Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

WordPlate: WordPress on Composer with sensible defaults

github.com

Post reply on HN
Print view View original

81–90 of 105 posts

Re: WordPlate: WordPress on Composer with sensible defaults

#81

Post by johnchristopher »

Nextgrid wrote: post #79
johnchristopher wrote: post #54

Earlier quoted context omitted.

Yeah. Big workflow failures here. The person who changed the code doesn't have a revision system in place or the skills/knowledge to put the site back up after such a minor edit :/.

How do you even reliably version-control something that relies on editing its own code?

There's some confusion here. WordPress themes and plug-ins don't rely on the built-in web editor. That's why it can be safely disabled.

What that guy did is no different from sshing into the prod server, live editing a Django plug-in and refreshing the browser.

Version control of the plug-in won't protect from that. But it's a handy tool to manage regressions.

Rolling back changes and editing a live plug-in are different problems.

Re: WordPlate: WordPress on Composer with sensible defaults

#82

Post by unity1001 »

Nextgrid wrote: post #78
unity1001 wrote: post #77

Earlier quoted context omitted.

Same goes for Windows. Same goes for every single major tech service. We read major security flops that expose millions' data from every major tech service every other day. Why should WordPress be singled out for anything other than just baseless elitist ire. > this disgrace of a platform It looks like this needs to be hammered home: That disgrace of a platform is running 50% of the web and 30% of all ecommerce websi…

> Same goes for Windows. Windows has significantly improved since its early days - the Windows you're talking about would be at best unpatched Windows XP. > Same goes for every single major tech service. We read major security flops that expose millions' data from every major tech service every other day. Disagreed. Find me any tech service anywhere similar to WP's scale that can be compromised in a fully automated m…

> Windows has significantly improved since its early days - the Windows you're talking about would be at best unpatched Windows XP.

Same for WordPress.

> the exploits are of the same kind over and over again?

There is nothing that anyone can do for websites that people put up and abandon. They are not updated, and they would naturally get compromised.

> Disagreed. Find me any tech service anywhere similar to WP's scale that can be compromised in a fully automated manner

Find me any totally customizable service or software that is under your own total control, which you can just set up anywhere on the Internet as your OWN property and abandon it if you would just feel like it...

> I'm not sure anyone is singling out WP? Every stupid data breach gets called out

There are multitudes of comments that specifically single out WP in the post's comment thread. Including this very thread that you are on.

> The problem with WP is that it's prone to the same kinds of vulnerabilities over and over again

That's just flat out false.

> outdated, bad development practices/standards that make writing secure code difficult and a language/runtime that is itself flawed

Ah, its not just WordPress animosity, its also PHP animosity. Which, runs 80% of all websites on the planet in turn. And with hollow arguments of 'good practices'.

There absolutely isnt one single software that gets THIS widely used without noticeable amount of security cases. This includes 'good practice' software.

And again, I said this before and Im saying it again: WHERE is that objective study that compares WordPress with other software in regard to vulnerabilities, taking into account 'good practices' and use cases? Like taking into account Windows computers that are scarcely connected to the Internet or taking into account how the majority of Linux servers are run by sysadmins and not end users?

Nowhere.

There is one universal, dumb concept of 'security vulnerability' and it applies universally without taking into account anything. As a result, the random website that a site owner has abandoned getting compromised by an NON-UPDATED plugin is the same with a freaking internet-wide used web server software getting hacked or a major tech service leaking millions of users' data out.

Totally un-objective.

> (uploading a malicious file is a non-issue in every non-PHP application because your app server doesn't automatically execute said file - except in PHP where if the file ends in .php and is in the web root your server will happily execute it).

No it doesnt. Dont make up falsities. PHP executes files how you configure it to. Another case of configurability and total customizability. If you give the users to customize something, there will be those who customize it in bad ways. Its as simple as that.

> A significant chunk of people smoke tobacco, doesn't necessary mean it's good for you

Unintelligible comparison. Totally absurd.

> if the drawbacks of WP mostly impact other peopl

They dont. You are literally projecting your subjective opinions that are totally free of any objective, data-backed comparison.

> those drawbacks won't be priced in and thus if WP appears cheaper it will be popular.

That doesnt even make sense. All the legal liabilities of site owners, ecommerce site operators, any kind of business person are on them. They dont go away because some software is open source. And if all of those people are still on WordPress, it means that there is no such 'drawback to be priced in' as you so baselessly claim.

...

It just ended up as another string of uninformed, personal & subjective opinions posing as truisms. No data backed comparison, no self-contained, coherent logic, just bashing on what's popular. You even proposed things PHP doing certain things because people CONFIGURE it so as 'bad things'.

I'll just remind you that the case of WordPres is the same with any case in which you give people total control and total customizability - some people will f*ck up some segment of it whereas multidudes more people use it properly. It wouldn't be any different if you gave people totally customizable cars.

Ill leave you to your subjective biases at this point. Baseless arguments actually only backed by elitism and hate of what has become popular...

Re: WordPlate: WordPress on Composer with sensible defaults

#83

Post by Nextgrid »

unity1001 wrote: post #82
Nextgrid wrote: post #78

Earlier quoted context omitted.

> Same goes for Windows. Windows has significantly improved since its early days - the Windows you're talking about would be at best unpatched Windows XP. > Same goes for every single major tech service. We read major security flops that expose millions' data from every major tech service every other day. Disagreed. Find me any tech service anywhere similar to WP's scale that can be compromised in a fully automated m…

> Windows has significantly improved since its early days - the Windows you're talking about would be at best unpatched Windows XP. Same for WordPress. > the exploits are of the same kind over and over again? There is nothing that anyone can do for websites that people put up and abandon. They are not updated, and they would naturally get compromised. > Disagreed. Find me any tech service anywhere similar to WP's sca…

> Same for WordPress.

Not as much - WP favours backwards compatibility (or is it laziness?) even when doing so impacts security.

Another problem is that the environments Wordpress targets are inherently vulnerable - while it's not WP's fault directly, they do nothing to warn people against using them nor outright stop supporting broken, insecure configurations.

> There are multitudes of comments that specifically single out WP in the post's comment thread. Including this very thread that you are on.

I was talking about publicized data breaches in general. But if we specifically talk about CMSes, I'm not sure anything else beats Wordpress and similar PHP-based CMSes of that era when it comes to not just the amount of vulnerabilities, but especially the nature of them - the same, dumb, basic problems resolved in every other language (including modern PHP with a framework such as Laravel) repeated over and over again.

> WHERE is that objective study that compares WordPress with other software in regard to vulnerabilities

Someone posted the following excerpt of the Wordpress codebase: https://github.com/WordPress/WordPress/blob/master/wp-includ... which appears to be some custom attempt at simulating SQL query parameterization instead of using the actual, database-driver-provided function. If this is indeed the purpose of that function and it is indeed used, then I'm not sure there is any valid excuse for this in today's day and age.

Someone else mentioned password hashing still relying on MD5 - if that is actually true, I'm not sure that is excusable either? I haven't done PHP for many years now, but surely even if the native functions aren't available, couldn't they use a "polyfill" such as https://github.com/ircmaxell/password_compat ?

I'm sure there are many other issues but frankly the first one should be enough for any competent developer to run away.

> No it doesnt. Dont make up falsities. PHP executes files how you configure it to.

I was with you until this, but now I think you're arguing in bad faith.

Yes, if you want to be pedantic, PHP and your web server execute files like how you configure them to. In practice, the environment where the vast majority of Wordpress sites are deployed (your typical shared hosting environment) will execute anything that ends with .php and is in the web root.

This is inherently a legacy PHP problem (which WP encourages by supporting it) - no other language that I know of does this by default. If I accidentally store a malicious file in Python, Ruby, Node.js, etc applications, the worst that will happen is that I serve it back. At no point what so ever the server itself will execute that file.

Yet in the PHP environments Wordpress targets, this is a massive issue which means every single feature handling file uploads (both in WP core and any plugins) should anticipate your server's misconfiguration (maybe it's not limited to .php files, but .html files too?) and try to protect against it, eventually failing and then you get yet another Wordpress vulnerability.

Re: WordPlate: WordPress on Composer with sensible defaults

#84

Post by [deleted] »

montroser wrote: post #49
splatzone wrote: post #42

Earlier quoted context omitted.

You could have avoided all of these problems by having a developer set up a staging environment, version the site in Git and disallow file editing on the site.

Fair enough, and now I know. But would you also agree it's a totally insane capability, let alone default , for a CMS to offer a web interface to edit its own running application code? With no VCS integrated or rollback mechanism... I was too naive to know I should look for a thing like that to disallow.

[deleted]

Re: WordPlate: WordPress on Composer with sensible defaults

#85

Post by splatzone »

montroser wrote: post #49
splatzone wrote: post #42

Earlier quoted context omitted.

You could have avoided all of these problems by having a developer set up a staging environment, version the site in Git and disallow file editing on the site.

Fair enough, and now I know. But would you also agree it's a totally insane capability, let alone default , for a CMS to offer a web interface to edit its own running application code? With no VCS integrated or rollback mechanism... I was too naive to know I should look for a thing like that to disallow.

Yes, those are totally legitimate criticisms.

IMO WordPress' big flaw (and key asset) is its commitment to backwards compatibility. The upside of this is that it was very easy for people to pick up and deploy it on PHP hosting in the 2000s, leading to its massive growth. The downside is that, as a WordPress developer, you're saddled with sticking to decisions made years ago.

It's definitely not your fault that this is unclear, the WP.org documentation does a poor job of explaining the pitfalls. After 5-10 years of working with it you come to understand the weird kinks...

Sorry for piling on your comment.

Re: WordPlate: WordPress on Composer with sensible defaults

#86

Post by MonaroVXR »

kijin wrote: post #9
9dev wrote: post #6

Just reading this again gives me a backflash of the horrors of working with WordPress. If you haven’t seen the source, you don’t know just how god-awful the code is - and it just won’t die, because of all the ecosystem traction it has. Even the PHP developers have chosen to ignore WordPress in language evolution considerations, as the WordPress community refuses to do accept kind of progress for their project - they…

There's much more to WordPress than the ecosystem. If we just think of it as a legacy tool that is only limping along because of the plugins, we will forever be perplexed that it continues to exist. WordPress is the FLOSS alternative to Wix et al. It is the only practical software that enables people to create and self-host an online presence without having to type a single line of code, and without being beholden to…

Using other static website generators and CMS would be easy, but I beg to differ with Gatsby, Sanity, Vercel and more.

1-point-click installations failing, to failing standard templates, tutorials that are only for version 2 and not 3, because that's a video right now.

Talk is cheap, but execution is where it is.

Re: WordPlate: WordPress on Composer with sensible defaults

#87

Post by MonaroVXR »

beezlewax wrote: post #26
DoctorOW wrote: post #15

Earlier quoted context omitted.

> Understand the users, on the other hand, build a good alternative, and that billion-dollar market might become yours. Isn't that the entire point of Ghost?

Its written in node js though right? You can run php and mysql almost anywhere you want. Even the most basic hosting setups are pre configured for this. Apache is preinstalled on most cheap shared hosting. That's the thing.. if you want to take down wordpress it should be something current wordpress users can easily install on their current hosting with zero extra config to do. No terminals no server settings to deal…

Even developers and tech people are having difficulties with installing Wordpress, but that's just my experience. So I don't think it's that easy.

Re: WordPlate: WordPress on Composer with sensible defaults

#88

Post by MonaroVXR »

kijin wrote: post #24
DoctorOW wrote: post #15

Earlier quoted context omitted.

> Understand the users, on the other hand, build a good alternative, and that billion-dollar market might become yours. Isn't that the entire point of Ghost?

The installation guide for self-hosted Ghost assumes that you have at least a virtual private server, and gives you a bunch of commands to type into a root shell. By that time, you've already lost 90% of the people who would have chosen WordPress.

I thought Ghost was pay only?

Re: WordPlate: WordPress on Composer with sensible defaults

#89

Post by MonaroVXR »

JodieBenitez wrote: post #80
9dev wrote: post #6

Just reading this again gives me a backflash of the horrors of working with WordPress. If you haven’t seen the source, you don’t know just how god-awful the code is - and it just won’t die, because of all the ecosystem traction it has. Even the PHP developers have chosen to ignore WordPress in language evolution considerations, as the WordPress community refuses to do accept kind of progress for their project - they…

The code is awful, but some plugins are even worse. And the database schema... such a nightmare. I have the luxury to be able to refuse Wordpress projects. In fact whenever I can I replace Wordpress with Django.

Django is also my go-to idea.
Post reply on HN