3 ms·

As someone who develops in PHP, and continues to be generally annoyed by the way many HN commenters will dismiss the language out of hand, I really hate to be t

As someone who develops in PHP, and continues to be generally annoyed by the way many HN commenters will dismiss the language out of hand, I really hate to be the one saying this. However, while PHP has come a long way and modernised significantly in terms of development practise, WordPress is really not an example of that modernisation. It may have applications for a basic blog, but I find it very difficult to take a Wordpress-built project seriously when it's supposedly aimed at developers and includes auth/signup + handling user credentials.

deleted 10y ago
[deleted]
tomcam 10y ago
Agreed with everything except the last sentence, which I do not understand. Why shouldn't WordPress include authorization and signup? Are there higher quality PHP facilities for it or what?
- lucideer 10y ago
  Using WordPress for a simple read-only blog is OK: security is not as major a concern. Once you're taking signups, the quality and security record of the underlying software is worth considering more carefully, and I just personally would not choose WordPress where those are requirements.
  - tomcam 10y ago
    Auth code looks ok to me but I am not a PHP expert. Could find no major recent breaches--am I missing something? (Not being snarky, just trying to understand the issue.)
    - lucideer 10y ago
      WordPress the app is inherently unsecure in many ways. A full overview would be lengthy, but an obvious example is the general architectural reliance on self-modifying code, which requires write access to executable files on your server (this can be disabled with some difficulty, but this makes updates difficult and completely breaks many popular plugins. Doing so is not encouraged or really properly supported by WP devs). This isn't the only problem, but it's a large enough one, and most importantly, it's by design. Auth code might look OKish (haven't looked closely recently), but any general vulnerability in any part of the app as a whole or in any 3rd-party plugins potentially opens you up to data breaches.
floridianfisher 10y ago
https://wordpress.org/showcase/archives/ https://wordpress.org/showcase/archives/
- lucideer 10y ago
  I'm not sure this link is very relevant unless you're trying to posit that popularity ~= quality in some way? If you're interested in further testament to its popularity, builtwith.com is always a fun read. I believe about 20% of the internet runs WordPress, a number which grows to approach 70% if you exclude sites not using off-the-shelf cms software.

deleted 10y ago

[deleted]

tomcam 10y ago

Agreed with everything except the last sentence, which I do not understand. Why shouldn't WordPress include authorization and signup? Are there higher quality PHP facilities for it or what?

lucideer 10y ago
Using WordPress for a simple read-only blog is OK: security is not as major a concern. Once you're taking signups, the quality and security record of the underlying software is worth considering more carefully, and I just personally would not choose WordPress where those are requirements.
- tomcam 10y ago
  Auth code looks ok to me but I am not a PHP expert. Could find no major recent breaches--am I missing something? (Not being snarky, just trying to understand the issue.)
  - lucideer 10y ago
    WordPress the app is inherently unsecure in many ways. A full overview would be lengthy, but an obvious example is the general architectural reliance on self-modifying code, which requires write access to executable files on your server (this can be disabled with some difficulty, but this makes updates difficult and completely breaks many popular plugins. Doing so is not encouraged or really properly supported by WP devs). This isn't the only problem, but it's a large enough one, and most importantly, it's by design. Auth code might look OKish (haven't looked closely recently), but any general vulnerability in any part of the app as a whole or in any 3rd-party plugins potentially opens you up to data breaches.

floridianfisher 10y ago

https://wordpress.org/showcase/archives/ https://wordpress.org/showcase/archives/

lucideer 10y ago
I'm not sure this link is very relevant unless you're trying to posit that popularity ~= quality in some way? If you're interested in further testament to its popularity, builtwith.com is always a fun read. I believe about 20% of the internet runs WordPress, a number which grows to approach 70% if you exclude sites not using off-the-shelf cms software.