Comment by acdha | Hacker News Reader

Comment by acdha | Hacker News Reader

Parent Full thread

> I don't know what the dynamics are for WordPress plugin developers to write this much vulnerable code, but WordPress itself has had very few vulnerabilities over the years.

I think it’s a microcosm of the larger PHP problem: it’s a language and environment which is really easy to get started with, but requires significant skill and experience to use safely. The core developers of both have made some improvements but the community culture still has room to go and there’s a huge discoverability / training gap for all of the people who are just getting started — WordPress is incredibly popular so there’s a constant stream of people who just want to change their site and haven’t thought about all of the different angles for attack.

WordPress's problems have nothing at all to do with PHP. WP is currently lagging PHP best practices by about a decade. You could in theory swap all the PHP out for, I dunno, Ruby, and if the WP architecture didn't change then it would still have all the same problems.

A decade is being kind of generous. But your comment is spot on.

That's definitely not true in the sense that PHP, even in the latest versions (much less the versions most servers run), still has a lot of the fast-and-lose culture around correctness and things which are pretty uncommon outside of PHP these days such as putting files in a webroot where they're accessible to the world unless you remember to specifically prevent that and do so perfectly, and the endemic problems around aggressive type coercion or optional error handling. In our hypothetical swap for Ruby, Python, etc. those classes of error would either disappear completely or become much less common.

More importantly, however, note that I mentioned the cultural components: people learn bad habits from all of the old tutorials and tons of low-quality code floating around, and there isn't a culture of aggressively correcting that. The half-life on that stuff is a lot longer than the time it'll take to get people to upgrade to PHP 8, especially when more people got some Facebook-style “move fast and break things” ideas without the “… use linters and write tons of tests so you can ship that often” part.

Reply on news.ycombinator.com