In reply to Phil.

I have seen this problem in many different fields, completely unrelated to WordPress. It’s a human problem, wanting everything to be simpler than it actually is [Maslow’s 4th level for anyone who cares].

I don’t personally know a single person involved here, but I have a lot of experience evaluating people (>10k) from their writing. From the outside, PV’s writing indicates a very intelligent person who is really frustrated with the current WP Security organizational structure, a structure that is not remotely the best possible.

You see the same problem in big companies, where security is an afterthought instead of being a fundamental part of the design.

I think we can all agree that this needs to be fixed everywhere.

How? For starters, how about being more effective in continuous education of plugin developers in best practices, whatever those are each month, week, or day.

Perhaps a Security Repository of Best Practices? 😁

Second, elevating security in the WP CMS framework code to be on an equal level with developing new features.

It would certainly help me feel better about having my livelihood dependent on WordPress being secure enough.

Click to Edit –

I have seen this problem in many different fields, completely unrelated to Wordpress. It’s a human problem, wanting everything to be simpler than it actually is [Maslow’s 4th level for anyone who cares].

I don’t personally know a single person involved here, but I have a lot of experience evaluating people (&gt;10k) from their writing. From the outside, PV’s writing indicates a very intelligent person who is really frustrated with the current WP Security organizational structure, a structure that is not remotely the best possible.

You see the same problem in big companies, where security is an afterthought instead of being a fundamental part of the design.

I think we can all agree that this needs to be fixed everywhere.

How? For starters, how about being more effective in continuous education of plugin developers in best practices, whatever those are each month, week, or day.

Perhaps a Security Repository of Best Practices? 😁

Second, elevating security in the WP CMS framework code to be on an equal level with developing new features.

It would certainly help me feel better about having my livelihood dependent on Wordpress being secure enough.

SaveCancelDelete