The weblog software that people seem to choose by default these days is
Wordpress. Wordpress has a lot of features, is widely used and liked,
and is offered as a free single-click install by a lot of web hosting
providers. But several of the Wordpress blogs I follow have been hacked
at some point. When I looked into blogging software, the reason became
clear: Wordpress is a large piece of software, written in PHP, a language
which originally was designed arose in a world where security concerns
were much less significant, and which has addressed those security
concerns (and other evolving needs) by adding things, not by a
fundamental redesign. (UPDATE: it appears I was being far too
generous to PHP in saying that it had been ‘designed’.) The result is a rather large, complicated
language, which is hard to learn well enough to master all the security
issues. Also, Wordpress uses an SQL database to store weblog entries,
comments, and such, which opens up possibilities of SQL injection
attacks. The single-click install is easy, but upgrading is not so
easy; and if one runs the software for any length of time, one has to
upgrade much more often than one has to install.