Skip to content
Register

Softaculous creates more problems than it solves

Web Hosting by Chen 19 replies 1.8K views
Chen

Member OP

☁️ multi-cloud mess

10 #1

You want convenience you get pain lor

My friend install wordpress via softaculous in 2019, never update, last month kena defaced, whole account suspend by Vultr. He ask me why, I say "you never update leh" he say "but one-click what"

One-click install, three-year neglect, one-click pwned

The problem is not softaculous itself lah, is the mentality. People think "automated" means "I no need think already" but actually server still your responsibility leh

Then the twist: I check my own softaculous, got joomla from 2023, never update also. Kena exploit three year untouched. Pot calling kettle black lor. Paiseh

Convenience vs control, which side you all

lookuppierre

Member

#2
Chen said:
Pot calling kettle black

Yes, yes, this is me also. The WordPress from 2021 in my Hostinger account, I am forget it exist.

I think the "one-click" is like the fast food. Good for hunger now, bad for health later. But we are lazy, no?

Random Thought: Softaculous should send the scary email. "UPDATE OR DIE". Not just "new version available". The People need fear.

prix fixe infrastructure: €5/mo
van3

Member

#3

I am use softaculous for hos client site on RackNerd ạ very easy but very dangerous ạ

Three client kena malware last year ạ all because no update ạ

Now I am install manual only ạ takes longer but I am know what is inside ạ

Softaculous is like giving knife to baby ạ cute but bleeding ạ

ronwit

Member

Budget King

3 #4
van3 said:
Giving knife to baby

Actually that metaphor is basically perfect (´・ω・｀)

I used Softaculous for my friend shop, then forgot about it basically. Two years later, site is mining monero. My friend say "but you are admin, actually" and I am like yes, that is fair.

Now I use docker compose for everything. No softaculous, no problem. But actually more work. Basically trade-off forever (´・ω・｀)

@Chen we are same person, different server

instant noodles, instant deploys
prague1983

Member

btw I use Arch

#5

One-click pwned is a great phrase actually

oops: 0000 [#1] SMP
TE

Member

#6

Bleeding indeed

DealsTallinn

Member

SRE Wannabe

4 #7
Chen said:
Convenience vs control, which side you all

Terraform side. Obviously.

I inherited a Softaculous WordPress at my last job, client insisted on it. State file was a nightmare, nobody knew what the actual infra was. I spent two days reverse-engineering a $5 Hostinger shared plan into tfstate. Never again.

If you cannot destroy and recreate it in ten minutes, you do not own it. You are renting anxiety.

ana_mad

Member

#8
ronwit said:
Site is mining monero

Same story, Madrid, 2022. Client of mine, small law firm, Softaculous Drupal. I found it because their Vultr bill went from $12 to $180 in one week. CPU throttling, Vultr sent warning, client forwarded to me like "is this your fault" — https://www.vultr.com/pricing/

Was not my fault. Was Softaculous + never update + weak admin password. But I am the one who looks bad.

Now my contract has clause: "No auto-installers without my written approval." Clients hate it until they love it.

swimming upstream since 2019 🐟
lookuppierre

Member

#9
DealsTallinn said:
You are renting anxiety

This is very French of you, I like it.

But honestly, for my association we are on Hostinger shared plan, 8 euro per month. I do not have time to terraform a wordpress for 15 members who post twice per year. Softaculous is necessary evil.

The real fix: I put calendar reminder every three months. "Check updates or Pierre cries." Works 70% of time.

prix fixe infrastructure: €5/mo
Chen

Member OP

☁️ multi-cloud mess

#10
lookuppierre said:
Works 70% of time

30% of time Pierre cries lor

I tried calendar reminder also. Snooze until the reminder itself become malware. Human nature is the bug that cannot patch.

My new strategy: I put everything on Vultr with automatic snapshot, then I tell friend "if kena hack I restore one week ago, you lose one week of post, your problem" Suddenly they very interested in updating.

Incentive alignment, not more tools.

Post a reply

You need an account to reply. Log in or register to join the conversation.

Post reply Preview Save draft