Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

EmDash – A spiritual successor to WordPress that solves plugin security

blog.cloudflare.com

Post reply on HN
Print view View original

291–300 of 558 posts

Re: EmDash – A spiritual successor to WordPress that solves plugin security

#291

Post by mmaunder »

The generous take is that this is someone's pet project that marketing got too excited about, and that the leadership haven't applied their minds to. GPL provides a moat for the community, who are contributing their time and energy into a project. It ensures that, even if a commercial company grabs your software, extends it, and commercializes it, that you can fold those improvements back into your original distribution. While the commercial entity benefits from your free labor, you benefit back from theirs.

Re-implementing WordPress (their words, not mine) as MIT licensed, while legally questionable, breaks that virtuous cycle and removes the community's moat. They've taken WordPress's roles and menus and borrowed its Gutenberg code (which is GPL), and launched it as an MIT licensed product, which breaks that virtuous cycle. It means e.g. a hosting company can take the product closed source if they want to, and never have to contribute any of what they build on top of the community's work, back to the community.

https://github.com/emdash-cms/emdash/tree/main/packages/core... says "The core EmDash CMS package - an Astro-native, agent-portable reimplementation of WordPress."

Emdash uses WP's RBAC roles. Also uses their menus. Also depends on @wordpress/block-serialization-default-parser which I think might (??) be able to be used by an MIT project even though WordPress is GPL.

They used Claude Code it seems because the first commit has a CLAUDE.md file which became an AGENTS.md.

Re: EmDash – A spiritual successor to WordPress that solves plugin security

#292

Post by MrFurious »

9dev wrote: post #242
TheTaytay wrote: post #155

It looks like I'm in the minority after reading this comments, but I'm quite happy to see this announcement. A "good" standard, free CMS with theming and plugin support without the issues of Wordpress is _welcome_. (And the issues are many: Licensing, trust, drama, security, and cost). I'm guessing that a lot of cynicism here is coming from this crowd not being the target market of Wordpress in the first place? What…

There are great standard CMSes that do everything technically better than Wordpress (not that it's harder to jump higher than a rock, but hey). That's not the hard part. Every developer should build a good CMS once. The hard part is displacing Wordpress market share; building a community of bloggers, marketeers, agencies, web designers, and so on; creating a huge ecosystem of paid and free plugins, allowing plugin de…

I find it hard to believe that people used to WordPress, with its flaws and virtues(yes, wordpress have virtues), will switch to this, no matter how much it's from Cloudflare.

Re: EmDash – A spiritual successor to WordPress that solves plugin security

#295

Post by notahacker »

madrox wrote: post #183
solarkraft wrote: post #99

Convince me this isn’t vibeslop. If Cloudflare really have radically changed their software development philosophy lately, this would actually be an interesting project, being based on Astro and coming with some APIs for programmatic management. Them being so happy about the „cost of software development“ and not going very deep into ecosystem, community or project management doesn’t convince me that this is going to…

I'm getting so exhausted of the "slop" accusation on new project launches. There are legit criticisms of EmDash in the parent comment that are overshadowed by the implication it was AI coded and, thus, unusable quality. The problem is there's no beating the slop allegation. There's no "proof of work" that can be demonstrated in this comment section that satisfies, which you can see if you just keep following the enti…

They called the project EmDash and launched it on April 1st with a blog which brags about how little effort it took to write because of agents before even saying what it is.

If the product launch involves dressing the engineering team up in duck suits and releasing to a soundtrack of quacking, it's really not surprising people are asking the guy they hid behind the Daffy mask on why he's dressed as a duck rather than what he learned about headless CMS architecture from being on the Astro core team...

Re: EmDash – A spiritual successor to WordPress that solves plugin security

#296

Post by mi_lk »

earthlingdavey wrote: post #260

This is very interesting. I've worked with WordPress on and off for 10 years, and I'm convinced that this project has got 2 things absolutely spot on. TypeScript and Worker plugins. I've given the security, or lack of, WP a lot of thought recently. In WP malicious plugin has access to the database, enfironment variables, rendering text on screen (think XSS). Luckily, a thoughtfully designed plugin system can mitigate…

> I'm convinced that this project has got 2 things absolutely spot on. TypeScript and Worker plugins.

Can you explain why TS is spot on?

Re: EmDash – A spiritual successor to WordPress that solves plugin security

#297

Post by abimaelmartell »

earthlingdavey wrote: post #260

This is very interesting. I've worked with WordPress on and off for 10 years, and I'm convinced that this project has got 2 things absolutely spot on. TypeScript and Worker plugins. I've given the security, or lack of, WP a lot of thought recently. In WP malicious plugin has access to the database, enfironment variables, rendering text on screen (think XSS). Luckily, a thoughtfully designed plugin system can mitigate…

I used to work with Wordpress a lot, but last time was a couple years ago.

The appeal for the company i was working with was ease of installation on legacy servers (FTP). You would just upload the files, and it worked. No CLI tools, no dependency management, no build tools.

But yeah, security was a big issue. Constant hacks.

Re: EmDash – A spiritual successor to WordPress that solves plugin security

#298

Post by riffraff »

SunshineTheCat wrote: post #70
embedding-shape wrote: post #7

> Our name for this new CMS is EmDash. We think of it as the spiritual successor to WordPress. It’s written entirely in TypeScript. It is serverless, but you can run it on your own hardware or any platform you choose. Plugins are securely sandboxed and can run in their own isolate, via Dynamic Workers, solving the fundamental security problem with the WordPress plugin architecture. And under the hood, EmDash is power…

I think this is true, however, when it comes to non-coding clients I've worked with they really do like the ability to make minor edits to a site with a UI rather than having to continually ping a developer. The problem with WordPress (and it looks like this solution largely just replicated the problem) is that it's way too cumbersome and bloated. It really is unlike any modern UI for really any SaaS or software in g…

Are you sure the admin notices and sidebar are not plugin issues?

I use Wordpress for my blog because I stopped caring about maintaining one, and I'm mildly confident wp will be around for 10 more years.

There are basically no notices and the admin sidebar is ~10 obvious entries (home, posts, pages, comments, appearance, settings etc).

Re: EmDash – A spiritual successor to WordPress that solves plugin security

#299

Post by a57721 »

benatkin wrote: post #65
kbdot wrote: post #49

Earlier quoted context omitted.

Cloudflare doesn't do April fools jokes. In fact, 1.1.1.1 was released on April 1st back in 2018 and now it's one of the most used DNS service in the world.

It's a legit April Fools'. On the initial commit: > Some content is hidden > Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden. This for "a spiritual successor to WordPress".

Isn't it normal for the initial commit to be large?

Re: EmDash – A spiritual successor to WordPress that solves plugin security

#300

Post by riffraff »

avarun wrote: post #270
CodeWriter23 wrote: post #248

Earlier quoted context omitted.

8 years later and now I'm getting the 4 1's joke.

I still don't get it

I interpreted it back then as just following the tradition of 8.8.8.8, 4.4.4.4, 2.2.2.2
Post reply on HN