Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Whitehouse.gov Chooses WordPress, Again

pagely.com

Post reply on HN
Print view View original

331–340 of 371 posts

Re: Whitehouse.gov Chooses WordPress, Again

#331

Post by laumars »

coldtea wrote: post #291
laumars wrote: post #226

Earlier quoted context omitted.

The NFS requirement for multiple Wordpress hosts are an instant deal breaker for me when discussing CMS on the cloud. Wordpress made sense when the web was a collection of independent servers. However in today’s cloud-orientated hosting landscape there are a thousand better ways to provide said content. Both at the beginner level and at the enterprise.

> The NFS requirement for multiple Wordpress hosts are an instant deal breaker for me when discussing CMS on the cloud. There's no "NFS requirement for multiple Wordpress hosts" tho.

In theory that’s true but in practice there needs to be a common file system for WP to function properly otherwise you end up with a lot of kludges that break the admin panel or that adds other caveats to WPs normal behaviour.

Re: Whitehouse.gov Chooses WordPress, Again

#332

Post by laumars »

prox wrote: post #277
laumars wrote: post #226

Earlier quoted context omitted.

The NFS requirement for multiple Wordpress hosts are an instant deal breaker for me when discussing CMS on the cloud. Wordpress made sense when the web was a collection of independent servers. However in today’s cloud-orientated hosting landscape there are a thousand better ways to provide said content. Both at the beginner level and at the enterprise.

What are a few of the better ways you would suggest at the moment? (Honest question from a WP dev?)

That very much depends on a case by case scenario.

I’ve seen WP used for everything from personal blogs, international news sites, shopping sites, and even fantasy sports games. The diversity of WP is definitely a strength. But it does mean that there’s not going to be a 1 size fits all alternative.

Re: Whitehouse.gov Chooses WordPress, Again

#333

Post by laumars »

snowwrestler wrote: post #286
laumars wrote: post #262

Earlier quoted context omitted.

Sorry, by “independent servers” I meant self hosting / on prem. And while that hasn’t gone away entirely it has diminished massively as companies deprecate on prem hardware as hardware ages and replaces those resources with cloud services. Stuff like NFS made sense for on prem but it’s a terrible solution for building services on AWS (for example). Security wise, any popular CMS will be a security nightmare. It’s not…

> Security wise, any popular CMS will be a security nightmare. I disagree, and I think it comes from a different understanding of what web security is. Popular CMS software benefits from millions of people hammering on installations. If the community constructs a sane process for handling vulnerability reports (and WP has), then the average user of that software benefits from a robust continuous testing regime that t…

You’re overlooking a key thing there though. You’re assuming every hack is a targeted one. And that simply isn’t the case.

Whenever a new vulnerability is discovered for WP (or any popular suite, be it a shop like Magento or message board like phpBB) you then get hordes of bots that trawl the internet looking for sites that run out of date versions of said software just for the purpose of hacking it. Even search engines become tools for bots to hunt out these insecure platforms.

I’m not someone who advocates security through obscurity however the vast majority of WP et al hacks are not targeted and thus a home grown CMS technically wouldn’t fall foul in the same way.

HOWEVER please don’t twist my words into saying that home grown CMSs are “more” secure. I’m making no such claim what-so-ever (and nor did I in my previous post when you want off on a soliloquy about how I apparently suggested that — I did no such thing!). My statement is and was only that any popular CMS will be a security nightmare. That point is very much true.

This is why I also brought up the point about WAF and additional policies on your admin path. The former buys you a little more time with updates (assuming you’re with a reputable WAF that supports the CMS platform you’re hiding against) because they can identify suspicious requests (ie ones that look like they’re triggering a known vulnerability) and simply block those requests from your site (technically the WAF is a reverse proxy with some firewalling, request heuristics, etc).

As for the point about admin policies: if you can IP whitelist who gets access to /admin then that saves you a lot of pain early on. But that’s obviously not always practical. However there are plenty of other ways to harden access.

Disclaimer: in a former life I used to repair and harden hacked CMSs, shops like Magento, etc.

Re: Whitehouse.gov Chooses WordPress, Again

#334

Post by laumars »

throw0101a wrote: post #309
laumars wrote: post #226

Earlier quoted context omitted.

The NFS requirement for multiple Wordpress hosts are an instant deal breaker for me when discussing CMS on the cloud. Wordpress made sense when the web was a collection of independent servers. However in today’s cloud-orientated hosting landscape there are a thousand better ways to provide said content. Both at the beginner level and at the enterprise.

> The NFS requirement for multiple Wordpress hosts are an instant deal breaker for me when discussing CMS on the cloud. Unless you have a very dynamic site (posts hourly, multi-daily), would making it static-y be a solution? * https://wp2static.com Do a post via web GUI, it gets written out to disk, and then you rsync (or auto- git or whatever) to distribute it.

Depends on a persons use case because but not all WP installs are blogs / news sites.

However if you can and are going down the static site route then I’d wager there are easier platforms to start with.

I built a static site generator that takes markdown files and “compiles” them to HTML using pandoc. The whole thing is just 1 shell script. But that use case also wouldn’t suite most other people.

So it really depends on what the team need and what the site does.

Re: Whitehouse.gov Chooses WordPress, Again

#335

Post by sneak »

marc_io wrote: post #267
sneak wrote: post #178

Earlier quoted context omitted.

The problem isn't LAMP, the problem is wordpress. It stores state that should be in files in the database, and state that should be in the database in files, so they are tightly coupled, and you have to snapshot both at the same time. It's also a security nightmare and runs dynamic code on every page load by default, so a fresh wordpress install in its default state will fall over when on HN on Reddit or Slashdot, un…

It's clearly not “bad” for a lot of people, as it powers a huge portion of websites, everywhere.

The vast majority of those people contract out the (complicated) maintenance in keeping it secure and performant, or they get hacked and their site goes down, or they get ~no traffic so performance doesn't matter and neither does their choice of blog software.

Entire large businesses (WPEngine, for example) have been built upon the overhead costs from blog operators having to compensate for it being a bad app.

My close friend is one of the sysadmins for the WP instance mentioned in TFA. Pull back the curtain and it's pretty ugly and resource-intensive to run WP at scale; I've done it myself.

Re: Whitehouse.gov Chooses WordPress, Again

#336

Post by [deleted] »

laumars wrote: post #329
apple4ever wrote: post #318

Earlier quoted context omitted.

There are plenty of ways of doing it without NFS.

CMS in general, yes. WP specifically, no. Often the “loads of ways” on WP require changing its normal behaviour and thus breaks ones ability to use the admin console. Or use some other kludge that might suit some subset of people some of the time. But ultimately it keeps coming back to kludges or other workarounds that introduce as many caveats as they solve.

[deleted]

Re: Whitehouse.gov Chooses WordPress, Again

#337

Post by schwartzworld »

ehnto wrote: post #220
shiftpgdn wrote: post #44

Earlier quoted context omitted.

JAM stack (this term is trademarked by Netlify, FYI) is such an awful trend for anyone but developers. The web runs on WordPress because it's SO easy for anyone to stand up a quality, functional website. I drop in on a local WordPress event a few times a year and many of the people there are 60+ and very much non technical but have put together great sites that benefit humanity.

> JAM stack (this term is trademarked by Netlify, FYI) is such an awful trend for anyone but developers JAMstack sites are annoying to build, so much minutiae and configuration, abstractions on top of abstractions, and you never own the codebase as it's frameworks and libraries all the way down. You spend half your time trying to figure out if X could work with Y, rather than just making X do Y's job by writing some…

> you never own the codebase as it's frameworks and libraries all the way down.

Frameworks and libraries aren't really necessary for JAMstack. JAMstack really just means relying on external services for dynamic content. You don't have to use Gatsby or Hugo or whatever. A JAMstack site can be a single HTML page with a script tag (and all mine usually are).

I built my own static site generator and I feel so much more ownership over the code. You should try it. Not only is it my code all the way down, but it only runs on my machine. All the generated assets will remain functional and security bug free as long as browsers understand HTML, CSS and JS, even if I never update the code again.

Re: Whitehouse.gov Chooses WordPress, Again

#338

Post by 0xbadcafebee »

XCSme wrote: post #224
0xbadcafebee wrote: post #121

WordPress is definitely the Jenkins of the CMS world. Easy for a desktop user to set up, absolutely trash for literally every best practice, but nobody's made anything better [for free] yet. If you are trying to deploy WordPress today with DevOps best practices (version control/12 factor app/etc): set it up with Bedrock ( https://roots.io/bedrock/ ), manage dependencies with Composer, and use environment variables fo…

I am not sure if this is relevant, but I just remember someone announcing this site yesterday: https://wpgitupdater.dev/

You can do this yourself with Dependabot for free. It's pretty easy to set up and you don't host anything to use it.

Re: Whitehouse.gov Chooses WordPress, Again

#339

Post by userbinator »

throw_m239339 wrote: post #157
userbinator wrote: post #38

Earlier quoted context omitted.

Please stop spreading misinformation. https://docs.microsoft.com/en-us/lifecycle/faq/internet-expl... "Internet Explorer 11 is the last major version of Internet Explorer. Internet Explorer 11 will continue receiving security updates and technical support for the lifecycle of the version of Windows on which it is installed."

> Please stop spreading misinformation. IE is already a security hazard for users. IE doesn't support any of the content security policies implemented in other modern browsers, which makes its a target for every possible XSS scheme and what not. https://caniuse.com/?search=csp If your users use IE you are putting them at greater risk than any other browser users and the former should be actively discouraged to do so.

XSS is only a problem if you make it one.

Maybe if you stop forcing your users into your authoritarian ideals, people might start to change their perception of you.

Re: Whitehouse.gov Chooses WordPress, Again

#340

Post by judge2020 »

XCSme wrote: post #221
judge2020 wrote: post #160

Earlier quoted context omitted.

On the other hand, whitehouse.gov being the target of a zero-day WP exploit isn’t going to be a huge deal since it’s just a website for putting public available, or soon-to-be publicly available stuff. The only big attack vector i can see is it being used as a sure-fire way to target senior administration officials with other exploits like a chrome or Firefox zero-day.

If it was an important target, would it make more sense to choose a somewhat more secure platform OR to build a proprietary solution?

I think it would definitely be better to do a SSG or even wordpress with static output since you can throw it all behind authentication, which greatly reduces the attack surface.
Post reply on HN