Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

EmDash – A spiritual successor to WordPress that solves plugin security

blog.cloudflare.com

Post reply on HN
Print view View original

361–370 of 558 posts

Re: EmDash – A spiritual successor to WordPress that solves plugin security

#361

Post by gbibas »

jimnotgym wrote: post #284
gbibas wrote: post #258

Earlier quoted context omitted.

[flagged]

I did that once, employed someone on Fiverr to do a WordPress site. They installed a load of plugins for no reason, made a mess, then gave me my money back. I went back to a static site. That has been my experience, low barrier to entry, low price, shoddy work. Or hire an agency, pay top dollar for little work.

Ha, yeah that's the other side of it — low barrier to entry cuts both ways. The WordPress talent pool is huge but unfiltered. Still, the fact that pool exists at all is what keeps WordPress dominant. Nobody's hiring Fiverr gigs to customize an EmDash site yet.

Re: EmDash – A spiritual successor to WordPress that solves plugin security

#362

Post by tvaughan »

perlgeek wrote: post #251
embedding-shape wrote: post #7

> Our name for this new CMS is EmDash. We think of it as the spiritual successor to WordPress. It’s written entirely in TypeScript. It is serverless, but you can run it on your own hardware or any platform you choose. Plugins are securely sandboxed and can run in their own isolate, via Dynamic Workers, solving the fundamental security problem with the WordPress plugin architecture. And under the hood, EmDash is power…

I love building static (or statically generated) websites, but all too often, customers want dynamic content. And what's worse, they don't tell you up-front, because they don't really understand the difference. "I need a website for my bakery". "What's supposed to be on it?" "Our address, opening times, a few pictures". I build them a static website. "Now I need a contact form". Ok, that doesn't really fit into a sta…

This is why we built https://sumar.io/

Re: EmDash – A spiritual successor to WordPress that solves plugin security

#363

Post by Zanfa »

benatkin wrote: post #341
a57721 wrote: post #299

Earlier quoted context omitted.

Isn't it normal for the initial commit to be large?

A little larger, a lot of the time, though I like a small initial commit better. Though just a little larger. Not so large that it is too large to show on a GitHub page. That means not using version control properly.

> Not so large that it is too large to show on a GitHub page.

Maybe not applicable in this case, but Github has a ridiculously low threshold for when it starts hiding diffs. Probably a limitation of their new React frontend.

Re: EmDash – A spiritual successor to WordPress that solves plugin security

#364

Post by solaire_oa »

notahacker wrote: post #295
madrox wrote: post #183

Earlier quoted context omitted.

I'm getting so exhausted of the "slop" accusation on new project launches. There are legit criticisms of EmDash in the parent comment that are overshadowed by the implication it was AI coded and, thus, unusable quality. The problem is there's no beating the slop allegation. There's no "proof of work" that can be demonstrated in this comment section that satisfies, which you can see if you just keep following the enti…

They called the project EmDash and launched it on April 1st with a blog which brags about how little effort it took to write because of agents before even saying what it is . If the product launch involves dressing the engineering team up in duck suits and releasing to a soundtrack of quacking, it's really not surprising people are asking the guy they hid behind the Daffy mask on why he's dressed as a duck rather tha…

I know that it's discourteous to write-off a potentially valuable project because the release post showed a lack of self-awareness, but I think it's indicative of the larger struggle taking place: that trust is decaying.

It's decaying for a lot of the reasons displayed in the post, like you described, but the post also:

  - is overlong (probably LLM assisted)
  - is self-congratulatory
  - boosts AI
  - rewrites an existing project (vs contributing to the original)
  - conjures long-term maintenance doubt/suspicions
  - is functionally an advertisement (for CloudFlare)
So yeah, maybe EmDash is revolutionary with respect to Wordpress, but it hasn't signaled trust, and that's a difficult hurdle to get past.

Re: EmDash – A spiritual successor to WordPress that solves plugin security

#367

Post by donohoe »

bombcar wrote: post #287
foopod wrote: post #221

As a (unfortunately) wordpress dev this seems to solve my single biggest painpoint with WP. Which isn't plugin security, but the overall plugin architecture. WP treats plugins as content, literally in the same top level `wp-content` directory as uploaded images. This makes CI/CD among other things, a nightmare. But EmDash plugins are just TS modules, which has got to make things easier even if plugin configuration do…

Wordpress has no concept of a "staging site" and no way to make changed and then "export" them from dev to production; you basically have to either restore it as a backup or just replay the changes by hand.

Huh? That’s not how i think you should be approaching that. I always run local, staging, and production sites. It’s easy to setup and deploy across.

Re: EmDash – A spiritual successor to WordPress that solves plugin security

#368

Post by donohoe »

omnimus wrote: post #303
abimaelmartell wrote: post #297

Earlier quoted context omitted.

I used to work with Wordpress a lot, but last time was a couple years ago. The appeal for the company i was working with was ease of installation on legacy servers (FTP). You would just upload the files, and it worked. No CLI tools, no dependency management, no build tools. But yeah, security was a big issue. Constant hacks.

The constant hacks are side effect of Wordpress popularity. Every discovered security flaw is exploited by bots almost immediately. Unless you keep up with the updates you are very vulnerable. It is not because wordpress is built on "legacy" stack. Other CMSes on that stack (and many are very popular) don't have this problem.

I think the security issue is that people trust random plugins without reviewing them.

I’ve been running WP with small and large companies and no big security issues. You either build your own plugins or go with the trusted few you need to augment your operation.

Re: EmDash – A spiritual successor to WordPress that solves plugin security

#369

Post by tcherasaro »

staticautomatic wrote: post #356
perlgeek wrote: post #251

Earlier quoted context omitted.

I love building static (or statically generated) websites, but all too often, customers want dynamic content. And what's worse, they don't tell you up-front, because they don't really understand the difference. "I need a website for my bakery". "What's supposed to be on it?" "Our address, opening times, a few pictures". I build them a static website. "Now I need a contact form". Ok, that doesn't really fit into a sta…

Is this not often trivially solved with islands?

Yeah and this is probably why they said in the article:

“ And under the hood, EmDash is powered by Astro, the fastest web framework for content-driven websites.”

Post reply on HN