7 ms·
WordPress WASM
- mizzao 4y agoWhat does it even mean to run PHP in the browser... Is this supposed to be some sort of replacement for server-side PHP?
- franky47 4y agoSkip React/Vue/Svelte/next week's JS framework and client-side render your app directly in PHP, genius. /s
- have_faith 4y agoThis just replaces the frontend framework written in JS with a frontend framework written in PHP compiled via wasm. It doesn't eliminate the need for something to manage views and state on the front end, as that's where you're executing all of your code now?
- franky47 4y agoYes indeed. The sarcasm may have been lost in my reply, running PHP in the browser is a great feat of engineering, but not a practical one.
- have_faith 4y agoIt's rare that I don't discern sarcasm, my bad!
- zelphirkalt 4y agoJust wait what things on top of that WP-PHP people will come up with. This thing will blind enough people with the looks of "modern and shiny", that they might create something similarly vulnerable and mistake prone to original WP plugins. I mean, someone must be writing these plugins ... shudders
- cylinder714 4y agoIt's an awesome hack, though. "Approved!"
- laundermaf 4y agoFirst thing that came to mind is that I could load this up on a static host, saving content in a local SQLite (or even in SQLite in S3), make changes and then export the results to S3 as static HTML files. All without ever running any PHP/SQL host. One could technically upload this to GitHub Pages. Endless possibilities!
- 0xChain 4y agoI was thinking the exact same, but with Cloudflare Pages in order to use the WAF to see if it may help thwart any PHP-related vulns
- paulryanrogers 4y agoWhat kind of download size though?
- adamziel 4y agoI already did! https://adamziel.github.io/index.html https://adamziel.github.io/index.html https://adamziel.github.io/tutorial.html https://adamziel.github.io/tutorial.html It also lives on netlify: https://fanciful-gnome-a4edc4.netlify.app/ https://fanciful-gnome-a4edc4.netlify.app/
- franky47 4y agoSome ideas for persisting the SQLite database in IndexedDB: https://github.com/jlongster/absurd-sql https://github.com/jlongster/absurd-sql
- samwillis 4y agoThe tldr, is that AbsurdSQL uses IndexedDB to make WASM SQLite ACID compliant. The alternative is to pause writes and dump the whole db as a string to indexeddb, very slow, and not durable. AbsurdSQL is an incredible hack, but is a hack at best. There is a new api, File System Access and the “origin private file system”[0], coming to browsers that has been design specifically with WASM SQLite in mind. I believe the Chrome team have been collaborating with the SQLite team to ensure it will work well. Once this drops it’s going to bring a lot of innovation. 0: https://web.dev/file-system-access/#accessing-files-optimized-for-performance-from-the-origin-private-file-system https://web.dev/file-system-access/#accessing-files-optimize...
- adamziel 4y agoThank you for sharing! I just created an issue: https://github.com/adamziel/wordpress-wasm/issues/19 https://github.com/adamziel/wordpress-wasm/issues/19
- samwillis 4y agoI think this is a really compelling pattern for converting traditional server rendered apps to be offline enabled (or choosing to build new ones this way). I have seen similar examples using Python. Initially these are more of a “backed data” type app, with no offline public writes. [0] The next step is to have local/offline SQLite to server syncing, enabling writes while offline that are synced back to the server on reconnection. This would inherently be eventually consistent and brings its own issues with relational data integrity, however the SQLite Session Extension could be I good way to build such a system [1] The alternative is a new data store based on CRDTs (conflict free merging of offline edits), there are some exciting developments happening in that area. I have seen it suggested that the SQLite session extension is almost a crdt if you squint at it. 0: https://simonwillison.net/2021/Jul/28/baked-data/ https://simonwillison.net/2021/Jul/28/baked-data/ 1: https://www.sqlite.org/sessionintro.html https://www.sqlite.org/sessionintro.html
- euroderf 4y agoI really like this idea. Distributed, loosely-coupled content creation & management that syncs up with "everyone else" on a time scale of minutes or hours.
- jcheng 4y agoSounds a lot like Lotus Notes!
- metadat 4y agoThis is certainly a cool idea, but I don't understand a few things about how reality would work with an async reconciliation process on the database layer: 1.) How would the auto-incremented ID fields be merged in such a system? 2.) How are unique constraint violations handled?
- djbusby 4y agoDon't use auto-increment. Use a ULID or some other algorithm driven PK
- hardwaresofton 4y agoWASM may offer the most secure-by-default installations of Wordpress to ever exist. This is seriously impressive -- I think we're getting a glimpse of a world where people can really run server side apps on their computers easily. Add an app store and the web will have finished becoming the platform that everyone has been suspecting it is.
- croes 4y agoAnd thanks to Chrome one severe bug will effect all around the globe. Monocultures are susceptible to pests and diseases
- maven29 4y agoCan't be worse than unpatched wordpress plugins.
- rwalle 4y agoPeople are already using Chrome or Chromium-based browser all over the world. VSCode, Spotify, Teams, Slack, Figma and many others use Electron or CEF which are based on Chromium. It is not necessarily going to be a bigger risk what what we have now. And I am sure a severe bug in Qt will also affect almost everyone, no different from the Chromium situation. And I trust the Chromium/Electron community more than the random "another cross-platform UI framework" that pops up on hacker news that probably will not be maintained in a year. (I am some people don't like this sentence but they have to face the fact.)
- 4y ago
- 19h 4y agoThis is amazing for security, you’ll just need to hook the file system calls and block FS writes at the wasm bridge level. It won’t prevent obvious security bugs in the PHP code though, which arguably is the most important attack vector for spammers trying to post stuff on your WordPress installation
- mrweasel 4y agoI am still impressed that this actually works. Very nice work.
- asadkn 4y agoFor those wondering about the "why", this post details the motivation: https://make.wordpress.org/core/2022/09/23/client-side-webassembly-wordpress-with-no-server/ https://make.wordpress.org/core/2022/09/23/client-side-webas... Basically for learning/interactive tutorials, trying out something quickly in different PHP versions (which is cumbersome right now), secure and easy demos for themes and plugins.
- metadat 4y agoPretty amazing to get all of PHP working in WASM. Next maybe we can get full MySQL, too (like the Crunchy Postgres port [0] [1]). Would also love to see it for Java, Go, Perl, Sed, and Awk :) What if Intelli-J could run in the browser? Yes please. I bet some of these even already exist. What a time to be alive, 15 years ago I'd never have guessed Javascript could evolve into this! [0] https://www.crunchydata.com/blog/crazy-idea-to-postgres-in-the-web-browser https://www.crunchydata.com/blog/crazy-idea-to-postgres-in-t... [1] https://news.ycombinator.com/item?id=32498435 https://news.ycombinator.com/item?id=32498435 (August 22, 2022; 814 points, 172 comments) ^ n.b. Submitted by @samwillis
- redanddead 4y agoYou mean to say that PHP and different versions of it are able to be simulated via JS on Web apps? Kind of crazy actually
- cdmckay 4y agoI don’t think it’s via JS, it’s via WebAssembly. WebAssembly doesn’t use JS, it’s separate, although you can interface with WASM via JS.
- nisegami 4y agoIs it my turn to post this prophetic talk? https://www.destroyallsoftware.com/talks/the-birth-and-death-of-javascript https://www.destroyallsoftware.com/talks/the-birth-and-death...
- 4y ago
- jacooper 4y agoThis could give you a free WordPress website using Cloudflare Pages + workers. If it worked fully of course, which it currently doesn't.
- axelthegerman 4y agoEven then, how would the database state be shared between workers? It's a local sqlite so there is just one in-process instance of it.
- jacooper 4y agoFree managed databases exist. Also cloudflare has D2, which is based on SQLITE, but has yet to launch. I think it should launch by the end of this year.
- mmmmwhat 4y agoIt's probably the most secure way to deploy Wordpress soon.
- john-doe 4y agoAnd the most convoluted.
- abdullah2993 4y agoI'm too dumb to understand how would this work. Can anyone explain please. Wordpress server side is where all the magic happens data is stored and retrieved from the database. How would it look like in wasm? Will the wasm communicate with database? If so wouldn't it expose db credentials? What would the backend look like? I have so many questions
- axelthegerman 4y agoThis is more to play around and show off themes/plugins or test different PHP versions. The database also runs on the client in wasm (sqlite). But it's utterly useless if you want to put a blog online as it only runs locally in the browser and nobody else will see the posts.
- simonw 4y agoThere is no backend: the database itself is SQLite in WASM living in the user's own browser. This is more of a tech demo and test environment than something that would work as an alternative to server-side WordPress - since if you are using a CMS you generally want the results to be visible to people other than you! It's very, very cool though.
- adamziel 4y agoAuthor here, here's an in-depth writeup on how this works and why it's useful: https://make.wordpress.org/core/2022/09/23/client-side-webassembly-wordpress-with-no-server/ https://make.wordpress.org/core/2022/09/23/client-side-webas... To answer your questions directly: WebAssembly is the magic sauce that transforms server-side code into client-side code. MySQL unfortunately is not yet supported by WebAssembly, so I applied a plugin that adds SQLite supports to WordPress [0]. The WebAssembly application has its own in-memory filesystem that lives in a specific browser tab and is scraped as soon as you close it. So – technically it exposes db credentials, and even the entire DB, but that you are the only user of that DB so it's okay. > What would the backend look like The only backend is a static file server where the code and the database live. Your browser downloads a copy of the database and allows you to modify it in the current tab, but the updates are never saved back to the server. [0] https://github.com/aaemnnosttv/wp-sqlite-db https://github.com/aaemnnosttv/wp-sqlite-db
- ildon 4y agoA very very interesting addition would be to add the ability to fetch data from a remote WP website's APIs. In this way the server could serve a cached page on first request, then the wasm file would be downloaded. From then the whole rendering could be client side, while still fetching data from the remote DB. This could significantly speed up things for users.
- deleted 4y ago[deleted]
- ridruejo 4y agoNice! See also https://wordpress.wasmlabs.dev/ https://wordpress.wasmlabs.dev/
- jokethrowaway 4y agoThis is great for the "I want a CMS but don't want to run a server" crowd. Oftentimes I run some CMS in some private network and then deploy a static build somewhere else
- lizardactivist 4y agoWASM has in a way picked up and succeeded where Java applets left off.
- JustLurking2022 4y agoThis seems like a "can't see the forest through the trees" project. If you don't want to run a server, there's no need for WordPress in the first place - just use a static site generator, or a SPA that uses static content as the backend. Have done a lot of WordPress development, and I love it, but it doesn't seem like it fits this use case better than other options.
- dgudkov 4y agoStatic site generators require a headless CMS and all the headless CMS I tried are much harder to use and way less flexible then WordPress.
- JustLurking2022 4y agoI mostly agree - but running WordPress in a browser doesn't actually solve any of those issues - it's not intended for hosting anything publicly visible, as it can't persist to a remote DB. To make it capable of doing so, ou would likely end up with a server layer somewhere, minimally to manage authz, which puts it back in the realm of equivalent to a SPA.
- dmsnell 4y agoAs noted above seven hours before your comment ;) the purpose for this project is for embedding interactive WordPress installations in documentation and to provide a playground in the browser for testing code or learning how to write plugins, etc... The forest is shrinking the time and distance between code we care about and visualizing the results. WASM and an in-browser environment is the tree. Even for experienced devs it's not always readily available to have a web server, PHP, a database, and WordPress running where you can quickly make a change and test it out or demonstrate it to others. This makes it possible to ship a WordPress site as a demo site (with pre-filled content and structure) where anyone can show off their WordPress plugin or theme without needing to have a backend or worrying about securing it.
- JustLurking2022 4y ago
- senko 4y agoFor a moment I read this as WordPerfect WASM and thought it a great way to preserve old but gold software in usable state.
- brundolf 4y ago"Your scientists", etc
- adamziel 4y agoAuthor here, it is super encouraging to see this trending on HN, thank you for the great discussion, links, and ideas! I hope to change how learning, using, and contributing to WordPress looks like. This writeup explores how WASM WordPress works and why it's useful: https://make.wordpress.org/core/2022/09/23/client-side-webassembly-wordpress-with-no-server/ https://make.wordpress.org/core/2022/09/23/client-side-webas... Here's a few possible applications: try a theme without affecting your current website, have live themes and plugins demos right in the directory, enable first contributions directly on wordpress.org without any setup steps, learn WordPress in the browser, or replay and debug failed tests right in the CI. Technically most of these things are possible today with a specialized backend. The problem is that it's either expensive and time-consuming to maintain, like a fleet of custom WP instances, or limited, like iframing a preconfigured 3rd party solution. WASM-based solution is open-source, cheap to run, and doesn't seem to have deal-breaking limitations. I wouldn't run production websites on this just yet, as it sometimes crashes in Chrome and the bundle size is 50MB+, but both problems can be solved. Once they are, this will be so much more than just a cool tech demo.