Thanks for the link. They’re NOT bogus. It’s irresponsible of you to make that claim.
I disagree with (Robert Deaton, at the link you posted) the writer’s perspective. Security issues, regardless of how “minor” one might interpret them, aggregate into serious problems.
For example, exposing directory contents and paths is not good because if I can easily learn what code (plugins, etc) you have installed then I am one step further along in whacking your system.
It’s trivial to guard against a server “misconfig” of error_reporting (include a check in the code to make sure files aren’t called directly unless they are meant to be).
It’s trivial to guard against browseable directories (include a blank index.php file). So why not just add the protection into the code? There’s no reason not to unless someone doesn’t appreciate security.
At the same time, when WP folks say they offer a “secure” platform then many people, me included, expect them to take even the most minor security issue seriously and do something about it. E.g. protect users against other admin’s choices; if code/files aren’t meant to be exposed then ensure it stays hidden unless the user intentionally exposes it.
For those who want to read about the issues (and see possible workarounds), see this link:
https://www.securityfocus.com/archive/1/426442
The notice was posted to the Bugtraq mailing list — one of the most authoritive groups of security-minded people on the Internet. Well respected people in the security community. I’d bet that there would not be one person there who would agree with your perspective.
