Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Whitehouse.gov Chooses WordPress, Again

pagely.com

Post reply on HN
Print view View original

101–110 of 371 posts

Re: Whitehouse.gov Chooses WordPress, Again

#101

Post by trog »

splatzone wrote: post #79
falcolas wrote: post #61

Earlier quoted context omitted.

Simplicity? Perhaps in its use, but not the code. The code and hosting requirements are, frankly, Frankenstein's monster levels of frightening. ~~You have to~~ WP expect you to install it such that it can modify its install folders - all of them. Security-fucking-nightmare. It will use incoming requests to trigger "cron" jobs (which can include self-upgrades), via a non-loopback HTTP request. It falls apart under any…

WordPress is not without its design flaws, some of which make sense from the point of view of helping non-techies run their own sites (such as making updates easy.) But as someone who has built 100s of sites with WordPress I feel the need to defend it on a few points here: > You have to let it modify its install. Security-fucking-nightmare. You don't have to do this, you can set up sane permissions and use the wp cli…

> You don't have to do this, you can set up sane permissions and use the wp cli[0] tool to install updates manually. I prefer to version sites with git and install updates locally, then git pull down on to the live server.

Curious as to how you manage WP with git, particularly around when new files are added by core/plugin updates, which I've always found a bit of a hassle to deal with?

Re: Whitehouse.gov Chooses WordPress, Again

#102

Post by 1123581321 »

winrid wrote: post #81
falcolas wrote: post #61

Earlier quoted context omitted.

Simplicity? Perhaps in its use, but not the code. The code and hosting requirements are, frankly, Frankenstein's monster levels of frightening. ~~You have to~~ WP expect you to install it such that it can modify its install folders - all of them. Security-fucking-nightmare. It will use incoming requests to trigger "cron" jobs (which can include self-upgrades), via a non-loopback HTTP request. It falls apart under any…

I've been in the top 10 of HN and I think I saw at most 10-20RPS. My $5/mo VPS running WordPress can handle about 50rps for an article page...

50RPS must be tuned or cached in some way, as the memory load for 50 requests to the full app should overwhelm the 1GB server and ~50-100ms is typical and the $5 instance has one core.

Re: Whitehouse.gov Chooses WordPress, Again

#103

Post by unfocused »

I also host a Wordpress site for some non-technical people that are part of the legal community.

I chose it because they just need to publish basic info, much like most govt places, and all the non-tech people find it easy to add content.

It's been up and running for 8 years using the same webhost. Easy to keep up to date, and easy to use, and it solves their business problem.

Nothing wrong with WP when you just want to post simple information.

Re: Whitehouse.gov Chooses WordPress, Again

#104

Post by falcolas »

splatzone wrote: post #94
falcolas wrote: post #85

Earlier quoted context omitted.

> You don't have to do this I updated my original comment here. > A good practice is to set up your own cron job on the server and disable the internal cron in your wp-config.php Defaults matter. And when I was working on it, this wasn't well documented anywhere. If it is now, great. It shouldn't be the default. > Just install a page caching plugin of your choice[1] A bad idea, IMO. It's still going through the PHP s…

You touch on a really good point here about the default cron setting (yes, it still uses the lazy cron on page load by default.) From a developer point of view this is questionable at best, but from a business point of view I reckon decisions like these are the core of why WordPress is popular. You don't have to know what cron is to install a WordPress site. You don't have to know anything about git or setting up var…

I realize that it's really written for end users instead of developers, but that means scares me every time I see something as high profile as the White House using it. For the exact reason as you say here: "it's easy to shoot yourself in the foot and get your site hacked".

WP is absolutely NOT secure by design; it's a hot mess that has helped normalize ignoring security in our web applications. That we encourage its use, that we haven't replaced it with something better, is a damned travesty.

Re: Whitehouse.gov Chooses WordPress, Again

#105

Post by 1123581321 »

mattmanser wrote: post #27
pmarreck wrote: post #19

Earlier quoted context omitted.

Have you ever tried to customize or add functionality to Wordpress? Because if it’s anything like Drupal or other PHP based tech of a certain era, it’s hell

Yes, a few months ago, it was ridiculously easy. It literally took me 20 minutes to customize how the side bar was working and embed some new dynamic content. I even inherited off a parent theme so any updates to the theme wouldn't over-ride my changes. I've never even written much PHP in the past. I even added it into the the theme editor so the client could change the text/etc. themselves. Not sure what you did, bu…

That's one problem with Wordpress' default renders; it sends developers down those relatively narrow paths of customizing existing output. It's easy if requirements are flexible enough to allow that, but not the right CMS for truly customized content architecture and presentation.

Re: Whitehouse.gov Chooses WordPress, Again

#106

Post by qwerty456127 »

monoideism wrote: post #89

The one thing great about WordPress is the massive number of themes available (and plugins, if you're not a programmer). I wish very much that there were 10% as many attractive themes available for static sites. Yes, you can port them, but it's a pain. And yes, you can design them, but it takes more time and most programmers don't have the design chops to pull it off.

the massive number of themes available (and plugins, if you're not a programmer)

and ease of starting with an almost-free "unlimited" shared hosting.

These are the only 2 good things about WordPress.

> I wish very much that there were 10% as many attractive themes available for static sites. Yes, you can port them, but it's a pain.

That's what I always did whenever I needed a website design.

Re: Whitehouse.gov Chooses WordPress, Again

#107

Post by HotVector »

unfocused wrote: post #103

I also host a Wordpress site for some non-technical people that are part of the legal community. I chose it because they just need to publish basic info, much like most govt places, and all the non-tech people find it easy to add content. It's been up and running for 8 years using the same webhost. Easy to keep up to date, and easy to use, and it solves their business problem. Nothing wrong with WP when you just want…

My go-to for creating a static website to be managed by non-tech people is Svelte + some markdown renderer. I put all the info into Markdown files so it can be easily changed, kind of like Jekyll.

Re: Whitehouse.gov Chooses WordPress, Again

#108

Post by wslack »

boyesm wrote: post #64

Looking through the FAQ on the USDS website that is linked in the source, it seems a lot less bureaucratic than I would've ever anticipated. No job descriptions, no dress code. It seems more like a startup than I would've expected from a government org. https://www.usds.gov/faq

We're trying. There's still a lot of bureaucracy around USDS (which we work with to make things happen), but the org itself aims to be an excellent working environment. Happy to answer questions.

Re: Whitehouse.gov Chooses WordPress, Again

#109

Post by thayne »

irjustin wrote: post #57
thayne wrote: post #45

Earlier quoted context omitted.

From an operations perspective, gatsby and next.js are much simpler though. You are just deploying static content behind a webserver or even something like s3. Horizontal scaling is almost trivial. With wordpress though, you have to worry about a database as well, scaling is more complicated, you need to run php on your webservers (which has security implications), updates that include schema updates frequently requi…

Horizontal scaling for static content is just as trivial if not more trivial in WordPress with the plugins. [Edit] downvotes are fine but let's open up discussion. Further edit, WP has great static content manager plugins. It's not direct to S3 but a single server can handle a lot of traffic in that mode. The part that becomes significantly easier is updating that content or adding new ones. You don't need devops to…

I think we are talking about different things. I'm not talking about static assets that you use in your site. I mean the entire site is static, and thus doesn't require any database or any server-side page generation. Which means not only that it is easier to scale since you don't even have any state in the database, but each node can also handle more traffic, because it is doing less. (And if you something like s3 or github pages, or netlify, you don't even need to worry about individual servers).

> The part that becomes significantly easier is updating that content or adding new ones. You don't need devops to rebuild and redeploy.

From my perspective as an SRE, that's actually a bad thing. I've seen content creators take down big parts of the site because they changed or deleted an asset. Most of the time that could have been caught by automated tests as part of a build pipeline, if one had been in place.

There is certainly a trade-off though. Wordpress and Drupal are great for quick turnaround content creation and editing. If you want your changes to be live as soon as you make them , Wordpress is better at that than a static site generator. On the other hand if you want rock-solid stability, and want any changes to go through a gamut of automated tests, Wordpress is not a good fit. It is possible, but it definitely isn't easy.

Re: Whitehouse.gov Chooses WordPress, Again

#110

Post by yurishimo »

trog wrote: post #101
splatzone wrote: post #79

Earlier quoted context omitted.

WordPress is not without its design flaws, some of which make sense from the point of view of helping non-techies run their own sites (such as making updates easy.) But as someone who has built 100s of sites with WordPress I feel the need to defend it on a few points here: > You have to let it modify its install. Security-fucking-nightmare. You don't have to do this, you can set up sane permissions and use the wp cli…

> You don't have to do this, you can set up sane permissions and use the wp cli[0] tool to install updates manually. I prefer to version sites with git and install updates locally, then git pull down on to the live server. Curious as to how you manage WP with git, particularly around when new files are added by core/plugin updates, which I've always found a bit of a hassle to deal with?

The most common approach is to store everything but the wp-content folder in git, including plugins. A way to save space there is by using composer so your Repo only needs to include custom plugins that your team wrote.

It can be a hassle on shared hosts, but most managed hosts have a git workflow that their agency partners utilize so it’s not too bad if you’re doing anything on a professional level.

Post reply on HN