3 ms·

I realize that it's really written for end users instead of developers, but that means scares me every time I see something as high profile as the White House u

I realize that it's really written for end users instead of developers, but that means scares me every time I see something as high profile as the White House using it. For the exact reason as you say here: "it's easy to shoot yourself in the foot and get your site hacked". WP is absolutely NOT secure by design; it's a hot mess that has helped normalize ignoring security in our web applications. That we encourage its use, that we haven't replaced it with something better, is a damned travesty.

kijin 6y ago
Hopefully the White House has access to someone who knows how to set up WordPress without shooting themselves in the foot. The fact that WordPress.com doens't get hacked all the time means that there are definitely people who know how to do it.
- earthboundkid 6y ago
  Yes, but there are also a lot of people who don’t. I still use an RSS reader and basically every six months, a blog that I followed 5 years back and went dark will get taken over by spammers because no one was paying attention to it anymore.
  - hluska 6y ago
    I can’t imagine what this has to do with the White House’s website.
    - earthboundkid 6y ago
      We’re using the White House as an excuse to talk about Wordpress.
- trog 6y ago
  > The fact that WordPress.com doens't get hacked all the time means that there are definitely people who know how to do it. Regular reminder that wordpress.com is a different software product to wordpress.org :) wordpress.com runs their (relatively) newer JavaScript-based stack; wordpress.org (which is what we're talking about here, unless I misread the article referenced here completely) is the LAMP stack version.
  - nsomaru 6y ago
    Unless the new Wordpress is written in node, comparing the new “JavaScript” stack with the old “LAMP” stack makes no sense to me. Those technologies do not serve the same purpose.
    - trog 6y ago
      > Unless the new Wordpress is written in node, comparing the new “JavaScript” stack with the old “LAMP” stack makes no sense to me. Those technologies do not serve the same purpose. It's written in JavaScript; it runs on node.js - at least the front-end part of it (https://github.com/Automattic/wp-calypso https://github.com/Automattic/wp-calypso). I don't know what is running on the backend but I don't think it's LAMP? The point I was making though is that "WordPress" can mean two different things - wordpress.org (the self-hosted LAMP version) or wordpress.com, which is a SaaS offering (so the language is more or less irrelevant unless you're really interested in running your own admin frontend, I guess).
      - photomatt 6y ago
        We run WordPress multi-site on WP.com to power several hundred million user accounts. So whenever you visit a domain hosted by us, you're hitting 99% core WordPress, plus some custom plugins and code we run to make it multi-datacenter and super-secure. Calypso is our JS dashboard that lets you manage all your sites in one place, plus get cool WP.com features like stats and notifications. It's just a REST API client, just like the iOS and Android apps.

kijin 6y ago

Hopefully the White House has access to someone who knows how to set up WordPress without shooting themselves in the foot. The fact that WordPress.com doens't get hacked all the time means that there are definitely people who know how to do it.

earthboundkid 6y ago
Yes, but there are also a lot of people who don’t. I still use an RSS reader and basically every six months, a blog that I followed 5 years back and went dark will get taken over by spammers because no one was paying attention to it anymore.
- hluska 6y ago
  I can’t imagine what this has to do with the White House’s website.
  - earthboundkid 6y ago
    We’re using the White House as an excuse to talk about Wordpress.
trog 6y ago
> The fact that WordPress.com doens't get hacked all the time means that there are definitely people who know how to do it. Regular reminder that wordpress.com is a different software product to wordpress.org :) wordpress.com runs their (relatively) newer JavaScript-based stack; wordpress.org (which is what we're talking about here, unless I misread the article referenced here completely) is the LAMP stack version.
- nsomaru 6y ago
  Unless the new Wordpress is written in node, comparing the new “JavaScript” stack with the old “LAMP” stack makes no sense to me. Those technologies do not serve the same purpose.
  - trog 6y ago
    > Unless the new Wordpress is written in node, comparing the new “JavaScript” stack with the old “LAMP” stack makes no sense to me. Those technologies do not serve the same purpose. It's written in JavaScript; it runs on node.js - at least the front-end part of it (https://github.com/Automattic/wp-calypso https://github.com/Automattic/wp-calypso). I don't know what is running on the backend but I don't think it's LAMP? The point I was making though is that "WordPress" can mean two different things - wordpress.org (the self-hosted LAMP version) or wordpress.com, which is a SaaS offering (so the language is more or less irrelevant unless you're really interested in running your own admin frontend, I guess).
    - photomatt 6y ago
      We run WordPress multi-site on WP.com to power several hundred million user accounts. So whenever you visit a domain hosted by us, you're hitting 99% core WordPress, plus some custom plugins and code we run to make it multi-datacenter and super-secure. Calypso is our JS dashboard that lets you manage all your sites in one place, plus get cool WP.com features like stats and notifications. It's just a REST API client, just like the iOS and Android apps.