Ajay - On the Road called Life!

Comments:

1. Brian Layman says:
   October 28th, 2006 at 10:35 am

   I’ve been looking at a bunch of different sites as people upgrade and, other than mine, yours is the first I’ve seen to mention that there are security reasons to upgrade. Good Show. I’ve been trying to spread the word, but security has always been downplayed in the WP arena. With the addition of the missing index, people who were complaining about the speed of 2.0.4 should get a nice bump too.

2. Ajay says:
   October 28th, 2006 at 12:25 pm

   Will agree about security being downplayed out here. Or atleast the attempt to mask that security should be the reason to upgrade.

   This time the note about the security bugs being fixed was put in the release post itself.

   I too am not aware of the detailed bug fixes wrt security.

3. Brian Layman says:
   October 28th, 2006 at 10:22 pm

   The biggest one is a hole that allowed you do download files that you knew the name of. As you can guess, that might be bad.

4. Ajay says:
   October 28th, 2006 at 10:33 pm

   Hi Brian,

   I don’t clearly understand what you mean by this.

   When you say download file what kind of files are you talking about? Or are you talking about php files of WordPress core?

5. Brian Layman says:
   October 29th, 2006 at 2:13 am

   Yep, This particular issue was a directory traversal bug in a packaged plugin. It didn’t keep its download function isolated to the directory it was supposed to be downloading from. And if you were clever enough you could get it to download things from other directories.

6. Thilak says:
   October 29th, 2006 at 4:11 am

   I upgraded all my blogs to 2.0.5 last morning, I’m eagerly waiting for v2.1

7. Ajay says:
   October 29th, 2006 at 8:46 am

   @Brian, Now I know what you are talking about

   @Thilak, I’m already running 2.1 in my demoblog. It’s got a lot of changes from 2.0

8. Thilak says:
   October 29th, 2006 at 10:36 am

   Must be a Beta with tons of bugs, anyway where did you get it ?

9. Thilak says:
   October 29th, 2006 at 10:38 am

   It must be a beta. Anyway where did you get it ?

10. Brian Layman says:
    October 29th, 2006 at 10:58 am

    It’s long before beta. It’s before alpha even. It’s available to those who are testers
    http://wordpress.org/download/beta/

    And those hackers who want to check out the nightly builds of the product:
    http://wordpress.org/download/nightly/

    There’s no quiz you must take to join. As no support is offered for any of the pre-release products, the only test is how fast you can dig yourself out of a hole when a feature you rely on doesn’t work in the current build. It’s sort of a pass fail thing….

11. Ajay says:
    October 29th, 2006 at 1:45 pm

    @Thilak, Brian has given you the link above.

    The only support you get is via the Testers and Hackers list. The reason I run it is so that I can ensure my themes and plugins are compatible with the next version of WordPress.

12. Thilak says:
    October 29th, 2006 at 2:43 pm

    Yeah, I’m playing around with 2.1 locally

13. Ajay says:
    October 29th, 2006 at 5:42 pm

    I got 2.1 synchronized using svn. It’s kinda cool though scary to run the latest code.

    There have been sometimes that the blog has just shutdown and I had to wait till the next update.