• sugar_in_your_tea@sh.itjust.works
    link
    fedilink
    English
    arrow-up
    12
    arrow-down
    2
    ·
    edit-2
    4 months ago

    And inherent insecurity. It wasn’t designed to be secure, it was designed to be full-featured, so it has a pretty big attack surface.

    • maynarkh@feddit.nl
      link
      fedilink
      English
      arrow-up
      13
      ·
      4 months ago

      That’s the ecosystem. WordPress itself is pretty basic, these things attack plugins, and their often not-very-experienced creators and users. The thing with WordPress is that this kind of vulnerability comes with the problem space, not the particular solution. If there was a different product in the same space, it would not fare better by default.

      Also, I’d bet that a ton of CVEs are filed for C++ libraries, yet nobody is harping on about how insecure C++ is.

      • sugar_in_your_tea@sh.itjust.works
        link
        fedilink
        English
        arrow-up
        4
        arrow-down
        1
        ·
        4 months ago

        Exactly. A plug-in architecture is a feature, and it’s really hard to secure. Instead of going that route, they should have instead solved specific problems. When you make it easy to add someone else’s code, you also make it easy to forget to remove it later, or to not stay updated on which plugins are deprecated/abandoned.

        A plug-in system is insecure by design for a public-facing service. YAGNI, so pick a handful of stuff you actually need.