Whitehouse.gov Chooses WordPress, Again • Hacker News Board

Re: Whitehouse.gov Chooses WordPress, Again

#271

Post by iso1210 » Sun, Jan 24, 2021, 2:10 PM UTC

bartread wrote: post #249

YetAnotherNick wrote: post #239

Earlier quoted context omitted.

How do you test wordpress without deploying it? \s

We do it with a secondary copy of our website. Honestly though, there's a lot of talk about changes here without much talk of the most obvious class of changes that Wordpress is designed to support: adding content to your website or blog. For all its faults it does make that very easy, and it's designed with the intent that you will do so by working directly on the live site (you can obviously preview and review cont…

Indeed, I have 3 copies of my wordpress site.

The main one, where people update content.

Then there's a backup that gets auto restored every morning (with appropiate sed etc to change URLS), which is suitable for developing and testing any code changes

The third is one which is manually restored from the backup, and suitable for longer term experiments, how best to organise pages, etc.

Re: Whitehouse.gov Chooses WordPress, Again

#272

Post by lhorie » Sun, Jan 24, 2021, 2:14 PM UTC

falcolas wrote: post #61

westoque wrote: post #4

I hope we again see the value of using systems like Wordpress for it’s simplicity in getting a blog/website setup and easily modify content. Lately most of the modern marketing websites I see is built using gatsby and next.js. Having been talking to different content/marketing teams, they hate it so much because of the complexity it brings. Editing content? Sign in to this headless CRM app, want a form? Go sign in to…

Simplicity? Perhaps in its use, but not the code. The code and hosting requirements are, frankly, Frankenstein's monster levels of frightening. ~~You have to~~ WP expect you to install it such that it can modify its install folders - all of them. Security-fucking-nightmare. It will use incoming requests to trigger "cron" jobs (which can include self-upgrades), via a non-loopback HTTP request. It falls apart under any…

The difficulties you mentioned seem naive at best. Throwing a cache in front of a high traffic site is common sense these days and not really stack-specific; keeping up with security updates is hard with any stack (npm package upgrades can be quite the nightmare); installing... have fun docker composing your app with a mysql image, I guess?

IMHO, this isn't that fair of a characterization of WordPress in the first place, considering that the alternatives that the GP mentioned don't come close to doing half of what WordPress can do. I could similarly sing praises about how static site generators are so much easier to maintain as a developer than next.js + whatever you cobbled up to handle data persistence, CMS auth, admin UI, SEO, domain specific logic (drafting, theming, social media integration, etc), but again, it's very much an apples vs oranges comparison.

Re: Whitehouse.gov Chooses WordPress, Again

#273

Post by kichimi » Sun, Jan 24, 2021, 2:16 PM UTC

Little warning for anyone reading these comments:

100% of the criticism will be by devs with little or no experience with WordPress.

It's almost an in-joke to hate on WordPress at this point.

Re: Whitehouse.gov Chooses WordPress, Again

#274

Post by herve76 » Sun, Jan 24, 2021, 2:19 PM UTC

Is it 2010 Again?

Re: Whitehouse.gov Chooses WordPress, Again

#275

Post by johnchristopher » Sun, Jan 24, 2021, 2:31 PM UTC

> Dave Amirault, Pagely’s Director of Marketing, and Jeff Matson, Minister of Propaganda, have had a few moments to gather their first impressions of the site.

I had to google that because for a split second I thought the US had a minister of Propaganda. It's a job title at Pagely.

Re: Whitehouse.gov Chooses WordPress, Again

#276

Post by belorn » Sun, Jan 24, 2021, 2:38 PM UTC

coldtea wrote: post #150

falcolas wrote: post #61

Earlier quoted context omitted.

Simplicity? Perhaps in its use, but not the code. The code and hosting requirements are, frankly, Frankenstein's monster levels of frightening. ~~You have to~~ WP expect you to install it such that it can modify its install folders - all of them. Security-fucking-nightmare. It will use incoming requests to trigger "cron" jobs (which can include self-upgrades), via a non-loopback HTTP request. It falls apart under any…

> Simplicity? Perhaps in its use, but not the code. Nobody but other devs cares about the simplicity of the code if the code works. > The code and hosting requirements are, frankly, Frankenstein's monster levels of frightening. Huh? Wordpress/PHP hosting requirements are the easiest to meet in the industry. Not to mention the most widely available... > ~~You have to~~ WP expect you to install it such that it can modi…

If people avoid installing plugins and custom themes, and absolutely do not change the theme so that automatic updates have to be turned off, and they also install automatic updates, then its pretty fine.

As someone who works professionally at a hosting company, no one does this. The history of Wordpress security has followed window XP with users who downloads random files from the internet and click cancel every time something want to update. Every hosting company that I know has to implement firewall rules to address WordPress security, just like the old days of windows.

The default configuration is also not fine. At minimum you need to disable rpc calls to the login, as the password attacks trigger a lot work that eats resources and processes. RPC is on per default in order to make the WordPress mobile app work.

Re: Whitehouse.gov Chooses WordPress, Again

#277

Post by prox » Sun, Jan 24, 2021, 2:47 PM UTC

laumars wrote: post #226

coldtea wrote: post #150

Earlier quoted context omitted.

> Simplicity? Perhaps in its use, but not the code. Nobody but other devs cares about the simplicity of the code if the code works. > The code and hosting requirements are, frankly, Frankenstein's monster levels of frightening. Huh? Wordpress/PHP hosting requirements are the easiest to meet in the industry. Not to mention the most widely available... > ~~You have to~~ WP expect you to install it such that it can modi…

The NFS requirement for multiple Wordpress hosts are an instant deal breaker for me when discussing CMS on the cloud. Wordpress made sense when the web was a collection of independent servers. However in today’s cloud-orientated hosting landscape there are a thousand better ways to provide said content. Both at the beginner level and at the enterprise.

What are a few of the better ways you would suggest at the moment? (Honest question from a WP dev?)

Re: Whitehouse.gov Chooses WordPress, Again

#278

Post by johnchristopher » Sun, Jan 24, 2021, 2:48 PM UTC

This thread is full of pro and anti wordpress/php and of anti and pro jamstack.

I'd like to see the project's requirements.

Re: Whitehouse.gov Chooses WordPress, Again

#279

Post by nkozyra » Sun, Jan 24, 2021, 2:49 PM UTC

aheckler wrote: post #238

nkozyra wrote: post #29

Earlier quoted context omitted.

There's no single metric, but in particular I believe that inherent inefficiency with WordPress design will incur more cost to scale, as an example. Not to mention things little security issues. I don't have an agenda against WordPress and very often when people ask me what they should use for simple projects I say "just use WordPress." My rule of thumb is that will probably be alright for a simple, small project, bu…

> inherent inefficiency with WordPress design will incur more cost to scale Check out Cloudflare's Automatic Platform Optimization tool from last year [0]. It uses Workers to cache static and dynamic content from WordPress on the edge. Just $5/month. IMHO, that would "scale reasonably" for many use cases. [0] https://blog.cloudflare.com/automatic-platform-optimizations...

CDN literally everything is - to me - a last resort you can use when your underlying application cannot handle any direct traffic.

It's an expensive compromise that you shouldn't need unless you're in Alexa top 100 territory.

Re: Whitehouse.gov Chooses WordPress, Again

#280

Post by snowwrestler » Sun, Jan 24, 2021, 2:52 PM UTC

falcolas wrote: post #61

westoque wrote: post #4

I hope we again see the value of using systems like Wordpress for it’s simplicity in getting a blog/website setup and easily modify content. Lately most of the modern marketing websites I see is built using gatsby and next.js. Having been talking to different content/marketing teams, they hate it so much because of the complexity it brings. Editing content? Sign in to this headless CRM app, want a form? Go sign in to…

Simplicity? Perhaps in its use, but not the code. The code and hosting requirements are, frankly, Frankenstein's monster levels of frightening. ~~You have to~~ WP expect you to install it such that it can modify its install folders - all of them. Security-fucking-nightmare. It will use incoming requests to trigger "cron" jobs (which can include self-upgrades), via a non-loopback HTTP request. It falls apart under any…

WP only needs to modify itself if it updates itself. You can manage updates yourself with a git or even a CI workflow if you want to. These work the same way for WP as they do for a static blog codebase.

Or, you can keep folders locked down until it’s time to update, then unlock and let it update itself, then re-lock the permissions. This can be done manually or with a job scheduler.

WP needs a caching strategy for performance but so do static blog generators. The static copy is the cache, and rebuilding it is the cache purge.

Edit to add: Wordpress is so popular there are dedicated hosting companies, which makes all this stuff super easy. I managed WP myself for years; now I just have an account at WP Engine and they handle all this stuff for me.