[dead]
EmDash – A spiritual successor to WordPress that solves plugin security
541–550 of 558 posts
Re: EmDash – A spiritual successor to WordPress that solves plugin security
#542Welp, it looks like if you selfhost, the sandboxing of plugins benefit goes out thr window from what I'm reading. What kind of open source is that? Opencore? More like openinsecure, for thr security version, pay the Piper. I might still give it a try, but I sure hope we can put monthly monetary ceiling, had ceilings on our accounts. Anyone knows if cost-caps are possible on CLOUDFLARE??
Honestly, you'll struggle to find a cloud platform cheaper than cloudflare. The $5/mo gets you 10 million dynamic requests (static assets are not included in this limit, so often a single pageview will be 1 dynamic request) and that would be across the whole workers product for your account, no extra pricing for extra websites, domains, or anything else like you'd see in most "wordpress hosting" I run all my personal…
Care to share your multi-site strategy? I've been investigating ways to program billing alerts, which should alert me when bill is at xx%. There are a few ways, so that makes it more paletable. It just boils my blood when these big platforms don't offer it as a feature. THAT IS JUST PURE UNADULTERATED EVEIL, IT SOULD BE CRIMINAL REALLY!!
Re: EmDash – A spiritual successor to WordPress that solves plugin security
#543Earlier quoted context omitted.
[flagged]
> With PHP you can still drop a single file on shared hosting and be up in minutes, with no build step or CDN proxy in the mix. I don't have a shared hosting account any more, nor do I want to have to figure out which providers are the best for my needs. It's far quicker for me to upload something to Cloudflare Pages or Netlify.
[dead]
Re: EmDash – A spiritual successor to WordPress that solves plugin security
#544The problem is that it doesn't solve the network-effect problem. People aren't on WordPress because of WordPress. They're on WordPress because of WooCommerce, a million themes, BuddyPress, integrations for every stupid internal business API on the planet (many of which are terrible and were written by an idiot with a crayon). The APIs will have no testing because they are bad. In many cases the WordPress implementati…
You seem to have missed the point. This is intended to be more secure in a new world where exploits will be cheap to discover. The factors you mention won't keep people onboard if systems are compromised every day in too many ways for fragmented security teams to keep on top of.
People running WordPress don't have security teams. If they get compromised they blat the server, re-upload a fresh copy, update the plugin affected and apologise for the week of downtime.
Re: EmDash – A spiritual successor to WordPress that solves plugin security
#545Earlier quoted context omitted.
That is not a pure upgrade, GPL may well be the "better" / safer / trusted /... option for some
You're welcome to take an MIT-licensed project, fork it, and relicense it as GPL. The inverse? not so much. Hard to sell it as anything but an upgrade if you care about open source.
> You're welcome to take an MIT-licensed project, fork it, and relicense it as GPL.
No you can't. MIT requires attribution.
Re: EmDash – A spiritual successor to WordPress that solves plugin security
#546Earlier quoted context omitted.
It is true though. We have a cursor subscription and work and i now see many non-technical people building their own internal tooling. People that had essentially never written a line of code before this new revolution. The cost of building software has really drastically decreased.
So has the quality unfortunately
It’s fine. The business value still exceeds the intangible loss due to quality. And for internal tools with a few-months-lifespan it’s perfectly acceptable.
Re: EmDash – A spiritual successor to WordPress that solves plugin security
#547Wordpress powers 40%+ of the web, the second largest CMS is Shopify. [1]
I have been on and off in the past 6 - 7 years trying to get DHH / 37Signals to release a CMS / simply blog system that compete with Wordpress.
May be Shopify should do it instead, and name it Pressify.
[1] https://w3techs.com/technologies/overview/content_management
Re: EmDash – A spiritual successor to WordPress that solves plugin security
#548> x402 is an open, neutral standard for Internet-native payments. It lets anyone on the Internet easily charge, and any client pay on-demand, on a pay-per-use basis. A client, such as an agent, sends a HTTP request and receives a HTTP 402 Payment Required status code. In response, the client pays for access on-demand, and the server can let the client through to the requested content. Fascinating. Cloudflare is envis…
Looking into x402, and this is more about giving your agent a crypto wallet rather than a debit card.
Re: EmDash – A spiritual successor to WordPress that solves plugin security
#549Earlier quoted context omitted.
CMSs allow non-technical people to update the site - that's why WordPress, Drupal, and all of the shambling corpses of "digital experience platforms" still command the dollars and eyeballs that they do. Go ahead and give your content people access to a static site builder and see how quickly the process falls apart. Static site generators are perfect for engineers but terrible for the marketing people that are the ac…
I did this, and you are 100% correct. I used Hugo, told the marketing people to send me a markdown file and I'd load it up to Hugo. That was clearly too painful for them. So I told them to send me a Word doc and I'd convert it to markdown and load it up. That was too painful. I told them to send me an email with the words and images and I'd work out the rest. That was too painful. They got some marketing agency to re…
But this wasn't their fault.
The tech layer you suggested didn't match the business and organisational layer.
We need a CMS so it can act as an abstraction layer.
Re: EmDash – A spiritual successor to WordPress that solves plugin security
#550Earlier quoted context omitted.
The post literally does that. it talks about how plugin access to core is handled. So to be explicit: if you don't see that as a very significant security improvement over WP's open world, then it may help to understand why. The post also talks about WP ecosystem downside due to this.
| "network:fetch" // ctx.http is available (host-restricted via allowedHosts) | "network:fetch:any" // ctx.http is available (unrestricted outbound — use for user-configured URLs) | "read:content" // ctx.content.get/list available | "write:content" // ctx.content.create/update/delete available | "read:media" // ctx.media.get/list available | "write:media" // ctx.media.getUploadUrl/delete available | "read:users" // c…
> I have no clue how it could replace any serious WP plugin.
I'll repeat: your knowledge of security has a gap. You can specifically look up on "Principle of least privilege" as is widely used in apps and browsers too.