Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

What's new in WordPress 3.7, "Basie"

poststat.us

Post reply on HN
Print view View original

21–29 of 29 posts

Re: What's new in WordPress 3.7, "Basie"

#21

Post by nisa »

e12e wrote: post #18
DigitalSea wrote: post #3

The automatic background updates feature might be the most important feature of all in 3.7. Hopefully this goes a long way to plug some of the rampant security issues that plague the CMS because of failure to update to a later version. The new date querying features are also a welcome addition as it has been notoriously hacky in prior versions querying advanced date values in Wordpress and finally we search has been…

Auto-update? It shouldn't be able to auto-update. It shouldn't have write-privileges to the folders running code! Granted, I generally don't do php, and cerainly not wordpress -- but with all these php projects having a run-once-magically-write-a-config-php-thingy -- they also generally throw a warning if that config is writable after initial setup. Do the chgrp-dance when installing/upgrading: chgrp www-data -R php-…

This is effective but unfortunately there is already malware that plants itself inside the database. If you are able to execute code remotely you can also almost always write to /tmp

Re: What's new in WordPress 3.7, "Basie"

#23

Post by jcutrell »

I for one am very excited about all of the new functions and classes available. http://codex.wordpress.org/Version_3.7 - things like wp_extract_urls() and a WP_Http_Streams class look really exciting.

Not so excited about auto updates, but every site I build is in some kind of version control anyway.

Re: What's new in WordPress 3.7, "Basie"

#24

Post by aaroncampbell »

gregd wrote: post #4
DigitalSea wrote: post #3

The automatic background updates feature might be the most important feature of all in 3.7. Hopefully this goes a long way to plug some of the rampant security issues that plague the CMS because of failure to update to a later version. The new date querying features are also a welcome addition as it has been notoriously hacky in prior versions querying advanced date values in Wordpress and finally we search has been…

Ugh. I'm extremely skeptical of auto-updates. My servers don't auto-update, my workstation doesn't auto-update..nothing I own, auto-updates if it's capable of it. Can anyone tell me if it can be turned off? All I'm seeing is this: For developers there are lots of options around how to control the new updates feature, including allowing it to handle major upgrades as well as minor ones, more sophisticated date query s…

By default it only updates minor releases, which are only used to fix security issues and regressions. So it's only automating the the safest updates, and I think the good it will do by keeping sites secure outweighs the risk.

Re: What's new in WordPress 3.7, "Basie"

#25

Post by snowwrestler »

DigitalSea wrote: post #3

The automatic background updates feature might be the most important feature of all in 3.7. Hopefully this goes a long way to plug some of the rampant security issues that plague the CMS because of failure to update to a later version. The new date querying features are also a welcome addition as it has been notoriously hacky in prior versions querying advanced date values in Wordpress and finally we search has been…

Auto update is itself a security issue because it means the app can overwrite itself.

This is not a security concern with client apps like browsers because they don't run on a publicly listening server. Wordpress does.

Re: What's new in WordPress 3.7, "Basie"

#26

Post by nyordanov »

gregd wrote: post #4
DigitalSea wrote: post #3

The automatic background updates feature might be the most important feature of all in 3.7. Hopefully this goes a long way to plug some of the rampant security issues that plague the CMS because of failure to update to a later version. The new date querying features are also a welcome addition as it has been notoriously hacky in prior versions querying advanced date values in Wordpress and finally we search has been…

Ugh. I'm extremely skeptical of auto-updates. My servers don't auto-update, my workstation doesn't auto-update..nothing I own, auto-updates if it's capable of it. Can anyone tell me if it can be turned off? All I'm seeing is this: For developers there are lots of options around how to control the new updates feature, including allowing it to handle major upgrades as well as minor ones, more sophisticated date query s…

http://make.wordpress.org/core/2013/10/25/the-definitive-gui...

Re: What's new in WordPress 3.7, "Basie"

#27

Post by e12e »

nisa wrote: post #21
e12e wrote: post #18

Earlier quoted context omitted.

Auto-update? It shouldn't be able to auto-update. It shouldn't have write-privileges to the folders running code! Granted, I generally don't do php, and cerainly not wordpress -- but with all these php projects having a run-once-magically-write-a-config-php-thingy -- they also generally throw a warning if that config is writable after initial setup. Do the chgrp-dance when installing/upgrading: chgrp www-data -R php-…

This is effective but unfortunately there is already malware that plants itself inside the database. If you are able to execute code remotely you can also almost always write to /tmp

Yes, but code being written to data areas (or rather, written/stored in such a way that it can/will be executed later) generally is a bug. Allowing a server to overwrite itself is just a bad idea (hence the NX bit for memory).

Re: What's new in WordPress 3.7, "Basie"

#28

Post by pknight »

ChrisNorstrom wrote: post #14

To me Wordpress is one of the most important things to happen to the internet, Not Facebook, not Twitter. Wordpress has democratized creating a site and helped millions of people create an online business, community, blog, helping bring in massive amounts of revenue for small business owners. I've got 4 sites running wordpress: my portfolio, my online store, a design database for items under $50, and a magazine cutou…

I admire Matt a lot. I think Matt would be the first to point out that WordPress is the culmination of a community, from the hundreds and hundreds of contributing developers over the years to the beginner users and everyone in between. I'll bet he has zero fucks to give about how much recognition he personally gets and rightfully so. Or, he might point out that Mike Little co-founded WP.

Besides, the recognition the Dorsey's, Zuckerbergs and even the Jobs of the world get tend to be overstated in comparison to the actual confluence of factors going into their companies successes. By idolizing individuals reality is distorted.

Re: What's new in WordPress 3.7, "Basie"

#29

Post by adnanfasih »

jcutrell wrote: post #23

I for one am very excited about all of the new functions and classes available. http://codex.wordpress.org/Version_3.7 - things like wp_extract_urls() and a WP_Http_Streams class look really exciting. Not so excited about auto updates, but every site I build is in some kind of version control anyway.

I agree on that! I also like the new look of WordPress but the auto update option is not effective for all sites. Specially for developers who don't want to get clear the coding mess after every update.
Post reply on HN