Thread

1. zelphirkalt · 1790100372 · focus · HN ↗

   These are the reason, why every easily reachable web server will be spammed with /something/something.php?somearg=someval. If I had to guess, which software on the web has been the most exploitable over all of the web's history, WP would surely be among the top candidates. Maybe right after MS Teams or Sharepoint or some stuff like that.

   1. toyg · 1790103296 · focus · HN ↗

      TBF, some of it is structural: if you're the most popular anything on the internet, you'll be the most attacked and the most exploited, and hence the most exploitable.

      1. 0xbadcafebee · 1790183261 · focus · HN ↗

         Most attacked, sure. Most exploited? You get out of it what you put into it. If you work to make it more secure, it will stay more secure, popular or not.

         WordPress is a software design from the early 2000's - and not a particularly good example. Even back then there were more secure designs.

         Take QMail for example. A simple design, it had security baked in from the start, and remains one of the most secure software packages in history. This exploit would have been prevented if WordPress had followed QMail's security designs. Enforced data flow, avoidance of parsing, eliminating untrusted code, and eliminating bugs by choosing code paths with fewer variables, would've all prevented this bug.

         DJB wrote a paper on QMail[1] to try to explain what worked and what was unnecessary. Anyone implementing new software (and wants it to be secure) should consider these [and other] design points. Popular software doesn&#x27;t have to be bad software. [1] <a href="https:&#x2F;&#x2F;cr.yp.to&#x2F;qmail&#x2F;qmailsec-20071101.pdf" rel="nofollow">https:&#x2F;&#x2F;cr.yp.to&#x2F;qmail&#x2F;qmailsec-20071101.pdf

Unofficial Hacker News client; not affiliated with Y Combinator.