Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

EmDash – A spiritual successor to WordPress that solves plugin security

blog.cloudflare.com

Post reply on HN
Print view View original

391–400 of 558 posts

Re: EmDash – A spiritual successor to WordPress that solves plugin security

#391

Post by lioeters »

crabmusket wrote: post #327

Does it bother anyone else that the capability tags in their example seem to follow different noun:verb conventions? capabilities: ["read:content", "email:send"],

Now that you mention it.. List of capabilities:

  read:content
  write:content
  read:media
  write:media
  network:fetch
  read:users
  email:send
  email:provide
  email:intercept
Also:

> ### Trusted Mode

> Trusted plugins are npm packages or local files added in `astro.config.mjs`. They run in-process with your Astro site.

> - *Capabilities are documentation only.* Declaring `["read:content"]` documents intent but isn't enforced — the plugin has full process access.

> - Only install from sources you trust. A malicious trusted plugin has the same access as your application code.

Re: EmDash – A spiritual successor to WordPress that solves plugin security

#392

Post by bombcar »

donohoe wrote: post #367
bombcar wrote: post #287

Earlier quoted context omitted.

Wordpress has no concept of a "staging site" and no way to make changed and then "export" them from dev to production; you basically have to either restore it as a backup or just replay the changes by hand.

Huh? That’s not how i think you should be approaching that. I always run local, staging, and production sites. It’s easy to setup and deploy across.

How do you deploy menu changes from staging to production?

Re: EmDash – A spiritual successor to WordPress that solves plugin security

#393

Post by ValentineC »

donohoe wrote: post #371
rcarr wrote: post #328

In my opinion, Cloudflare are coming at this from the wrong angle. WordPress is so popular because back in the day it was the easiest way to get a website built. So it got a network effect of engineers behind it which is why it persists at 40% of websites today. Same thing happened with React - majority of Typescript sites are written in React and NextJS because of the network effect around it. Yeah the security aspe…

Wordpress has an amazing talent pool of experienced people. EmDash is starting from zero - but you have to start somewhere! I’m very happy with WP, but I’ll be cheering on EmDash if it gets momentum.

WordPress lost a lot of "experienced people" in the last two years, after Matt Mullenweg decided to wage war on WP Engine.

Re: EmDash – A spiritual successor to WordPress that solves plugin security

#394

Post by ValentineC »

hrmtst93837 wrote: post #134
onion2k wrote: post #36

Earlier quoted context omitted.

That used to be a major selling point because hosts enabled PHP for a directory devs would FTP things into, but those days are thankfully long gone. I don't think it's any more difficult to host a JS, TS, or anything else, app than it is to host a PHP app today. In fact, PHP is probably more difficult than something like Netlify.

[flagged]

> With PHP you can still drop a single file on shared hosting and be up in minutes, with no build step or CDN proxy in the mix.

I don't have a shared hosting account any more, nor do I want to have to figure out which providers are the best for my needs.

It's far quicker for me to upload something to Cloudflare Pages or Netlify.

Re: EmDash – A spiritual successor to WordPress that solves plugin security

#397

Post by thedevilslawyer »

SoftTalker wrote: post #379

They say it was developed by AI agents but they still claim copyright in the LICENSE file. Doesn't seem right.

I mean the creator of the commit takes authorship, just like the auto-complete in old style IDE. Using agents requires a skill, that varies from vibe to advanced.

Why do you feel it's not right?

Re: EmDash – A spiritual successor to WordPress that solves plugin security

#398

Post by thedevilslawyer »

Yokohiii wrote: post #353
TheTaytay wrote: post #155

It looks like I'm in the minority after reading this comments, but I'm quite happy to see this announcement. A "good" standard, free CMS with theming and plugin support without the issues of Wordpress is _welcome_. (And the issues are many: Licensing, trust, drama, security, and cost). I'm guessing that a lot of cynicism here is coming from this crowd not being the target market of Wordpress in the first place? What…

> I'm guessing that a lot of cynicism here is coming from ...the fact that CF just dumps tokens to generate some slop to compete with the single biggest web platform and casually adding a vendor lock in. It's just buzz, an inexpensive attempt to grab a valuable market share. If you set security as a selling point for EmDash, then I am baffled. The WP lock file has 30k lines, the brand new EmDash has 16k lines, but it…

Frankly, you're wrong. This is a fundamentally better plugin architecture that WP, and if you can't see it, then it's your understanding of security that's not right.

Re: EmDash – A spiritual successor to WordPress that solves plugin security

#399

Post by wolrah »

transcriptase wrote: post #378
yurishimo wrote: post #286

Earlier quoted context omitted.

There are two types of WordPress sites from my perspective as someone who got their start in webdev in that ecosystem. The first and arguably largest is exactly what you describe. Little sites for small businesses who just want an online presence and maybe to facilitate some light duty business development with a small webshop or forum. These sites are done by fly by night marketers who are also hawking SEO optimizat…

I have no idea if it’s still true but it used to be the case that you had 3 choices with a Wordpress install and even a couple plugins: 1) Have a part time job updating it and plugins, making sure you weren’t introducing vulns at every step 2) Leave it as is and hope that no vulns are discovered for your particular version or plugin versions 3) Have things auto-update and pray that your plugins don't get sold or comp…

4) Don't use a stack of plugins, if you must use any keep them as dumb as possible and stick to those with a longstanding reputation.

A basic instance, set to auto-update, installed on a shared webhost where OS/web server updates are someone else's problem is pretty foolproof. A VPS running a long-term distro set to auto update is almost as good.

---

That said I personally dropped Wordpress for static site generation years ago because I realized I didn't actually need any of the dynamic features and wasn't using the WYSIWYG editor. Now I write Markdown in to a file in a git repo and then trigger a regeneration whenever I update it.

Post reply on HN