Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The complicated futility of WordPress

coderjerk.com

Post reply on HN
Print view View original

101–110 of 241 posts

Re: The complicated futility of WordPress

#101

Post by schroeding »

TimTheTinker wrote: post #20
jshwlkr wrote: post #13

Earlier quoted context omitted.

I'm not entirely sure it's fair to blame WordPress directly for the quality of 3rd-party products (and their security).

Third-party plugins are subject to WordPress's security model and implementation. Automattic could create a PluginV2 system with tightened security and new requirements for plugin developers, then put a plan in place to deprecate and remove support for v1.

Honest question, how would that work?

PHP code is not sandboxable (ignoring the ability to disable functions), AFAIK. Is it? So plugins do have complete (read) access over the entire code, the secrets in the config files, the database etc.?

Not allowing plugins to directly execute PHP code would either fundamentally break the wordpress plugin model or require an interpreter for a turing-complete "wordpress plugin programming language", right? That would kill any performance, especially on uncached wordpress instanced, even on PHP 8, wouldn't it?

Re: The complicated futility of WordPress

#102

Post by AussieWog93 »

ironmagma wrote: post #78
muglug wrote: post #62

For at least the last 10 years WordPress has been an OSS tool whose serverside internals make hardened software engineers recoil in horror, but which nevertheless continues to deliver incredible value for the majority of its customer base. It's a reminder that if you build something that people really want, how you build it doesn't matter, as long as you have plenty of duck tape at the ready.

Only for interesting definitions of "doesn't matter." The number of security exploits for WordPress websites seems to differ. https://www.cvedetails.com/product/4096/Wordpress-Wordpress....

You'd probably find just as many exploits in Windows, and people use that every day without a hitch.

Just for what it's worth, I haven't experienced any intrusions at all on my WordPress site since moving away from a free shared host 3 years ago (and even then, I don't even think WordPress was the culprit there).

Re: The complicated futility of WordPress

#103

Post by atoav »

seanwilson wrote: post #21

Are there any good options for an open source headless CMS that works with a static site generator that has a page builder that has quick and accurate live previews before you deploy? E.g. so you can build new landing pages from header, testimonial and contact form blocks. There's lots of options if you just want Markdown but this isn't enough for heavily branded business websites where you need to check how complex…

I use lektor, it has a preview server with a editor, works for multilanguage sites, themes are easily extended/modified etc.

You basically run "lektor serve" edit your site locally in the backend and then once you are done you click "publish" in the backend and it copies the site to the webserver via scp (provided you have the ssh credentials).

Simple and effective. For anything more sophisticated I use grav CMS

Re: The complicated futility of WordPress

#104

Post by AussieWog93 »

ghostly_s wrote: post #46
theteapot wrote: post #11

Earlier quoted context omitted.

Wordpress is lightweight? 5.9 download is +19.7M zipped and that's without any plugins. The lock in to the Wordpress framework. Not sure whether that qualifies as "vendor" lock in but it's pretty big dep that's impossible to break out of if you go beyond simple blog.

Do they even offer VPS storage in units smaller than a GB these days? No one cares about a 20MB binary.

For what it's worth, I'm running the absolute cheapest DigitalOcean droplet money can buy ($5/mo) and that comes with 25GB of NVME storage as standard.

Re: The complicated futility of WordPress

#105

Post by iqanq »

eric4smith wrote: post #52

I absolutely hate Wordpress, but I completely understand why it's popular. The reason why it's bigger than other publishing tools, is because there's almost nothing out there that has the deep network of plugins that can do almost anything. Sure, the backend of spaghetti PHP, HTML, MySql and endless backdoors and security issues are a nightmare, but there are really not that many alternatives to what Wordpress can do…

The security issues are a feature. Wordpress never ends making money for those who get paid to install and maintain it.

Re: The complicated futility of WordPress

#106

Post by modernerd »

skilled wrote: post #92

My only wish is that someone with deep technical prowess could explain to me why the Gutenberg back-end Editor is so slow. And, enlighten me as to why the core WordPress team aren’t doing much about it.

Riad's writeup here may be interesting to you on the “why it's slow” part: https://riad.blog/2020/02/14/a-journey-towards-a-performant-...

I don't think it's fair to say the core team isn't doing much to improve or prevent degrading performance — they performance-test every PR: https://developer.wordpress.org/block-editor/contributors/co...

There's also a performance team (for general WP performance, but also covering the editor/JS) that meets regularly and posts minutes. https://make.wordpress.org/core/2022/02/01/performance-team-...

Page performance from sites made with WP's block editor is pretty good compared to other editor plugins too, which probably matters more than editor performance (more people generally read a site than write it): https://wptavern.com/gutenbergs-faster-performance-is-erodin...

Re: The complicated futility of WordPress

#107

Post by bdlowery »

ironmagma wrote: post #78
muglug wrote: post #62

For at least the last 10 years WordPress has been an OSS tool whose serverside internals make hardened software engineers recoil in horror, but which nevertheless continues to deliver incredible value for the majority of its customer base. It's a reminder that if you build something that people really want, how you build it doesn't matter, as long as you have plenty of duck tape at the ready.

Only for interesting definitions of "doesn't matter." The number of security exploits for WordPress websites seems to differ. https://www.cvedetails.com/product/4096/Wordpress-Wordpress....

That’s awesome, now can you find one that points to all the plugins that cause these security exploits? Because none of those are from the default WordPress install with the Standard plugins (ACF Pro, CPT UI, etc).

Re: The complicated futility of WordPress

#108

Post by aksss »

Karunamon wrote: post #33
TimTheTinker wrote: post #20

Earlier quoted context omitted.

Third-party plugins are subject to WordPress's security model and implementation. Automattic could create a PluginV2 system with tightened security and new requirements for plugin developers, then put a plan in place to deprecate and remove support for v1.

...and face a fully justified user/dev revolt that makes Mozilla's worst day look like a single angry tweet. Remember that there's a massive paid ecosystem around WP plugins & themes, not to mention the stuff Automattic sells (hosting, their own plugins, etc.) They can't afford it, and most people don't want it. I think history shows that taking flexibility away from something popular because of its flexibility is no…

Wish Microsoft put some thought into this before completely kneecapping the start menu customization and capability in Windows 11.

Re: The complicated futility of WordPress

#109

Post by inglor_cz »

acomjean wrote: post #60
sircastor wrote: post #58

Earlier quoted context omitted.

I know there’s lots of noise about Gutenberg, but I love the block editor. It’s one of the reasons I stick with Wordpress rather than moving to a SSG.

Gutenberg is a bit of a pain to get started with, but it truly is kinda amazing page layout tool. I think Wordpress needs something like better defaults. You are so dependent on picking a good theme and it seems really hard to tell what’s going on in the theme world.

I am an intense user of WP since 2016 and I wrote several plugins for my own purposes.

The overhaul that came with Gutenberg was painful and it took almost two years to catch and fix all the bugs, for example with embedded videos. But as of 2022, I am happy with Gutenberg and it feels intuitive.

I know a few guys who could never make the necessary switch in their heads and hate Gutenberg with a fury of thousand suns, though. All of them are over fifty.

Now, Substack has even more intuitive and amateur-user-friendly editor, but a much more limited set of options.

Re: The complicated futility of WordPress

#110

Post by bdlowery »

pupppet wrote: post #85

I’ve easily built hundreds of WP sites and Gutenberg makes me sad. Anyone raving about the block editor has clearly never used one of WP’s paid page builder plugins like Beaver Builder and Elementor, they’re in a whole different league. You of course can continue using these plugins, but the absolute chasm in quality separating these plugins and Gutenberg highlights Automattic doesn’t have the technical or design kno…

Why use elementor when you can get far better Google Core Web Vitals, and actually write semantic html all with ACF?

Writing PHP isn’t that hard!

Post reply on HN