Hacker News Reader

Comment by TheTaytay | Hacker News Reader

It looks like I'm in the minority after reading this comments, but I'm quite happy to see this announcement.

A "good" standard, free CMS with theming and plugin support without the issues of Wordpress is _welcome_. (And the issues are many: Licensing, trust, drama, security, and cost).

I'm guessing that a lot of cynicism here is coming from this crowd not being the target market of Wordpress in the first place? What were you recommending to non-technical friends and family who wanted a good, open source, affordable CMS to back their website? Wordpress has all the right _ideas_, but the wrong implementation.

View on HN

There are great standard CMSes that do everything technically better than Wordpress (not that it's harder to jump higher than a rock, but hey). That's not the hard part. Every developer should build a good CMS once.

The hard part is displacing Wordpress market share; building a community of bloggers, marketeers, agencies, web designers, and so on; creating a huge ecosystem of paid and free plugins, allowing plugin devs to commit to your marketplace and lock customers in.

Wordpress is awful. The only thing it's got going is its moat, but that's not an engineering problem, but a people problem instead.

I find it hard to believe that people used to WordPress, with its flaws and virtues(yes, wordpress have virtues), will switch to this, no matter how much it's from Cloudflare.

Those standard CMSs that are technically "better" than WP, I would bet they are at least over a decade old, some have even come out during the same time with wp when there was no market share to speak of and still were left in the dust.

The problem is that people misunderstand why WP was and is better than all alternatives that tried to take it's place, I have no idea either but I know that others have tried same thing as CF and failed.

I have been one of the maintainers of a moderately successful CMS back in the day, but there are definitely well-groomed alternatives that have popped up a lot more recently than that, especially from the headless variety.

I'm convinced the thing that WP did better was being the first simple and accessible blogging platform when blogging was still a thing. IIRC, the alternatives were things like Joomla or Drupal - awful behemoths for enterprise users. WordPress was a breath of fresh air compared to those, and out of the blogging scene, people started to use it for agency projects, while others published an ever-increasing number of plugins and themes. The rest is just momentum of that movement.

> There are great standard CMSes that do everything technically better than Wordpress

Like?

CraftCMS for example is a great example of what you can achieve with PHP; there's Directus or Strapi for headless CMS, for example; or Ghost, Contentful, Storyblok and more as SaaS alternatives.

Surreal CMS. Nothing is more simple and robust for non-technical people to use. Not open source, but that's never a requirement in these cases.

I think the cynicism is related to cloudflares recent previous releases that were considered to be slop that significantly overpromised on its capabilities/completeness. Trust can take a long time to rebuild.

Throw in the the bragging about slop and cleanroom clones to avoid AGPL, the name and April 1st launch date, and maybe the high priority afforded to agent-friendly crypto payment infrastructure if anyone was paying attention. Maybe they prompted the marketing agent with "how can you get HN to loathe a product as innocuous as an open source headless CMS?"

Other than that, it seems it might be a half decent headless CMS, if the bit of WordPress you want is its interface, and not the number of plugins and devs and not being tied to Cloudflare's infrastructure.

> I'm guessing that a lot of cynicism here is coming from

...the fact that CF just dumps tokens to generate some slop to compete with the single biggest web platform and casually adding a vendor lock in. It's just buzz, an inexpensive attempt to grab a valuable market share.

If you set security as a selling point for EmDash, then I am baffled. The WP lock file has 30k lines, the brand new EmDash has 16k lines, but it LESS verbose yaml. JS is the cornerstone of anti-security that WP couldn't dare to compete with. The plugin isolation is also bogus, WP plugins are insecure because they have all access to everything, but they need at least some, mostly DB, how is that even solved? Isolation does shit there.

I am not a fan of WP, but CF doesn't even try to get this right.

Frankly, you're wrong. This is a fundamentally better plugin architecture that WP, and if you can't see it, then it's your understanding of security that's not right.

If you have arguments, then make them. This is just saying stuff for the sake of it.

The post literally does that. it talks about how plugin access to core is handled. So to be explicit: if you don't see that as a very significant security improvement over WP's open world, then it may help to understand why. The post also talks about WP ecosystem downside due to this.

  | "network:fetch" // ctx.http is available (host-restricted via allowedHosts)
  | "network:fetch:any" // ctx.http is available (unrestricted outbound —   use for user-configured URLs)
  | "read:content" // ctx.content.get/list available
  | "write:content" // ctx.content.create/update/delete available
  | "read:media" // ctx.media.get/list available
  | "write:media" // ctx.media.getUploadUrl/delete available
  | "read:users" // ctx.users is available
  | "email:send" // ctx.email is available (when a provider is configured)
  | "email:provide" // can register email:deliver exclusive hook (transport provider)
  | "email:intercept" // can register email:beforeSend / email:afterSend hooks
  | "page:inject"; // can register page:fragments hook (inject scripts/styles into pages)

That are the plugin capabilities. I have no clue how it could replace any serious WP plugin. Of course it's secure ;)

> I have no clue how it could replace any serious WP plugin.

I'll repeat: your knowledge of security has a gap. You can specifically look up on "Principle of least privilege" as is widely used in apps and browsers too.

Reply on news.ycombinator.com