Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why Wordpress?

johnmaeda.com

Post reply on HN
Print view View original

81–90 of 90 posts

Re: Why Wordpress?

#81

Post by WhiteSource1 »

XparXnoiAx wrote: post #13
lkrubner wrote: post #3

I'm looking at the "dead" comment by PravlageTiem. I understand that PravlageTiem was being sarcastic, and some people feel that sarcasm undermines the tone that is supposed to prevail on Hacker News. But still, PravlageTiem raises an important point: WordPress has historically been a security nightmare. Possibly there was a tone of anger in the way PravlageTiem expressed themselves, but the security flaws in WordPre…

Yeah, I wish I could recommend WordPress to people because it's really nice at what it does, but the security flaws are too serious.The fact that it takes months for them to fix serious vulns reported to them only makes it worse. Seriously, there are youtube tutorials about 'How to Hack Wordpress.' It can't get much worse than that: https://www.youtube.com/results?q=wordpress+hack

How about putting a tool like Incapsula on top (free option offers 2 factor authentication) which makes hacking just a bit harder.

Re: Why Wordpress?

#82

Post by anotheryou »

blueatlas wrote: post #73
ivanhoe wrote: post #64

What are the alternatives? Is there any other free, self-hosted, open source CMS that out-of-the-box allows an average non-tech person to publish content, images, etc. with such ease and nicely designed admin GUI? Easy to install, can be installed on any cheap shared hosting and will work fine, has automatic updates, content is searchable, has tones of themes free or cheap to choose from, it's fairly easy to customiz…

Take a look at Concrete5. It's a LAMP stack like Wordpress, MVC under the covers, a common sense architecture, and highly extensible. It has an exceptional, in-context UI for content editing that is the best I've seen, and a good core team and community that is very active. One area that Wordpress wins is with respect to the overall number of themes and plug-ins, but that's pretty much it.

I tried it a few years ago and it was not ripe yet. Community to small, bugs to severe.

The WYSIWYG editor is still nice though. But it adds a lot of complexity if you want something it can't do. Somme abstracted forms in wordpress are easier.

Re: Why Wordpress?

#83

Post by whitemale »

> investing in the future of young women and people of color who are learning to code; and as Automattic we are actively doing the same to advance diversity and inclusion as a leading technology company

They forgot to include LGBTQ.

It might be just me, but I don't really care who writes a piece of software. It could have been written by a black gay transgender muslim female or it could have been written by a privileged white boy, it doesn't matter.

When I last checked Wordpress, its codebase was amateurish and horrible with a plugin API that looks like a bad joke. Automattic should focus on making their codebase not stink instead of worrying about SJW propaganda.

Re: Why Wordpress?

#84

Post by matt_morgan »

sean_patel wrote: post #5
lkrubner wrote: post #3

I'm looking at the "dead" comment by PravlageTiem. I understand that PravlageTiem was being sarcastic, and some people feel that sarcasm undermines the tone that is supposed to prevail on Hacker News. But still, PravlageTiem raises an important point: WordPress has historically been a security nightmare. Possibly there was a tone of anger in the way PravlageTiem expressed themselves, but the security flaws in WordPre…

> WordPress has historically been a security nightmare. This. And all this started around the same time - in 2006 -- when Stefan Esse, the PHP security expert "resigned". In a blog post in 2006 (that can no longer be found) Esse was quoted as saying he quit > "because among other things they were resistant to his finding bugs in PHP, and had refused to patch some of the bugs he found." Source(s) http://www.darkreadin…

If Django (for example) was as popular and as user-friendly as WP, there would certainly be DJEngines out there charging what WPEngine charges. It's not about security problems, it's about the fact they charge less than I (for example) can. For my clients to get from me what they get from WPEngine would easily be $1000/month, rather than $99.

One of my clients spends $99/month on WPEngine, and $5-20K per month on the advertising and social media that brings in all their new traffic. They have five people on staff, who probably cost $80-100K per month. $99 for WPEngine is a blessing--it frees them up to think about what's important, rather than wondering whether their tech provider is handling backups.

Your arguments about WP security are not strengthened by the point about WPEngine costs.

Re: Why Wordpress?

#85

Post by mymmaster »

If you have an existing web application (i.e. Rails or Django) and need to add in CMS, Wordpress becomes suboptimal very quickly. If you're doing work for a client website, they want you to spend as few hours ($$$) as possible launching a CMS. For that there are modern API-first CMS like https://buttercms.com that were built to quickly integrate into any tech stack. Which means you remain very productive working in technology you're comfortable with instead of learning PHP (in the event you're well versed in Ruby or Python, for example).

Re: Why Wordpress?

#86

Post by g00gler »

mgkimsal wrote: post #75
g00gler wrote: post #50

Earlier quoted context omitted.

What do they use so many plugins for? I took over supporting/developing a WordPress site and one of the first things I did was delete a bunch of pointless plugins. I wound up writing quite a few of my own for different tools and left some third party plugins so there are still probably 10 active between 3 sites on a multisite install. I installed Google analytics directly in the header of the custom themes on each of…

Install woocommerce - you'll end up with 12-15 plugins off the bat. Would you like to force everything to be SSL? Another plugin. Do you want a contact form? Another plugin. Do you want to disable the bizarre update messages from ignite woo that won't go away? Another plugin. Oh, you want some slider-carousel thing on some page? Another plugin. Caching? Another plugin. Image optimization? Another plugin. Some sort of…

So I think you're agreeing with me? I can't really tell.

I agree that knowledge of best practices is really important, because why would you need to run a plugin on top of your site to force HTTPS?

I use Apache to force HTTPS, Apache to handle error documents, etc. My themes each have their own cache manifest.

It's common sense / best practice to have a second server to test updates on, that's what I do. Given I only have 12 plugins with a handful on active on each site, it doesn't take too long. I also add and develop plugins on the second server.

IMO the shittiest thing about WordPress is the library so by and large I choose not to use it when it isn't necessary, so pretty much everything besides querying posts and accepting AJAX calls since they make it nearly impossible to otherwise.

In general, I try to develop apps/plugins that run 100% independent of WordPress and just write a wrapper for the library that's used for administration on the WordPress dashboard.

An example of this is a plugin that's more or less a long test, with some custom GUI and other requirements (save progress, download CSV, take notes, etc). I wrote it to WordPress standards and used a short code to add it to a page. It was slow, sooooo slow.

So, I rewrote the entire front end to be an independent app that uses a custom DB table, propagated by a plugin on the WordPress dashboard. Result? 80% faster load times.

Another example, I made a simple app that gets some data from another custom DB table and sends tweets, triggered by cron. It uses a SQLite DB to track a few settings and a list of users to mention.

I wrote a wrapper for the library with a simple API to manage settings in the WordPress dashboard.

Unless there is a drastic change to WordPress's plugin system these apps will always work. Even if there is a change, pretty much all the code that WordPress cares about is displaying the settings page and receiving AJAX requests.

It might not be by the book but it's faster and in my opinion, pretty logical. This way apps are portable and can be transferred to other platforms easily, not necessarily other WordPress sites on shared hosts but they're custom so that isn't the point.

* Edit to say, I wouldn't recommend any non technical user maintain a WordPress e-commerce site, anyways. Square makes it so easy, hosted secure and has tools for inventory and other things, too. All included in standard credit card processing fees.

I'm sure they aren't the only ones but I was amazed at how simply someone could set up a site, as I know someone who has a store and uses square for payment processing already.

Re: Why Wordpress?

#87

Post by dwheeler »

nikcub wrote: post #45
dankohn1 wrote: post #37

Earlier quoted context omitted.

An alternative would be for plugin authors to achieve a Core Infrastructure Initiative Best Practices Badge, which is free and shows a commitment to secure coding. https://bestpractices.coreinfrastructure.org Disclosure: I'm the co-author of the badge at the Linux Foundation.

Is there a single plugin that has been granted the badge? The policy docs don't seem specific enough in areas where plugin developers need help (ie. don't use superglobals, raw sql or PHP scripts outside of the plugin load process) while being an over burden in less important areas (ie. requirement that each project have a security expert, and CI builds) Having an audited plugin repository for Wordpress is an idea i'…

Some WordPress plugins have started working on getting a CII best practices badge. None have gotten it quite yet, but there's no reason they can't. There's no cost for the badge, and the criteria are general "common sense" criteria that most people would agree are reasonable.

That shouldn't be surprising. The CII badge process opened in May 2016, so it's only been available for about half a year. I expect that most WordPress plug-in authors don't even know about it (yet).

> I have to wonder if WordPress added a small cost and verification system at front, similar to the app store, if third-party code would be of higher quality.

I think that's likely. At the very least, someone could run some static analysis on the plug-in with rules very specific to WordPress (e.g., "don't use superglobals"). That could really help.

However, there are many general "good things" that plug-ins should do. Trying to recreate a list of general good practices would take a lot of time, and be a pain (trust me!). Instead of reinventing the wheel for a list of general good practices, I suggest using the CII best practices badge identify general good practices, and then if you wish, create a separate list of rules specific to WordPress. That'd be much easier.

Disclosure: I'm technical lead on the CII best practices project. But it's still a good thing :-).

Re: Why Wordpress?

#88

Post by XparXnoiAx »

WhiteSource1 wrote: post #81
XparXnoiAx wrote: post #13

Earlier quoted context omitted.

Yeah, I wish I could recommend WordPress to people because it's really nice at what it does, but the security flaws are too serious.The fact that it takes months for them to fix serious vulns reported to them only makes it worse. Seriously, there are youtube tutorials about 'How to Hack Wordpress.' It can't get much worse than that: https://www.youtube.com/results?q=wordpress+hack

How about putting a tool like Incapsula on top (free option offers 2 factor authentication) which makes hacking just a bit harder.

2 factor authentication is great, but it won't stop an attacker from using an XSS attack to get the authentication cookie.

In general, security isn't something that can be tacked on as an afterthought, it has to be built in from the beginning.

Re: Why Wordpress?

#89

Post by mgkimsal »

g00gler wrote: post #86
mgkimsal wrote: post #75

Earlier quoted context omitted.

Install woocommerce - you'll end up with 12-15 plugins off the bat. Would you like to force everything to be SSL? Another plugin. Do you want a contact form? Another plugin. Do you want to disable the bizarre update messages from ignite woo that won't go away? Another plugin. Oh, you want some slider-carousel thing on some page? Another plugin. Caching? Another plugin. Image optimization? Another plugin. Some sort of…

So I think you're agreeing with me? I can't really tell. I agree that knowledge of best practices is really important, because why would you need to run a plugin on top of your site to force HTTPS? I use Apache to force HTTPS, Apache to handle error documents, etc. My themes each have their own cache manifest. It's common sense / best practice to have a second server to test updates on, that's what I do. Given I only…

> It's common sense / best practice to have a second server to test updates on, that's what I do. Given I only have 12 plugins with a handful on active on each site, it doesn't take too long. I also add and develop plugins on the second server.

WP specifically makes this non-trivial, because post and db data has hardcoded path info in it. Export/import a database? You have to make changes to it. For something that is 10 years old... an import/export system that acknowledges the reality of plugins and separation of data would be nice.

SSL? When you're running wordpress, and you think "I want everything to be SSL"... you look for a plugin. I wouldn't and don't, but this particular system was something I inherited.

20+ plugins in WP systems seems to be something I run in to far more often than the "expert dev/ops guy who knows about SQL and can handwrite in 5 plugins what takes 15 by normal folks" systems.

I think you're in the minority when it comes to being able to be 'good' with wordpress. As I was suggesting before, part of the appeal in wordpress is there's a low common denominator. Someone who came across your WP code that used custom tables, (instead of throwing EVERYTHING in to either wp_options or post_meta)... they'd be lost. Honestly. Really. I see it quite often. People writing plugins and themes and selling WP solutions not having the foggiest idea how to write or use SQL.

"Square makes it so easy, hosted secure and has tools for inventory and other things, too. All included in standard credit card processing fees."

This particular client was sold on "you can customize everything in woo/wp". There were a number of technical things they wanted to do which Square and others do not do, and they'd already tried with other hosted solutions as well (3dcart, for certain, and maybe another).

What we inherited (and what I normally get in most projects that get referred) is an undocumented mess of stuff that is not in version control of any sort, a mishmash of various versions of libraries, etc.

CAN you build 'decent' code in WP? Without a doubt, it's possible, but the defaults still go against commonly accepted dev practices. The more configs go in databases ("wp_options for everything by default"), the harder migrating between various environments is (I can't just pull code, for example, because db configs are required for everything to run correctly). That's not insurmountable, but you're working in an environment where these common tools and practices are a) not provided and b) not-understandable or accessible by the majority of the developers in that community.

Post reply on HN