Hacker News new | past | comments | ask | show | jobs | submit
pmlnr | on: We have a year to fix security everywhere
Here's an idea: as a first step, simplify everything, and make sure you're aware how your stack works, and what it imports.

As an example: WordPress is a horrible thing, but the core has been through so much, that it's suprisingly secure. Then plugins and themes come, and whoosh, the security is gone.

We need a new KISS: keep it simple, stupid, secure.

mirashii | parent | next
The "surprisingly secure" WordPress just had a unauthenticated RCE earlier this year. Just simplifying isn't going to be enough.

https://nvd.nist.gov/vuln/detail/cve-2026-63030

ricardobayes | root | parent | next
If that's your benchmark for being unsecure, then React is unsecure too.

https://react.dev/blog/2025/12/03/critical-security-vulnerab...

mirashii | root | parent
I would put both of those projects in the category of things I wouldn't call remarkably secure, yes.

To be remarkably secure, these projects would need to not have these kinds of defects, despite the combination of being written in languages have that have a long track record of footguns and lack of initiatives to fix them (proposal-symbol-proto, and PHP's list is too long to even start) and being themselves ecosystems with questionable track records on security in the related areas (Look at $wpdb in 2026, or overall code quality and willingness to modernize, or the entirety of the model of RSC for things that are just going to nearly guarantee you punch all kinds of holes on accident).

wolvoleo | root | parent | next
WordPress and secure don't go together in the same sentence.

I mean the base is fairly secure if you religiously update it, but the problem is you won't avoid using plugins whose security is much more hit and miss, unless you are using the most basic blog site imaginable.

pmlnr | root | parent | next
"First step"

Nobody said it's enough, but it's a start.

spiderfarmer | root | parent
Plus, how secure are the plugins?
m_mueller | root | parent
WP plugins are why I banned it everywhere. Last time I used it was many years ago, so not sure it still applies, but back then even caching was done in a plugin, without which it was unusably slow… just no.
tokioyoyo | parent | next
The reason is simple - nothing really bad has happened that we can point at and say "ah, shit, let's all learn collectively". I know it sounds naive when I say it, but there hasn't been a significantly consequential hack, leak, destruction, or anything related to cybersecurity where it led for concerns of people.

The main thing I can think of is cyber insurance, which requires a bunch of audits, and some checks maybe, and it changes some conditions whenever there's a big explosion. Whenever big leaks happened, data security and etc., nobody really went to jail, so nobody really cares. Everything can be brushed off, because it costs time to implement proper measures and adds friction / barriers in some cases. So in the end, there's a huge pushback against it. And I totally get it, to be honest.

loading story #49606359
loading story #49606236
Helmut10001 | parent | next
Static sites all the way (hugo, jekyll, mkdocs!). No one needs wordpress. There's even Sveltia or DecapCMS now, to give those WYSIWYG-people access to static site editing. Then, remove PHP and all the dependency overhead and attack surface and you have a stripped down nginx that is pretty simple, minimalistic and bulletproof.
loading story #49606497
loading story #49607389
Cthulhu_ | parent | next
> as a first step, simplify everything, and make sure you're aware how your stack works, and what it imports.

We've been trying that for years but the enthusiasm of developers and the eagerness of their employers fight against it. Worse, with coding LLMs it's now easier than ever to output a lot of code, fast.

It'll ultimately be up to more experienced developers to salvage these projects. Or not, given that the coding LLMs aren't stopping and will likely get better over time. Either way, we will need experienced people that know what to look out for / know how to instruct LLMs to output secure code and find weaknesses etc.

crotobloste | parent | next
> We need a new KISS: keep it simple, stupid, secure.

Maybe KISSASS: "keep it simple, stupid! also secure, stupid!"

bob1029 | parent | next
Minimization of 3rd party dependencies has always been a key for risk reduction. Now more than ever before.

Some stacks make this a lot easier than others. I regret the rules of HN effectively forbid this conversation because it has meaningful technical consequences and isn't purely about ideological flame war.

anilakar | parent | next
Probably nine out of ten Wordpress sites do not need active content. Why are we not rendering static copies and serving them to customers?
Gigachad | parent | next
This is not at all easy though. Most Wordpress users are not software companies. They contract some work out to set it up, maybe some recurring maintenance but they don’t have in house development experience.

If they have a site existing today built on plugins and a theme, how are they realistically going to simplify this? How would they even know they need to without the site being hacked?

zdc1 | parent | next
The problem is that lots of people don't want a CMS, they want a platform for development / e-commerce / bookings / whatever. Enforcing vanilla WordPress would push people towards other platforms. Now that could be a good thing, but I doubt WordPress are going to start killing their own marketshare with usage restrictions like that...
jonwinstanley | parent | next
Wordpress without any plugins is kinda useless. Best to completely avoid using it, there are better options
dakolli | parent
More and more people everyday become convinced, mostly because of AI take sellers/grifters, that needing to understand your stack is unnecessary. This problem is about to get way worse.