Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Whitehouse.gov Chooses WordPress, Again

pagely.com

Post reply on HN
Print view View original

131–140 of 371 posts

Re: Whitehouse.gov Chooses WordPress, Again

#131

Post by earthboundkid »

kijin wrote: post #122
falcolas wrote: post #104

Earlier quoted context omitted.

I realize that it's really written for end users instead of developers, but that means scares me every time I see something as high profile as the White House using it. For the exact reason as you say here: "it's easy to shoot yourself in the foot and get your site hacked". WP is absolutely NOT secure by design; it's a hot mess that has helped normalize ignoring security in our web applications. That we encourage its…

Hopefully the White House has access to someone who knows how to set up WordPress without shooting themselves in the foot. The fact that WordPress.com doens't get hacked all the time means that there are definitely people who know how to do it.

Yes, but there are also a lot of people who don’t. I still use an RSS reader and basically every six months, a blog that I followed 5 years back and went dark will get taken over by spammers because no one was paying attention to it anymore.

Re: Whitehouse.gov Chooses WordPress, Again

#132

Post by stickfigure »

kristopolous wrote: post #50
manigandham wrote: post #22

Earlier quoted context omitted.

Yes because Wordpress includes frontend rendering (of both the actual pages and the backend admin) by default. This means you get working HTML powered by dynamic content out of the box, and it keeps working as content changes without needing constant builds for static sites. I see the benefits of modern component-driven frontend systems but I think the better opportunity would be to integrate this cleanly into existi…

Wordpress also has a really rich ecosystem of mature and widely used plugins that are quite easy to install. The podcast ones for instance, they'll allow you to schedule the publishing of a new episode, then upload the episode to all the major platforms, format the images, titles and descriptions automatically for the different platforms, cross post to the social media accounts announcing the new episode, allow you t…

> rich ecosystem of mature and widely used plugins

...which is a bit like Russian Roulette.

Re: Whitehouse.gov Chooses WordPress, Again

#133

Post by 0xbadcafebee »

Since it mentions they're using NewRelic, I thought I'd mention a fun potential security hole for those using AWS integrations (and probably others). You have to create a custom read-only IAM role to absorb all the AWS events into NewRelic. But if you don't put in your particular NewRelic customer ID in the policy, the policy allows any customer in NewRelic to add that AWS account to their own NewRelic account and ingest its metrics. Since you don't have to include the customer ID in the role to make the integration work, it's likely there are a lot of AWS accounts out there with misconfigured IAM policies allowing any unscrupulous NewRelic customer to view their metrics.

Re: Whitehouse.gov Chooses WordPress, Again

#134

Post by earthboundkid »

irrational wrote: post #82
thayne wrote: post #45

Earlier quoted context omitted.

From an operations perspective, gatsby and next.js are much simpler though. You are just deploying static content behind a webserver or even something like s3. Horizontal scaling is almost trivial. With wordpress though, you have to worry about a database as well, scaling is more complicated, you need to run php on your webservers (which has security implications), updates that include schema updates frequently requi…

Wait, what non-trivial site doesn’t require a database?

JSON files in a git repo will get you really far if you want it to.

Re: Whitehouse.gov Chooses WordPress, Again

#135

Post by 9935c101ab17a66 »

Glyptodon wrote: post #83
westoque wrote: post #4

I hope we again see the value of using systems like Wordpress for it’s simplicity in getting a blog/website setup and easily modify content. Lately most of the modern marketing websites I see is built using gatsby and next.js. Having been talking to different content/marketing teams, they hate it so much because of the complexity it brings. Editing content? Sign in to this headless CRM app, want a form? Go sign in to…

Is there a CMS that has a Wordpress-like admin panel and content editing tools that builds and deploys the needed updates to a static site when you save an article, etc.?

Yes, there are lots now! There are some good ones, but some are definitely way pricier than I think they should be. With Next.js, you can even use Wordpress as a cms to back a static blog (https://github.com/vercel/next.js/tree/canary/examples/cms-w...)

Just a few off the top of my head:

- https://graphcms.com - https://prismic.io - https://www.sanity.io - https://www.datocms.com/ - https://www.cosmicjs.com/

More at the top of this Next.js docs page:

https://nextjs.org/docs/basic-features/data-fetching#simple-...

I've spent quite a bit of time playing with Nextjs, so if you have more specific questions feel free to let me know.

Re: Whitehouse.gov Chooses WordPress, Again

#136

Post by earthboundkid »

jakelazaroff wrote: post #11
westoque wrote: post #4

I hope we again see the value of using systems like Wordpress for it’s simplicity in getting a blog/website setup and easily modify content. Lately most of the modern marketing websites I see is built using gatsby and next.js. Having been talking to different content/marketing teams, they hate it so much because of the complexity it brings. Editing content? Sign in to this headless CRM app, want a form? Go sign in to…

Is that because WordPress is simple , though? There are similar CMSes you can use with e.g. Gatsby. They’re just a glorified build systems, after all — there’s nothing inherently complex about the content management experience. And on the flip side, it’s possible to load up WordPress with enough plugins that it becomes a nightmare to use. I think we see people choose WordPress because it’s familiar, popular, battle-t…

Wordpress makes sense if the goals are:

- Big upfront design

- Leverage existing plugins to minimize new development

- Use managed hosting

- Hand off to non-technical or semi-technical people and spin down development to just occasional contract work

If you actually have a FTE developer, it doesn’t fit as well at all. Among other problems, it does not work with a git centric development flow, which any modern dev will insist on.

Re: Whitehouse.gov Chooses WordPress, Again

#137

Post by thwarted »

splatzone wrote: post #94
falcolas wrote: post #85

Earlier quoted context omitted.

> You don't have to do this I updated my original comment here. > A good practice is to set up your own cron job on the server and disable the internal cron in your wp-config.php Defaults matter. And when I was working on it, this wasn't well documented anywhere. If it is now, great. It shouldn't be the default. > Just install a page caching plugin of your choice[1] A bad idea, IMO. It's still going through the PHP s…

You touch on a really good point here about the default cron setting (yes, it still uses the lazy cron on page load by default.) From a developer point of view this is questionable at best, but from a business point of view I reckon decisions like these are the core of why WordPress is popular. You don't have to know what cron is to install a WordPress site. You don't have to know anything about git or setting up var…

There is a big conflict here between what is practical for users and what is best practice for developers.

What about the conflict between what is practical for users and what is best practice for users?

Security isn't just a developer's concern. Having to clean up a hacked WordPress site because of crappy defaults isn't very practical for users, either.

Re: Whitehouse.gov Chooses WordPress, Again

#138

Post by kortilla »

falcolas wrote: post #85
splatzone wrote: post #79

Earlier quoted context omitted.

WordPress is not without its design flaws, some of which make sense from the point of view of helping non-techies run their own sites (such as making updates easy.) But as someone who has built 100s of sites with WordPress I feel the need to defend it on a few points here: > You have to let it modify its install. Security-fucking-nightmare. You don't have to do this, you can set up sane permissions and use the wp cli…

> You don't have to do this I updated my original comment here. > A good practice is to set up your own cron job on the server and disable the internal cron in your wp-config.php Defaults matter. And when I was working on it, this wasn't well documented anywhere. If it is now, great. It shouldn't be the default. > Just install a page caching plugin of your choice[1] A bad idea, IMO. It's still going through the PHP s…

> It's still going through the PHP server and all of the routing/plugin/DB code within WP. Much better to use Varnish (and its ilk) and avoid overloading the PHP service.

This is incorrect. WP supercache generates static html that takes precedence over falling back to the php engine. This is the way it worked nearly a decade ago too.

I wish people wouldn’t spend so much effort bad-mouthing technology they don’t even understand. I don’t even like Wordpress but reading this is super annoying.

Re: Whitehouse.gov Chooses WordPress, Again

#139

Post by kortilla »

falcolas wrote: post #80
ceejayoz wrote: post #77

Earlier quoted context omitted.

> It is if your users expect to be able to add plugins themselves, or you want it to do automatic version upgrades. I'm fairly certain for the White House's sort of use case this is not an issue. > Using a filesystem reset is a nice way around WP's requirements. I'd personally hesitate to rely on it for a popular site, since it still leaves a site vulnerable to code injection for those 24 hours. We did not permit it…

> I'm fairly certain for the White House's sort of use case this is not an issue. One can only hope. > We did not permit it to have write access to its own filesystem, at all. It worked fine. Cool beans - you installed it sanely. But contrary to how WP expects to be installed. I've corrected the original statement.

> But contrary to how WP expects to be installed.

No, this is incorrect. WP is compatible with no write access and recognizes it in the default setup workflow.

Post reply on HN