71–80 of 86 posts
Earlier quoted context omitted.
I've not heard of the problem of a user with id #1 before, can you explain please? What's the issue with a user id #1 when the username is not admin?
if user #1 is still an admin but with a different name you can just go to wpurl/?author=1 and if url rewriting is enabled you'll be redirected to wpurl/author/nicename and nicename is usually equal to the username
Earlier quoted context omitted.
How so? Assuming about 100,000 common words in the English language, with a five word phrase aren't you talking about 10000000000000000000000000 combinations for a dictionary attack to churn through? Even if you narrow it down to phrases that make grammatical sense (which certainly isn't a trivial thing to do algorithmically), you're still talking pretty astronomical numbers, and that doesn't account for the large in…
Have you ever used SwiftKey or Swype on Android? Vaguely the same principles apply here. It actually wouldn't be hard to generate passphrases where you try the most "predictable" phrases first. E.g. if you start your brute-forcing at "my cat" you would try "my cat likes" a long time before you tried "my cat algorithmically". Also, 100,000 common words is a bit more than you would need. If people are plucking words fr…
Earlier quoted context omitted.
Have you ever used SwiftKey or Swype on Android? Vaguely the same principles apply here. It actually wouldn't be hard to generate passphrases where you try the most "predictable" phrases first. E.g. if you start your brute-forcing at "my cat" you would try "my cat likes" a long time before you tried "my cat algorithmically". Also, 100,000 common words is a bit more than you would need. If people are plucking words fr…
Nobody starts brute forcing at "mycat." Even if they somehow knew that's how it started, that barely helps them. They don't know how many other words there are, or what the next one is. Simply because it is more likely to be "my cat likes" does not mean it is now feasible to crack. Without social engineering, that password is not crackable for all practical purposes and is far from a terrible password.
I've used WordPress in the past because it was easy to setup and use. However, given the consistently bad security record I'd love to try something different. Anyone have recommendations for other open source CMS's? Similar functionality to WP is enough - I don't need anything fancy.
It is time for every Wordpress user to consider to switch to Octopress. Static sites have no attack vector, don't need security updates and are faster out of the box. Octopress has importers for many blogging systems including Wordpress: https://github.com/mojombo/jekyll/wiki/blog-migrations P.S.: I have migrated a few days ago myself from Posterous to Octopress. It was a piece of cake.
WordPress
1) Beginner friendly
- One doesn't need to be a coder or mess with cmd to use it.
- Abundance of tutorial(text/audio/video)
- You can host it anywhere, even for free. FTP? I know that from work.
- Hosting provider even install it for you
- Expert support is all over the web
- Drupal and Joomla can't beat WordPress new user adoption, why? They're made to be customized(more developer-centric). Too much option is apparently not good for new user.
2) Features
- Need something? there's plugin for that
- People/visitors loves nice design/layout, WordPress have thousands of themes
- Secure. Attacked by some random ddos/script kiddies? Hosting provider will take care of it. Malicious code? same case.
Static site generator.
1) Beginner friendly
- Yes, at least if you're familiar with cmd.
- Most tutorial suggesting Amazon S3/CDN/cloud etc. Well those service are inaccessible to many.
- Write new post, generate, upload...complicated!
- Lets embed image/audio/video with one-click...nope!
- Lets edit old blog post... oh why art thou so hard
- Lets try it on my phone, nope!
2) Features
- I want to add Facebook comment, how? Read the manual, download that, configure...blabla. No thanks
- Lets add analytics code. Edit template and insert this javascript, save and regenerate...blabla. No thanks
Conclusion : it might be a piece of cake for you but not to most people. Remember "most user are idiot"?. If I want to have simple static blog with nice editor I would use Blogger. Dumping random text? I have pastebin for that. Static site generator sure is attractive but we are just not there yet.
I have a feeling that 'campaign' to promote static site generator to WordPress user is strikingly similar to Windows-to-Linux campaign. It just never going to happen for most user, at this rate.
Just get the Login Lockdown plugin and install it.
2) WP Better Security
3) WPScan (https://github.com/wpscanteam/wpscan)
Should be sufficient for most small/medium installation
Earlier quoted context omitted.
I actually find Wordpress to be much lighter and cleaner than many other CMS systems. It's impressive to me that the code is relatively consistent despite going through years of iterations. I also find the plugin mechanics of Wordpress to be simple to understand. It's got plenty of room for improvement but I think it's got a lot of good qualities too.
It has been consistent, all right. Consistently terrible. For years. Every time I duck under the hood to debug something I always come away stunned and disturbed by the frequent use of globals, the frequent interleaving of different concerns and basically the all-round untraceability of the design as soon as themes or plugins are added. It's horrid. Oh! And there are still no unit or functional tests. And no concept…
It is time for every Wordpress user to consider to switch to Octopress. Static sites have no attack vector, don't need security updates and are faster out of the box. Octopress has importers for many blogging systems including Wordpress: https://github.com/mojombo/jekyll/wiki/blog-migrations P.S.: I have migrated a few days ago myself from Posterous to Octopress. It was a piece of cake.
This is what I think WordPress 1) Beginner friendly - One doesn't need to be a coder or mess with cmd to use it. - Abundance of tutorial(text/audio/video) - You can host it anywhere, even for free. FTP? I know that from work. - Hosting provider even install it for you - Expert support is all over the web - Drupal and Joomla can't beat WordPress new user adoption, why? They're made to be customized(more developer-cent…
> - Most tutorial suggesting Amazon S3/CDN/cloud etc. Well those service are inaccessible to many.
Because you just need to serve static content, there are more options than for Wordpress, incl. Google and Github.
> - Write new post, generate, upload...complicated!
Not at all:
1. Create a new post: rake new_post["title"]
2. Edit using your favorite editor
3. Sync: rake deploy
There are tags for that, i,e, {% img /img/pic01.png %}
> - Lets edit old blog post... oh why art thou so hard
You can edit any post. They are in folders sorted by year and month.
> - Lets try it on my phone, nope!
Correct.
Conclusion: Blogging this way seems complicated, but is isn't if you are really doing it. Please try it for sake of a faster and safer Internet.
Use a two-factor auth plugin like https://wordpress.org/extend/plugins/google-authenticator/ It works with the Google Authenticator app. Duo Security is also good: http://wordpress.org/extend/plugins/duo-wordpress/ The WordPress.com team have already announced two-factor auth support for wp.com blogs, and are working on an official solution for wp.org sites: http://macmanx.com/2013/04/12/two-step-authentication-on-wo…
Simply use five random dictionary words as a password and you are fine. The browser will store then the password easy login. Two-facor auth just adds to complexity, and that is a bad thing when it comes to secutiry. You want to be able to easily understand that a system is secure. The more complex a system is, the larger the likelyhood of a surprise "whoops, I overlooked that" somewhere down the road.
Two-factor auth is not just about rendering dictionary attacks ineffective.
Earlier quoted context omitted.
Nobody starts brute forcing at "mycat." Even if they somehow knew that's how it started, that barely helps them. They don't know how many other words there are, or what the next one is. Simply because it is more likely to be "my cat likes" does not mean it is now feasible to crack. Without social engineering, that password is not crackable for all practical purposes and is far from a terrible password.
No, but we're talking about brute forcing billions of attempts per second, and we're not up against randomness, we're up against "the best pseudorandomness the human brain can muster", so the odds aren't 1 / . A password is severely weakened if it isn't sufficiently random.