Whitehouse.gov Chooses WordPress, Again • Hacker News Board

Re: Whitehouse.gov Chooses WordPress, Again

#61

Post by falcolas » Sun, Jan 24, 2021, 2:35 AM UTC

westoque wrote: post #4

I hope we again see the value of using systems like Wordpress for it’s simplicity in getting a blog/website setup and easily modify content. Lately most of the modern marketing websites I see is built using gatsby and next.js. Having been talking to different content/marketing teams, they hate it so much because of the complexity it brings. Editing content? Sign in to this headless CRM app, want a form? Go sign in to…

Simplicity? Perhaps in its use, but not the code. The code and hosting requirements are, frankly, Frankenstein's monster levels of frightening.

~~You have to~~ WP expect you to install it such that it can modify its install folders - all of them. Security-fucking-nightmare.

It will use incoming requests to trigger "cron" jobs (which can include self-upgrades), via a non-loopback HTTP request.

It falls apart under any kind of load, both because of unoptimized DB queries, and because of PHP. You have to put a cache in front of it to be able to handle getting on HN, let alone Reddit.

Arbitrary plugin installation, in a non-sandboxed environment (see prior point about an application-writable install). Need more be said?

You really have to dedicate an admin to it if you want to keep it secure and performant. I still get angry remembering my experience installing, securing, and setting up caching in front of it.

Re: Whitehouse.gov Chooses WordPress, Again

#62

Post by imwally » Sun, Jan 24, 2021, 2:35 AM UTC

I was curious after seeing the accessibility statement what the previous administration's had.

https://www.whitehouse.gov/accessibility/

https://obamawhitehouse.archives.gov/accessibility

https://georgewbush-whitehouse.archives.gov/accessibility.ht...

https://trumpwhitehouse.archives.gov/accessibility

With that last one not being surprising at all.

Re: Whitehouse.gov Chooses WordPress, Again

#63

Post by chiefalchemist » Sun, Jan 24, 2021, 2:36 AM UTC

jakelazaroff wrote: post #11

westoque wrote: post #4

I hope we again see the value of using systems like Wordpress for it’s simplicity in getting a blog/website setup and easily modify content. Lately most of the modern marketing websites I see is built using gatsby and next.js. Having been talking to different content/marketing teams, they hate it so much because of the complexity it brings. Editing content? Sign in to this headless CRM app, want a form? Go sign in to…

Is that because WordPress is simple , though? There are similar CMSes you can use with e.g. Gatsby. They’re just a glorified build systems, after all — there’s nothing inherently complex about the content management experience. And on the flip side, it’s possible to load up WordPress with enough plugins that it becomes a nightmare to use. I think we see people choose WordPress because it’s familiar, popular, battle-t…

Gatsby isn't a CMS in the WP or Drupal sense of the word. Gatsby to me is more of an "integration first" minded architecture. That is, Gatsby is a way to unite multiple services, CMS's and content sources. But other than using .MD files Gatsby doesn't really have the ability to manage content in a true CMS sense. It's not like you log into some Gatsby admin panel and add content.

Re: Whitehouse.gov Chooses WordPress, Again

#64

Post by boyesm » Sun, Jan 24, 2021, 2:37 AM UTC

Looking through the FAQ on the USDS website that is linked in the source, it seems a lot less bureaucratic than I would've ever anticipated. No job descriptions, no dress code. It seems more like a startup than I would've expected from a government org.

https://www.usds.gov/faq

Re: Whitehouse.gov Chooses WordPress, Again

#65

Post by [deleted] » Sun, Jan 24, 2021, 2:37 AM UTC

partiallypro wrote: post #49

Good. Wordpress is battle tested, open source and in the right hands, secure. Twitter recently tried to dunk on the last administration's use of Wordpress at the State Dept, claiming they were hacked to show Trump had resigned, but it was just a disgruntled employee and was it never hacked.

[deleted]

Re: Whitehouse.gov Chooses WordPress, Again

#66

Post by kristopolous » Sun, Jan 24, 2021, 2:37 AM UTC

dannyw wrote: post #54

kristopolous wrote: post #50

Earlier quoted context omitted.

Wordpress also has a really rich ecosystem of mature and widely used plugins that are quite easy to install. The podcast ones for instance, they'll allow you to schedule the publishing of a new episode, then upload the episode to all the major platforms, format the images, titles and descriptions automatically for the different platforms, cross post to the social media accounts announcing the new episode, allow you t…

Governments should moderately prefer self-hosted solutions to cloud services, especially when a president just got banned from all social media platforms.

Great example. All of Trump's tweets are preserved at the National Archive, the department entrusted with doing that. https://www.newsweek.com/donald-trump-national-archive-tweet...

All of the concerns are handled by robust existing infrastructure. That's the point. That ultimately the website backend doesn't matter, our intuitive logic and apprehensions about this stuff simply doesn't apply

Let's take an extreme example, pretend they use GoDaddy as their registrar and someone falls for a phishing email hijacking the domain. The Whitehouse not only could probably seize it back with a single phone call but also get the right people on the phone to stop the DNS record propagation at the root servers as well.

It's kinda like how the police keep their cars running when they're parked and nowhere around. They don't have to worry the same way you and I do about someone smashing the window and driving off, the infrastructural support for their vehicle is vastly different.

Or how the president doesn't have to worry about when to leave for somewhere to beat traffic because the police literally clears the road the president is currently traveling on of all vehicles like Moses parting the sea. It's a completely different kind of logic

Re: Whitehouse.gov Chooses WordPress, Again

#67

Post by chiefalchemist » Sun, Jan 24, 2021, 2:40 AM UTC

For the sake of security and scale I hope they're serving pre-generated static pages. That is, WP is strictly a backend CMS, with frontend responsibility being delegated elsewhere.

At that point it's not full WP per se.

Re: Whitehouse.gov Chooses WordPress, Again

#68

Post by Krasnol » Sun, Jan 24, 2021, 2:41 AM UTC

I got the responsibility for a wordpress page and been told that they had some issues with the page not being available several times already.

After looking at the FTP, I've found out that the hoster locked down the page due to wordpress plugins which did not have been updated and turned into malware providers or something like that.

The whole thing is a monster. It has almost 30 plugins for the most stupid thing (like scrolling text). So the first thing I did was updating it. Unfortunately it looked messed up afterwards. So I rolled back the backup and started updating it one by one. I was left with one plugin which I could not remove or it would break down parts of the design. So I'm again left with an possible problem for the future.

The joke is: the page is mostly static. There is one single news section which has not been used for more than a year...I hate this thing...I wish I could give it to somebody to rebuild in plain HTML or something but the boss doesn't want it...

Re: Whitehouse.gov Chooses WordPress, Again

#69

Post by ceejayoz » Sun, Jan 24, 2021, 2:43 AM UTC

falcolas wrote: post #61

westoque wrote: post #4

I hope we again see the value of using systems like Wordpress for it’s simplicity in getting a blog/website setup and easily modify content. Lately most of the modern marketing websites I see is built using gatsby and next.js. Having been talking to different content/marketing teams, they hate it so much because of the complexity it brings. Editing content? Sign in to this headless CRM app, want a form? Go sign in to…

Simplicity? Perhaps in its use, but not the code. The code and hosting requirements are, frankly, Frankenstein's monster levels of frightening. ~~You have to~~ WP expect you to install it such that it can modify its install folders - all of them. Security-fucking-nightmare. It will use incoming requests to trigger "cron" jobs (which can include self-upgrades), via a non-loopback HTTP request. It falls apart under any…

> You have to let it modify its install. Security-fucking-nightmare.

You really don't. I've deployed it to Heroku, where the filesystem resets every 24h. It's a part of their famed five minute install for not-very-technical users on shared hosting, but it's by no means a requirement.

Re: Whitehouse.gov Chooses WordPress, Again

#70

Post by organsnyder » Sun, Jan 24, 2021, 2:43 AM UTC

viraptor wrote: post #51

Something1234 wrote: post #23

Earlier quoted context omitted.

add_shortcode is incredible. It's probably my favorite part of wordpress, and writing a plugin is so easy, just a single file zipped up or scp'd. Especially with custom post types or adding a new table.

> just a single file zipped up or scp'd And now your page displays a white page. Error in the log is an exception with no stacktrace/location. This was my experience in production a few times. It's a fun system if it works, but without a testing pipeline and a staging environment it's a lottery with a possible mystery breakage on every update/change.

> It's a fun system if it works, but without a testing pipeline and a staging environment it's a lottery with a possible mystery breakage on every update/change.

That describes every platform, programming language, layer of the stack, etc. that I've ever worked with.