Otherwise they don't work and in most cases don't even tell you why.
Actually, most of the time it does check and does tell you why it won't work.
A few quick examples:
- If you change your permalinks, it creates an .htaccess for you. If it is unable to do so, it gives you the .htaccess rules instead and tells you to put them in the file yourself.
- If you try to use the theme or plugin editor, and the file is not writable, then it will give you the file, but also a message saying "if this file was writable then you could edit it".
- The plugin updater works in one of two ways. If it can't write the files itself, then it tries to FTP to itself by asking the user for FTP credentials.
The software has these great features but only if you reduce your security (at least temporarily).
I take some exception to that... There's security and then there is paranoia. Security is not a matter of "improved" or "reduced" in any meaningful sense by making a few changes. That's oversimplification of reality.
If I make a file world writable, then it doesn't affect my security in any way if the world still has no access to my system. Securing a system is far more complex than a set of rules that you have to follow. People like those sets of rules because they're easy to understand, but they then get the mistaken impression that the rules must be followed, because anything less is "less secure". It's not true and it's the wrong way to think about security, because it leads people into doing stupid things for no good reason.
bigbny
finkyfeke
onlyconnect
markljackson
