Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

WordPress on .NET

peachpie.io

Post reply on HN
Print view View original

61–70 of 174 posts

Re: WordPress on .NET

#61

Post by pawadu »

deckiedan wrote: post #24
pawadu wrote: post #11

I don't care about performance, show me if security has improved! (which in the case of Wordpress can't be that hard)

WordPress security is complex. The core code is OK, security wise. Comparible to similar projects, I guess. The two major issues are that typically PHP runs with permission to modify the WordPress directory, which is useful for automatic upgrades, but means any exploit in any plugin, theme, etc. instantly becomes, "can replace WordPress". The other is that all themes and plugins are completely unsandboxed, and the qu…

> WordPress security is complex.

This must be an oxymoron since complexity is the enemy of security.

I think what you meant to say was

> WordPress security is at best ad-hoc, and mostly non-existing

Re: WordPress on .NET

#62

Post by pawadu »

josefresco wrote: post #47
pawadu wrote: post #11

I don't care about performance, show me if security has improved! (which in the case of Wordpress can't be that hard)

You're seriously out of touch if you think the WP Core is not secure. You must realize they have a very competent team ( https://automattic.com/ ), not to mention thousands of OSS developers that continually contribute. Does your company, or does this small team of techs even come close? https://wordpress.org/about/security/

not even have a very competent team can put enough lipstick on this pig:

http://www.cvedetails.com/vulnerability-list/vendor_id-2337/...

Re: WordPress on .NET

#63

Post by ChristianGeek »

rattray wrote: post #54
JBReefer wrote: post #40

Earlier quoted context omitted.

This is on .NET Core, so you can actually run this anywhere! I do a lot of Core development on a Mac, but it runs well on AWS/Linux/my toaster. Weird times, huh?

Out of curiosity, why do you use .NET? (Assuming you use Mac/AWS/etc because you like them)

For me, it's because I love C# (and F#, which I'm still learning).

Re: WordPress on .NET

#64

Post by hokkos »

algorithmsRcool wrote: post #15

I've been following the peachpie project for a while. The effort they put in is very impressive. They choose to heavily modify the C#/VB compiler (Roslyn) to handle php syntax. Microsoft should be investing time into helping them succeed, it would be great to see the Roslyn compiler platform become more broadly used.

It's so smart to do that, Roslyn provides a good design, keeping a rich syntax tree that can help for language tooling (auto-completion), so Language Server for VSCode is for free and all backends too.

Re: WordPress on .NET

#65

Post by sremani »

arenaninja wrote: post #58
sremani wrote: post #27

Earlier quoted context omitted.

CLR imposes lot of requirements for an assembly to run, that would definitely improve security esp. when comparing it to a interpreted language.

Ah ok. In terms of security I don't tend to think of memory safety, etc. especially since PHP processes die fast. I thought everyone was talking about SQL injections and the like so I was very confused Thanks for clarifying!

https://www.cvedetails.com/vulnerability-list/vendor_id-74/p...

Wow those are interesting.

SQL Injection is still an issue if there are string concats every where and calling the DB, so that is something, that can still happen.

Re: WordPress on .NET

#66

Post by blowski »

emodendroket wrote: post #23
alistproducer2 wrote: post #21

I work at a large company and we are starting to branch out into other languages. the problem is most of our infrastructure in .NET. Something like this would be really cool as it would allow us to utilize PHP while not asking too much of infrastructure team. I might put in an OSS approval request for this.

I think you might be the first case I've heard of of someone wanting to go from .NET to PHP.

Most of my work in the past few years has been migrating .NET projects to PHP for enterprise clients. Especially with PHP 7, the performance is good, it's easier to hire for, and the total cost of ownership is lower. The doomsayers predicting poor security are wrong - it is just as possible to build a secure PHP system as a secure .NET system, and just as easy to build an insecure one.

Of course, it depends on the project and the company, so this isn't a universal truth. But there are definitely a lot of companies out there spending a fortune on a .NET stack that are looking to move to a PHP open source stack for good reasons.

Re: WordPress on .NET

#67

Post by blowski »

FraaJad wrote: post #51
mtgx wrote: post #12

Earlier quoted context omitted.

PHP 7 improved performance by around 3x compared to PHP5, so I wonder how true that still is.

The benchmarks http://www.peachpie.io/benchmarks show peachpie outperforming PHP7 easily by 100x.

On Azure, without Opcache enabled. That's not a very good comparison.

Re: WordPress on .NET

#68

Post by deckiedan »

pawadu wrote: post #61
deckiedan wrote: post #24

Earlier quoted context omitted.

WordPress security is complex. The core code is OK, security wise. Comparible to similar projects, I guess. The two major issues are that typically PHP runs with permission to modify the WordPress directory, which is useful for automatic upgrades, but means any exploit in any plugin, theme, etc. instantly becomes, "can replace WordPress". The other is that all themes and plugins are completely unsandboxed, and the qu…

> WordPress security is complex. This must be an oxymoron since complexity is the enemy of security. I think what you meant to say was > WordPress security is at best ad-hoc, and mostly non-existing

I was replying to

> show me if security is improved! > (which for Wordpress can't be that hard)

that is, to say that the concept of 'WordPress Security' isn't a single simple thing to 'improve'. Unfortunately. If you wrote a set of 10 jillion tests and proved that wordpress core has no possible security vulnerabilities (humour me), that still would not fix 'WordPress Security'.

From a theoretical point of view, you're absolutely right, and I agree with you.

From a practical point of view, WordPress is often 'good enough', and 'works well enough', and has 'few enough security issues', for many people.

Improving security is great, but it's a complex, perhaps impossible problem.

Re: WordPress on .NET

#69

Post by josefresco »

pawadu wrote: post #62
josefresco wrote: post #47

Earlier quoted context omitted.

You're seriously out of touch if you think the WP Core is not secure. You must realize they have a very competent team ( https://automattic.com/ ), not to mention thousands of OSS developers that continually contribute. Does your company, or does this small team of techs even come close? https://wordpress.org/about/security/

not even have a very competent team can put enough lipstick on this pig: http://www.cvedetails.com/vulnerability-list/vendor_id-2337/...

What you're missing is that these security exploits are discovered, patched and disclosed. The same can't be said about most tech services / products. Security through obscurity is not a viable strategy.

Re: WordPress on .NET

#70

Post by CharlesW »

FraaJad wrote: post #51
mtgx wrote: post #12

Earlier quoted context omitted.

PHP 7 improved performance by around 3x compared to PHP5, so I wonder how true that still is.

The benchmarks http://www.peachpie.io/benchmarks show peachpie outperforming PHP7 easily by 100x.

For some of the operations highlighted, which are (naturally?) selected to impress. For others, the multiple is in single digits.

WordPress doesn't run 100X faster on Peachpie, but it'd be very interesting to see "real" benchmarks. Even a 2X improvement (vs the latest PHP 7, of course) would be compelling.

Post reply on HN