3 ms·

WordPress - it has excellent usability as a core product, but its real power comes from the large library of free plugins - there's pretty much always a plugin

by jacobwg 15y ago

WordPress - it has excellent usability as a core product, but its real power comes from the large library of free plugins - there's pretty much always a plugin for everything. You can sign up for a free hosted version of WordPress at http://wordpress.com http://wordpress.com, though it has paid upgrades, or you can download the self-hosted version for free at http://wordpress.org http://wordpress.org. You could even go with a webhost (like http://dreamhost.com http://dreamhost.com) and use their one-click-install for WordPress (feel free to use the coupon code JACOBWG for $97 off one year of DreamHost... disclosure: I do NOT receive any referral money or benefits from that code - all benefits have been rolled into that code's discount). If you're the "hacker" type, then check out http://jekyllrb.com/.. http://jekyllrb.com/...

colmmacc 15y ago
Wordpress had 6 "mandatory security update" releases in 2011 alone - http://codex.wordpress.org/WordPress_Versions http://codex.wordpress.org/WordPress_Versions . It doesn't seem to have had a secure design from the outset. Worse still, ordinarily one might advise "keep up to date", but wordpress had a release backdoored (http://www.cgisecurity.com/2007/03/wordpress-websi.html http://www.cgisecurity.com/2007/03/wordpress-websi.html) once, so keeping up-to-date isn't without its risks too. I've been giving tumblr a try, and so far - so good, but the functionality is pretty minimal.
- jacobwg 15y ago
  You're going to have security holes with every piece of software, though it is true some software is more secure than others. I personally view having security updates as a plus - it shows that the WordPress team (open source community) supports their software. The fact that WordPress is running on 70 million plus websites [1], about 15% of the web [2], means that if a security hole is found, it will be fixed, and it can be fixed by anyone without having to wait for a limited amount of employees of a particular company to write the patch (one of the benefits of open source). What you do get from Tumblr, though, is the fact that a 3rd party is responsible for keeping your website up and keeping it fast - you basically trade ownership of your website's software for a 3rd-party guarantee. This also means that if Tumblr is down or is hacked or you want to customize something beyond the theme, you are dependent on Tumblr... So, while each may have its own use-case (Tumblr is great for the following/reblogging stuff), the fact that WordPress is regularly updated is not a reason to avoid using it as a platform. [1] http://en.wordpress.com/stats/ http://en.wordpress.com/stats/ [2] http://wordpress.org/news/2011/08/state-of-the-word/ http://wordpress.org/news/2011/08/state-of-the-word/
  - rmccue 15y ago
    In addition, WordPress has a built-in updater, so it's incredibly easy to update, unlike many other platforms which require reuploading or obscure update steps.
    - colmmacc 15y ago
      Doesn't WordPress' built-in updater require write permissions to the PHP files? That's considered an insecure configuration by many.
- dwynings 15y ago
  Tumblr had 42 hours of downtime in 2011 alone - http://allthingsd.com/20111215/tumblr-had-42-hours-of-downtime-in-2011-and-thats-an-improvement/ http://allthingsd.com/20111215/tumblr-had-42-hours-of-downti....
- ggwicz 15y ago
  A huge thing people forget with WordPress is that most .org-powered sites are on shared hosting. Simple little bugs make it easy to hack an average WP site, but just setting things up right can solve a ton of issues. I'd recommend the digwp.com security recommendations. The book has better info but is pricey.
phzbOx 15y ago
I don't agree with wordpress. Wordpress is like a middle-ground with 'lots of features' vs 'easy to use for no tech people'. If you want something really simple to get started, tumblr rocks (You'll have something running in minutes). If you want to hack your blog with lots of custom features, just pick whatever blogging library in your favorite language.
- jacobwg 15y ago
  WordPress provides both a product that can be customized by non-coders (using existing themes and plugins) and a framework for blogging in the PHP language (by writing your own themes and plugins). It is both product and framework.
- tghw 15y ago
  My mother, who refers to her Firefox browser as "the Mozilla" uses Wordpress to maintain her neighborhood association's website. Aside from poorly formatted PDFs she sometimes has me upload, she has no problems using it. I looked at using Tumblr when we were getting her set up, but it did not have enough functionality for what they needed.
  - phzbOx 15y ago
    Yeah, exactly. It's good for mothers and no tech people. But for hackers, I'd use something else.
midwestwebdev 15y ago
The biggest issue I see with Wordpress is the free plugins. I've seen more Wordpress sites hacked by way of poorly written plugins than anything else. If they had some sort of robust security screening process for the plugins it might be OK... but as it stands, there's far too many plugins floating around written by people who seem to have zero knowledge of basic web app security. Honestly, I think you're better off just writing your own blog software. Obscure it, close source it, lock down DB permissions and put it on your own VPS, you could knock out a simple platform in a weekend. And you're much less likely to get hit by hackers.
- jacobwg 15y ago
  Yeah, free plugins are both a blessing and a curse, though the majority of the common WordPress plugins (the common ones) are quite secure and are regularly updated. Obviously you can't install just any plugin without doing some research. Obviously you have to be a programmer to roll your own blogging platform so that option is not for everyone, but you'd be reinventing a wheel being run on 70 million websites for the stated reason of writing something that is more secure? You'd have to be REALLY good at what you do compared to the 1000s of WP developers contributing to WP, the dedicated security team, and the hivemind of bug-reporting WP installations. Plus, when you do encounter a security vulnerability (not if you do), it will be your sole responsibility to patch the hole. Closed-source is not a security solution - security by obscurity is no security at all. I do not think that rolling your own blog platform is a bad idea as it's a great learning experience, but it is not a good solution if you are concerned about blog security.
  - jacques_chester 15y ago
    The number one focus of Wordpress is features. Shiny new features. Performance and security come a very distant second and third in this picture. Wordpress still has no unit testing. It still forces you to upgrade a version to get bugfixes and security patches. It relies entirely on beta testers to find data-destroying bugs. And it's increasingly being transformed into a catspaw for Automattic. I've been administering Wordpress for 6 or 7 years. And I hate its guts. I hate its developers. And I hate that it's an absolute triumph of Worse is Better.

by jacobwg 15y ago

colmmacc 15y ago

Wordpress had 6 "mandatory security update" releases in 2011 alone - http://codex.wordpress.org/WordPress_Versions http://codex.wordpress.org/WordPress_Versions . It doesn't seem to have had a secure design from the outset. Worse still, ordinarily one might advise "keep up to date", but wordpress had a release backdoored (http://www.cgisecurity.com/2007/03/wordpress-websi.html http://www.cgisecurity.com/2007/03/wordpress-websi.html) once, so keeping up-to-date isn't without its risks too. I've been giving tumblr a try, and so far - so good, but the functionality is pretty minimal.

jacobwg 15y ago
You're going to have security holes with every piece of software, though it is true some software is more secure than others. I personally view having security updates as a plus - it shows that the WordPress team (open source community) supports their software. The fact that WordPress is running on 70 million plus websites [1], about 15% of the web [2], means that if a security hole is found, it will be fixed, and it can be fixed by anyone without having to wait for a limited amount of employees of a particular company to write the patch (one of the benefits of open source). What you do get from Tumblr, though, is the fact that a 3rd party is responsible for keeping your website up and keeping it fast - you basically trade ownership of your website's software for a 3rd-party guarantee. This also means that if Tumblr is down or is hacked or you want to customize something beyond the theme, you are dependent on Tumblr... So, while each may have its own use-case (Tumblr is great for the following/reblogging stuff), the fact that WordPress is regularly updated is not a reason to avoid using it as a platform. [1] http://en.wordpress.com/stats/ http://en.wordpress.com/stats/ [2] http://wordpress.org/news/2011/08/state-of-the-word/ http://wordpress.org/news/2011/08/state-of-the-word/
- rmccue 15y ago
  In addition, WordPress has a built-in updater, so it's incredibly easy to update, unlike many other platforms which require reuploading or obscure update steps.
  - colmmacc 15y ago
    Doesn't WordPress' built-in updater require write permissions to the PHP files? That's considered an insecure configuration by many.
dwynings 15y ago
Tumblr had 42 hours of downtime in 2011 alone - http://allthingsd.com/20111215/tumblr-had-42-hours-of-downtime-in-2011-and-thats-an-improvement/ http://allthingsd.com/20111215/tumblr-had-42-hours-of-downti....
ggwicz 15y ago
A huge thing people forget with WordPress is that most .org-powered sites are on shared hosting. Simple little bugs make it easy to hack an average WP site, but just setting things up right can solve a ton of issues. I'd recommend the digwp.com security recommendations. The book has better info but is pricey.

phzbOx 15y ago

I don't agree with wordpress. Wordpress is like a middle-ground with 'lots of features' vs 'easy to use for no tech people'. If you want something really simple to get started, tumblr rocks (You'll have something running in minutes). If you want to hack your blog with lots of custom features, just pick whatever blogging library in your favorite language.

jacobwg 15y ago
WordPress provides both a product that can be customized by non-coders (using existing themes and plugins) and a framework for blogging in the PHP language (by writing your own themes and plugins). It is both product and framework.
tghw 15y ago
My mother, who refers to her Firefox browser as "the Mozilla" uses Wordpress to maintain her neighborhood association's website. Aside from poorly formatted PDFs she sometimes has me upload, she has no problems using it. I looked at using Tumblr when we were getting her set up, but it did not have enough functionality for what they needed.
- phzbOx 15y ago
  Yeah, exactly. It's good for mothers and no tech people. But for hackers, I'd use something else.

midwestwebdev 15y ago

The biggest issue I see with Wordpress is the free plugins. I've seen more Wordpress sites hacked by way of poorly written plugins than anything else. If they had some sort of robust security screening process for the plugins it might be OK... but as it stands, there's far too many plugins floating around written by people who seem to have zero knowledge of basic web app security. Honestly, I think you're better off just writing your own blog software. Obscure it, close source it, lock down DB permissions and put it on your own VPS, you could knock out a simple platform in a weekend. And you're much less likely to get hit by hackers.

jacobwg 15y ago
Yeah, free plugins are both a blessing and a curse, though the majority of the common WordPress plugins (the common ones) are quite secure and are regularly updated. Obviously you can't install just any plugin without doing some research. Obviously you have to be a programmer to roll your own blogging platform so that option is not for everyone, but you'd be reinventing a wheel being run on 70 million websites for the stated reason of writing something that is more secure? You'd have to be REALLY good at what you do compared to the 1000s of WP developers contributing to WP, the dedicated security team, and the hivemind of bug-reporting WP installations. Plus, when you do encounter a security vulnerability (not if you do), it will be your sole responsibility to patch the hole. Closed-source is not a security solution - security by obscurity is no security at all. I do not think that rolling your own blog platform is a bad idea as it's a great learning experience, but it is not a good solution if you are concerned about blog security.
- jacques_chester 15y ago
  The number one focus of Wordpress is features. Shiny new features. Performance and security come a very distant second and third in this picture. Wordpress still has no unit testing. It still forces you to upgrade a version to get bugfixes and security patches. It relies entirely on beta testers to find data-destroying bugs. And it's increasingly being transformed into a catspaw for Automattic. I've been administering Wordpress for 6 or 7 years. And I hate its guts. I hate its developers. And I hate that it's an absolute triumph of Worse is Better.