focus · HN ↗

                  Pros: it has a low entry barrier

                  Cons: it has a low entry barrier

      2. nkozyra · 1790105905 · focus · HN ↗

         [dead]

         1. Zak · 1790111096 · focus · HN ↗

            Manual safety or not is a real debate among people who carry pistols for self defense and law enforcement, and no manual safety is the majority position. The reasoning is that an extra step when the user needs the pistol in an emergency is problematic, a properly designed pistol can only fire if the trigger is pulled, and a properly designed holster makes pulling the trigger impossible until the pistol is drawn. Nobody seriously advocates carrying an unloaded pistol for those purposes, and only lunatics advocate having people who don't know what they're doing carry pistols.

            It's not a great analogy to Wordpress, which attempts to provide as much capability as possible in a CMS while requiring as little expertise from the user as possible. Vanilla Wordpress, kept up to date is pretty safe. Plugins are just a click away though, and using plugins safely requires evaluating each plugin's risk profile and track record individually, which is real sysadmin work.

            1. nkozyra · 1790283876 · focus · HN ↗

               I think you've dissected this metaphor more than was necessary.
         2. ImPostingOnHN · 1790121189 · focus · HN ↗

            If the only gun you would choose to have is an unloaded one, you could just not have it, save a few hundred dollars, and lose no marginal utility.
      3. zelphirkalt · 1790106705 · focus · HN ↗

         I think the problem is of another nature:

         People who _don't_ know what they are doing are using WP for every project, that they touch, because it is all they know. Given WPs database design, the assumptions baked into that, and the complications resulting from that, make anything other than a posts and pages website a PITA.

         This in turn requires one to install shitty plugins, or spend time developing a minimalistic solution to each new challenge. With every plugin the attack surface grows, and the vast majority of larger WP sites is this cobbled together mess of WP plugins, having some WP expert trying to make them all work together without stepping on each other's toes, while hopelessly falling behind on updates, because updates could, and _will_ break things.

         People only knowing PHP and WP, try to use WP as a sledgehammer, not realizing that hammer actually being made out of glass. Very few plugins are actually minimalistic, no-bloat, safe, well-developed. Lots of those plugins are 80% marketing fluff and wanting to make a business out of worse than mediocre code bases. That's also due to many people in that community being exactly those, who don't know anything but WP.

         Even normal core WP updates can break the legality of ones site. I have had that at some point, where after some WP update it started loading emojis from a friggin third party, to replace the unicode symbol I had used. I was furious, because this needs to be part of the data protection policies/statements. One does not simply load a third party shit, replacing what the dev actually put there, which was just a unicode symbol. That's an idiotic thing to do. If I wanted third-party emojis, I would have included them myself.

         Finally, some big pages run on WP says not much, given the catastrophic state of many websites. whitehouse.gov is laughably badly made. Another complete failure. The first thing I see that it loads Google tags manager. A government site loading shit.

             fonts.googleapis.com
             googletagmanager.com
             gstatic.com
             parsely.com
         

         All this crap. And this is only what is loaded right out of the box. I haven't even allowed their shitty scripts to run yet.

         And the navigation font is tiiiny. What a horrendous design.

         When I click on some navigation link, it wants to go to:

             https://www.whitehouse.gov/wp-content/uploads/2026/01/Wide_Site_Primary_02.mp4
         

         lol. From nav directly to some mp4 video?? Not a URL of a page, which then would display the video, but a URL directly to a video? Good that my noscript blocked media on that domain!

         If it is a prime example, then it is a prime example of a very shitty made website, by people, who don't know what they should be doing.

         So all this shows is one can make a shitty site using WP. Great. I am sure one can also make a not shitty site using WP. Like you say, _"If you know what you are doing ..."_. Just that most WP people don't. They don't know how to not make a mess, or choose the short-term easy way out, and install tons of shitty plugins. Many of them just have to put things up once initially and are paid, or hold the hand open for some maintenance fee they extract, required only due to how badly made these WP sites are.

      4. imnotr0b0t · 1790120005 · focus · HN ↗

         Yeah, I agree that with the right expertise you can keep WordPress safe, and the White House is a good example of that. But the problem is the WP ecosystem and defaults push people without that expertise to install plugins and themes, and "if you know what you're doing" is the exception, not the rule for its user base
      5. chrismorgan · 1790139075 · focus · HN ↗

         WordPress’s security model is distilled insanity, concentrated vulnerability. You’re supposed to give your site write access to its code, which turns almost any vulnerability into complete and persistent site takeover. Not to mention how many things will store code in the database and execute it from there, and how much of its design is fragile as anything, and how many plugins, often popular ones, do obviously dumb things that would not have been possible in most ecosystems.

         Drupal (also popular in governments and such), by contrast, will check that it can’t write to anything but its designated file uploads directory, and complain if it can, and has careful guidance around avoiding letting uploads be accidentally executable too. The blast radius of the typical vulnerability, and the possibility of persistent takeover, is drastically reduced.

         It’s possible to use C correctly, but in practice using it invites security problems, because it’s frightfully easy to make subtle but disastrous mistakes, even for experts, so there are reasons why people are moving to safe languages.

         WordPress is that kind of bad. It has always been bad, though it’s somewhat less bad than it used to be. Some of its badness is a part of how it got popular.

         1. graemep · 1790158018 · focus · HN ↗

            > You’re supposed to give your site write access to its code

            You do not need to. Its to help people who cannot manage an ssh login update. You can use the cli to update if you can. I am pretty sure big sites will not be doing their updates from the big site.

            The problem with plugins is lack of a proper framework. Its very easy to do things like pass user inputs into a query by strong concatenation because you have to make in extra effort to not do so.

            That said, its no guarantee. I have seen people do things like call exec on user inputs in Django.

            > has careful guidance around avoiding letting uploads be accidentally executable too.

            That should be the default, not something you need to take extra care over.

            1. trollbridge · 1790166284 · focus · HN ↗

               I support plugins for a client that require write access to their homedir that contains their code. They use it to hold temp files!

               I can mitigate the damage a little bit with some chattr +i, but overall, every plugin is another gigantic attack surface.

            2. chrismorgan · 1790175883 · focus · HN ↗

               > That should be the default, not something you need to take extra care over.

               I agree. That’s one of the problems of PHP’s file-based execution model, and how the likes of Apache and nginx work. Drupal is no paragon of security, but it’s far closer than WordPress. For all its faults, even Node.js avoids this class of problem.

Unofficial Hacker News client; not affiliated with Y Combinator.