@Viper007Bond - Hobbyists or people with too much time on their hands may follow every change in SVN but anyone trying to keep track of development needs to follow trac, the developers blog, the dev site on wordpress.com, and the hackers mailing list. That might work for people like you and me, but it doesn't work for most users.

I think its arrogant of any of us to say why people use WordPress or how they use it. Most of those who are interested in following/contributing to WordPress development only ever hear back from a teeny percentage of users. Fact is, people use it for all kinds of reasons, including the fact that its open source code that can be modified however they want. People do hack the core code - whether they should or not is moot.

WordPress updates aren't updates - they are full installs that just happen to be able to be applied to an existing site. If the database isn't changed then its only files. Security releases usually only change a file or two so why can't these be distributed as patches for existing installs? If one line is changed, why can't the codex show this? It's a lot easier for anyone who can't run the update as they can then manually change the line(s) and be assured that their core code is as secure as possible given current knowledge of vulnerabilities.

But, hey, let's get off this "Elpie - you..." thing eh? My comments were based on feedback I get and from interaction I have with others running WordPress sites. None of which apply to me or my own sites. I do manage sites for others that cannot upgrade (for one or more of the reasons I gave) and each of those is as secure as possible. Each also had a line or two of core code changed to match the security fixes plus the addition of the current_user_can check to all applicable admin files. (This is actually one example of why core files get hacked too, because the core could be more secure but current_user_can() is only used in a few files atm).

IMO, this latest round of attacks is an opportunity to look at what works and what doesn't work for WordPress users. Shame if the blame game gets any worse.