Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Whitehouse.gov Chooses WordPress, Again

pagely.com

Post reply on HN
Print view View original

151–160 of 371 posts

Re: Whitehouse.gov Chooses WordPress, Again

#151

Post by [deleted] »

falcolas wrote: post #99
rapind wrote: post #93

Earlier quoted context omitted.

> A bad idea, IMO. It's still going through the PHP server and all of the routing/plugin/DB code within WP. Much better to use Varnish (and its ilk) and avoid overloading the PHP service. I'm not a big WP fan, but this statement is false in most cases. Page caching in WordPress is usually (always?) serving up the pre-rendered HTML direct from disk (or CDN) without hitting PHP. Pagely (the post we're discussing) even…

> Page caching in WordPress is usually (always?) serving up the pre-rendered HTML direct from disk I'd be very curious how a WP plugin is managing this. Third party hosting building in caching, normal in-line caches (like Varnish), nginx/apache caching, sure - I get those, and they behave how you say. But a WP plugin? I'm curious how that would bypass PHP & WP entirely.

[deleted]

Re: Whitehouse.gov Chooses WordPress, Again

#153

Post by 1over137 »

splatzone wrote: post #94
falcolas wrote: post #85

Earlier quoted context omitted.

> You don't have to do this I updated my original comment here. > A good practice is to set up your own cron job on the server and disable the internal cron in your wp-config.php Defaults matter. And when I was working on it, this wasn't well documented anywhere. If it is now, great. It shouldn't be the default. > Just install a page caching plugin of your choice[1] A bad idea, IMO. It's still going through the PHP s…

You touch on a really good point here about the default cron setting (yes, it still uses the lazy cron on page load by default.) From a developer point of view this is questionable at best, but from a business point of view I reckon decisions like these are the core of why WordPress is popular. You don't have to know what cron is to install a WordPress site. You don't have to know anything about git or setting up var…

>But this tradeoff in the favour of user experience had made it easy for millions of people to set up their own website

Indeed. And so many commentators here on HN (myself included) bemoan FAANG centralization and wish for decentralization and federation and the like... well, this tradeoff is relevant in that matter.

Re: Whitehouse.gov Chooses WordPress, Again

#155

Post by slouch »

Abishek_Muthian wrote: post #113

Few years back I heard in the Google Dev conference that they are going to partner with WP/Automattic to make it more secure among other things. What happened to it? I feel improving the security architecture of plugin integration could go a long way. Although using lesser plugins, only from trusted developers, keeping them updated, using other security plugins(Firewall, 2FA etc.) and regular backups can help keep WP…

At least 4 Google developers contributed to WordPress 5.6

Re: Whitehouse.gov Chooses WordPress, Again

#156

Post by Falkon1313 »

fermienrico wrote: post #47
blhack wrote: post #31

Earlier quoted context omitted.

“JavaScript, APIs, Markup”

For a second I thought you're being sarcastic until I looked it up.

Next thing we know, the kids these days will invent some mindblowing new concept like "HappyText Makestuff Language" aka HTML that actually allows you to link to other documents!

Re: Whitehouse.gov Chooses WordPress, Again

#157

Post by throw_m239339 »

userbinator wrote: post #38
astrowilliam wrote: post #28

Earlier quoted context omitted.

IE11 will soon be a security hazard and not worth the effort to code for.

Please stop spreading misinformation. https://docs.microsoft.com/en-us/lifecycle/faq/internet-expl... "Internet Explorer 11 is the last major version of Internet Explorer. Internet Explorer 11 will continue receiving security updates and technical support for the lifecycle of the version of Windows on which it is installed."

> Please stop spreading misinformation.

IE is already a security hazard for users. IE doesn't support any of the content security policies implemented in other modern browsers, which makes its a target for every possible XSS scheme and what not.

https://caniuse.com/?search=csp

If your users use IE you are putting them at greater risk than any other browser users and the former should be actively discouraged to do so.

Re: Whitehouse.gov Chooses WordPress, Again

#158

Post by captn3m0 »

coldtea wrote: post #150
falcolas wrote: post #61

Earlier quoted context omitted.

Simplicity? Perhaps in its use, but not the code. The code and hosting requirements are, frankly, Frankenstein's monster levels of frightening. ~~You have to~~ WP expect you to install it such that it can modify its install folders - all of them. Security-fucking-nightmare. It will use incoming requests to trigger "cron" jobs (which can include self-upgrades), via a non-loopback HTTP request. It falls apart under any…

> Simplicity? Perhaps in its use, but not the code. Nobody but other devs cares about the simplicity of the code if the code works. > The code and hosting requirements are, frankly, Frankenstein's monster levels of frightening. Huh? Wordpress/PHP hosting requirements are the easiest to meet in the industry. Not to mention the most widely available... > ~~You have to~~ WP expect you to install it such that it can modi…

Wordpress is also the only CMS that offers multisite hosting - single codebase, single webserver, one docker container - for running multiple sites with different configuration.

You wanna run 2 blogs on Ghost - run 2 instances, same for _everything but Wordpress_.

Re: Whitehouse.gov Chooses WordPress, Again

#159

Post by nsomaru »

splatzone wrote: post #79
falcolas wrote: post #61

Earlier quoted context omitted.

Simplicity? Perhaps in its use, but not the code. The code and hosting requirements are, frankly, Frankenstein's monster levels of frightening. ~~You have to~~ WP expect you to install it such that it can modify its install folders - all of them. Security-fucking-nightmare. It will use incoming requests to trigger "cron" jobs (which can include self-upgrades), via a non-loopback HTTP request. It falls apart under any…

WordPress is not without its design flaws, some of which make sense from the point of view of helping non-techies run their own sites (such as making updates easy.) But as someone who has built 100s of sites with WordPress I feel the need to defend it on a few points here: > You have to let it modify its install. Security-fucking-nightmare. You don't have to do this, you can set up sane permissions and use the wp cli…

> I prefer to version sites with git and install updates locally, then git pull down on to the live server.

I’m working on my first WP project and am trying this approach. A question I have is how do you handle plugins that have hooks that only run once when installed? Those hooks don’t run if you pull in via git. Also if they make changes to the dB (migrations), how is that managed if the plug-in was installed on a different server?

Re: Whitehouse.gov Chooses WordPress, Again

#160

Post by judge2020 »

mmgutz wrote: post #144

Let's not forget this is the government. You can't simply just build stuff. There are many levels of red tape. Software has to be approved, etc. It's far easier to stay with the status quo and use what's already been approved then try to convince management there are simpler, more secure ways of building sites.

On the other hand, whitehouse.gov being the target of a zero-day WP exploit isn’t going to be a huge deal since it’s just a website for putting public available, or soon-to-be publicly available stuff. The only big attack vector i can see is it being used as a sure-fire way to target senior administration officials with other exploits like a chrome or Firefox zero-day.
Post reply on HN