Do you mean WordPress? Sure, of course it shouldn't escape critical scrutiny, but people actually sneer at it (and PHP generally, and worse, at PHP programmers).
There's a lot to learn from WordPress and PHP.
There's a lot to learn from WordPress and PHP.
Having fought with a poorly documented, inconsistent and generally badly-designed codebase for a few months, I'm not sure I'd agree that WP is undeserving of some sneering. It is one of the worst made things I have ever seen.
PS: I no longer develop in PHP, and haven't seen the WP codebase in about three years so perhaps it has improved.
Wordpress users have a poor security track record.
As an ex-user myself, who built the site and only installed a couple of plugins, I moved my organization to another platform because I was sick and tired of having to babysit what should be a solved problem by now.
If it's something like Squarespace then what's really happening is you're paying someone else to babysit it for you.
My preferred solution would probably Movable Type, but since my org can't afford it and we don't need fancy formatting, it's Nikola + Coil CMS. Easily editable by non-techies and yet there's no code to attack on the site - it's all statically served by Nginx.
And if the API with which you must interact is poorly structured and documented, then this becomes harder. Furthermore, a messy core codebase makes projects harder to complete (as was my experience building custom auth for wordpress).
That is what competing systems have to beat. I do think that our own django CMS https://django-cms.org is a better system than WordPress - more elegant, more secure, more extensible and scalable.
But it's not enough to be proud of our beautiful internals, we have to give the ordinary, non-expert user a good experience too, and make them feel in charge of the system from the start. That's why we admire WordPress and want to beat it (and who would want to beat something that they sneer at - it seems a low ambition!).
For many people it's "log in to cpnael, press the wordpress button, done". this is what other systems need to beat, and... without the cooperation of major hosting companies, they won't.
get install scripts in to control panels like virtualmin to get rolling on adoption.
We welcome community contributions of installers, and those always go into the OSS version of Virtualmin, as long as the person is willing to help maintain it long-term, and it is generally usable on a wide variety of our supported operating systems without too much effort (e.g. it works without needing a super new version of the language). Adding such an installer does put the app in front of about 100,000 users (which is roughly our current installation count of Virtualmin GPL), so that's cool and probably is a useful use of time/effort for someone wanting to make a web application more visible and more widely used.
We're working on better support for multiple versions of Python, as that's also a problem for more widespread adoption of Python apps (and Ruby, and Node, and Perl, etc.). Most rely on very, ridiculously, new versions of the language, whereas PHP apps almost always have a low barrier to entry that matches what an old version of CentOS shipped with. So, users don't just need to install the application or framework, they also need to install a personal version of the language it is written in. That's a bridge too far, for the vast majority of beginners. We already support multiple PHP versions, as that was a priority for many of our users, but we're just getting started looking into stuff like rbenv, plenv, pyenv, etc. for private versions of languages.
The problem of needing very new versions of the language currently leads to a lot of our supported non-PHP apps being unsupported on the most popular systems, without some extra hoops to jump through; CentOS 6, which still has more active installs than anything else, can't run many modern Ruby, Python, or Perl applications, without installing a newer version of the language. SCL provides newer versions of some of those, so it's not insurmountable, but it's still a leap for many non-technical users.
Anyway, it's worth being aware that using the latest and greatest language features is fun, but it's also limiting reach. (Even once we automate all of this for other languages than PHP, Virtualmin is still running on a tiny number of the servers in the wild, relatively speaking.)
Oh - yes, there's a "Django" installer, but not the Django CMS I was referring to.
Yes, it's a small number, but I'm doing my best to help grow it with my client base, and then their client base, etc.
Thank you for the work you all do on Virtualmin.
I'm glad to hear Virtualmin is working well for you. If you have problems with Python stuff in Virtualmin, feel free to let us know. The squeaky wheel gets the grease...and not many people squeak about Python/Django support in Virtualmin. As far as I can tell there are literally thousands of times more WordPress users than Django users (just to put it into perspective).
Real-world example: I needed to build a restaurant website in as little time as possible.
A Google search for Wordpress Restaurant template gave me everything I needed (I went with one from ThemeForest).
The same search replacing Wordpress with Django doesn't return anything relevant :( (it does give me several paid ads for Wix and other site builders).
Edit: mgkimsal also has a point. It's ridiculously easy to get Wordpress up and running with most hosting providers.
Edit2: the article mentions the setup issues. Docker containers sound like a way to overcome that one, but the ecosystem barrier will remain.
You mentioned custom auth plugins and custom theme - did you build those yourself, or use third party ones?
One of the biggest issues I have is that the more popular a plugin is, generally the worse it seems to be from a code standpoint (I'm talking about understandability, testability, performance, readability, etc). Yes, it works, but... if I need to extend it... it seems like it was written by and for people who do not understand programming (and yes, I realize that's generally exactly what's going on).
When you try to do a large WP project, you're suddenly dealing with a dozen or more separate plugin authors/companies, all of whom have different styles and competency levels, and some of whom break other code (unintentionally almost always). Trying to 'support' that is a logistical headache, on top of whatever else you're trying to have the system do.
It's not so poorly made that it's unusable. Even from a development perspective.
I've seen quite a few beautifully-engineered projects that failed in some critical, unresolvable way or (more often than not) were just plain unusable.
The entire world is built on shitty infrastructure that gets the job done.
Maybe it's because I just haven't forced myself to get good and fast w/ Django, but when I need a CMS and the project is almost entirely about how it looks or some functionality that is solved by a well regarded plugin I just head straight for WP.
That being said, I 100% agree that the codebase is horrific when you're used to writing modern PHP (even worse when you're used to other languages, period) but it is such a known quantity it's hard to move away from it unless it can be solved by using something like Squarespace, etc.
I disagree, I found writing custom auth and theme to be nightmarish compared to other frameworks and CMSs because the codebase is so poorly documented and illogically structured. It probably took us three times as long as it should have done to "complete" the project. Having subsequently played with some other CMSs/frameworks like October (based on Laravel) and Django, wordpress looks somewhat inexcusably bad.
The guy is in Chicago right now and gets a lot of business from engineering firms. He is doing phenomenally well, he gets about 30-40k from (what appears to be) 20-40 hours of setting up fairly basic things with Wordpress.
That guy taught me well about my being snobbish.
WP built a culture, which mostly works, not just a product, which - by any reasonable standard - is utter crap internally.
Once you build a cultural monopoly, it's damn near impossible for a second mover to dismantle it. You have to wait for a new niche to colonise, or for WP to implode under the weight of its own awfulness.
A new niche is hard to imagine in blog land, at least while we have today's web. And awful as it is, WP isn't quite so awful it's likely to implode. If it was, it would have done it by now.
Your friend is making money because he's thinking like a business person who can offer a service, not like a developer who primarily thinks about tools, not cultures.
I'm sure you can learn a lot from PHP/Wordpress, but everything has opportunity costs. You can learn better from better languages and frameworks.
My shop does Python, Java, C and PHP. I know very good programmers who happen to write PHP for a living. They are the ones sneering at PHP the hardest.
There are some plain-crazy things about this language, but there are also some plain-crazy things about other popular languages too. It's like we forget that JavaScript was absolutely reviled for over a decade. PHP is undergoing a JavaScript-like transformation, though it will never get that kind of popularity because of the lack of client-side browser usability.
I'm not a purist, if you're making money coding PHP more power to you. Around here there are a lot of businesses hiring people to make them Wordpress sites. But an aspiring dev asks me what language to learn I don't recommend it.
There's also some crazy defaults with json_encode which you actually need to send a flag to disable to get valid UTF-8. JSON_UNESCAPED_UNICODE, I am looking at you...interestingly enough they set the default to not cause buggy JSON parsers people use to blow up. Not a choice I would have made, but I guess they like to be nice to their users. It would be nice if their documentation for this function gave a more prominent message about this.
To address your second point though, I wouldn't advise that anyone learn _any_ language specifically. I would have them address concepts directly and try to be language agnostic. JavaScript would be the closest thing just for employability reasons, but it has way too many JavaScript-specific quirks for me to recommend someone to base their career on it.
I started out learning PHP on a LAMP stack on an old laptop, and reading C tutorials online. Probably my best move was working through SICP.
If they were math-inclined and weren't worried about immediate employability I'd recommend SICP even though Scheme is irrelevant in industry.
But if they wanted to make money as a web dev as fast as possible, JavaScript makes sense.
Ninja edit: yep. (http://asmblah.github.io/uniter/demo/interactive.html)
So you could run a PHP VM on top of a Javascript VM in PHP.
Also, an exploitable XSS in your web application can be just as damaging as a server compromise.
Entering a growth market early and appealing to beginners can get you a lot of traction and mind-share.
Being easy to get started with is better than being easy to use overall because of human cognitive biases.
You can coast on that initial traction for a long time and remain successful because people will become "fans" and tie their ego to the tools, especially if they started using it very young.
No one gives a shit about security.
Success does not have to be correlated with providing value if you target the less informed.