EmDash – A spiritual successor to WordPress that solves plugin security • Hacker News Board

Re: EmDash – A spiritual successor to WordPress that solves plugin security

#421

Post by dgb23 » Thu, Apr 02, 2026, 7:48 AM UTC

Yokohiii wrote: post #347

dgb23 wrote: post #313

Earlier quoted context omitted.

The problem with Go specifically is that it's not great for processing arbitrary JSON and especially not your typical frontend code. One issue is that you don't write Go code, you write Go plus some templating language (like html/template or go templ). Not being able to seamlessly move from regular code and template code adds friction and is limiting while developing, figuring stuff out and iterating. Another problem…

> One issue is that you don't write Go code, you write Go plus some templating language (like html/template or go templ). Not being able to seamlessly move from regular code and template code adds friction and is limiting while developing, figuring stuff out and iterating. Wow that is the cheapest excuse I've heard recently. Templating languages can certainly be dogshit, but demanding it to be the native language is…

I‘m not even a fan of JSX, but it’s simply way more productive than having a separate, idiosynchratic language for templating.

The issue is not an aside or secondary. Web development is a highly competitive profession. I literally cannot afford too much development friction.

There are very strong alternatives to JSX that I prefer btw.

Lit-html builds on JS native template literals, the performance and bundle size is astronomically better.

PHP I wouldn’t recommend anyone, because of the insane footguns, and in recent years it has become increasingly unstable, but if you already know it well, then it has a lot of properties that are missed in other ecosystems.

Clojure does it best from a productivity standpoint if you own the whole stack. The REPL workflow is far ahead of anything else I tried and expressing UI as regular, compact data literals is a unique advantage.

Now I like Go, and I tried it for web development, because I consider it a very high trust language and ecosystem. It just has a few disadvantages in that department when used in the trenches.

Re: EmDash – A spiritual successor to WordPress that solves plugin security

#422

Post by karel-3d » Thu, Apr 02, 2026, 7:55 AM UTC

I am not fluent in Cloudflare-lingo. What is "Dynamic Worker" and how can I run it outside Cloudflare?

The repo says "depends on Dynamic Workers ... Dynamic Workers are currently only available on paid accounts" but the article says "but you can run it on your own hardware".

Re: EmDash – A spiritual successor to WordPress that solves plugin security

#423

Post by shreyssh » Thu, Apr 02, 2026, 7:55 AM UTC

embedding-shape wrote: post #7

> Our name for this new CMS is EmDash. We think of it as the spiritual successor to WordPress. It’s written entirely in TypeScript. It is serverless, but you can run it on your own hardware or any platform you choose. Plugins are securely sandboxed and can run in their own isolate, via Dynamic Workers, solving the fundamental security problem with the WordPress plugin architecture. And under the hood, EmDash is power…

[flagged]

Re: EmDash – A spiritual successor to WordPress that solves plugin security

#424

Post by shreyssh » Thu, Apr 02, 2026, 7:55 AM UTC

perlgeek wrote: post #251

embedding-shape wrote: post #7

> Our name for this new CMS is EmDash. We think of it as the spiritual successor to WordPress. It’s written entirely in TypeScript. It is serverless, but you can run it on your own hardware or any platform you choose. Plugins are securely sandboxed and can run in their own isolate, via Dynamic Workers, solving the fundamental security problem with the WordPress plugin architecture. And under the hood, EmDash is power…

I love building static (or statically generated) websites, but all too often, customers want dynamic content. And what's worse, they don't tell you up-front, because they don't really understand the difference. "I need a website for my bakery". "What's supposed to be on it?" "Our address, opening times, a few pictures". I build them a static website. "Now I need a contact form". Ok, that doesn't really fit into a sta…

[flagged]

Re: EmDash – A spiritual successor to WordPress that solves plugin security

#425

Post by earthlingdavey » Thu, Apr 02, 2026, 7:56 AM UTC

TrueSlacker0 wrote: post #381

earthlingdavey wrote: post #260

This is very interesting. I've worked with WordPress on and off for 10 years, and I'm convinced that this project has got 2 things absolutely spot on. TypeScript and Worker plugins. I've given the security, or lack of, WP a lot of thought recently. In WP malicious plugin has access to the database, enfironment variables, rendering text on screen (think XSS). Luckily, a thoughtfully designed plugin system can mitigate…

I personally i am in the other camp and think they got the language change absolutley wrong. I already have php installed on my server why do i need to install TypeScript? The easiest website to run is in php. All other languages add a barrier.

I agree with your sentiment. Meet the customer where they are at, right?

Years ago, I would have said small bussinesses are on cPanel, FTP-ing files to the server. Asking them to run NodeJS is crazy. But here we are, the hosting landscape is vastly different, is it still so crazy to ask a small business owner to put there code on GH, connect GH to a hosting platform and push?

---

Anyway, I doubt you will see people dropping off WP and migrating sites to EmDash. What's more likely will be that it is considered as an alternatave for new projects.

Re: EmDash – A spiritual successor to WordPress that solves plugin security

#426

Post by VerifiedReports » Thu, Apr 02, 2026, 7:59 AM UTC

plug-in security

Re: EmDash – A spiritual successor to WordPress that solves plugin security

#427

Post by epse » Thu, Apr 02, 2026, 7:59 AM UTC

slotted-dotted wrote: post #420

lupu wrote: post #416

So this product has nothing to do with wordpress, it's just another CMS that mentioned WP only bcz they created a migration plugin that won't work on 90% of existing wp sites and won't work on 100% of woocommerce sites. This is no successor, it's not even in the same universe. - vendor lock-in, losing gpl, losing access to plugins source code, loosing ownership.

It's licensed under MIT. It's more permissive than wordpress.

That is not a pure upgrade, GPL may well be the "better" / safer / trusted /... option for some

Re: EmDash – A spiritual successor to WordPress that solves plugin security

#428

Post by earthlingdavey » Thu, Apr 02, 2026, 8:04 AM UTC

dominotw wrote: post #350

earthlingdavey wrote: post #260

This is very interesting. I've worked with WordPress on and off for 10 years, and I'm convinced that this project has got 2 things absolutely spot on. TypeScript and Worker plugins. I've given the security, or lack of, WP a lot of thought recently. In WP malicious plugin has access to the database, enfironment variables, rendering text on screen (think XSS). Luckily, a thoughtfully designed plugin system can mitigate…

https://news.ycombinator.com/item?id=47503348

> I am now scared to talk to anyone. Eventually the conversation turns to AI and they want to talk or show their vibecoded app.

> I am just tired boss. I am not going to look at your app.

Hey, I feel bad for you. I would say try and avoind HN if you don't want to see AI.

But, in this case, I want to respectfully disagree with you. I read the frontpage of HN almost daily, I never really jump into conversations, for this post about EmDash I am absolutely qualified to contribute.

There are precisely 2 open source projects in existence (proove me wrong) where the "Worker Plugin" architecture has been taken. Mine and EmDash. Looking at some of the code examples from EmDash was like looking at my own docs.

If you don't want to look at my app, then fine. But please don't gatekeep, I'm qualified to talk here.

Re: EmDash – A spiritual successor to WordPress that solves plugin security

#429

Post by mpeg » Thu, Apr 02, 2026, 8:05 AM UTC

bzmrgonz wrote: post #384

Welp, it looks like if you selfhost, the sandboxing of plugins benefit goes out thr window from what I'm reading. What kind of open source is that? Opencore? More like openinsecure, for thr security version, pay the Piper. I might still give it a try, but I sure hope we can put monthly monetary ceiling, had ceilings on our accounts. Anyone knows if cost-caps are possible on CLOUDFLARE??

Honestly, you'll struggle to find a cloud platform cheaper than cloudflare.

The $5/mo gets you 10 million dynamic requests (static assets are not included in this limit, so often a single pageview will be 1 dynamic request) and that would be across the whole workers product for your account, no extra pricing for extra websites, domains, or anything else like you'd see in most "wordpress hosting"

I run all my personal sites and client sites (one of them for a fortune 500 company) in the $5/mo plan, and the only time I went over that was when a client got hammered with malicious requests (and it was like $100)

Disclaimer: I have no relationship to cloudflare, I'm just a happy customer

Re: EmDash – A spiritual successor to WordPress that solves plugin security

#430

Post by notahacker » Thu, Apr 02, 2026, 8:11 AM UTC

madrox wrote: post #338

notahacker wrote: post #295

Earlier quoted context omitted.

They called the project EmDash and launched it on April 1st with a blog which brags about how little effort it took to write because of agents before even saying what it is . If the product launch involves dressing the engineering team up in duck suits and releasing to a soundtrack of quacking, it's really not surprising people are asking the guy they hid behind the Daffy mask on why he's dressed as a duck rather tha…

There's plenty of other comments saying this. It isn't that I don't understand, and need a clever metaphor. But to run with your metaphor, can we, maybe, just ignore the quacking since we all know that's just how you get attention these days and instead focus on that other stuff? Because it seems like asking about the duck mask will never produce a satisfactory answer and instead turn into a debate on the merits of d…

Obtuse and repetitive debates is what HN comments are for. :)

But in this case it feels less like somebody has launched a revolutionary new product and HN is debating the MIT licence and landing page weight, and more like somebody has announced they've a plug-in replacement for a popular repository with a troll post and HN chooses not to spend enough time on Github to discover the all-star team and excellent architectural decisions the blog didn't bother mentioning.

Plus Cloudflare deliberately signalling that at best they're not very invested in its success and it might well just be low-effort slop probably is more pertinent to whether a purported WordPress replacement actually gains any traction than its technical merit, and headless CMS with vendor lockin vs managing WordPress security isn't likely to be a more productive debate than one on "slop". The target audience for this product is much more 'HN crowd' than 'read about agentic solutions to workforce automation on Gartner crowd' too, so the quacking alienating HN is actually relevant.