Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Whitehouse.gov Chooses WordPress, Again

pagely.com

Post reply on HN
Print view View original

221–230 of 371 posts

Re: Whitehouse.gov Chooses WordPress, Again

#221

Post by XCSme »

judge2020 wrote: post #160
mmgutz wrote: post #144

Let's not forget this is the government. You can't simply just build stuff. There are many levels of red tape. Software has to be approved, etc. It's far easier to stay with the status quo and use what's already been approved then try to convince management there are simpler, more secure ways of building sites.

On the other hand, whitehouse.gov being the target of a zero-day WP exploit isn’t going to be a huge deal since it’s just a website for putting public available, or soon-to-be publicly available stuff. The only big attack vector i can see is it being used as a sure-fire way to target senior administration officials with other exploits like a chrome or Firefox zero-day.

If it was an important target, would it make more sense to choose a somewhat more secure platform OR to build a proprietary solution?

Re: Whitehouse.gov Chooses WordPress, Again

#222

Post by iamacyborg »

newsbinator wrote: post #192
coldtea wrote: post #150

Earlier quoted context omitted.

> Simplicity? Perhaps in its use, but not the code. Nobody but other devs cares about the simplicity of the code if the code works. > The code and hosting requirements are, frankly, Frankenstein's monster levels of frightening. Huh? Wordpress/PHP hosting requirements are the easiest to meet in the industry. Not to mention the most widely available... > ~~You have to~~ WP expect you to install it such that it can modi…

> Nobody but other devs cares about the simplicity of the code if the code works. They care when you start quoting a week for a simple addition that should take an hour, because every time you have to wade into a mess, in which one wrong semicolon in functions.php brings down the entire website. Of course you test and you test, but you're surrounded by landmines at all times.

> in which one wrong semicolon in functions.php brings down the entire website.

Don’t immediately deploy code into prod until you’ve tested it?

Re: Whitehouse.gov Chooses WordPress, Again

#223

Post by trog »

daniellarusso wrote: post #190
trog wrote: post #101

Earlier quoted context omitted.

> You don't have to do this, you can set up sane permissions and use the wp cli[0] tool to install updates manually. I prefer to version sites with git and install updates locally, then git pull down on to the live server. Curious as to how you manage WP with git, particularly around when new files are added by core/plugin updates, which I've always found a bit of a hassle to deal with?

Check out the roots.io project for some software development ‘best practices’ as applied to Wordpress for development and deployment.

Thanks! Looks super interesting.

Re: Whitehouse.gov Chooses WordPress, Again

#224

Post by XCSme »

0xbadcafebee wrote: post #121

WordPress is definitely the Jenkins of the CMS world. Easy for a desktop user to set up, absolutely trash for literally every best practice, but nobody's made anything better [for free] yet. If you are trying to deploy WordPress today with DevOps best practices (version control/12 factor app/etc): set it up with Bedrock ( https://roots.io/bedrock/ ), manage dependencies with Composer, and use environment variables fo…

I am not sure if this is relevant, but I just remember someone announcing this site yesterday: https://wpgitupdater.dev/

Re: Whitehouse.gov Chooses WordPress, Again

#225

Post by dgb23 »

hmillison wrote: post #197
westoque wrote: post #4

I hope we again see the value of using systems like Wordpress for it’s simplicity in getting a blog/website setup and easily modify content. Lately most of the modern marketing websites I see is built using gatsby and next.js. Having been talking to different content/marketing teams, they hate it so much because of the complexity it brings. Editing content? Sign in to this headless CRM app, want a form? Go sign in to…

I built out a site using headless WP with Next.js as the frontend. With server side rendering of React, we still took advantage of caching the HTML in a CDN like you would with vanilla WP but it was much easier to build our own theme as desired with React. While configuring certain parts of Wordpress was tricky at times, especially because deploying it is at odds with the stateless nature of modern containerized infr…

Have you been using the preview feature of Next for this to allow for a fast feedback loop for content?

Re: Whitehouse.gov Chooses WordPress, Again

#226

Post by laumars »

coldtea wrote: post #150
falcolas wrote: post #61

Earlier quoted context omitted.

Simplicity? Perhaps in its use, but not the code. The code and hosting requirements are, frankly, Frankenstein's monster levels of frightening. ~~You have to~~ WP expect you to install it such that it can modify its install folders - all of them. Security-fucking-nightmare. It will use incoming requests to trigger "cron" jobs (which can include self-upgrades), via a non-loopback HTTP request. It falls apart under any…

> Simplicity? Perhaps in its use, but not the code. Nobody but other devs cares about the simplicity of the code if the code works. > The code and hosting requirements are, frankly, Frankenstein's monster levels of frightening. Huh? Wordpress/PHP hosting requirements are the easiest to meet in the industry. Not to mention the most widely available... > ~~You have to~~ WP expect you to install it such that it can modi…

The NFS requirement for multiple Wordpress hosts are an instant deal breaker for me when discussing CMS on the cloud.

Wordpress made sense when the web was a collection of independent servers. However in today’s cloud-orientated hosting landscape there are a thousand better ways to provide said content. Both at the beginner level and at the enterprise.

Re: Whitehouse.gov Chooses WordPress, Again

#227

Post by mudlark »

westoque wrote: post #4

I hope we again see the value of using systems like Wordpress for it’s simplicity in getting a blog/website setup and easily modify content. Lately most of the modern marketing websites I see is built using gatsby and next.js. Having been talking to different content/marketing teams, they hate it so much because of the complexity it brings. Editing content? Sign in to this headless CRM app, want a form? Go sign in to…

They can just static dump a site, bar search, and most issues vanish.

Re: Whitehouse.gov Chooses WordPress, Again

#229

Post by faeyanpiraat »

gnicholas wrote: post #71
imwally wrote: post #62

I was curious after seeing the accessibility statement what the previous administration's had. https://www.whitehouse.gov/accessibility/ https://obamawhitehouse.archives.gov/accessibility https://georgewbush-whitehouse.archives.gov/accessibility.ht... https://trumpwhitehouse.archives.gov/accessibility With that last one not being surprising at all.

I was surprised that the accessibility widget on the current website has a feature called “high contrast mode” that does not significantly increase the contrast ratio between the primary text and the background. It also significantly lowers the contrast between the secondary text and the background, sometimes as low as 2.1 (7 is the recommended minimum). Given the icon they chose, it seems like “dark mode” would be a…

A data point to support your claim: The main body text becomes white on dark grey with a contrast ratio of 14.22, compared to the original dark blue text on white background with a contrast ratio of 14.93.

Re: Whitehouse.gov Chooses WordPress, Again

#230

Post by mudlark »

kortilla wrote: post #138
falcolas wrote: post #85

Earlier quoted context omitted.

> You don't have to do this I updated my original comment here. > A good practice is to set up your own cron job on the server and disable the internal cron in your wp-config.php Defaults matter. And when I was working on it, this wasn't well documented anywhere. If it is now, great. It shouldn't be the default. > Just install a page caching plugin of your choice[1] A bad idea, IMO. It's still going through the PHP s…

> It's still going through the PHP server and all of the routing/plugin/DB code within WP. Much better to use Varnish (and its ilk) and avoid overloading the PHP service. This is incorrect. WP supercache generates static html that takes precedence over falling back to the php engine. This is the way it worked nearly a decade ago too. I wish people wouldn’t spend so much effort bad-mouthing technology they don’t even…

Caching is hard. Drupal used to, may still use the dB for caches. So you get pool issues. You have to also throttle features, like site Search or other intensive scripts. So in the main the internal caching is a step up from none.
Post reply on HN