Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Whitehouse.gov Chooses WordPress, Again

pagely.com

Post reply on HN
Print view View original

351–360 of 371 posts

Re: Whitehouse.gov Chooses WordPress, Again

#351

Post by photomatt »

toast0 wrote: post #129
falcolas wrote: post #61

Earlier quoted context omitted.

Simplicity? Perhaps in its use, but not the code. The code and hosting requirements are, frankly, Frankenstein's monster levels of frightening. ~~You have to~~ WP expect you to install it such that it can modify its install folders - all of them. Security-fucking-nightmare. It will use incoming requests to trigger "cron" jobs (which can include self-upgrades), via a non-loopback HTTP request. It falls apart under any…

So much this. It's been a bit over five years since I had to run it, but this is what I remember. If you run multiple webservers, upgrading is extra fun, because when you upgrade, it assumes it can update the mysql schema (which is pretty much totally insane; a www-user writable php script shouldn't be able to create/remove/alter tables). The best way I found was to make a copy of the database, install the new versio…

This is the plugin we use to run WP databases across many servers and geographic locations: https://wordpress.org/plugins/hyperdb/

Re: Whitehouse.gov Chooses WordPress, Again

#352

Post by photomatt »

winrid wrote: post #81
falcolas wrote: post #61

Earlier quoted context omitted.

Simplicity? Perhaps in its use, but not the code. The code and hosting requirements are, frankly, Frankenstein's monster levels of frightening. ~~You have to~~ WP expect you to install it such that it can modify its install folders - all of them. Security-fucking-nightmare. It will use incoming requests to trigger "cron" jobs (which can include self-upgrades), via a non-loopback HTTP request. It falls apart under any…

I've been in the top 10 of HN and I think I saw at most 10-20RPS. My $5/mo VPS running WordPress can handle about 50rps for an article page...

Thank you for sharing. :)

Re: Whitehouse.gov Chooses WordPress, Again

#353

Post by thayne »

pembrook wrote: post #234
thayne wrote: post #45

Earlier quoted context omitted.

From an operations perspective, gatsby and next.js are much simpler though. You are just deploying static content behind a webserver or even something like s3. Horizontal scaling is almost trivial. With wordpress though, you have to worry about a database as well, scaling is more complicated, you need to run php on your webservers (which has security implications), updates that include schema updates frequently requi…

You’re not wrong, but you’re missing the point. The “operations” perspective is the least important perspective on any marketing site/blog. Design flexibility in production, marketing features and multi-author content production are the only thing that matters. Gatsby is built by developers, for developers. And it’s hilariously out of touch with the needs of anybody else. We’re almost 10 years into the static site ec…

> The “operations” perspective is the least important perspective on any marketing site/blog.

It definitely isn't for the marketing sites and blogs I maintain. Site stability and reliability trump how convenient it is for marketing content creators to release changes. Better to have a site that doesn't have the latest change than a site that is completely down, or worse a site hacked because of a vulnerability in the CMS. Is that true for every site? Absolutely not! Although it seems like it would be for whitehouse.gov.

Re: Whitehouse.gov Chooses WordPress, Again

#354

Post by photomatt »

Zelphyr wrote: post #293
westoque wrote: post #4

I hope we again see the value of using systems like Wordpress for it’s simplicity in getting a blog/website setup and easily modify content. Lately most of the modern marketing websites I see is built using gatsby and next.js. Having been talking to different content/marketing teams, they hate it so much because of the complexity it brings. Editing content? Sign in to this headless CRM app, want a form? Go sign in to…

It’s true that Wordpress is very good at letting you modify content easily. That is, as you say, a major reason to use it. However. That assumes you are only needing to edit text with basic formatting (bold, underline, etc...) As soon as you get into anything more complex you pretty much have to understand HTML and CSS. I just ran into this with three different Wordpress installs. Two use Divi and the third uses WP B…

This is why we built Gutenberg, which is the new editor in WP that allows you to do rich layouts without using Divi or Bakery. Gutenberg is what the new White House site uses! You can do really advanced things with it.

Re: Whitehouse.gov Chooses WordPress, Again

#355

Post by cutler »

pembrook wrote: post #231
HotVector wrote: post #107

Earlier quoted context omitted.

My go-to for creating a static website to be managed by non-tech people is Svelte + some markdown renderer. I put all the info into Markdown files so it can be easily changed, kind of like Jekyll.

You’re getting downvoted because this would only be suitable for the most simple of blogs/sites that rarely need updating. And I’m sorry, giving non-technical people a code editor and telling them to write markdown & front matter and deal with git is just hilarious. It’s the typical “developer’s developer” solution. Fun for the dev to set up and write an article about how they built it on Dev.to, but with zero though…

I used to wonder about this with Rails. Ruby is all about programmer happiness but Rails consultants tend to charge a premium so is the client paying for Ruby making the consultant's life easier or a better, more efficient product?

Re: Whitehouse.gov Chooses WordPress, Again

#356

Post by cutler »

jaza wrote: post #115
steviedotboston wrote: post #3

> Political affiliations aside, I think we can all breathe a bit easier today knowing they didn’t choose Drupal. Strongly disagree. Drupal is a great CMS and there's a reason the government uses it so extensively.

I was a Drupal dev for ~10 years. Once upon a time, I built many sites with it, and I recommended it to many folks. Despite its flaws (and it always had flaws), it was a great piece of software in its heyday, and it had (and still has?) an amazing community. I'd still choose it over WordPress any day. But the days when I'd recommend either of them (or indeed anything in PHP) are long gone. Your best bet now is probab…

Come off it. Much as I prefer Ruby and Python the CMS domain is dominated by PHP and ASP.Net. Whilst there are Rails and Django-based CMSes their combined adoption is a drop in the ocean compared with Drupal alone, never mind Wordpress.

Re: Whitehouse.gov Chooses WordPress, Again

#358

Post by laumars »

snowwrestler wrote: post #345
laumars wrote: post #333

Earlier quoted context omitted.

You’re overlooking a key thing there though. You’re assuming every hack is a targeted one. And that simply isn’t the case. Whenever a new vulnerability is discovered for WP (or any popular suite, be it a shop like Magento or message board like phpBB) you then get hordes of bots that trawl the internet looking for sites that run out of date versions of said software just for the purpose of hacking it. Even search engi…

It’s extremely rare for automated attacks to scale against popular CMSs before the patch for that vulnerability is available. In the vast majority of cases the script kiddies find out about the vulnerability when the patch is released. Then some bad guy has to write the script to target it, and distribute that and/or scale it. All a site owner has to do to win, is patch faster than that. We always aimed to evaluate s…

> It’s extremely rare for automated attacks to scale against popular CMSs before the patch for that vulnerability is available. In the vast majority of cases the script kiddies find out about the vulnerability when the patch is released. Then some bad guy has to write the script to target it, and distribute that and/or scale it. All a site owner has to do to win, is patch faster than that.

Again you’re over estimating the average IT team’s ability to keep on top of WP patches. And again I have to reiterate my point about the advantages of a good WAF (web application firewall).

I’m not making a theoretical argument here. I’ve seen and have had to fix numerous sites from companies with competent developers and sys admins but who were simply unlucky enough not to notice that one RCE vulnerability in time.

> I’m sure you saw a lot of CMS installations that got hacked. I’m also sure that most them were because of either poor patch discipline, or misconfiguration, or both.

Neither actually. Just busy teams in medium sized business having a plethora of projects and too little time to manage everything with the same degree of love that your larger companies or start ups do when they have a dedicated team working in a single product.

Remember the appeal of WP for many is that it is “plug and play” so it often gets installed in organisations as a way of reducing the burden on existing developers and/or sysadmins. A strategy that makes complete sense on paper but can back fire spectacularly.

Let’s also remember that WP also appeals to the hobbyists too. You can’t accuse them of being incompetent sysadmins because they never set out to be technical. Instead they were sold on how easy WP is to install and manage.

Again this is why I keep discussing WAFs. Using them is non-obvious but it does reduce the burden on whatever individual or team manage WP.

> But even then a popular CMS may have an advantage: it’s a lot easier to find professional help for a popular CMS than for a niche or custom one.

Oh i agree. Choosing an established CMS isn’t a bad decision as there are plenty of benefits in doing so.

> Honestly, running any software at all is going be a nightmare for a lot of people. Hence the success of products like Squarespace and Wix; now they don’t have to.

This I agree with too.

Re: Whitehouse.gov Chooses WordPress, Again

#359

Post by aheckler »

nkozyra wrote: post #279
aheckler wrote: post #238

Earlier quoted context omitted.

> inherent inefficiency with WordPress design will incur more cost to scale Check out Cloudflare's Automatic Platform Optimization tool from last year [0]. It uses Workers to cache static and dynamic content from WordPress on the edge. Just $5/month. IMHO, that would "scale reasonably" for many use cases. [0] https://blog.cloudflare.com/automatic-platform-optimizations...

CDN literally everything is - to me - a last resort you can use when your underlying application cannot handle any direct traffic. It's an expensive compromise that you shouldn't need unless you're in Alexa top 100 territory.

That's a perfectly fair attitude. I was just trying to show that it's not very expensive to scale WordPress. :)

Re: Whitehouse.gov Chooses WordPress, Again

#360

Post by pembrook »

thayne wrote: post #353
pembrook wrote: post #234

Earlier quoted context omitted.

You’re not wrong, but you’re missing the point. The “operations” perspective is the least important perspective on any marketing site/blog. Design flexibility in production, marketing features and multi-author content production are the only thing that matters. Gatsby is built by developers, for developers. And it’s hilariously out of touch with the needs of anybody else. We’re almost 10 years into the static site ec…

> The “operations” perspective is the least important perspective on any marketing site/blog. It definitely isn't for the marketing sites and blogs I maintain. Site stability and reliability trump how convenient it is for marketing content creators to release changes. Better to have a site that doesn't have the latest change than a site that is completely down, or worse a site hacked because of a vulnerability in the…

> Site stability and reliability trump how convenient it is for marketing content creators

You’re optimizing for the wrong thing then. Content creation, driving traffic to the site, and converting that traffic is the harder, more important task.

Your role is the easiest, most trivial one.

On the spectrum of engineering problems, I’d place self driving cars and sentient AI somewhere on the right side labeled difficult.

On the left side of the scale, at the far edge labeled easiest, I’d place “keeping a wordpress site online.”

40% of the internet is powered by Wordpress, so I think a few hundred million people have figured it out.

On the other hand, 99% of all websites get little to no traffic. Maybe this is the difficult part you should be optimizing for instead?

Post reply on HN