/ Register

Learn about Centmin Mod LEMP Stack today
Register Now

Wordpress Wordpress's plans to remotely force Wordpress updates !

Discussion in 'Blogs & CMS usage' started by eva2000, Aug 11, 2019.

Tags:
Previous Thread Next Thread
Loading...
  1. Aug 11, 2019 #1
    eva2000

    eva2000 Administrator Staff Member

    58,893
    12,490
    113
    May 24, 2014
    Brisbane, Australia
    Ratings:
    +19,122
    Local Time:
    11:45 AM
    Nginx 1.31.x
    MariaDB 10.x/11.4+/12.3+
    Interesting news that Wordpress is thinking about forcibly updating very out dated Wordpress sites remotely on https://www.zdnet.com/article/wordpress-team-working-on-daring-plan-to-forcibly-update-old-websites/ ! Imagine all the broken Wordpress sites as a result of this ! Then again if you're running Wordpress 3.7, you'd have more security related problems besides a broken site :)

    Though you'd be able to opt out of this process too
     
  2. Aug 18, 2019 #2
    deltahf

    deltahf Premium Member Premium Member

    595
    270
    63
    Jun 8, 2014
    Ratings:
    +500
    Local Time:
    9:45 PM
    Wait... what?

    How would this work from a technical perspective? WordPress has a back-door for WP devs to initiate upgrades or code executions, without this permission being specifically configured or granted by the site owner? This is the first I have heard of that! That sounds like a bigger security concern than out of date software!
     
  3. Aug 18, 2019 #3
    eva2000

    eva2000 Administrator Staff Member

    58,893
    12,490
    113
    May 24, 2014
    Brisbane, Australia
    Ratings:
    +19,122
    Local Time:
    11:45 AM
    Nginx 1.31.x
    MariaDB 10.x/11.4+/12.3+
    Indeed I haven't given this more thought, but now you mention it yeah not sure how this would work from technical perspective given that from my basic understanding of Wordpress auto update mechanism, it only would auto update if Wordpress owner opted into auto updating - that the control is on Wordpress end user side.

    But guess you and I need to read the details which are at Configuring Automatic Background Updates | WordPress.org for Wordpress auto update mechanism
    edit: was thinking about this and one way would be Wordpress folks push out a Wordpress 3.7 minor release which has code only in that minor 3.7 release to force a major core auto-update bypassing the controls that usually skip core updates.
     
  4. Aug 18, 2019 #4
    deltahf

    deltahf Premium Member Premium Member

    595
    270
    63
    Jun 8, 2014
    Ratings:
    +500
    Local Time:
    9:45 PM
    Wow, I had no idea. I thought auto-updated only happened if you turned them on.

    Not sure how I feel about this... :eek:
     
  5. Aug 19, 2019 #5
    jcat

    jcat Member

    154
    22
    18
    Jun 21, 2015
    New Jersey
    Ratings:
    +65
    Local Time:
    9:45 PM
  6. Aug 19, 2019 #6
    BamaStangGuy

    BamaStangGuy Active Member

    669
    192
    43
    May 25, 2014
    Ratings:
    +272
    Local Time:
    8:45 PM
    I support this.
     
  7. Aug 20, 2019 #7
    eva2000

    eva2000 Administrator Staff Member

    58,893
    12,490
    113
    May 24, 2014
    Brisbane, Australia
    Ratings:
    +19,122
    Local Time:
    11:45 AM
    Nginx 1.31.x
    MariaDB 10.x/11.4+/12.3+
    Yeah it's something I have been thinking about myself for Centmin Mod. Question I ask myself, what if Centmin Mod users DO NOT regularly update their stack/versions ? Or if they just set and forget and there's security and bug fixes ? It's why I am working on tools/emailnotify.sh Beta Branch - add tools/emailnotify.sh in 123.09beta01 to get better alerts for such updates to Centmin Mod users.
    True especially if you're using Wordpress versions as old as 3.7!

    Yeah will make the internet as a whole that tad safer with less chance of compromised Wordpress sites become part of malicious botnet/attacks.
     
  8. Aug 20, 2019 #8
    jcat

    jcat Member

    154
    22
    18
    Jun 21, 2015
    New Jersey
    Ratings:
    +65
    Local Time:
    9:45 PM
    Unrelated to WP:

    Biggest issue for us is nginx/php being built via source so

    I feel building from source is a bit more scary than simply updating an rpm although in most cases if building via source fails, it normally doesn't affect the current running binaries, etc. Building from source uses lots of CPU, so in an environment with many hundreds of installs of centminmod, it has to be done in small batches.

    On a seperate note and we started using 'expect' which is a bit hacky but in the end does the job very well and always us to automate using the centminmod menu. Being able to fully automate option 22 is the best thing ever :) and already testing automating nginx/php upgrades as well.

    But.. yes the I agree on emailnotify defintely a great thing to have.

    Also, I am in no way complaining about the decision to build from source, its awesome and love it, everything has pros and cons.
     
  9. Aug 20, 2019 #9
    Jon Snow

    Jon Snow Active Member

    917
    188
    43
    Jun 30, 2017
    Ratings:
    +293
    Local Time:
    10:45 PM
    Nginx 1.13.9
    MariaDB 10.1.31
    Wordpress is a bit different from centminmod.

    There are so many people who pay to have their wordpress sites set up without touching it. There are auto installers on cPanel that will do the job for you. People who use those tools are more likely to keep their sites outdated and that's why they get hacked.

    You need a little technical knowledge to set up a VPS with CMM, so I don't think you'll get people like that using it.

    There can be an option to enable automatic centminmod code updates when installing it. Could help. I'm not sure if automatic php/nginx updates are possible with cmm.
     
  10. Aug 20, 2019 #10
    eva2000

    eva2000 Administrator Staff Member

    58,893
    12,490
    113
    May 24, 2014
    Brisbane, Australia
    Ratings:
    +19,122
    Local Time:
    11:45 AM
    Nginx 1.31.x
    MariaDB 10.x/11.4+/12.3+
    for centmin mod updates itself there already is via cmupdate command Beta Branch - Cronjob Auto Updating Centmin Mod Code Guide or AUTO_GITUPDATE persistent variable but this only runs when centmin.sh is triggered unlike cronjob cmupdate which will run regardless of centmin.sh trigger/runs Beta Branch - add AUTO_GITUPDATE variable support 123.09beta01
    working on unattended nginx/php-fpm update scripts so such can be possible in future
     
  11. Aug 20, 2019 #11
    Jon Snow

    Jon Snow Active Member

    917
    188
    43
    Jun 30, 2017
    Ratings:
    +293
    Local Time:
    10:45 PM
    Nginx 1.13.9
    MariaDB 10.1.31
    I meant like..

    You paste the line to install everything and at some point it'd just prompt a question asking you if you want to automatically update stuff and then it'd do it for you if you say "yes".

    That's just an idea if you really want centminmod users to have the centminmod code updated automatically.

    I personally rather do updates manually.
     
  12. Aug 20, 2019 #12
    eva2000

    eva2000 Administrator Staff Member

    58,893
    12,490
    113
    May 24, 2014
    Brisbane, Australia
    Ratings:
    +19,122
    Local Time:
    11:45 AM
    Nginx 1.31.x
    MariaDB 10.x/11.4+/12.3+
    I see what you mean. Yeah the installer is meant to be unattended so it wouldn't prompt for such. Maybe I can put the auto update prompt at same time the first centmin.sh run prompts for primary and secondary email addresses for future notifications.
     
Previous Thread Next Thread
Loading...

.