Feature suggestion : periodical email notification/reminder of security updates

  • Sabinou

    (@sabinou1)


    12 years, 3 months ago

    Hello,

    To help WordPress improve, I’d like to make a suggestion…

    Simply, that every self-hosted wordpress takes the initiative, by himself, to send the admin a notification email when there is a new version available, and some of the updates are security-related, and periodically re-send that email if no action follows.
    To prevent blogs left behind because the admin forgets to update or never logs in as admin.

    This way we wouldn’t spam the mailboxes, and we’d keep the wordpress internet ecosystem a bit healthier.

    You may also occasionally add notifications about global events requiring immediate admin action, like when the timthumb.php exploit was discovered.

    Don’t you guys think this would be a crucial feature for wordpress ?

    OTHERWISE, only blogs actively maintained by admins not afraid of trusting your auto-update buttons will always be up to date, and it would be bad for everyone, the webmasters, the web hosts, and the wordpress “ecosystem”.

    Well, that was for my suggestion ! 🙂

    Good day everyone,
    Sabinou

Viewing 5 replies - 16 through 20 (of 20 total)
1 2
  • Thread Starter Sabinou

    (@sabinou1)

    12 years, 2 months ago

    Thanks for the input, Esmi and Ipstenu, I submitted it to the suggested email adress.

    Thread Starter Sabinou

    (@sabinou1)

    11 years, 5 months ago

    I submitted the idea but never got any reply, and apparently it fell to the pits. And 8 months passed in the blink of an eye.

    That’s too bad, in this way the WordPress architecture is contributing to making the internet less secure, allowing deprecated plugins, with known security issues allowing malicious code execution, to stay activated on online blogs while the blog owners don’t even know there’s a problem with the plugins 🙁

    secconsult

    (@mvis)

    11 years, 5 months ago

    Hello Sabinou,

    I just stumbled over this thread and totally agree with you.
    I had the same idea last year and created a plugin to address that exact problem, which I believe will help a lot of people to keep the sites they are responsible for up-to-date without needing to login to each site and check for updates manually.

    We have a dedicated team looking for publicly disclosed vulnerabilities in dozens of different sources around the web, process and store this information. From within the plugin you can subscribe to a professional feed that will alert you per e-mail about vulnerabilities that affect your website. If you subscribe with the same user on multiple sites, you would only get one e-mail for each vulnerability but stating exactly which of your sites are affected by this vulnerability.

    The plugin (MVIS Security Center) is in the beta phase now, so the subscription is free for 3 months.
    We are also working on improving the e-mail notification settings to include status e-mails about plugins that have updates available in addition to informing users about vulnerabilities in WordPress, the plugins or themes. Please feel free to post features you would like to see in the support forum of the plugin itself and I will make sure that they get included.

    Of course it would also be helpful to not have the plugin page disappear but have an informative page explaining why the plugin is currently disabled. Even further, maybe exposing this through the WordPress update checks to give users information if a plugin was disabled because of security vulnerabilities, similar to if an update is available for a plugin or not.

    Thread Starter Sabinou

    (@sabinou1)

    11 years, 5 months ago

    Secconsult, if I may give an advice regarding your nice plugin (I have no problems with it being a commercial plugin, I love free software, I like open source software, but I am not a free software fundamentalist), you also ought to monitor if the wordpress repository pages of the installed plugins inside a blog, to check if one of these pages suddenly disappears. If such a page disappears, that means there has been a serious reason to doubt the plugin’s reliability…

    As for the rest, it’s all about hoping to catch the attention of influential worpdress community members and re-launch the debate :-/

    secconsult

    (@mvis)

    11 years, 5 months ago

    Good point Sabinou, I’ll take a look at it and see if this can be detected reliably and how this feature can be incorporated.

    Let’s cross our fingers in the meantime that this debate will be relaunched, with a better outcome 🙂

Viewing 5 replies - 16 through 20 (of 20 total)
1 2
  • The topic ‘Feature suggestion : periodical email notification/reminder of security updates’ is closed to new replies.

Tags