Hacker News Reader

Comment by joshmanders | Hacker News Reader

I am just not a fan of this. Avoiding Wordpress issues, just using an out of box solution; what if the customer wants specific features? Plugins? Oh those don't exist yet. Do you build your own plugin? Shoehorn some 3rd party system in?

I can't do that. My customers come to me expecting a solution that isn't hacky and just "there". They expect a solution that solves their issues and not tacks on more issues.

I've never seen any good results come from someone doing the least amount of work possible by finding out of the box solutions that half ass most of the features the client wants.

But I have seen many customers come back repeatedly satisfied with their completely custom solution because it has what they want and not confusing or anything, because it's to their specifications.

If doing half-assed work to get the client out the door and a new one in is the best thing, than I'd rather not be "the best".

View on HN

I think you are fooling yourself into thinking what you want to think.

IME that is fairly common among developers, who after all got into this line of work because they like writing code, not configuring a web interface. So, many developers will tend toward solutions that involve them writing lots of their own code, especially if it involves using an interesting new technology or framework. "Yes, node + Angular would be the perfect stack for your small business brochure site."

But let's think about the probabilities here, keeping in mind the customer wants a CMS (as specified in the parent comment). Wordpress is used by about a quarter of websites. What are the chances that your client wants a CMS feature that no one else has ever thought of before?

It's pretty unlikely. With very rare exceptions, there is a plugin available for what your client wants. You might need to modify the template to get exactly the look you want, but the feature is available. And Wordpress is not the only popular open-source CMS either--there are plenty of options to meet your client's needs.

From your business perspective, using a popular open-source CMS increases your margins: you spend less time building for the same quality. From a security perspective, a popular open-source CMS is superior to your code because so many other people are trying to attack and defend it. From the client's perspective, a popular open-source CMS is more future-proof--they can fire you and easily find another vendor to take over management. Even better if it's a commercially hosted instance and they don't have to worry about hosting at all.

Wordpress has its place for quick, dirty and simple jobs with common requirements however if you are trying to do something a little more complex wordpress is a awful choice.

You usually end up struggling with sub par plug-ins and unintuitive UI's that are a nightmare for you and the customer potentially wasting more time doing that then doing a custom build.

The point is it takes a 10X programmer to recognize when a out of the box popular solution might not be the right choice for the customer.

Installing a bunch of third party plugins is the fastest way to take an already somewhat vulnerable application and introduce security holes large enough to fly a 747 through.

I used to work in the hosting industry - the overwhelming majority of abuse reports against customers were from people who had installed wordpress and plugins and one of the plugins had a major security flaw, and then the customer was off to the races as part of a botnet or spamming.

So you now have to audit the plugins, you have to worry about future updates to those plugins introducing vulnerabilities, you have to worry about a plugin no longer being maintained and becoming obsolete, etc.

Is there a business case for WP and plugins? Certainly. But the blanket idea that you can just drop a PHP application on a server, install a bunch of plugins, and move on to your next more interesting project is extremely naive.

All of these points are valid, none of them are unique to the Wordpress solution.

If you're writing a reasonably complex CMS, you will create security flaws you can fly a 747 through. This is doubly true if the CMS isn't the end goal and rather a necessary dependency for what's actually needed.

The only guard against security holes is battle-testing your code - Wordpress may not be the most secure thing in the world, but it's likely more secure than something you can whip up yourself in a jiffy.

Ditto maintenance and obsolescence - in fact this problem is probably worse for a homebrew solution than WP, since the number of people qualified to maintain this homebrew codebase is approximately one, whereas you can actually hire for WP plugin maintainers if you need to. Likewise, homebrewing your own solution and then moving onto the next project literally means it's not being maintained from day one, which is strictly worse than even a casually maintained plugin.

WP installs aren't always the right solution, nor is deploying some off the shelf code, but choosing to write your own code needs to pass a higher standard than is normally applied in most companies - it's silly to complain that some open source thing might stop being maintained when by default what you write yourself is also not actively maintained ;)

> it's silly to complain that some open source thing might stop being maintained when by default what you write yourself is also not actively maintained ;)

I certainly agree to a large extent, but there's a lot that mitigates this as well:

When it's code you write, you have control over feature creep, documentation, comments, etc.

If you write something that only does what you need, you reduce a lot of the attack surface vs. off the shelf plugins, and you are in a position to make sure that the code commented and well documented. You don't have that sort of quality control over a third party plugin, and you may down the line be in for a rude awakening when it's no longer developer and has a breaking problem, and you open it up and find the code is a completely undocumented mess from top to bottom.

Of course if you're rushing something out the door, you might not produce anything better - but if you're a software shop with solid engineers, you have a high chance of being able to get better quality code out there than a lot of WP plugins.

(That being said, WP today is a lot more secure itself than it was in the past - the right option might be not writing the CMS from scratch, but writing any plugins you need from scratch)

I get your points, but at least with custom code you have security by obscurity. Using out of the box stuff puts you in a higher level of security risk because anyone can access the code and find bugs and how to exploit them. At least with custom code, it'll take some time for them to find something and attack you.

I mean for crying out loud, just installing Wordpress invites people trying to get in using automated tools. You can deploy a wordpress blog at it's default state, and wake up 3 days later to it being spammed.

The bad guys generally don't bother browsing Wordpress code to find vulnerabilities. It's tiresome to do, especially since a lot of good guys are doing the same thing and patching the obvious bugs.

Instead they use automated attacks to test any website directly for the most common errors. Understand that this is not limited to Wordpress. The types of vulnerabilities they test for are universal: password brute force, directory permissions, code injection, XSS, etc.

Sometimes one of these tests works, a site gets hacked, and then the developer has to a) recognize the site has been hacked, b) diagnose the problem, c) patch the hole, and d) recover the site.

For open-source projects like WordPress, the developer can then contribute the patch back to the community, and everyone else can pre-emptively fix their sites, even if they haven't been hacked yet. Bad guys also get these patches, and add automated attacks based on them. These are often what you see in WP logs, but such attacks are easily defeated by simply applying patches when they come out.

For custom-developed sites, you the developer must do all those steps by yourself, and yes that means you probably won't know about vulnerabilities until they are exploited.

The problem with custom solutions I see is that they are usually awesome at the first iteration but when the customer comes back wanting new features each subsequent version degrades. By degrades I mean that it takes longer, it is a little messier, a little hackier.

I believe this is honestly true for most software. The longer something has been around the more hacks it will inevitably have in it. The projects I have seen that last the longest are the ones built with a solid, generic foundation capable of handling all types of requests with minimal user touch.

I am not necessarily saying all out of the box solutions do this well but certainly, most if not all off the shelf parts have been iterated more to hammer out bugs, security issues, get the feel right, etc. than your homegrown bit ever could.

I of course couldn't advocate that wordpress is the solution to everything but if it meets the customer's needs right now and will do so for the foreseeable future, I see no reason not to use a mature, existing framework.

So how would you suggest getting the technical knowledge to build solid, generic foundations if most projects don't have them?

Rolling your own is almost never the best solution unless you are creating something truly innovative. This is almost never the case for client work as they are operating in defined markets. What always fails to get factored in is total lifetime cost - writing and deploying the code is a marginal part of that

Okay, so they need specific features and plugins. Start with WordPress, then write a WordPress plugin to your customer's specifications. You skipped writing 90% of the CMS, which is also tested and secured by a large group of developers. You have a much smaller codebase you're responsible for maintaining.

And what if the client wants a CRM... Do you install a popular CRM plugin, and then tell the customer to ignore 90% of what's in their dashboard, because posting articles isn't something they want?

If I as a client came to a company and said I wanted a CRM built for my company, and they gave me a Wordpress blog with a shitty CRM plugin, I'd request a refund and find someone who is actually going to build to my needs, and not hurry me through the tunnel to get my money and go onto someone else.

But I believe in quality over quantity. I'd rather spend time building a custom solution (Note, just because I am building a CRM doesn't mean I build the whole thing from the ground up, I use frameworks) that is going to make my client ecstatic and return again and again, than be like a friend's company. No good reviews. My current boss told me he had them make him a website few years ago. He said that lets just say he wouldn't be going back to them anytime soon. Why? Because they build EVERYTHING on WordPress.

>>My current boss told me he had [a friend's company] make him a website few years ago. He said that lets just say he wouldn't be going back to them anytime soon. Why? Because they build EVERYTHING on WordPress.

Sure, but that sounds like a strawman. The lesson in the original post isn't about building EVERYTHING on WordPress. It's about knowing when to use existing tools and solutions instead of reinventing the wheel.

>>I'd rather spend time building a custom solution... that is going to make my client ecstatic and return again and again

It completely depends on the project. If it is for a mission-critical application that needs a lot of custom, well-designed features, building it yourself might make sense. Otherwise using something someone else has built is just as likely to make your client ecstatic because you just saved them a lot of money and time.

> And what if the client wants a CRM... Do you install a popular CRM plugin, and then tell the customer to ignore 90% of what's in their dashboard, because posting articles isn't something they want?

No, I tell them to pay for Salesforce, because I'm not going to build something as good as Salesforce in anything approaching a normal project's budget, and I introduce them to trusted Salesforce consultants I know. It's more important to me that they get the right thing rather than pay me to do the wrong thing. And if you are building a CRM, even with a "framework", for any sort of business under, say, ten thousand employees, it's very likely--not without exception, but I'm betting hard in this direction and I will very rarely lose--that you are not doing the right thing for your client.

> If I as a client came to a company and said I wanted a CRM built for my company, and they gave me a Wordpress blog with a shitty CRM plugin,

The parent comment at the head of this subthread specified that the client wants a CMS. That's how we got on the topic of Wordpress to begin with.

I agree that Wordpress would be a terrible platform for building a CRM. But I am dubious that anyone needs a custom CRM. There are literally dozens of commercially available CRMs at all price points and industries.

That's just an example. I am building a custom CRM as part of a service right now. Or should I shoehorn Salesforce into this service and tell all my customers that to use that feature of our service, they have to also have a membership with salesforce?

My customers pay me for the features I am building all into this service... Not to charge them to hook a membership for another company up to it.

Then I have to provide support for Salesforce. Their service goes down, now I have my customers mad at me because part of my service is down.

No thanks.

It doesn't have to be Salesforce, but yes, I think you should help them find the right CRM solution, and configure and integrate it.

https://en.wikipedia.org/wiki/Category:CRM_software_companie...

Giving the customer direct ownership of their CRM database is a feature, not a bug. They will benefit from a CRM development team who has dedicated experience and expertise in CRM, plus they'll benefit from the feature and security requests of the other CRM customers. And it will make them less dependent on you, specifically. Which, from the client's perspective, is a good thing.

Edit to add: what's more likely, that Salesforce goes down, or that you are unavailable for some reason?

"And what if the client wants a CRM... Do you install a popular CRM plugin, and then tell the customer to ignore 90% of what's in their dashboard, because posting articles isn't something they want?"

No, you modify the template so it's not showing the stuff they don't want. Problem solved.

"If I as a client came to a company and said I wanted a CRM built for my company, and they gave me a Wordpress blog with a shitty CRM plugin, I'd request a refund and find someone who is actually going to build to my needs, and not hurry me through the tunnel to get my money and go onto someone else."

And if I was your boss, I'd fire you for wasting my money.

"But I believe in quality over quantity."

Nobody here is any different. The difference is that I don't think that the only one who can deliver quality is me.

"I'd rather spend time building a custom solution (Note, just because I am building a CRM doesn't mean I build the whole thing from the ground up, I use frameworks) that is going to make my client ecstatic and return again and again, than be like a friend's company."

And again, you're assuming that result isn't possible with an off the shelf solution.

>And what if the client wants a CRM...

SuiteCRM/SugarCRM

Salesforce

CiviCRM

vTiger

Insightly

Now figure out the integration between it and the WP site.

I would never just roll my own solution for a client. The whole point of open source is that it's battle tested.

It also saves you lots of time that could be used on the features they actually do want.

Most clients just want a soluton that works

I suppose it does allow you to lock them in easier with a custom solution.

Custom software is a business risk not an asset. Your company processes and people become dependent on workflows that lock you into the software. You become beholden to a single vendor, and eventually the pain of switching away from a woefully outdated system becomes all but impossible. Just ask the companies that still rely on hundreds of millions of lines of COBOL.

To add to this: Very old custom software located on internal systems is one thing, imagine if you are relying on 15 year old web-based software from a vendor that no longer exists. How do you protect that?

I think the point is that the developer should attempt to understand what the client actually needs and act intelligently to determine what tools or technologies would be best for the job.

If your client have the money to pay for the n months of work and maintenance, it is fine. I think most people try to use this solution because budget and time constraints.

Where in the story does it imply that Alice did halfassed or hacky work? And do not say because she used Wordpress or another off the shelf solution.

Reply on news.ycombinator.com