From the category archives:

Wordpress for Business

Joomla Quietly Crosses 23 Million Downloads, Now Powering Over 2,600 Government Sites

Joomla Content Management System

According to BuiltWith, of the top million websites using content management systems (or CMSes), three systems own more than 75 percent of the total market share: WordPress, Joomla, and Drupal. (All of which are open source, by the way.) Many are likely most familiar with WordPress, which TechCrunch has covered quite a bit (and uses to power most its sites, for full disclosure). WordPress is the most popular CMS on the Web, running 62 percent of the top million websites that use a CMS, according to BuiltWith, with Joomla now ranking second at 10 percent.

There are a ton of these content management systems out there, even though the top 3 claim most of the market share. And, as BuiltWith’s roster shows, microblogging and blog publishing services are often grouped in with CMSes — as some are able to be customized into a CMS — even though their scopes tend to be far more specialized. Services like Blogger and Tumblr, to name two, are sometimes lumped in with CMSes and have attracted a lot of coverage in the press, some of which is for good reason.

Joomla 1.5 Artcle Management - Backend

Joomla 1.5 Artcle Management - Backend

Because of this, services like Joomla seem to fly a bit under the radar. Or, at least so it seems with Joomla in particular, which has yet to be covered by TechCrunch. (Or has, at least, been covered minimally compared to 63 posts for WordPress.)

So what is this “Joomla”, and why should you care about it? Joomla is a free, open source CMS, written in PHP that uses object-oriented programming, storing data in a MySQL database, and does page caching, RSS feeds, printable versions of pages, news flashes, blogs, polls, search — things that every CMS should do.

And there are these impressive statistics: Joomla has now passed 23 million downloads, and currently stands at just over 23.5 million, to be precise. It owns 10.3 percent of the CMS market share, and BuiltWith shows it’s powering over 1.4 million websites. Joomla, for one, says that it’s impossible to know for sure, but estimates last year by FinishJoomla put that number between 1.5 and 2 million. Which admittedly seems small compared to the 23 million downloads.

Joomla Design - RayCoy.com

Joomla Design - RayCoy.com

Pure statistics are fine and dandy, but what’s led Joomla to become the second largest CMS on the Interwebs? This is an especially interesting question considering that, as an open source system, there is no figurehead or CEO pulling the strings, or making product decisions. Joomla is updated and expanded on, like WordPress(.org) and Drupal, by its community of developers. But unlike Matt Mullenweg of WordPress (who, incidentally, was named one of the 50 most important people on the Web by PC Magazine) there is no “face” of Joomla; instead, it has been collectively run by the nearly 250K developers that use Joomlacode.org, the resource in which developers can build open source software projects, tools and extensions, for Joomla users. (And there are currently nearly 8K extensions available for the Joomla platform.)

Joomla Design - RayCoy.com

Joomla Design - RayCoy.com

Unlike, say Mullenweg’s Automattic, Joomla is loosely headed by OpenSourceMatters.org, a non-profit entity that provides organizational, legal, and financial support to the Joomla community. The goal for OpenSourceMatters is to maintain Joomla’s open source nature, assuring that Joomla is a project that acts autonomously, is socially responsible, and remains accountable to its community.

Joomla website design —>

{ Comments on this entry are closed }

WordPress Warns Of Trojanized Plug-Ins, Urges Patching

Wordpress Security

Wordpress Security

Attackers added a back door to three plug-ins that were available for download from WordPress for more than 24 hours.

WordPress on Tuesday warned all users who run its software on their own servers to beware a trio of malicious plug-ins for its content management software, which may have been available for download from the site for more than 24 hours.

“Earlier today the WordPress team noticed suspicious commits to several popular plugins–AddThis, WPtouch, and W3 Total Cache–containing cleverly disguised backdoors. We determined the commits were not from the authors, rolled them back, pushed updates to the plugins, and shut down access to the plugin repository while we looked for anything else unsavory,” said a warning from Matt Mullenweg, founding developer of WordPress, released on Tuesday.

Plug-ins extend WordPress functionality, and the ones called out in the security warning offer an interface with social networking sites (AddThis), mobile and iPad versions of WordPress blogs (WPtouch), and server performance enhancements (W3 Total Cache). AddThis and W3 Total Cache have been downloaded at least 500,000 times, and the free version of WPtouch, more than two million times.

Mullenweg said that while an investigation is underway and there’s no evidence that attackers compromised the WordPress site, WordPress just to be safe has forcibly reset all passwords for WordPress.org, which is the site where users can download WordPress. “To use the forums, [development site] Trac, or commit to a plugin or theme, you’ll need to reset your password to a new one”–by using the log-in page–said Mullenweg.

Plug-ins extend WordPress functionality, and the ones called out in the security warning offer an interface with social networking sites (AddThis), mobile and iPad versions of WordPress blogs (WPtouch), and server performance enhancements (W3 Total Cache). AddThis and W3 Total Cache have been downloaded at least 500,000 times, and the free version of WPtouch, more than two million times.

Mullenweg said that while an investigation is underway and there’s no evidence that attackers compromised the WordPress site, WordPress just to be safe has forcibly reset all passwords for WordPress.org, which is the site where users can download WordPress. “To use the forums, [development site] Trac, or commit to a plugin or theme, you’ll need to reset your password to a new one”–by using the log-in page–said Mullenweg.

In addition, he said that any users of the three Trojanized plug-ins who updated them “in the past day” (meaning Monday or Tuesday) should upgrade those plug-ins immediately.

Plug-ins, malicious or otherwise, continue to account for an increasing number of vulnerabilities seen in applications, both on PCs (for example, with browsers) and in Web applications (such as WordPress). In terms of WordPress, plug-ins now account for 80% of all WordPress-related vulnerabilities, according to HP DVLabs.

But some plug-in vulnerabilities are worse than others. “Web-based backdoors can be extremely dangerous,” said Paul Ducklin, head of technology for Sophos in the Asia Pacific region, in a blog post. “If you’re a WordPress user, you’ll know that the WordPress platform includes a complete and powerful administration interface, password-protected, via a URL such as “site.example/wp-admin.” A WordPress backdoor might offer something with similar functionality, but using a different, unexpected, URL, and using a password known to the hacker, instead of to you.”

Another danger is that if attackers managed to steal WordPress passwords, they might attempt to use them to access other sites. According to Mullenweg, “as a user, make sure to never use the same password for two different services, and we encourage you not to reset your password to be the same as your old one.”

Unfortunately, password reuse remains rampant as numerous, recent attacks have shown, such as when LulzSec released stolen databases containing usernames and passwords–such as the release of 37,608 SonyPictures.com passwords, which researchers have cross-referenced with other leaked databases.

http://www.informationweek.com/news/security/vulnerabilities/231000230

{ Comments on this entry are closed }