• Resolved fooshoocoo

    (@fooshoocoo)


    After installing WordPress I immediately began to get lots of hits in my server logs from bots visiting the URL where I installed. I have never given this URL to anyone, published it anywhere or accessed it from any remote machine. I suppose it is possible that the bots guessed the URL (xxx.com/wordpress) but I don’t recall seeing any entries for this URL before the day I installed.

    So, does WordPress have sort of spyware in it that reports details of where it has been installed onto a central server, from where it can be harvested by bots?

Viewing 10 replies - 16 through 25 (of 25 total)
  • are you really claiming that i have no right to expect my machines to be online and accessible for my own limited purposes and also secure and inaccessible to unauthorised uses?
    No, but why then are you using software you had not thoroughly investigated first ?

    i didn’t enable any option for these ‘pings’ and i have not yet been able to find the option to turn them off
    You as yet non-existent code audit would have found an option on Options > Discussion. Helpful Hint – The line “Attempt to notify any Weblogs linked to from the article (slows down posting.)” means “Tell the world !!!!”

    spyware is any software that sends out information about me without asking me first if i want that information sent out.
    How locked down is your browser ? I can see your IP – did you know that ? Who is spying there then – me for seeing it or your browser for helpfully handing over that information ? How locked down is your whole OS ?

    that’s why i’m running open source software.
    Open source software does not contain spyware ? That’s a new one on me.

    but i’m not going to run wordpress again until i have time to do a full code audit
    I’d not trust it again ..oh no. Why not rewrite it ?

    i don’t even know what these ‘pings’ contain
    You didn’t know about pings, but you claim a standard you do know about. Hmm…..

    rustindy

    (@rustindy)

    C’mon, so he didn’t know about blog functionality in modern blogwares. No need to be hard on him for it. We all have to start somewhere, yes?

    Anyhow, now he knows where the options are to turn off notifications of any type that his blog will send out by default (which, as said, 99% of bloggers want turned on, which is why they’re on by default), and he’ll know better the next time he installs software he hasn’t bothered to research ??

    BTW (and someone please correct me if I’m wrong), but I think a pingback only contains the blog address and a timestamp – the excerpt and body are almost certainly not part of the information sent.

    Dgold

    (@dgold)

    I think WordPress would do the most benefit for the widest variety of users, if WordPress would take into account that some people might want to use it for something other than a public blog.

    It sure would make a great article on Codex: all the things you need to disable to have your WordPress notify no-one. Disable RSS entirely, turn off pings, turn off trackbacks, turn off register user…

    That’s tricky how you install the software, make one test post, and your URL is known from then on by Google et al. Unless you think of the options to disable before you do anything. For me, right now for some reason Technorati knows my old test-site URL that I moved to my current URL.

    rustindy

    (@rustindy)

    Actually, that does bring up a good question – does WP notify https://rpc.pingomatic.com/ when it’s installed because of the default post?

    shep

    (@shep)

    there is a piece of software that allows no one to read what you write besides you, it’s called a pen and paper. (or would that be hardware?) ??

    Technorati is fetched as soon as you login for the very first time. It’s the dash ….

    rustindy

    (@rustindy)

    Technorati is fine, I’d imagine. I’m curious about services that would display a public link to your blog, like Pingomatic, being notified because of the default post that’s created when you install WP. Or does that notification only go out when you start creating new posts?

    vkaryl

    (@vkaryl)

    Yep. You simply open the dash files in an editor FIRST – and get all that crap out of there before you upload….

    Dgold, are you volunteering to take this thread and pull the meat off the bone for the codex? That’s great! ??

    Dgold

    (@dgold)

    No, miklb. I want to READ the article, when someone who knows how to do these things writes it.

    I’m just a novice WP user who would like to keep some of my WP installations more quiet and others pinging the public.

Viewing 10 replies - 16 through 25 (of 25 total)
  • The topic ‘wordpress contains spyware?’ is closed to new replies.