25 Nov
2023
25 Nov
'23
6:24 p.m.
Does anyone else use Docker on their VPS and if so what spec is it running on? I'm
migrating to a new one to upgrade to 64bit and decided to try Docker. It has worked pretty
well on my local servers, none massively powerful, but in spite of being told the overhead
of multiple copies of things isn't much of an impact it seems I have obliterated the
capability of my VPS barely half way through the process, with htop registering both swap
and physical memory maxed out.
I've migrated 8 WordPress sites and had to disable 3 to regain some level of stability
(these using the official WordPress Docker image, which admittedly spins up Apache and
MariaDB for each one). I've decommissioned 2 WordPress sites, but have 7 more to move
(4 of those being in 2 multisite setups) as well as 3 phpBB, 3 Piwigo and a Roundcube, not
to mention email and mailman.
These are low traffic and experimental sites in many cases, but at the moment I'm
debating between reverting to the old setup (possibly an issue as my phpBB sites are
planned to migrate to Discourse which started the Docker idea), or moving the databases
into a single container, and possibly the WordPress sites into a single Apache (which also
part defeats the object of Docker I guess).
I was expecting more load, but not this much. Part way through is not an ideal time,
particularly when I'm still battling COVID two and a half weeks on from catching it
(which isn't helping my thought processes!).
Any thoughts from the collective wisdom here?
Paul Tansom | Aptanet Ltd. | https://www.aptanet.com/ | 023 9238 0001
=============================================================================
Registered in England | Company No: 4905028 | Registered Office: Ralls House,
Parklands Business Park, Forrest Road, Denmead, Waterlooville, Hants, PO7 6XP
25 Nov
25 Nov
6:40 p.m.
On 25 Nov 2023, at 18:25, Paul Tansom via BitFolk
Users <users(a)mailman.bitfolk.com> wrote:
Does anyone else use Docker on their VPS and if so what spec is it running on? I'm
migrating to a new one to upgrade to 64bit and decided to try Docker. It has worked pretty
well on my local servers, none massively powerful, but in spite of being told the overhead
of multiple copies of things isn't much of an impact it seems I have obliterated the
capability of my VPS barely half way through the process, with htop registering both swap
and physical memory maxed out.
I have a couple of VPSs at minimum spec (other than disk space), both running docker in a
swarm. I have about 40 containers running over the swarm very comfortably. With the
exception of a few standard logistical containers (nginx reverse proxy, redis, etc.) the
vast majority are small, specialised micro-services that I have written.
If you are having issues I would suggest it is more likely to be the containers themselves
rather than Docker in general. I don’t run anything like Wordpress.
Regards,
Chris
--
Chris Smith <space.dandy(a)icloud.com>
26 Nov
26 Nov
12:13 a.m.
Hello,
On Sat, Nov 25, 2023 at 06:24:54PM +0000, Paul Tansom via BitFolk Users wrote:
I've migrated 8 WordPress sites and had to disable
3 to regain
some level of stability (these using the official WordPress Docker
image, which admittedly spins up Apache and MariaDB for each one).
I wouldn't expect to have a good time running 8 separate copies of
MariaDB on a small VM.
Docker is basically besides the point - they're just processes
running on your one kernel, just in different namespaces. The normal
complaint about Docker is that it might use a lot more disk space.
One copy of something massive like a DBMS inside each container is
just not sensible unless you enjoy spending money. That needs to be
one MariaDB per host in my opinion.
I'd likely run one MariaDB on the main VM.
Thanks,
Andy
--
https://bitfolk.com/ -- No-nonsense VPS hosting
12:31 a.m.
Hello,
On Sun, Nov 26, 2023 at 12:13:40AM +0000, Andy Smith via BitFolk Users wrote:
I'd likely run one MariaDB on the main VM.
The other thing I'd probably do is run one reverse proxy (e.g.
haproxy) in one container to put in front of all the others so that
it can cache resources for all of them in one place. Otherwise
you've got N copies of Apache (or whatever) each trying to reserve a
bit of memory to cache the resources it is responsible for serving.
It may also be desirable to have the proxy terminate the TLS so that
all happens in one place, too.
But I would not spend any time on that until I'd worked out how to
not run a new copy of MariaDB with every Wordpress site. The whole
thing with a DBMS is that it manages its own chunk of memory and
storage so by running multiple of them it's wasting a lot of
resources and busting your caches when likely the total query load
is small. Just look at all the settings MariaDB has for buffer sizes
- all of those are being multiplied by the number of sites you're
trying to run.
Another thing you might want to think about with Docker is that any
time you need to upgrade the Docker packages it's going to tear
down ALL of your containers to do it. Are you prepared for that
downtime?
Currently the only thing I run in Docker is mastodon but I've seen
MANY package updates to the docker packages on Debian 12 so far, and
each time that happens my mastodon server goes down until Docker has
had chance to restart. I don't care, but I'm the only user.
When you run Wordpress sites conventionally outside of Docker, sure
there might be upgrades to Apache or to MariaDB, but those are
relatively quick and sometimes can take advantage of graceful
reloads so that people may not even notice. Having Docker restart
all containers can take a few seconds. Especially with the way you
have it now - MariaDB is not fast to start!
That's why people who make non-trivial use of containers tend to
want to put them in some sort of orchestration system (e.g Docker
Swarm, k8s, …) across multiple hosts so that they can ensure that
there is a staggered restart. Lots more complexity.
Thanks,
Andy
--
https://bitfolk.com/ -- No-nonsense VPS hosting
5:27 a.m.
Hi Paul,
I made the same move earlier this year – from a 32-bit VPS to full 64-bit, and due to
issues with WordPress sites getting compromised and affecting/infecting each other, I also
decided to move to containerised WordPress instances too (it was actually the driver for
moving to 64-bit, I think Docker needed that or something).
I’ve got 2GB RAM and 30GB storage, so not much more than a standard VPS. I currently run
13 containers on my VPS, which consists of:
- mysql-server (one DB per WordPress site within this, separate users per DB, etc.)
- nginx reverse proxy to terminate SSL and direct incoming hostnames to the correct
container
- pihole + wireguard + unbound for travelling
- portainer for managing my containers (I have two portainer containers, the second one is
used to easily upgrade the first!)
- 6 WordPress containers
- 6 certbot containers, one per WordPress, generally used for first-time cert generation;
otherwise stopped
- 1 certbot-renew container than runs once a month and checks all Lets Encrypt
certificates, renews any that are expiring soon
I’m also using the official WordPress Docker image, I use the wordpress:php8.1-apache
image so that I always get the latest WordPress available, but pin to a version of PHP,
pretty sure I’m not running an instance of MariaDB per WP site with this!
I recently started using Docker compose stacks to manage my containers; the WordPress
sites + nginx + MySQL are in one, the certbots are in another, certbot-renew is in
another, and pihole + vpn is in another. Makes it easy to update/restart/manage different
sets of containers together.
I’ve not had any performance issues with any of my sites or with my VPS in general. Mine
are also generally low traffic I used to run all these WordPress sites directly on the VPS
with Apache virtualhosts before, if anything I’d say it runs better now. According to
htop, I’m using 1.2GB of 1.9GB of RAM, and just over 50% of my 1GB of swap. Load average
is 0 – 0.1 whenever I check.
Happy to share any of my config if it’s helpful.
Cheers,
Paul
From: Paul Tansom via BitFolk Users <users(a)mailman.bitfolk.com>
Date: Saturday, 25 November 2023 at 18:25
To: users(a)mailman.bitfolk.com <users(a)mailman.bitfolk.com>
Cc: Paul Tansom <paul(a)aptanet.com>
Subject: [bitfolk] Docker on VPS
Does anyone else use Docker on their VPS and if so what spec is it running on? I'm
migrating to a new one to upgrade to 64bit and decided to try Docker. It has worked pretty
well on my local servers, none massively powerful, but in spite of being told the overhead
of multiple copies of things isn't much of an impact it seems I have obliterated the
capability of my VPS barely half way through the process, with htop registering both swap
and physical memory maxed out.
I've migrated 8 WordPress sites and had to disable 3 to regain some level of stability
(these using the official WordPress Docker image, which admittedly spins up Apache and
MariaDB for each one). I've decommissioned 2 WordPress sites, but have 7 more to move
(4 of those being in 2 multisite setups) as well as 3 phpBB, 3 Piwigo and a Roundcube, not
to mention email and mailman.
These are low traffic and experimental sites in many cases, but at the moment I'm
debating between reverting to the old setup (possibly an issue as my phpBB sites are
planned to migrate to Discourse which started the Docker idea), or moving the databases
into a single container, and possibly the WordPress sites into a single Apache (which also
part defeats the object of Docker I guess).
I was expecting more load, but not this much. Part way through is not an ideal time,
particularly when I'm still battling COVID two and a half weeks on from catching it
(which isn't helping my thought processes!).
Any thoughts from the collective wisdom here?
Paul Tansom | Aptanet Ltd. | https://www.aptanet.com/ | 023 9238 0001
=============================================================================
Registered in England | Company No: 4905028 | Registered Office: Ralls House,
Parklands Business Park, Forrest Road, Denmead, Waterlooville, Hants, PO7 6XP
9:42 a.m.
Perhaps the sensible approachbis to address the problem: wordpress. I banned it on my
servers many years ago, so I no longer have to update addons all the time tor users who
can't see why they should bother.
Less slickly presented, but faster and more secure is Modx. Give it a try.
On 26 Nov 2023 at 05:27, Paul Lewis via BitFolk Users <users(a)mailman.bitfolk.com>
wrote:
Hi Paul,
I made the same move earlier this year – from a 32-bit VPS to full 64-bit, and due to
issues with WordPress sites getting compromised and affecting/infecting each other, I also
decided to move to containerised WordPress instances too (it was actually the driver for
moving to 64-bit, I think Docker needed that or something).
I’ve got 2GB RAM and 30GB storage, so not much more than a standard VPS. I currently run
13 containers on my VPS, which consists of:
- mysql-server (one DB per WordPress site within this, separate users per DB, etc.)
- nginx reverse proxy to terminate SSL and direct incoming hostnames to the correct
container
- pihole + wireguard + unbound for travelling
- portainer for managing my containers (I have two portainer containers, the second one
is used to easily upgrade the first!)
- 6 WordPress containers
- 6 certbot containers, one per WordPress, generally used for first-time cert generation;
otherwise stopped
- 1 certbot-renew container than runs once a month and checks all Lets Encrypt
certificates, renews any that are expiring soon
I’m also using the official WordPress Docker image, I use the wordpress:php8.1-apache
image so that I always get the latest WordPress available, but pin to a version of PHP,
pretty sure I’m not running an instance of MariaDB per WP site with this!
I recently started using Docker compose stacks to manage my containers; the WordPress
sites + nginx + MySQL are in one, the certbots are in another, certbot-renew is in
another, and pihole + vpn is in another. Makes it easy to update/restart/manage different
sets of containers together.
I’ve not had any performance issues with any of my sites or with my VPS in general. Mine
are also generally low traffic I used to run all these WordPress sites directly on the VPS
with Apache virtualhosts before, if anything I’d say it runs better now. According to
htop, I’m using 1.2GB of 1.9GB of RAM, and just over 50% of my 1GB of swap. Load average
is 0 – 0.1 whenever I check.
Happy to share any of my config if it’s helpful.
Cheers,
Paul
From: Paul Tansom via BitFolk Users <users(a)mailman.bitfolk.com>
Date: Saturday, 25 November 2023 at 18:25
To: users(a)mailman.bitfolk.com <users(a)mailman.bitfolk.com>
Cc: Paul Tansom <paul(a)aptanet.com>
Subject: [bitfolk] Docker on VPS
Does anyone else use Docker on their VPS and if so what spec is it running on? I'm
migrating to a new one to upgrade to 64bit and decided to try Docker. It has worked pretty
well on my local servers, none massively powerful, but in spite of being told the overhead
of multiple copies of things isn't much of an impact it seems I have obliterated the
capability of my VPS barely half way through the process, with htop registering both swap
and physical memory maxed out.
I've migrated 8 WordPress sites and had to disable 3 to regain some level of
stability (these using the official WordPress Docker image, which admittedly spins up
Apache and MariaDB for each one). I've decommissioned 2 WordPress sites, but have 7
more to move (4 of those being in 2 multisite setups) as well as 3 phpBB, 3 Piwigo and a
Roundcube, not to mention email and mailman.
These are low traffic and experimental sites in many cases, but at the moment I'm
debating between reverting to the old setup (possibly an issue as my phpBB sites are
planned to migrate to Discourse which started the Docker idea), or moving the databases
into a single container, and possibly the WordPress sites into a single Apache (which also
part defeats the object of Docker I guess).
I was expecting more load, but not this much. Part way through is not an ideal time,
particularly when I'm still battling COVID two and a half weeks on from catching it
(which isn't helping my thought processes!).
Any thoughts from the collective wisdom here?
Paul Tansom | Aptanet Ltd. | https://www.aptanet.com/ | 023 9238 0001
=============================================================================
Registered in England | Company No: 4905028 | Registered Office: Ralls House,
Parklands Business Park, Forrest Road, Denmead, Waterlooville, Hants, PO7 6XP
_______________________________________________
BitFolk Users mailing list <users(a)mailman.bitfolk.com>
You're subscribed as <iain(a)hairydog.co.uk>
Unsubscribe:
<https://mailman.bitfolk.com/mailman/postorius/lists/users.mailman.bitfolk.com/>
or send an email to <users-leave(a)mailman.bitfolk.com>
9:54 a.m.
On 2023-11-26 09:42+0000, iain via BitFolk Users wrote:
Perhaps the sensible approachbis to address the
problem: wordpress. I
banned it on my servers many years ago, so I no longer have to update
addons all the time tor users who can't see why they should bother.
Less slickly presented, but faster and more secure is Modx. Give it a
try.
Is there a middle ground? What about WordPress on the home computer with
something like https://wordpress.org/plugins/simply-static/ to produce
static files that get copied to the VPS?
Can't beat static generation... but you can go a step further than just
static delivery with something like this that I've been playing around
with, the test results so far look pretty quick:
https://gitlab.com/edneville/gzip-disk
Best regards,
Ed
10 a.m.
This is possibly a good alternative, but it's just another way to paper over the
cracks.
Wordpress is not safe. It should not be used.
On 26 Nov 2023 at 09:54, Ed Neville via BitFolk Users <users(a)mailman.bitfolk.com>
wrote:
On 2023-11-26 09:42+0000, iain via BitFolk Users wrote:
Perhaps the sensible approachbis to address the
problem: wordpress. I
banned it on my servers many years ago, so I no longer have to update
addons all the time tor users who can't see why they should bother.
Less slickly presented, but faster and more secure is Modx. Give it a
try.
Is there a middle ground? What about WordPress on the home computer with
something like https://wordpress.org/plugins/simply-static/ to produce
static files that get copied to the VPS?
Can't beat static generation... but you can go a step further than just
static delivery with something like this that I've been playing around
with, the test results so far look pretty quick:
https://gitlab.com/edneville/gzip-disk
Best regards,
Ed
_______________________________________________
BitFolk Users mailing list <users(a)mailman.bitfolk.com>
You're subscribed as <iain(a)hairydog.co.uk>
Unsubscribe:
<https://mailman.bitfolk.com/mailman/postorius/lists/users.mailman.bitfolk.com/>
or send an email to <users-leave(a)mailman.bitfolk.com>
10:05 a.m.
On Sun, 26 Nov 2023 at 10:00, iain via BitFolk Users <
users(a)mailman.bitfolk.com> wrote:
This is possibly a good alternative, but it's just
another way to paper
over the cracks.
Wordpress is not safe. It should not be used.
A little narrow sighted, Wordpress is extremely secure and as a core
platform it is proactively maintained to what I see has a high standard.
Of course there may be issues with some plugins but those are secondary
choices to Wordpress itself.
Arguably the insecurity you are referring to is that of the system
administrator for not maintaining the local system, if the platform isn't
patched then by the same count debain isn't secure.
10:54 a.m.
On 2023-11-26 10:05+0000, Peter Collins via BitFolk Users wrote:
A little narrow sighted, Wordpress is extremely secure
and as a core
platform it is proactively maintained to what I see has a high
standard.
Of course there may be issues with some plugins but those are
secondary choices to Wordpress itself.
Arguably the insecurity you are referring to is that of the system
administrator for not maintaining the local system, if the platform
isn't patched then by the same count debain isn't secure.
From a DoS point of view any WordPress site with search enabled is going
to be subject to high-load events when someone takes a grudge against
your business.
If you have a limited catalogue of products, I think static generation
is the place to be, is is going to be a faster experience for the user
and you'd handle more reqs/sec until you're at a shopping basket. Better
than nothing.
I'm toying with the idea of putting my static site into WordPress,
offline, and copy the statics. I don't have the time really to make my
site mobile friendly. A random template that's done that for me, bonus
points for markdown, seems a good route.
WordPress does have a reputation for vulnerabilities, but I don't know
how much of that has to be coupled with a sysadmin that sets things up
with poor permissions? How much of that reputation is down to PHP
scripting flaws on the plugin author's part?
Anyway, if the apache module I linked to earlier floats your boat, let
me know - I'm happy with it at the moment :)
Ed
11:07 a.m.
On Sun, 26 Nov 2023 at 10:06, Peter Collins via BitFolk Users
<users(a)mailman.bitfolk.com> wrote:
On Sun, 26 Nov 2023 at 10:00, iain via BitFolk Users
<users(a)mailman.bitfolk.com> wrote:
Agreed.
This is possibly a good alternative, but it's just another way to paper over the
cracks.
Wordpress is not safe. It should not be used.
A little narrow sighted, Wordpress is extremely secure and as a core platform it is
proactively maintained to what I see has a high standard.
Of course there may be issues with some plugins but those are secondary choices to
Wordpress itself. Arguably the insecurity you are referring to is that
of the system administrator for not maintaining the local system, if the platform
isn't patched then by the same count debain isn't secure.
When referring to security risks of Wordpress and previous exploits,
it would be super helpful to share exactly which successful exploits
have been witnessed in the wild.
I'm sure that different Wordpress plugins have wildly different track
records when it comes to security, but it would be great to get an
idea of which ones to avoid, rather than throwing out the baby with
the bath water.
Personally I've run Wordpress with many plugins for years without
incident, but it's always made me a bit nervous.
10:52 a.m.
The reality is that users do not update addons. So the admin has to do it, which is a pain
and good luck with getting paid!
Yes, the core of wordpress is pretty secure (though way too slow).
But that's like saying that guns don't kill people: the bullets that users put in
them are the problem.
On 26 Nov 2023 at 10:06, Peter Collins via BitFolk Users
<users(a)mailman.bitfolk.com> wrote:
On Sun, 26 Nov 2023 at 10:00, iain via BitFolk Users <users(a)mailman.bitfolk.com>
wrote:
This is possibly a good alternative, but it's just another way to paper over the
cracks.
Wordpress is not safe. It should not be used.
A little narrow sighted, Wordpress is extremely secure and as a core platform it is
proactively maintained to what I see has a high standard.
Of course there may be issues with some plugins but those are secondary choices to
Wordpress itself.
Arguably the insecurity you are referring to is that of the system administrator for not
maintaining the local system, if the platform isn't patched then by the same count
debain isn't secure.
_______________________________________________
BitFolk Users mailing list <users(a)mailman.bitfolk.com>
You're subscribed as <iain(a)hairydog.co.uk>
Unsubscribe:
<https://mailman.bitfolk.com/mailman/postorius/lists/users.mailman.bitfolk.com/>
or send an email to <users-leave(a)mailman.bitfolk.com>
11:01 a.m.
On 2023-11-26 10:52+0000, iain via BitFolk Users wrote:
The reality is that users do not update addons. So the
admin has to do
it, which is a pain and good luck with getting paid!
Yes, the core of wordpress is pretty secure (though way too slow).
For any page response that is predictable, I think static generation is
the route. If what the user wants to do falls into the sphere of a
template that doesn't have logins, I urge you to look at generating it
statically. The icing on the cake of course is when 90% of the requests
accept gzip responses.
Anyway. If you don't have time to keep the addons up todate, or the
author of the addon has abandoned it... well, would it have worked just
fine in an offline publication fashion?
But that's like saying that guns don't kill
people: the bullets that
users put in them are the problem.
Well, I fail to have an adequate analogy, but you're right, WordPress is
slow, we all want fast sites, that's how the "supercache" style plugins
exist, but they need write to the DocumentRoot, but that user has been
given a loaded gun at this point. So is WordPress the arms dealer?
Anyway. If anyone has success with WordPress in a static sense, please
follow up... hopefully it handles markdown, I'm open to giving it
another go if I can get the same functionality locally.
Ed
11:08 a.m.
On Sun, 26 Nov 2023 at 10:52, iain <iain(a)hairydog.co.uk> wrote:
> But that's like saying that guns don't kill people: the bullets that users
> put in them are the problem.
Actually what you’re describing is guns don’t kill it’s the person pulling
the trigger.
My point remains, whatever your issues with Wordpress are, to say it
shouldn’t be as it’s just not safe is wrong.
The reality is that users do not update addons. So the
admin has to do it,
which is a pain and good luck with getting paid!
Again that’s not the fault of Wordpress as a platform.
Yes, the core of wordpress is pretty secure (though
way too slow).
That’s subjective
11:14 a.m.
No, people pulling a trigger doesn't kill anyone. It's the impact of the bullet.
Some wordpress addons have security holes. Not all of them. Unfortunately, most users of
Wordpress want to use addons, for good reason.
They don't realise the security implications. It's very hard to know, even for
up-to-date geeks.
The reality is that Wordpress is promoted to the technically semi-literate and is not safe
for those people.
On 26 Nov 2023 at 11:08, Peter Collins via BitFolk Users
<users(a)mailman.bitfolk.com> wrote:
On Sun, 26 Nov 2023 at 10:52, iain <iain(a)hairydog.co.uk> wrote:
_______________________________________________
BitFolk Users mailing list <users(a)mailman.bitfolk.com>
You're subscribed as <iain(a)hairydog.co.uk>
Unsubscribe:
<https://mailman.bitfolk.com/mailman/postorius/lists/users.mailman.bitfolk.com/>
or send an email to <users-leave(a)mailman.bitfolk.com>
The reality is that users do not update addons. So the admin has to do it, which is a
pain and good luck with getting paid!
Again that’s not the fault of Wordpress as a platform.
Yes, the core of wordpress is pretty secure (though way too slow).
That’s subjective
But that's like saying that guns don't kill people: the bullets that users put in
them are the problem.
Actually what you’re describing is guns don’t kill it’s the person pulling the trigger.
My point remains, whatever your issues with Wordpress are, to say it shouldn’t be as it’s
just not safe is wrong.
11:19 a.m.
I think there are a lot of valid points here, but sometimes in reality it’s not as simple
as “banning WordPress from my server” or similar, as the end users maintaining the sites
or updating the content are non-techie, and even with WordPress often struggle to
understand some concepts. I’ve converted my own website to static content to move away
from WordPress, but that’s not easy or possible for everyone.
I suggested using WordPress as an editor and using a plugin to export to static files, and
was met with blank responses. They also couldn't understand that their editor would be
on a different URL to their website, and that changes may take a short while to be
reflected.
Fundamentally, WordPress is the Windows of CMSes, their large install base makes them a
target and to some extent no matter now secure WordPress is, there are so many people
targeting it that vulnerabilities will be found. WordPress accounts for 43% of all
websites on the internet; modx is 0.1%. So it's largely security by obscurity.
My approach is simply that I can't (easily) eliminate WordPress from my life, so
I'll take every precaution to minimise the impact IF it gets compromised. For me,
that's running it in containers and keeping it up to date as best possible.
Kind regards,
Paul
+44 (0) 773 996 2121
Sent from my iPhone. Please excuse brevity, spelling, and punctuation.
________________________________
From: Peter Collins via BitFolk Users <users(a)mailman.bitfolk.com>
Sent: Sunday, November 26, 2023 11:08:11 AM
To: iain <iain(a)hairydog.co.uk>
Cc: Peter Collins via BitFolk Users <users(a)mailman.bitfolk.com>om>; Peter Collins
<bitfolkvps(a)3720.co.uk>
Subject: [bitfolk] Re: Docker on VPS
On Sun, 26 Nov 2023 at 10:52, iain
<iain@hairydog.co.uk<mailto:iain@hairydog.co.uk>> wrote:
The reality is that users do not update addons. So the admin has to do it, which is a pain
and good luck with getting paid!
Again that’s not the fault of Wordpress as a platform.
Yes, the core of wordpress is pretty secure (though way too slow).
That’s subjective
But that's like saying that guns don't kill people: the bullets that users put in
them are the problem.
Actually what you’re describing is guns don’t kill it’s the person pulling the trigger.
My point remains, whatever your issues with Wordpress are, to say it shouldn’t be as it’s
just not safe is wrong.
11:49 a.m.
Yes, Wordpress has a large following. But it is nothing like as much as 45% Maybe 4.5%.
You imply that Modx is only more secure because it is less common.
Firstly, there's no basis for this. There would be exploits if there were holes.
Secondly, security by obscurity IS security. Not ideal, but if it works...
The problem with flat filing Wordpress output is that WP generates second-rate html. OK
it's not Wix awful, but it's not good.
On 26 Nov 2023 at 11:19, Paul Lewis via BitFolk Users <users(a)mailman.bitfolk.com>
wrote:
I think there are a lot of valid points here, but sometimes in reality it’s not as
simple as “banning WordPress from my server” or similar, as the end users maintaining the
sites or updating the content are non-techie, and even with WordPress often struggle to
understand some concepts. I’ve converted my own website to static content to move away
from WordPress, but that’s not easy or possible for everyone.
I suggested using WordPress as an editor and using a plugin to export to static files,
and was met with blank responses. They also couldn't understand that their editor
would be on a different URL to their website, and that changes may take a short while to
be reflected.
Fundamentally, WordPress is the Windows of CMSes, their large install base makes them a
target and to some extent no matter now secure WordPress is, there are so many people
targeting it that vulnerabilities will be found. WordPress accounts for 43% of all
websites on the internet; modx is 0.1%. So it's largely security by obscurity.
My approach is simply that I can't (easily) eliminate WordPress from my life, so
I'll take every precaution to minimise the impact IF it gets compromised. For me,
that's running it in containers and keeping it up to date as best possible.
Kind regards,
Paul
+44 (0) 773 996 2121
Sent from my iPhone. Please excuse brevity, spelling, and punctuation.
From: Peter Collins via BitFolk Users <users(a)mailman.bitfolk.com>
Sent: Sunday, November 26, 2023 11:08:11 AM
To: iain <iain(a)hairydog.co.uk>
Cc: Peter Collins via BitFolk Users <users(a)mailman.bitfolk.com>om>; Peter Collins
<bitfolkvps(a)3720.co.uk>
Subject: [bitfolk] Re: Docker on VPS
On Sun, 26 Nov 2023 at 10:52, iain <iain(a)hairydog.co.uk> wrote:
_______________________________________________
BitFolk Users mailing list <users(a)mailman.bitfolk.com>
You're subscribed as <iain(a)hairydog.co.uk>
Unsubscribe:
<https://mailman.bitfolk.com/mailman/postorius/lists/users.mailman.bitfolk.com/>
or send an email to <users-leave(a)mailman.bitfolk.com>
The reality is that users do not update addons. So the admin has to do it, which is a
pain and good luck with getting paid!
Again that’s not the fault of Wordpress as a platform.
Yes, the core of wordpress is pretty secure (though way too slow).
That’s subjective
But that's like saying that guns don't kill people: the bullets that users put in
them are the problem.
Actually what you’re describing is guns don’t kill it’s the person pulling the trigger.
My point remains, whatever your issues with Wordpress are, to say it shouldn’t be as it’s
just not safe is wrong.
12:28 p.m.
On 2023-11-26 11:49+0000, iain via BitFolk Users wrote:
Yes, Wordpress has a large following. But it is
nothing like as much
as 45% Maybe 4.5%.
You imply that Modx is only more secure because it is less common.
Firstly, there's no basis for this. There would be exploits if there were holes.
Secondly, security by obscurity IS security. Not ideal, but if it works...
Security through obscurity does not work. Almost all C-style memory
management bugs are obscure, until someone fuzzes it. Race conditions
are obscure too... DJB did a lot to dissuade the idea of the downfalls
of security through obscurity.
The problem with flat filing Wordpress output is that
WP generates
second-rate html. OK it's not Wix awful, but it's not good.
Poor HTML though, isn't the realm of templating rather than stock WP
itself? My handcrafted HTML is not good by any standard, but the
artists/designers can certainly do a better job than I can.
I wanted to get a template or something from fiver, but by the looks of
it they're all (first few clicks I looked at) setup to make them for WP.
Ed
3:19 p.m.
A password is security by obscurity.
On 26 Nov 2023 at 12:28, Ed Neville via BitFolk Users <users(a)mailman.bitfolk.com>
wrote:
On 2023-11-26 11:49+0000, iain via BitFolk Users wrote:
Yes, Wordpress has a large following. But it is
nothing like as much
as 45% Maybe 4.5%.
You imply that Modx is only more secure because it is less common.
Firstly, there's no basis for this. There would be exploits if there were holes.
Secondly, security by obscurity IS security. Not ideal, but if it works...
Security through obscurity does not work. Almost all C-style memory
management bugs are obscure, until someone fuzzes it. Race conditions
are obscure too... DJB did a lot to dissuade the idea of the downfalls
of security through obscurity.
The problem with flat filing Wordpress output is
that WP generates
second-rate html. OK it's not Wix awful, but it's not good.
Poor HTML though, isn't the realm of templating rather than stock WP
itself? My handcrafted HTML is not good by any standard, but the
artists/designers can certainly do a better job than I can.
I wanted to get a template or something from fiver, but by the looks of
it they're all (first few clicks I looked at) setup to make them for WP.
Ed
_______________________________________________
BitFolk Users mailing list <users(a)mailman.bitfolk.com>
You're subscribed as <iain(a)hairydog.co.uk>
Unsubscribe:
<https://mailman.bitfolk.com/mailman/postorius/lists/users.mailman.bitfolk.com/>
or send an email to <users-leave(a)mailman.bitfolk.com>
4:38 p.m.
On 2023-11-26 15:19+0000, iain wrote:
A password is security by obscurity.
Yeah, hunter2 is an example of a password, and dictionary attacks work.
SSL certificates and authorized_keys are probably better ways to manage
authentication, PKI cards were popular at one point.
P.S. I didn't get much success with simply-static, so yeah, any of the
other static site generators would be better if the content is easy
enough to migrate.
Best regards,
Ed
5:08 p.m.
On Sun, Nov 26, 2023 at 03:19:43PM +0000, iain via BitFolk Users wrote:
A password is security by obscurity.
In case that wasn't entirely tongue-in-cheek, the term "security by
obscurity" refers to secret methods, which, one out in the open, become
permanently useless.
In contrast, a password, if accidentally discovered or leaked, can easily be
changed, and is then just as secure as before, as long as the leakage
wasn't through a system flaw that could be used again.
--
Anahata
anahata(a)treewind.co.uk -+- http://www.treewind.co.uk
Home: 01535 501017 Mob: 07976 263827
27 Nov
27 Nov
12:07 a.m.
On Sun, Nov 26, 2023 at 11:49 AM iain via BitFolk Users
<users(a)mailman.bitfolk.com> wrote:
Yes, Wordpress has a large following. But it is
nothing like as much as 45% Maybe 4.5%.
You're right, it's not 45%. It's more likely to be 43.1%.
https://w3techs.com/technologies/history_overview/content_management/all
You imply that Modx is only more secure because it is
less common.
The implication is that a lesser known or used piece of software will
likely have a lower number of exploits developed for it, not that it
is less secure.
-n
155
days inactive
157
days old
21 comments
10 participants
participants (10)
-
Adam Spiers -
Anahata -
Andy Smith -
Chris Smith -
Ed Neville -
iain -
Paul Lewis -
Paul Tansom -
Peter Collins -
William Anderson