310
this post was submitted on 25 Jun 2024
310 points (99.1% liked)
Technology
58108 readers
3976 users here now
This is a most excellent place for technology news and articles.
Our Rules
- Follow the lemmy.world rules.
- Only tech related content.
- Be excellent to each another!
- Mod approved content bots can post up to 10 articles per day.
- Threads asking for personal tech support may be deleted.
- Politics threads may be removed.
- No memes allowed as posts, OK to post as comments.
- Only approved bots from the list below, to ask if your bot can be added please contact us.
- Check for duplicates before posting, duplicates may be removed
Approved Bots
founded 1 year ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
If i were to take a shot every time vulnerabilities are found in the WordPress ecosystem i'd be comatose by now...
I'd guess it's not because of the inherent insecurity of WordPress, but the sheer size of the ecosystem and the fact that like 40% of the Internet is WordPress sites.
And inherent insecurity. It wasn't designed to be secure, it was designed to be full-featured, so it has a pretty big attack surface.
That's the ecosystem. WordPress itself is pretty basic, these things attack plugins, and their often not-very-experienced creators and users. The thing with WordPress is that this kind of vulnerability comes with the problem space, not the particular solution. If there was a different product in the same space, it would not fare better by default.
Also, I'd bet that a ton of CVEs are filed for C++ libraries, yet nobody is harping on about how insecure C++ is.
Exactly. A plug-in architecture is a feature, and it's really hard to secure. Instead of going that route, they should have instead solved specific problems. When you make it easy to add someone else's code, you also make it easy to forget to remove it later, or to not stay updated on which plugins are deprecated/abandoned.
A plug-in system is insecure by design for a public-facing service. YAGNI, so pick a handful of stuff you actually need.
It's not the product, it's the cavalier consumption of unsigned add-ons despite knowing better.
What are alternatives of WordPress if I wanted to add something to my website?
Drupal, but you are getting into a different type of complex symfony code built on years and years of drupalism's. It's powerful and pretty well maintained though.
What are you trying to achieve?
There's a ton you can do, you don't need WordPress just because you want a website. Figure out what you want your website to do, then look for tools to do that.
Just a side note, Commento is kinda dead on the self-hosting front at least as it's been years since an update, which is probably not great for a public service.
However, Comentario is a updated fork that's being maintained.
I’ve used https://getgrav.org for a while and it’s been pretty solid.
If you want a mostly straightforward WordPress-alike that's not WordPress, you probably should at least consider Ghost. I'm using it for my blog and it's got a slightly weird focus on "paid blog members", but it's super solid and doesn't have a multi-decade history of endless security problems.
And, soon, it'll be a happy member of the Fediverse.
If you want to add something to your website then you're already running WordPress, no?
No, I haven't added nothing. I was going code a basic html 5 page but I wanted a blog like atmosphere, since the website is all about my writing.