The Next WordPress | Hacker News Reader

The Next WordPress

wsvincent.com

43 pointswsvincent39 comments

First of all, Wordpress is known to fix security issues quickly and platforms with many developers have more eyes on the code so it's only natural that they have a LOT of reported vulnerabilities. This does not mean that it's "inherently" insecure.

A static site can't enable...

- User management (Members)

- On-site-comments (That Search engines can find)

- Voting (Polls & Ratings are very popular on Wordpress!)

- Carts (For selling products)

- Any user submitted content

...without 3rd party services that rely on JS.

This means that you rely on several external services for the site to have these features and in the end, the costs will be higher than running it on Wordpress.

But it could possibly be easier to maintain, be more secure, have higher performance and the dynamic parts wouldn't all fail at the same time so the uptime of the core site could be better.

> This does not mean that it's "inherently" insecure.

It's a pretty strong indicator though.

No, the more developers the better is usually the case.

Any app that is large and complex at it's core with a very wide API that is continuously expanded on and occasionally refactored will get new bugs and vulnerabilities along the way.

Couple that with many developers that are exchanged now and then and you have a nice unavoidable mess to handle whether you want to or not.

Also, a majority of the vulnerabilities are in abandoned and badly coded plugins:

https://www.wpwhitesecurity.com/wordpress-security/statistic... (2014)

This is completely wrong. The more eyes you have on something, the more hackers attacking something combined with more pen testers and coders working on it, the more secure it is.

You know what is insecure and makes for a great target..software developed by few people, updated infrequently by people who don't care. The exact opposite of WordPress.

Not really. Sometimes you hear about the WordPress security vulnerabilities that are patched, but still exploited, and this is mostly a problem with people not keeping an eye on security updates.

Combine that with the popularity that WordPress has drawing in people who know enough to program themes and plugins, but not enough to program said themes and plugins securely (avoiding simple SQLi and XSS) and you get the perception of an insecure system that WordPress has.

Also the blame falls on actual users not keeping plugins up to date or using one's from dodgy sources.

The most uninformative article I've ever read that was on the home page of HN. It's full of misconceptions and assumptions (that every WP based site can be be replicated with static site generators, that 'WP is inherently insecure' and so on).

Also that static generation of site pages on a mac app would be an acceptable solution.

Also, if you choose a really great host, you shouldn't have any security issues ;-)

The article simply doesn't meet the standards of HN and only spreads popular misconceptions.

It smells like a thinly veiled piece of advertising for Lektor, to be honest.

I would love to maintain our websites with a static site generator and manage updates via pull requests to our version control system.

I don't have a single user who would understand that sentence. That's why we use WordPress.

Maybe with a pre-configured, cross-platform App - It might be "easier", but then you'd have to have it auto-update as well.

While with any dynamic CMS, it's just - go to this site and login.

Totally agree. Wordpress is approachable to most users who want to have a web site for their business, but not super tech savvy.

I still think we can improve the status quo by adopting performance and security benefits that comes with static sites. If you are interested, I wrote elaborative post introducing the solution I'm building www.laktek.com/2016/11/29/introducing-pragma/

> WordPress itself is an inherently insecure platform.

Linking to regular security updates for a system is proof that that system takes security seriously, not that it is insecure. I'd worry about an open source project that didn't have regular security updates.

Also, "inherent" is silly to use in this context.

> Static Site Generators are a new, hybrid approach to web development

It's like Movable Type never existed.

I generally disagree with most of the arguments here, but the last part of this article makes a good point that the business owner (person buying website) usually doesn't make the decisions about the technology that gets used. This is especially true for SMBs (I'm excluding the DIY/hacker-types here).

I built a WordPress plugin inside of HubSpot called Leadin (it's now their HubSpot Marketing Free product). The idea was to build light weight marketing automation for Very Small Businesses. We started on WordPress because most small businesses use it. We incorrectly assumed in the beginning the business owners would be the decision makers on whether or not to use our product. We quickly found out it was usually the web development agency/consultant they worked with who would install it for them, then explain the value of the product. We eventually shifted our marketing to focus heavily on agencies which became our main acquisition source.

Agencies like to use WordPress because it's customizable enough to easily build what their clients need, is the same interface across every site and has a huge ecosystem of the add-ons that their clients what. Until you can replicate the WordPress 3rd party developer ecosystem it will remain the dominant player. Also, static sites can't do all the things WordPress does, like polling, comments, shopping carts, etc. you'd have to rely on a third party for those components and when you add up all those, I'd think that would be more than $100/year in subscriptions. It's easier and cheaper to have it all centralized in WordPress which is why agencies choose to use it. If you can charge a retainer too, the holy grail for agencies because it's reoccurring, predictable revenue, you're essentially getting paid to just keep things updated and make sure they don't break or get hacked.

I wrote a post about a Serverless CMS architecture that is a good follow up to this article: https://www.aerobatic.com/blog/a-serverless-cms-architecture...

I think the author assumes that all wordpress sites are simple blogs. Woocommerce alone powers 30% of e-commerce sites.

What makes you think that? The word "blog" is nowhere in the article. It's clear to me they're talking about WP the platform.

wonder how one does a static e-commerce site.

Author here. Snipcart is one option for e-commerce for static sites.

https://snipcart.com/

The author does list shopify in one if the alternatives whatever that means. WordPress is not just a blog but a platform.

I believe Medium is the next Wordpress because not only allows you to publish but also to consume in an elegant and productive way. The recommendation engine is quite good and the daily newsletter sent by email is good enough to make me want to check the stories right away. They make an extensive use of images that really adds to the user experience.

I used to be a Wordpress fan but now Medium has caught my attention.

So in essence it is not about the technical platform, it is about effective production and consumption, and Medium hits the nail on both.

>I believe Medium is the next Wordpress

Medium is a service, Wordpress is a platform. If you're talking about a replacement for Wordpress.com then you have an argument.

But this submission was regarding the platform/CMS of Wordpress so your argument is apples to oranges.

The context is sites with custom features. Medium isn't in that market. Medium is the new Blogspot.

Or xanga, or livejournal, etc.

Is Medium even customizable now? I've mostly been avoiding the site due to getting sick of the tacky tweet-begging UX whenever you select any of the text in a post. A huge number of WP sites are professional or semiprofessional and have plugins and/or customization that allow the operators to run a business from the site. Can Medium do any of that? Are there plugins for it yet?

Wordpress isn't just a thing that people use. It's a gravity well of humanity's non-technical web authoring aspirations; matter keeps accreting there in the form of plugins and feature additions. Escaping it at this point is going to be difficult for most people, similar to how sending satellites into orbit is infeasible for most small businesses.

It's more precise to say "problem" when you mean something bad, and not "issue," which is neutral. I am pretty sure that "issue" is a bureaucratic euphemism.

It seems the higher up you go, the worse language gets:

  Technician: "The server is on fire!"
  Manager: "Uh . . . the server has a 'problem.'"
  Senior Director: "Ahem, the service has an 'issue.'"
  Owner: "You mean my server is on fire?"

Actually, maybe it's middle management.

I would like to see a simple but extendable cms which would be mostly static but the non static parts would be handled by aws lambda or gce functions or something similiar.

Seems a lot more complicated than Wordpress for not a lot of gain?

Just adding DatoCMS (https://www.datocms.com/) to the list of CMS specifically designed for static websites (shameless plug)!

Here Netlify is listing all the available products in this niche, both commercial and open-source: https://headlesscms.org/ Things are moving.. slowly :)

> Lektor is file-based by default, so updating content does not require a cloud server at all but merely access to the root file itself, which can be stored on a service like Dropbox or Google Drive. A developer can use a local server to generate dynamic content and a full-featured site, but the CMS, which is currently a simple Mac app, simply updates the original file.

This. This would be something phenomenal. The problem with WordPress and services like it, is that they take your content, package them into something they can understand and hides them under their pillows.

Inverting the control, like what the OP says -- where the user owns the content, that can be plugged into layers like WordPress, looks like the path towards the future.

I made http://hexopress.com with a similar vision. It is not yet a full blown shape of what I have in mind, but it cuts the concept well.

whatever static site has a backend for your clients, it's potential security problem.

I was recently considering creating an IDE specifically for WordPress with built-in completion, tips and mapping for people who are skilled at programming but new to WP development. Would anyone use it?

Have you tried Pinegrow?

I had seen it before but didn't realize it included a WP theme builder. Thanks for the heads up!

$100 a year is too costly?

Reply on news.ycombinator.com