EmDash – A spiritual successor to WordPress that solves plugin security • Hacker News Board

Re: EmDash – A spiritual successor to WordPress that solves plugin security

#101

Post by hatmanstack » Wed, Apr 01, 2026, 5:51 PM UTC

8organicbits wrote: post #76

hatmanstack wrote: post #47

Earlier quoted context omitted.

There might be pie on your face but they stole my line, https://github.com/HatmanStack/kill-wordpress

I think you need to account for the base rate. There's a lot of WordPress plugin vulnerability disclosures because there's a lot of WordPress plugins and there are enough deployments of the plugins to make searching for those vulnerabilities is worthwhile. That site warns that WordPress plugins can be abandoned, but that's clearly not a WordPress specific issue. Sure some site could use SSG, but that's a different de…

Just measured your visit, zing.

Re: EmDash – A spiritual successor to WordPress that solves plugin security

#102

Post by solarkraft » Wed, Apr 01, 2026, 5:52 PM UTC

rgbrenner wrote: post #77

> Solving scale-to-zero for WordPress hosting platforms > WordPress is not serverless Just not accurate. WordPress doesn't prevent this.. It's up to hosting providers to work on their infra so it can run in a serverless fashion. For example: https://www.agiler.io That's serverless wordpress that scales to zero.. no changes to WordPress, plugins or anything else.. just platform infra.

Last time I checked Wordpress was completely fine living in a couple of PHP files on a webspace. That’s like the pinnacle of „serverless“, is it not?

Re: EmDash – A spiritual successor to WordPress that solves plugin security

#103

Post by vetrom » Wed, Apr 01, 2026, 5:55 PM UTC

embedding-shape wrote: post #7

> Our name for this new CMS is EmDash. We think of it as the spiritual successor to WordPress. It’s written entirely in TypeScript. It is serverless, but you can run it on your own hardware or any platform you choose. Plugins are securely sandboxed and can run in their own isolate, via Dynamic Workers, solving the fundamental security problem with the WordPress plugin architecture. And under the hood, EmDash is power…

It looks like they rolled it so you can plug in local components of your choice, though? The security model does assume you have MAC containerized environments available at your fingertips though, so having something like DHH's once is probably a soft minimal dependency if you want to do-it-yourself.

Re: EmDash – A spiritual successor to WordPress that solves plugin security

#104

Post by pwython » Wed, Apr 01, 2026, 5:55 PM UTC

spankalee wrote: post #50

It's a shame they don't seem to try to address the divide between CMS's and static sites. Most WordPress sites could just be static, but WordPress has a nice editor interface, so they're not - unless you use a SSG plugin. Building that into the core workflow (which I believe Astro supports) and giving users a nice hosted editor that produces a static site would be welcome innovation.

I've been migrating a few Wordpress sites from Wordpress to Astro + Strapi recently, working in 'hybrid mode' so the entire site is static except for post previews in Strapi (only that one route is SSR).

Editing content in Strapi, once customized with CKEditor and such, is Wordpressy enough for the human Editors familiar with WP.

So far I'm loving the stack.

Re: EmDash – A spiritual successor to WordPress that solves plugin security

#105

Post by doright » Wed, Apr 01, 2026, 5:57 PM UTC

I dunno, with the constant firehose of debate and disdain for AI this is a joke I'm too burned out about to feel like laughing at.

Re: EmDash – A spiritual successor to WordPress that solves plugin security

#106

Post by jdurban » Wed, Apr 01, 2026, 5:59 PM UTC

the plugin security problem in WordPress was never really a code quality problem - it was a trust model problem. any developer could publish a plugin and any site owner could install it with one click, with no vetting layer in between. TypeScript and serverless doesn't change that dynamic unless the trust model changes too. curious how EmDash handles third-party plugin permissions at the API boundary.

Re: EmDash – A spiritual successor to WordPress that solves plugin security

#107

Post by flakiness » Wed, Apr 01, 2026, 5:59 PM UTC

solarkraft wrote: post #99

Convince me this isn’t vibeslop. If Cloudflare really have radically changed their software development philosophy lately, this would actually be an interesting project, being based on Astro and coming with some APIs for programmatic management. Them being so happy about the „cost of software development“ and not going very deep into ecosystem, community or project management doesn’t convince me that this is going to…

If you read the first few sentences...

> But for the past two months our agents have been working on an even more ambitious project: rebuilding the WordPress open source project from the ground up.

They have honed their AI OSS troll marketing chop and every step goes far and far. I'll take it more seriously once they start open sourcing vibe coded projects they actually use in their production.

Re: EmDash – A spiritual successor to WordPress that solves plugin security

#108

Post by solarkraft » Wed, Apr 01, 2026, 6:00 PM UTC

FlamingMoe wrote: post #86

A WordPress spiritual successor backed by Cloudflare sounds great in theory, but the headline feature, plugin isolation via Dynamic Workers, only works on Cloudflare's runtime. On any other host it's just a TypeScript CMS without the security model that justifies its existence. Open source but architecturally locked in.

I missed this. So they didn’t really solve much at all. I guess at least it’s compatible with other runtimes. But yeah, who would’ve guessed that Cloudflare software would (besides being vibeslop) prefer Cloudflare infra. This, of course, makes the software quite hard to adopt.

Re: EmDash – A spiritual successor to WordPress that solves plugin security

#109

Post by lurkshark » Wed, Apr 01, 2026, 6:00 PM UTC

amiga386 wrote: post #87

> While EmDash aims to be compatible with WordPress functionality, no WordPress code was used to create EmDash. That allows us to license the open source project under the more permissive MIT license. Ha ha, that's really funny timing given the recent launch of Cleanroom As A Service, promising that you can licensewash other peoples' code quickly and easily: https://malus.sh/ I'm not saying they did that, but it's ir…

Malus is (well crafted) satire.

Re: EmDash – A spiritual successor to WordPress that solves plugin security

#110

Post by 0xbadcafebee » Wed, Apr 01, 2026, 6:01 PM UTC

Serious question: Why is everyone still using JavaScript to AI-code projects? You can vibe-code apps with real languages now.

There's no reason to use an interpreted, bloated, weird language anymore. The only reason interpreted languages were a thing was so you could edit a file and re-run it immediately without a compile step. Compiling is now cheap, and you don't have to build expertise in a new language anymore. Ask AI to write your app in Go, it'll happily comply. Run it and it's faster with less memory use and disk space. The code is simpler and smaller making reviewing easier. Distribution is as easy as "copy the file".

I'll grant you, interpreted languages skip the "portability" compiling/distributing step, and let you avoid the stupid MacOS code signing. But Go is stupid easy to cross-compile, and (afaik?) the user can un-quarantine a self-signed app pretty easily.