6 ms·

I love the idea of more and more people trying to get away from platforms. But for the love of all things good, please: 1. Don't use wordpress, you'll catch a

I love the idea of more and more people trying to get away from platforms. But for the love of all things good, please: 1. Don't use wordpress, you'll catch a virus. 2. Don't use scroll-jackers, your OS/Browser combination should provide the best scrolling experience for your user, if you hate your own scroll experience, get a better browser/OS, don't FK with the one I have it's perfect. 3. Don't use pop-ups that cover content to sign up - EVERYONE I know immediately closes the page and never returns when that happens... it's kinda the opposite of what you want right?

klez 9y ago
Am I doing it right? No wordpress, no js (at all!), no popups, just (low quality) content. https://klezlab.it https://klezlab.it EDIT: damn, I just noticed the date on the most recent post. I should give the blog some more love...
- bovermyer 9y ago
  I do the same thing, though my site doesn't look as polished as yours: https://www.benovermyer.com https://www.benovermyer.com But yes, you should really write something new!
- nercht12 9y ago
  Looks good to me :)
pmlnr 9y ago
> 1. Don't use wordpress, you'll catch a virus. ?!? First, you're talking about a self installed wordpress, not wordpress.com. Second: just keep it updated.
- coding123 9y ago
  Maybe, but you're still using a platform, they'll pull your SEO towards them every way they can. I kept my wife's wordpress site updated all the time... when the virus hit it was a PAID FOR Theme that was targeted. Seriously the surface area of Wordpress self-install is crazy bad, not to mention many of the themes you select install scroll-jackers and email-signup cover the page crap that I'm talking about.
  - marpstar 9y ago
    So should we all start from scratch and build our own CMS? WordPress is like Windows. It works great for a large majority of users. Some people catch malware because being the most popular tool will result in it being the most targeted.
    - coding123 9y ago
      I definitely agree with your point about everyone creating a CMS. I wish I had an answer for you - and like Windows yes I wish more people would migrate to a different OS too. There is Ghost, but I think more recently they are becoming more corporate too. However Ghost, unlike Wordpress is built on Node, which is more secure by default. It's similar to Java, in that the request handling is done by passing specific things around - in PHP everything has access to the request - every bit of code is able to do whatever it wants. So when you build a plugin system in PHP, you're giving your plugins a HUGE surface area. In non-PHP CMS's you have the ability to build a better system. You can isolate what the code is allowed to do. It's not perfect either, but there is a big different between Facebook writing PHP where the corporate can control the rules and its coding standards and Wordpress where people across a large spectrum of coding experience are providing a plugin that can, basically hose the entire website. (And edit to clarify - yes Ghost would have plugins with a wide range of coding experience, too, but remember there is a very different exploitable surface area here.)
  - goatherders 9y ago
    Ah, should have scrolled down. You bought a vulnerable theme. That isn't the fault of WordPress.
    - kemayo 9y ago
      I do think it's fair to criticize WordPress for its design being such that themes are inherent security vulnerabilities. Not that I don't see the trade-offs. They chose flexibility and ease-of-implementation early on, and are somewhat stuck with the security issue because of the huge theme ecosystem.
icc97 9y ago
I still love WordPress. It's one of the biggest open source projects. It's one of the few major tech companies who's CEO will post to HN. The famous 5-minute install is still by far the simplest I've seen. It has by far the widest use of translating. If you love your tech then sure install something else, but if you just want to blog then WordPress is your friend. But similar to using Windows you do indeed have to be careful because of it's popularity so it's a target. Almost entirely it's the plugins that are the problem. Just be careful with those.
goatherders 9y ago
People catch viruses by using crummy plugins. The WordPress core is comparably safe to other CMS choices.
- chriswarbo 9y ago
  Why use a CMS? I used to use a pretty heavyweight system, and was forever installing updates, monitoring logs, fighting spam comments, etc. I now have a static site, and it's mostly just fire and forget. In fact that's exactly the case for the IPFS mirror (since it's immutable)!
  - CM30 9y ago
    Cause some people have different needs? Personally, I like to have to control of my own comment system, as well as a user login setup and a bunch of other things that can't be done in plain HTML and CSS. A static site is good too (and for many people it'll work fine), but a CMS built site is also the way to go for many other people. It's all about what they want from a site or blog really.
prepend 9y ago
I think you’re less likely to have a security problem with Wordpress than a roll your own solution.
- chriswarbo 9y ago
  For blogs, it mostly suffices to have static HTML pages served from a basic/stripped-down HTTP server. The only way to "roll your own" would be to write your own HTTP server, which I agree would be a security concern, but I don't think it's what the parent had in mind.
claudiulodro 9y ago
> 1. Don't use wordpress, you'll catch a virus. For security I would much rather use WordPress than any other open-source CMS. There are hundreds of people around the world trying to find security holes in the core CMS every single day and any ones that are found are quickly patched. There is a reason it's used by many enterprise users. From https://wordpress.org/about/security/ https://wordpress.org/about/security/ : > The WordPress Security Team is made up of approximately 50 experts including lead developers and security researchers — about half are employees of Automattic (makers of WordPress.com, the earliest and largest WordPress hosting platform on the web), and a number work in the web security field. The team consults with well-known and trusted security researchers and hosting companies. (Disclaimer: I work for Automattic on WooCommerce)
- kelnos 9y ago
  I think the fallacy here is that if you want a blog, you need a full-blown CMS like Wordpress (or Drupal, or whatever). If you have some baseline technical skills, you're probably better off using a static site generator like Jekyll and hosting it on GitHub Pages or something like that. Then you just don't have any security worries at all. If you really want commenting, you can embed Disqus or FB or something. I certainly wouldn't recommend this for your average non-technical person who just wants to write a blog (hosted WP is a fine solution there), but for most of the people who post on HN, it seems silly to go for a CMS. (Yes, I know that a static site generator will not give you a lot of the dynamic features and whatnot that a CMS will give you, but I'd expect that a very small percentage of the "I want to write articles and publish them" set of people really needs any of them.)
CM30 9y ago
As someone who's used WordPress for years as both a developer and a website owner, no you won't get a virus from it. If you use it as it is out of the box (or with vetted, popular plugins from the official directory) and update whenever necessary, it's just as secure as any other CMS can be. What causes some people to have security problems on the other hand is usually either: A: They've not updated for years/not at all, hence security vulnerability stick around right under their nose. B: Their theme is poorly built and from some shady site trying to insert backdoors or what not for whatever reason. C: They're using poorly made plugins (this questionable third party product quality issue is always the trade off for using open software/anything that lets you run your own code, and can be migitated by not downloading anything from dodgy looking websites). D: Or perhaps that they've annoyed someone/some organisation with way more technical ability than you can practically guard against. Which again, is an issue with almost any script or program. A site based around 'hacking' could be run on the digital equivalent of Fort Knox, and it'd still probably be hacked every few weeks or so. If you're reasonable about the software and don't do anything too silly, it's about as safe as any of its alternatives. Can't disagree with the latter two points though. The latter's why reading Medium is basically a chore nowadays.
- nercht12 9y ago
  E: They're the unlucky one who got hit first by a cracker trying out his a zero-day.
agentultra 9y ago
Use a good static site generator. I stopped using Wordpress years ago. Life has been better. I don't get rando's trying to leave spammy, weird comments on my site trying to sell drugs. Nobody is constantly trying to hijack my Wordpress install. I'm not constantly being nagged to upgrade it. I just write locally in markdown and a script picks up the changes and re-publishes. I preview it on a locally running web server. When I'm happy I just run a small rsync script and boom. Statically served sites are super fast. Try GatsbyJS, Jekyll, Mynt; take your pick. It's funny... when I first started writing online I wrote some perl scripts that hacked together text files into an HTML template. Then when people started calling it blogging and sticking a database behind everything became the norm I eventually ceded to wordpress... but after a bunch of years doing that it's back to scripts hacking text files into HTML. Don't forget to check out the indieweb movement and start building links.

klez 9y ago

Am I doing it right? No wordpress, no js (at all!), no popups, just (low quality) content. https://klezlab.it https://klezlab.it EDIT: damn, I just noticed the date on the most recent post. I should give the blog some more love...

bovermyer 9y ago
I do the same thing, though my site doesn't look as polished as yours: https://www.benovermyer.com https://www.benovermyer.com But yes, you should really write something new!
nercht12 9y ago
Looks good to me :)

pmlnr 9y ago

> 1. Don't use wordpress, you'll catch a virus. ?!? First, you're talking about a self installed wordpress, not wordpress.com. Second: just keep it updated.

coding123 9y ago
Maybe, but you're still using a platform, they'll pull your SEO towards them every way they can. I kept my wife's wordpress site updated all the time... when the virus hit it was a PAID FOR Theme that was targeted. Seriously the surface area of Wordpress self-install is crazy bad, not to mention many of the themes you select install scroll-jackers and email-signup cover the page crap that I'm talking about.
- marpstar 9y ago
  So should we all start from scratch and build our own CMS? WordPress is like Windows. It works great for a large majority of users. Some people catch malware because being the most popular tool will result in it being the most targeted.
  - coding123 9y ago
    I definitely agree with your point about everyone creating a CMS. I wish I had an answer for you - and like Windows yes I wish more people would migrate to a different OS too. There is Ghost, but I think more recently they are becoming more corporate too. However Ghost, unlike Wordpress is built on Node, which is more secure by default. It's similar to Java, in that the request handling is done by passing specific things around - in PHP everything has access to the request - every bit of code is able to do whatever it wants. So when you build a plugin system in PHP, you're giving your plugins a HUGE surface area. In non-PHP CMS's you have the ability to build a better system. You can isolate what the code is allowed to do. It's not perfect either, but there is a big different between Facebook writing PHP where the corporate can control the rules and its coding standards and Wordpress where people across a large spectrum of coding experience are providing a plugin that can, basically hose the entire website. (And edit to clarify - yes Ghost would have plugins with a wide range of coding experience, too, but remember there is a very different exploitable surface area here.)
- goatherders 9y ago
  Ah, should have scrolled down. You bought a vulnerable theme. That isn't the fault of WordPress.
  - kemayo 9y ago
    I do think it's fair to criticize WordPress for its design being such that themes are inherent security vulnerabilities. Not that I don't see the trade-offs. They chose flexibility and ease-of-implementation early on, and are somewhat stuck with the security issue because of the huge theme ecosystem.

icc97 9y ago

I still love WordPress. It's one of the biggest open source projects. It's one of the few major tech companies who's CEO will post to HN. The famous 5-minute install is still by far the simplest I've seen. It has by far the widest use of translating. If you love your tech then sure install something else, but if you just want to blog then WordPress is your friend. But similar to using Windows you do indeed have to be careful because of it's popularity so it's a target. Almost entirely it's the plugins that are the problem. Just be careful with those.

goatherders 9y ago

People catch viruses by using crummy plugins. The WordPress core is comparably safe to other CMS choices.

chriswarbo 9y ago
Why use a CMS? I used to use a pretty heavyweight system, and was forever installing updates, monitoring logs, fighting spam comments, etc. I now have a static site, and it's mostly just fire and forget. In fact that's exactly the case for the IPFS mirror (since it's immutable)!
- CM30 9y ago
  Cause some people have different needs? Personally, I like to have to control of my own comment system, as well as a user login setup and a bunch of other things that can't be done in plain HTML and CSS. A static site is good too (and for many people it'll work fine), but a CMS built site is also the way to go for many other people. It's all about what they want from a site or blog really.

prepend 9y ago

I think you’re less likely to have a security problem with Wordpress than a roll your own solution.

chriswarbo 9y ago
For blogs, it mostly suffices to have static HTML pages served from a basic/stripped-down HTTP server. The only way to "roll your own" would be to write your own HTTP server, which I agree would be a security concern, but I don't think it's what the parent had in mind.

claudiulodro 9y ago

> 1. Don't use wordpress, you'll catch a virus. For security I would much rather use WordPress than any other open-source CMS. There are hundreds of people around the world trying to find security holes in the core CMS every single day and any ones that are found are quickly patched. There is a reason it's used by many enterprise users. From https://wordpress.org/about/security/ https://wordpress.org/about/security/ : > The WordPress Security Team is made up of approximately 50 experts including lead developers and security researchers — about half are employees of Automattic (makers of WordPress.com, the earliest and largest WordPress hosting platform on the web), and a number work in the web security field. The team consults with well-known and trusted security researchers and hosting companies. (Disclaimer: I work for Automattic on WooCommerce)

kelnos 9y ago
I think the fallacy here is that if you want a blog, you need a full-blown CMS like Wordpress (or Drupal, or whatever). If you have some baseline technical skills, you're probably better off using a static site generator like Jekyll and hosting it on GitHub Pages or something like that. Then you just don't have any security worries at all. If you really want commenting, you can embed Disqus or FB or something. I certainly wouldn't recommend this for your average non-technical person who just wants to write a blog (hosted WP is a fine solution there), but for most of the people who post on HN, it seems silly to go for a CMS. (Yes, I know that a static site generator will not give you a lot of the dynamic features and whatnot that a CMS will give you, but I'd expect that a very small percentage of the "I want to write articles and publish them" set of people really needs any of them.)

CM30 9y ago

As someone who's used WordPress for years as both a developer and a website owner, no you won't get a virus from it. If you use it as it is out of the box (or with vetted, popular plugins from the official directory) and update whenever necessary, it's just as secure as any other CMS can be. What causes some people to have security problems on the other hand is usually either: A: They've not updated for years/not at all, hence security vulnerability stick around right under their nose. B: Their theme is poorly built and from some shady site trying to insert backdoors or what not for whatever reason. C: They're using poorly made plugins (this questionable third party product quality issue is always the trade off for using open software/anything that lets you run your own code, and can be migitated by not downloading anything from dodgy looking websites). D: Or perhaps that they've annoyed someone/some organisation with way more technical ability than you can practically guard against. Which again, is an issue with almost any script or program. A site based around 'hacking' could be run on the digital equivalent of Fort Knox, and it'd still probably be hacked every few weeks or so. If you're reasonable about the software and don't do anything too silly, it's about as safe as any of its alternatives. Can't disagree with the latter two points though. The latter's why reading Medium is basically a chore nowadays.

nercht12 9y ago
E: They're the unlucky one who got hit first by a cracker trying out his a zero-day.

agentultra 9y ago

Use a good static site generator. I stopped using Wordpress years ago. Life has been better. I don't get rando's trying to leave spammy, weird comments on my site trying to sell drugs. Nobody is constantly trying to hijack my Wordpress install. I'm not constantly being nagged to upgrade it. I just write locally in markdown and a script picks up the changes and re-publishes. I preview it on a locally running web server. When I'm happy I just run a small rsync script and boom. Statically served sites are super fast. Try GatsbyJS, Jekyll, Mynt; take your pick. It's funny... when I first started writing online I wrote some perl scripts that hacked together text files into an HTML template. Then when people started calling it blogging and sticking a database behind everything became the norm I eventually ceded to wordpress... but after a bunch of years doing that it's back to scripts hacking text files into HTML. Don't forget to check out the indieweb movement and start building links.