Hacker News Reader

Comment by chaosprophet | Hacker News Reader

>If you listen to the WordPress people, the answer to this is 'be extremely zealous about updating your software', which is the same as saying, devote half your life to learning and understanding WordPress administration.

Apparently this person has not used a recent build of Wordpress.

View on HN

But they've got a point. Even if it takes "only 10 minutes" to upgrade, there have been so many new versions and so many security issues that it gets kind of old after a while. Especially if you have multiple sites all running it.

  svn update

Not a complex command to run! I hear there are these things called cronjobs too, so you don't even have to run it yourself. Just pick the latest stable branch and svn switch when a new major version comes out.

That makes sense in theory, but our company has dozens of WordPress sites. Once you have more than a few, managing software and plugin versions becomes exponentially more challenging.

I'm in the process of upgrading all of them to 2.8.4 and installing the necessary plugins and params in the config file so they can all be "auto updated" in the future. I plan on having my VA manage them from there.

However sometimes strange things happen - for example, I auto upgraded one of our sites the other day and the whole thing broke and only rendered a blank page, so it's entirely possible my VA will break one or more sites even using the auto upgrade functionality.

I was going to post the very same thing. I went from 2.6 to the latest version in about 10 minutes, at least half of which was downloading the update, the pushing it up to the server.

Obviously not. Otherwise he would have known about WordPress' automatic upgrade feature: http://codex.wordpress.org/Upgrading_WordPress

Plugins can also be upgraded with a single click.

The recommended procedure for "automatic" upgrades, as described on that page, is to back up your entire database and disable all plugins beforehand.

Not as bad as phpBB's "automatic" upgrade, which gives you a tar-ball of changed files which you're supposed to unpack...

Exactly. I give WP a lot of credit since it's the only web application I know of that can be upgraded from its own interface without the need to ever login to a shell or manually FTP files to the server.

That's what I love about WP. Joomla 1.6 (about to go into Beta) also has this feature as a built in component (which is also installable to Joomla 1.5.

When I read the article right at the first paragraph I was appalled. Quote: "...devote half your life to learning and understanding WordPress administration..." Really? Half your life to learn how to click ONE link? I don't get it, has the author here never even upgraded Wordpress?

Call me crazy if you like, but I'd never use a webapp that has that feature. It just opens you up to more potential security problems. For example, it appears to operate over in-the-clear HTTP. Poisoning someone's DNS cache and then somehow triggering an "upgrade" = changing their software to whatever I want.

Also, "Note that your files all need to be owned by the user under which your Apache server executes, or you will receive a dialog box asking for "connection information," and you will find that no matter what you enter, it won't work." That's a security no-no if I've ever seen one.

That should take, at most, a few additional clicks, since plugins can be disabled en masse and databases can be backed up with another plugin (or done automatically at the server).

It's WP's fault that he's not aware of how much easier it is update current releases, not his.

I would disagree. If he had done the update then it would have been obvious how easy it is becoming with each release.

Reply on news.ycombinator.com