The problem with this argument is simple: to stay secure, you have to keep WordPress core current with updates. And the only way to apply updates is for an administrator to apply them, either through the admin backend or directly through the filesystem.
The vast, vast, vast majority of WordPress users are not that diligent about doing this, and their hosts don't do it for them. So they just sit on whatever version they happened to be running when they first set up the site for years. I do a lot of consulting work on WP sites and see this all the time.
So while I would be the first to agree that the WP core team has gotten much, much better about writing secure software, until there's a way for that software to stay secure when used as average users use it, it will never be truly secure.
There is a market for WP hosts who will take this administrative burden on for you in exchange for costing you more -- WPEngine is a big player in that market. But I'm at the point now where I think the only way forward is for WP to just update itself automatically when updates are released, no user intervention required. It's not acceptable for security to be something you only get from a few high-priced hosts; most people will never use those hosts. It needs to be secure for everybody, including those who run it on commodity shared hosting run by semi-competent admins, as long as "runs great on commodity shared hosting run by semi-competent admins!" is a selling point for the software.
EDIT: They illustrate this problem right in the post!
"WordPress users must be responsible for their own security, maintain strong Passwords, and keep plugins and themes up to date, as well as WordPress itself."
How many decades of experience with non-technical users will it take to get us to understand that they just don't do that stuff? They don't maintain strong passwords. They don't run updaters. All that stuff that the post puts on their shoulders, is stuff we know for a fact that many (most?) of them will never even think of doing.
If you know that's the audience for your software, and you don't design it to be secure when used as you know that audience will use it, the responsibility for the eventual hacks are as much yours as theirs.
Having to keep up with an continuous stream of patches is not a property of a secure system. "Secure as long as you keep it patched" is a bar that almost any piece of software can clear.
Yes, this is my point exactly. Except much more succinctly stated :-D
In WP's defense, though, it is not the only blog/CMS product that works this way -- the vast majority I've used require some kind of user or admin interaction to apply updates, mostly to avoid people complaining if an update should break something. And WP's update process is much easier and friendlier to non-technical users than most are.
But in practice that turns out not to matter much, because no matter how easy making that intervention is, some percentage of users are going to skip it. The only way to get around that is to not require the interaction at all. That may risk breaking some stuff, but I'd rather work in an ecosystem where everybody's secure and poorly written extensions break occasionally than one in which poorly written extensions never break at the cost of security.
this is actually a pretty cogent argument. how do you apply this logic to other systems and software?
for example, we know that running an old version of OSX is not too bad. But if you're still running 10.4 instead of 10.4.3, you're in for some trouble.
when there is a security patch to a specifc X.Y release OSX or Windows, (like X.Y.Z) it's not secure to leave that running. the same would apply to any other piece of software (like WordPress), no?
Pretty much, yeah. Any software that is exposed to the public Internet needs to be kept up to date. If it's not, it's not secure. That means either someone has to update it, or it has to update itself.
The world has been moving slowly away from manual updates to automated ones for some time now. Windows Update used to be much more oriented towards manually reviewing and applying updates than it is today. Chrome famously updates itself completely silently, and Firefox is moving in that direction. Consumer-oriented products are all headed that way, because it's the only way to keep them secure when their "administrator" is a non-technical user.
WP is kind of unique in that it's a type of software (a content management system) that usually is only installed and administered by people with some technical experience, but the ease of installing WP has attracted a huge number of people without that experience to use it. So my argument would be that as WordPress has essentially become a consumer product, it should behave like one.
Comments
The problem with this argument is simple: to stay secure, you have to keep WordPress core current with updates. And the only way to apply updates is for an administrator to apply them, either through the admin backend or directly through the filesystem.
The vast, vast, vast majority of WordPress users are not that diligent about doing this, and their hosts don't do it for them. So they just sit on whatever version they happened to be running when they first set up the site for years. I do a lot of consulting work on WP sites and see this all the time.
So while I would be the first to agree that the WP core team has gotten much, much better about writing secure software, until there's a way for that software to stay secure when used as average users use it, it will never be truly secure.
There is a market for WP hosts who will take this administrative burden on for you in exchange for costing you more -- WPEngine is a big player in that market. But I'm at the point now where I think the only way forward is for WP to just update itself automatically when updates are released, no user intervention required. It's not acceptable for security to be something you only get from a few high-priced hosts; most people will never use those hosts. It needs to be secure for everybody, including those who run it on commodity shared hosting run by semi-competent admins, as long as "runs great on commodity shared hosting run by semi-competent admins!" is a selling point for the software.
EDIT: They illustrate this problem right in the post!
"WordPress users must be responsible for their own security, maintain strong Passwords, and keep plugins and themes up to date, as well as WordPress itself."
How many decades of experience with non-technical users will it take to get us to understand that they just don't do that stuff? They don't maintain strong passwords. They don't run updaters. All that stuff that the post puts on their shoulders, is stuff we know for a fact that many (most?) of them will never even think of doing.
If you know that's the audience for your software, and you don't design it to be secure when used as you know that audience will use it, the responsibility for the eventual hacks are as much yours as theirs.
Having to keep up with an continuous stream of patches is not a property of a secure system. "Secure as long as you keep it patched" is a bar that almost any piece of software can clear.
Yes, this is my point exactly. Except much more succinctly stated :-D
In WP's defense, though, it is not the only blog/CMS product that works this way -- the vast majority I've used require some kind of user or admin interaction to apply updates, mostly to avoid people complaining if an update should break something. And WP's update process is much easier and friendlier to non-technical users than most are.
But in practice that turns out not to matter much, because no matter how easy making that intervention is, some percentage of users are going to skip it. The only way to get around that is to not require the interaction at all. That may risk breaking some stuff, but I'd rather work in an ecosystem where everybody's secure and poorly written extensions break occasionally than one in which poorly written extensions never break at the cost of security.
this is actually a pretty cogent argument. how do you apply this logic to other systems and software?
for example, we know that running an old version of OSX is not too bad. But if you're still running 10.4 instead of 10.4.3, you're in for some trouble.
when there is a security patch to a specifc X.Y release OSX or Windows, (like X.Y.Z) it's not secure to leave that running. the same would apply to any other piece of software (like WordPress), no?
Pretty much, yeah. Any software that is exposed to the public Internet needs to be kept up to date. If it's not, it's not secure. That means either someone has to update it, or it has to update itself.
The world has been moving slowly away from manual updates to automated ones for some time now. Windows Update used to be much more oriented towards manually reviewing and applying updates than it is today. Chrome famously updates itself completely silently, and Firefox is moving in that direction. Consumer-oriented products are all headed that way, because it's the only way to keep them secure when their "administrator" is a non-technical user.
WP is kind of unique in that it's a type of software (a content management system) that usually is only installed and administered by people with some technical experience, but the ease of installing WP has attracted a huge number of people without that experience to use it. So my argument would be that as WordPress has essentially become a consumer product, it should behave like one.