In defense of WordPress

WordPressThere’s a lot of negative talk circulating regarding the security attacks currently underway against outdated versions of WordPress. One of the most outspoken critics, not without cause, is one of my favorite bloggers: John Gruber of Daring Fireball.

That Gruber is loyal to Movable Type perhaps influences (despite his claims to the contrary) the tone of his assessment of the situation. And, I’m sure, my loyalty to WordPress influences my assessment of it as well. WordPress is not Apple, but I hold both in perhaps unduly high esteem.

That said, there are easy (or, at least, prudent) steps one can take to keep WordPress secure against this attack. Also, security is not the only (nor, dare I say, anywhere near the most important) factor in selecting a blogging platform. I’ve worked a fair bit with Movable Type, and while I can’t speak to the relative security of the two applications, I definitely can speak to their relative ease of use, and in that regard, I see no comparison: WordPress is surprisingly consistent and intuitive, given its open source nature and the large size of its developer community, whereas Movable Type seems to live in its own world where up is down, left is right, files are assets, and you need to rebuild the site every time you change anything. (Caching, if it’s even necessary, should be invisible to the user.) And then there’s the proprietary markup language.

It is unfortunate, and a weakness of the system, that WordPress has come under attack in this fashion. I’m glad that the latest version, at least, is immune to this exploit. But to dismiss WordPress because of this seems to grossly miss the point. And, debate this if you like, I do believe that if you’re not prepared to keep your installation updated, you shouldn’t be hosting the site yourself anyway. Use WordPress.com — it’s free, and it’s always up-to-date. The biggest victims here, I fear, are site owners who have relied upon an apathetic hosting provider to manage their system, and whose sites have been left vulnerable through no fault of their own.

All of the room34.com sites are running 2.8.4, and none has fallen victim to these attacks. But this incident did inspire me to take an action I had been neglecting — last night I dug into my httpd.conf file, shuffled a bunch of directories around on the server, and consolidated all five of the WordPress sites I’m running down onto a single installation of the software, so from now on I’ll only need to update once instead of five times. I probably could have migrated to WordPress MU, but it was an interesting experiment to take the approach I did, and it allowed me to avoid having to merge databases.

Network Solutions: You’ve spoken. We’ve listened. We’re just idiots.

OK OK, Network Solutions. Don’t get your nsUndies* in a bunch. (*You’ll get that joke in a minute.) I’m still a diehard Network Solutions supporter, recommending all of my clients go with you instead of the sleazy likes of GoDaddy, despite your considerably higher prices. (My argument is, if you’re willing to spend thousands of dollars on a website project, why not spend an extra $25 on a better domain registrar?)

Anyway… just because I recommend you, doesn’t mean I will refrain from criticizing this: today I logged into my Network Solutions account to make some changes to my own DNS configuration, and I was confronted with the following ghastly announcement…

Network Solutions has listened, apparently.

What? Someone actually told you “I don’t understand what ‘Web Site’ means. Can you please call it something more obvious? Like, maybe, ‘nsBusinessSpace’? Yeah, that would be great.” Well, OK, maybe someone like Bill Lumbergh would think that. But he’s not really human.

I’ve seen something like this before, though. In fact, I’ve blogged about it before. But with Microsoft, it almost, just barely, managed to seem like they were in on the joke.