Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

EmDash – A spiritual successor to WordPress that solves plugin security

blog.cloudflare.com

Post reply on HN
Print view View original

321–330 of 558 posts

Re: EmDash – A spiritual successor to WordPress that solves plugin security

#321

Post by pilgrim0 »

SunshineTheCat wrote: post #70
embedding-shape wrote: post #7

> Our name for this new CMS is EmDash. We think of it as the spiritual successor to WordPress. It’s written entirely in TypeScript. It is serverless, but you can run it on your own hardware or any platform you choose. Plugins are securely sandboxed and can run in their own isolate, via Dynamic Workers, solving the fundamental security problem with the WordPress plugin architecture. And under the hood, EmDash is power…

I think this is true, however, when it comes to non-coding clients I've worked with they really do like the ability to make minor edits to a site with a UI rather than having to continually ping a developer. The problem with WordPress (and it looks like this solution largely just replicated the problem) is that it's way too cumbersome and bloated. It really is unlike any modern UI for really any SaaS or software in g…

I hated Wordpress so much that when the clients wanted an admin dashboard I used a neat PHP CMS called Kirby. It was awesome back then! So simple

Re: EmDash – A spiritual successor to WordPress that solves plugin security

#323

Post by earthlingdavey »

mi_lk wrote: post #296
earthlingdavey wrote: post #260

This is very interesting. I've worked with WordPress on and off for 10 years, and I'm convinced that this project has got 2 things absolutely spot on. TypeScript and Worker plugins. I've given the security, or lack of, WP a lot of thought recently. In WP malicious plugin has access to the database, enfironment variables, rendering text on screen (think XSS). Luckily, a thoughtfully designed plugin system can mitigate…

> I'm convinced that this project has got 2 things absolutely spot on. TypeScript and Worker plugins. Can you explain why TS is spot on?

The main thing is unified types.

- I've been done GraphQL server with a build step to share types between languages.

- I've used untyped JS client side code.

Both are prone to bugs, and not much fun.

TS for front and back end: sharing types means you'll have editor type hints, catch type errors at lint (or build), and you might even share validation logic between client and browser.

Re: EmDash – A spiritual successor to WordPress that solves plugin security

#324

Post by notnullorvoid »

embedding-shape wrote: post #7

> Our name for this new CMS is EmDash. We think of it as the spiritual successor to WordPress. It’s written entirely in TypeScript. It is serverless, but you can run it on your own hardware or any platform you choose. Plugins are securely sandboxed and can run in their own isolate, via Dynamic Workers, solving the fundamental security problem with the WordPress plugin architecture. And under the hood, EmDash is power…

Astro supports generating static html, so I suspect it'll work similarly where you can have some routes static and others dynamically created.

Re: EmDash – A spiritual successor to WordPress that solves plugin security

#325

Post by earthlingdavey »

ymolodtsov wrote: post #316
earthlingdavey wrote: post #272

Earlier quoted context omitted.

Why not a templating language, like Nunjucks EJS or JSX, with vanilla JS for interactivity?

You can use JSX in Astro if you prefer, but a CMS is more than just templates (not a LOT more I'd agree considering it's still static).

I know you can, but do blog-like sites really Island architecture?

IMO most sites like that would be better to pick no-framework, vanilla or jQuery for interactivity.

I can't image average WP users would be happy to move to EmDash, only to have a constant stream of dependabot updates for Astro.

It has 55 direct (non-dev) dependencies https://www.npmjs.com/package/astro?activeTab=dependencies - while ejs has 0 and nunjucks has 3.

I'm weary of updates, maybe it's just me, but I doubt it.

Re: EmDash – A spiritual successor to WordPress that solves plugin security

#326

Post by 0xbadcafebee »

znort_ wrote: post #309
0xbadcafebee wrote: post #110

Serious question: Why is everyone still using JavaScript to AI-code projects? You can vibe-code apps with real languages now. There's no reason to use an interpreted, bloated, weird language anymore. The only reason interpreted languages were a thing was so you could edit a file and re-run it immediately without a compile step. Compiling is now cheap, and you don't have to build expertise in a new language anymore. A…

> with real languages now. how is javascript not a real language? > There's no reason to use an interpreted there are loads and loads of reasons to use "interpreted" languages. that you can't think of even a single one while still pretending to be knowledgeable in the field is really intriguing. > bloated, weird language oh, i see, this is all just a religious rant. carry on!

Typescript is legitimately weird. You start off with Javascript, a language made to validate HTML forms. Then you implement a bytecode compiler so it's not unusably slow and buggy. Then you implement "frameworks" to try to make it create real applications across the insane platform that is the web browser. After twisting yourself into a pretzel just to avoid learning or making a new language, you finally invent another language on top of the first one just so you can have types. To top it all off, it takes up tons of memory and disk space. (I don't mention the slowness because I take it for granted, but 5x-10x slower than Go code is still worth considering)

Re: EmDash – A spiritual successor to WordPress that solves plugin security

#328

Post by rcarr »

In my opinion, Cloudflare are coming at this from the wrong angle. WordPress is so popular because back in the day it was the easiest way to get a website built. So it got a network effect of engineers behind it which is why it persists at 40% of websites today. Same thing happened with React - majority of Typescript sites are written in React and NextJS because of the network effect around it.

Yeah the security aspect is important, but how many of those Wordpress engineers are going to jump ship to this because of security when they've been fine with the risk so far? My money is not a lot. If someone is a WordPress dev in 2026, they're probably not the type of dev that likes to upskill and learn new tech. Similarly, if you're looking to target the average joe looking to build a fresh website, would that consumer really choose this over Wix or Squarespace? It doesn't look easier to use so I wouldn't count on it. So where is the network effect going to come from to make this the new WordPress?

I could see Vinext being successful if they keep at it— I think there are a sizeable amount of people who would like to move away from Vercel (and who will probably migrate to Tanstack when the ecosystem is more stable). But I'm not sure people on WordPress really want to leave. If they really want to make this successful I think they need a better angle which in my opinion would be making it easier, quicker, cheaper and more flexible than Squarespace/Wix/Shopify etc

Re: EmDash – A spiritual successor to WordPress that solves plugin security

#330

Post by dzonga »

this won't go far

base platform used - typescript - means for the average Joe out there - deploying is difficult - compared to php.

if they really wanted to be revolutionary - they would've made a single PHP script either on FrankenPHP backed by sqlite - single file deploy - with yeah a permission model Ala denojs for the security aspects.

end of day this is vibeslop.

Post reply on HN