Is this some kind of a pipe dream? WordPress runs a quarter of the web?
No it's not a pipe dream. It's a pipe nightmare.
WordPress now runs a quarter of the web
71–80 of 114 posts
Re: WordPress now runs a quarter of the web
#72Can we get a Wordpress alternative written in Go, though?
Journey? Might be more like a Ghost alternative, but in the ballpark. https://kabukky.github.io/journey/
Re: WordPress now runs a quarter of the web
#73And WordPress itself is NOT insecure. It is in fact the most secure CMS you can find out there. The issue is that its simplicity and easy installation, brought a lot of non-technical people to use it and develop for it. So you get a lot of bad written themes and plugins that lead to all sort of security issues. On the other hand, Drupal and Joomla, all had SQL injections on their core discovered lately: https://www.d…
But it does get an inordinate amount of attention from people looking to crack it. At least according to my server logs. So sure... if everything is locked down and up to date and no shaky plugins installed no problem. On the other hand, one careless slip up...
> On the other hand, one careless slip up...
And how is it not the same for any other server side software?
Most of the WP security issue is related to user not knowing what they are doing or third party plugin/theme.
Wordpress vanialla itself is not anymore insecure than other popular CMS or simialar software out there. From my own personal experince from doing at least 70-80 WP installs in different configurations and have never experienced any security issues in over 10 years. Thats doesnt mean its the norm. Its just that if you are going to play with a highly customizable and powerful piece of server side software and if you dont know what you are doing then you are going to screw shit up.
Re: WordPress now runs a quarter of the web
#74And WordPress itself is NOT insecure. It is in fact the most secure CMS you can find out there. The issue is that its simplicity and easy installation, brought a lot of non-technical people to use it and develop for it. So you get a lot of bad written themes and plugins that lead to all sort of security issues. On the other hand, Drupal and Joomla, all had SQL injections on their core discovered lately: https://www.d…
I learned a lot about security on the web by poking around wordpress sites in school. While I believe what you're saying is true it's hard to believe that the perception alone of wordpress's 'hackability' doesn't make it much more of a security risk.
"Oh they run wordpress? I can probably get into that."
"Runs wordpress vulnerability scanner script"
"Oh hey look ~wp-config.php!"
Re: WordPress now runs a quarter of the web
#75I recently looked at Hugo[1] as a WP alternative and have been very impressed. It's a static website generator written in Go and features its own server with live-reload so you can see changes to your content instantly in the browser. I was looking for something that a non-techie might be able to maintain and since Hugo offers prebuilt binaries the only requirements for the maintainer is to drop hugo.exe into the wor…
Considering some of the people I've made wordpress sites for couldn't even figure out the wordpress interface, command line anything is a no go for a large percentage of wordpress's intended audience.
Actually the command line interface wasn't the deal breaker for me. I was asked to help out creating a website for a tiny organization (Finally, deployment is the final hurdle. If they wanted to edit a sentence on a WordPress site it's very easy. But with something like Hugo it would be a 3 step process: Edit the file. Build the website. Deploy to your web host.
Re: WordPress now runs a quarter of the web
#76It's not that surprising to be honest. WordPress' success comes down to the following: 1. It was simple to use in an era where CMS meant 'large, complicated system that was tailored towards technies rather than the general population'. It didn't have a ton of features, but it was easy to use for the average blogger wanting to write posts without worrying about all the setup and coding and what not. 2. You could prett…
I agree with your points, but always wonder why shared hosting is often PHP/MySQL only. E.g. if you are using Python, say Django or Flask, and want to outsource your devops (i.e. shared hosting) you do not have many options. Of course, there is pythonanywhere or you might want to use PAAS like Heroku, but I find it interesting non the less. Is it so much more work for shared hosting providers to provide Python?
> but always wonder why shared hosting is often PHP/MySQL only.
It's easy. Compare with trying to track Rails upstream, particularly in the 2.x/3.x days when minor version increments could sometimes see you building a whole new set of ruby binaries compare to what shipped with your base Linux distro.
How often do you hear PHPers handwringing about virtual environments, locking dependencies, and whatnot? Like DOS and Windows, the PHP world has done a pretty good job of making it easy to install PHP, run PHP programs, and not spend hours of your life dinking with mutually-incompatible bits of the stack.
Why would a shared hosting service want the pain of other solutions?
Re: WordPress now runs a quarter of the web
#77And WordPress itself is NOT insecure. It is in fact the most secure CMS you can find out there. The issue is that its simplicity and easy installation, brought a lot of non-technical people to use it and develop for it. So you get a lot of bad written themes and plugins that lead to all sort of security issues. On the other hand, Drupal and Joomla, all had SQL injections on their core discovered lately: https://www.d…
I agree that Wordpress is probably the most secure major CMS out there, but it's unfortunately still not good.
It had a whole bunch of XSS issues lately. XSS should be a thing of the past if people would implement Content Security Policy. I'm not aware that Wordpress is working on this. This is hardly defensible.
On the positive side I think their automatic update mechanism helps a lot and it's a pity other major CMSes don't have that.
Re: WordPress now runs a quarter of the web
#78WordPress is like the Kalashnikov of the web. You can use it for pretty much anything, run it anywhere, do god knows what to it and it'll still happy hum along (albeit behind a very big varnish cache). A few of our clients have millions of pageviews running off of a couple t2.small instances and the single biggest factor for them is the UI and the security of knowing they're not tied into a bespoke platform.
wordpress, and a t2.micro can handle >1 million pageviews?
My test server delivered 3.9 Million pageviews per hour with similar setup[1]
Re: WordPress now runs a quarter of the web
#79Can we get a Wordpress alternative written in Go, though?
[deleted]
Re: WordPress now runs a quarter of the web
#80WordPress is like the Kalashnikov of the web. You can use it for pretty much anything, run it anywhere, do god knows what to it and it'll still happy hum along (albeit behind a very big varnish cache). A few of our clients have millions of pageviews running off of a couple t2.small instances and the single biggest factor for them is the UI and the security of knowing they're not tied into a bespoke platform.
If everything is cached, sure, serving static content is cheap. The comparison with a solid machine I find it funny, a bad update in a plug-in can render your site useless for a while and WP's security record is abysmal.
An argument to be made is that it's security record is due strictly to its popularity. Given the choice between the 1000 pound gorilla that everyone uses and has double digit CVEs released every year, and the unknown that nobody uses, I'm going to pick the first one simply because the second one likely has just as many holes - there's just not enough people trying to attack it.