{"id":37,"date":"2005-08-15T21:18:07","date_gmt":"2005-08-15T19:18:07","guid":{"rendered":"http:\/\/blog.blackdown.de\/2005\/08\/15\/more-on-security-announcements\/"},"modified":"2016-10-29T03:51:02","modified_gmt":"2016-10-29T01:51:02","slug":"more-on-security-announcements","status":"publish","type":"post","link":"https:\/\/blackdown.de\/articles\/more-on-security-announcements\/","title":{"rendered":"More on Security Announcements"},"content":{"rendered":"

Some people seem to misunderstand what I said<\/a> about the latest WordPress update.<\/p>\n

I, myself, am perfectly able to figure out what was broken and how it was fixed. That’s not the point. I was commenting on the handling of security announcements by the WordPress developers.<\/p>\n

I expect to get information about security issues from a central, easy-findable place from any project or product that has public exposure and more than a handful of users. (Yes, I expect that from open source projects too. Look around the net to see how good others handle it.)
\nExpecting your users to gather information about a problem from forums, blogs, foreign sites, or the source code is simply unprofessional.<\/p>\n

The often used argument that more specific information only helps hackers is just plain na\u00efve: WordPress is open source, its code and even nicely formatted svn changesets are freely available on the web. Hackers are not stupid, they’ll find the issues.<\/p>\n

Note, I’m not saying you should post sample exploits publicly. Just give enough information that administrators can determine whether their systems are vulnerable and how severe the problem is. Again, go around the net and look how other projects handle security announcements.<\/p>\n","protected":false},"excerpt":{"rendered":"

Some people seem to misunderstand what I said about the latest WordPress update. I, myself, am perfectly able to figure out what was broken and how it was fixed. That’s not the point. I was commenting on the handling of security announcements by the WordPress developers. I expect to get information about security issues from
[→ Read the rest of this entry<\/a>]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"spay_email":"","jetpack_publicize_message":"","jetpack_is_tweetstorm":false,"jetpack_publicize_feature_enabled":true},"categories":[8,20],"tags":[],"yoast_head":"\n\n\n\n\n\n\n\n\n\n\n\n\n\t\n\t\n\t\n