Hacker News Reader

Comment by habibur | Hacker News Reader

answers, "why you should write your own framework, if you have the knowledge and time."

Definitely not. Wordpress plugins are the source of exploits in the Wordpress ecosystem -- it's very very rarely the Wordpress core itself.

And it's almost always older versions of plugins that are vulnerable; however, at some point a plugin update will break the website and then you don't upgrade because there's more important things to do ...

It's the dependency loop of Wordpress really - people can't update the core because their plugins don't work with new core (yet, sometimes never), so their (outdated) core remains an exploit.

Not strictly a Wordpress issue, this happens with any CMS that allows third party modules (Drupal, for one, as I know from direct experience).

Yes, though the plugin system itself has really no rails at all. Any plugin can do anything.

The core main task is execute millions of actions/hooks offered without any control to be exploited by plugins. So "not hacking the core of wp" is really "hacking the core of wp"

Well, I would argue that one should write a web framework if he/she wants to do so. There is no other reason really.

Running anything on the web has risks, some more than others. Likewise, there are tradeoffs to any given plan.

Wordpress itself isn't some terrible thing, but an outdated version with 100+ plugins that is poorly administered is likely to be an unauthenticated root shell that happens to also function as a website. This is true of any web framework though.

Reply on news.ycombinator.com