• Alphane Moon@lemmy.world
    link
    fedilink
    English
    arrow-up
    52
    ·
    edit-2
    4 months ago

    Representatives for developers of the remaining three plugins couldn’t be reached because they provided no contact information on their sites.

    You’re asking for trouble if you’re using such random plugins on production sites.

    • Pechente@feddit.org
      link
      fedilink
      English
      arrow-up
      61
      ·
      4 months ago

      oh boy, the average wordpress site has like 30 plugins and the top bar is getting cluttered with so many plugin upsells that it fills the whole screen. There’s a huge industry of people making wordpress sites who shouldn’t.

      It’s quite frustrating to be asked as a dev to “fix” people’s site as my usual response is “shut it off and redo it well”.

      • Björn Tantau@swg-empire.de
        link
        fedilink
        English
        arrow-up
        20
        ·
        4 months ago

        It’s really a shame because by now WordPress itself actually works quite well. Sure, it’s fueled by unspeakably ugly spaghetti code. But at least it’s unspeakably ugly spaghetti code that works and receives regular automatic updates.

        And other than putting up a verification program I don’t see what they could do to improve the plugin situation.

        • Pechente@feddit.org
          link
          fedilink
          English
          arrow-up
          15
          ·
          4 months ago

          I agree. I don’t hate wordpress. It seems a bit dated by today’s standards and bloated in some aspects but you can definitely make a solid, fast website with it. It’s getting a bad reputation for its toxic plugin dev scene and crappy sites built using Elementor.

            • Donut@leminal.space
              link
              fedilink
              English
              arrow-up
              2
              ·
              4 months ago

              As someone who found elementor the only thing that was working at the time - any suggestions to do better? I have no coding experience fyi

              • Pechente@feddit.org
                link
                fedilink
                English
                arrow-up
                1
                ·
                4 months ago

                Coding is pretty much the only way to make a site that is both flexible and fast. If you wanna stay with page builders, I’d recommend something like webflow or framer but going with these closed systems is really not that amazing longterm. You’re gonna sink a lot of money into a system that will almost certainly enshittify in the future.

                If you’re willing to pick up coding, try to make your own theme with something like Advanced Custom Fields in wordpress or switch to something like Kirby CMS which is more flexible out of the box than wordpress and has great docs.

        • AbidanYre@lemmy.world
          link
          fedilink
          English
          arrow-up
          6
          ·
          4 months ago

          Regular automatic updates on ugly spaghetti code feels like it’s just asking for trouble.

      • maynarkh@feddit.nl
        link
        fedilink
        English
        arrow-up
        12
        ·
        4 months ago

        There’s a huge industry of people making wordpress sites who shouldn’t.

        And this is why I hate the state of the whole hacking scene and that now nation states are also carrying out en masse attacks. Everyone should be free to make a site on Wordpress or whatever. If they can’t, that’s how we get everyone on like 3 corporate platforms like Facebook.

      • Alphane Moon@lemmy.world
        link
        fedilink
        English
        arrow-up
        12
        ·
        4 months ago

        Funnily enough, I was hearing this from developers in the early 2010s when I was just starting my career (IT adjacent, but not a developer).

        • AA5B@lemmy.world
          link
          fedilink
          English
          arrow-up
          6
          ·
          edit-2
          4 months ago

          Seriously, people have been saying this stuff about WordPress as long as it’s been around, and I’m always surprised that it still exists. This was definitely one of those technologies that sounded bad enough that it could never last. Joke is on me.

          Of course I thought the same with JavaScript but was forced to learn it last year

          • orclev@lemmy.world
            link
            fedilink
            English
            arrow-up
            3
            ·
            4 months ago

            Of course I thought the same with JavaScript but was forced to learn it last year

            Use TypeScript. It’s still built on a giant steaming pile of shit but at least if you’re careful most of your own code can be reasonably correct.

            • AA5B@lemmy.world
              link
              fedilink
              English
              arrow-up
              3
              ·
              4 months ago

              It’s not my choice. I’m only here to help others fix their code, not to actually do the coding. I have to someone know best practices and how to fix common bugs

              • orclev@lemmy.world
                link
                fedilink
                English
                arrow-up
                1
                ·
                4 months ago

                That’s a shame. If you can convince them to use TypeScript that would be for the best, otherwise good luck, you’re going to need it. I can’t say you couldn’t pay me to write JavaScript, but I can say what I would demand to do it is way more than anyone would be willing to pay.

  • 0x0@programming.dev
    link
    fedilink
    English
    arrow-up
    43
    arrow-down
    1
    ·
    4 months ago

    If i were to take a shot every time vulnerabilities are found in the WordPress ecosystem i’d be comatose by now…

    • maynarkh@feddit.nl
      link
      fedilink
      English
      arrow-up
      27
      arrow-down
      1
      ·
      4 months ago

      I’d guess it’s not because of the inherent insecurity of WordPress, but the sheer size of the ecosystem and the fact that like 40% of the Internet is WordPress sites.

      • sugar_in_your_tea@sh.itjust.works
        link
        fedilink
        English
        arrow-up
        12
        arrow-down
        2
        ·
        edit-2
        4 months ago

        And inherent insecurity. It wasn’t designed to be secure, it was designed to be full-featured, so it has a pretty big attack surface.

        • maynarkh@feddit.nl
          link
          fedilink
          English
          arrow-up
          13
          ·
          4 months ago

          That’s the ecosystem. WordPress itself is pretty basic, these things attack plugins, and their often not-very-experienced creators and users. The thing with WordPress is that this kind of vulnerability comes with the problem space, not the particular solution. If there was a different product in the same space, it would not fare better by default.

          Also, I’d bet that a ton of CVEs are filed for C++ libraries, yet nobody is harping on about how insecure C++ is.

          • sugar_in_your_tea@sh.itjust.works
            link
            fedilink
            English
            arrow-up
            4
            arrow-down
            1
            ·
            4 months ago

            Exactly. A plug-in architecture is a feature, and it’s really hard to secure. Instead of going that route, they should have instead solved specific problems. When you make it easy to add someone else’s code, you also make it easy to forget to remove it later, or to not stay updated on which plugins are deprecated/abandoned.

            A plug-in system is insecure by design for a public-facing service. YAGNI, so pick a handful of stuff you actually need.

    • corsicanguppy@lemmy.ca
      link
      fedilink
      English
      arrow-up
      6
      ·
      4 months ago

      It’s not the product, it’s the cavalier consumption of unsigned add-ons despite knowing better.

      • IsThisAnAI@lemmy.world
        link
        fedilink
        English
        arrow-up
        11
        arrow-down
        2
        ·
        edit-2
        4 months ago

        Drupal, but you are getting into a different type of complex symfony code built on years and years of drupalism’s. It’s powerful and pretty well maintained though.

      • sugar_in_your_tea@sh.itjust.works
        link
        fedilink
        English
        arrow-up
        6
        arrow-down
        2
        ·
        4 months ago

        What are you trying to achieve?

        • static site like a blog? - Hugo
        • add comments? - Commento paid, or you can self-host
        • cloud stuff (e.g. Google Drive replacement) - NextCloud

        There’s a ton you can do, you don’t need WordPress just because you want a website. Figure out what you want your website to do, then look for tools to do that.

      • 0x0@programming.dev
        link
        fedilink
        English
        arrow-up
        2
        arrow-down
        1
        ·
        4 months ago

        If you want to add something to your website then you’re already running WordPress, no?

        • Fredselfish@lemmy.world
          link
          fedilink
          English
          arrow-up
          1
          ·
          4 months ago

          No, I haven’t added nothing. I was going code a basic html 5 page but I wanted a blog like atmosphere, since the website is all about my writing.

      • schizo@forum.uncomfortable.business
        link
        fedilink
        English
        arrow-up
        2
        arrow-down
        1
        ·
        4 months ago

        If you want a mostly straightforward WordPress-alike that’s not WordPress, you probably should at least consider Ghost. I’m using it for my blog and it’s got a slightly weird focus on “paid blog members”, but it’s super solid and doesn’t have a multi-decade history of endless security problems.

        And, soon, it’ll be a happy member of the Fediverse.

    • eskimofry@lemmy.world
      link
      fedilink
      English
      arrow-up
      34
      arrow-down
      5
      ·
      4 months ago

      Its convenient. Not everyone wants to waste their life centering divs you know

        • mbirth@lemmy.mbirth.uk
          link
          fedilink
          English
          arrow-up
          20
          ·
          4 months ago

          It’s the only CMS that runs on a classic AMP stack which is still the standard with cheap web hosters. And since everyone and their dog is using it, you can easily find support and ready-to-use plugins for almost anything.

          In the car world, WordPress is your plain old petrol car that just runs, can easily be refuelled and you can get anything repaired at every other street corner. That’s why it is still so widespread.

          • IsThisAnAI@lemmy.world
            link
            fedilink
            English
            arrow-up
            3
            arrow-down
            3
            ·
            edit-2
            4 months ago

            Drupal is out there. It’s not perfect but it’s well maintained and quite powerful with good community support.

        • mbirth@lemmy.mbirth.uk
          link
          fedilink
          English
          arrow-up
          18
          arrow-down
          1
          ·
          4 months ago

          Ghost runs on NodeJS which isn’t available at most cheap webhosters. Also it doesn’t do traditional blog things like pingbacks, trackbacks or webmentions.

          BearBlog can’t be self-hosted at all - it says so right on their GitHub’s README.

          WriteFreely is a Go binary that - again - isn’t supported on most cheap hosters. Also I can’t seem to find anything about it supporting pingbacks, trackbacks or webmentions. It seems to be more like a one-user Mastodon instance.

        • funkless_eck@sh.itjust.works
          link
          fedilink
          English
          arrow-up
          8
          arrow-down
          1
          ·
          4 months ago

          first one isn’t free

          second one you have to migrate posts using ctrl+c ctrl+v and then hand type the publish date

          third one you have to already have built your own SQL database

          • Vittelius@feddit.de
            link
            fedilink
            English
            arrow-up
            1
            ·
            4 months ago

            Ghost is open source. You can selfhost. It’s just that aggressively advertising their (paid) hosting services on the official website

        • Tavi@lemmy.blahaj.zone
          link
          fedilink
          English
          arrow-up
          2
          ·
          4 months ago

          You can try it, but I switched from Ghost to WordPress because of auto updates. Default ghost docker image doesn’t pin the correct DB version which causes errors, and watchtower updates break your website. Also, very little in the way of existing plugins or themes. Typing a new article doesn’t give much in the way for formatting.

          Way more documentation on the WordPress side of things and just general QoL stuff. Plus, free templates. Spaghetti it is, but spaghetti works and I don’t feel like using Hugo.

    • wagoner@infosec.pub
      link
      fedilink
      English
      arrow-up
      18
      ·
      4 months ago

      Laziest common response to things like this. People still use Windows? People still use cars? WordPress is insanely popular and there’s no indication that’s going to change. Not even after you’ve chosem to signal to all of us here that you don’t use it. Good for you, though!

      • 555@lemmy.world
        link
        fedilink
        English
        arrow-up
        3
        arrow-down
        1
        ·
        4 months ago

        Something that gets built on my machine and pushed up to the site and doesn’t allow third party code to execute on the backend.

        It really depends on what the website is.

        If you have a use case, I can be more detailed.

          • 555@lemmy.world
            link
            fedilink
            English
            arrow-up
            2
            arrow-down
            1
            ·
            4 months ago

            Cheap, easy, good.

            Pick two. This is how most things in life are.

            Personally, I’m a fan of static sites. But, being a web developer myself, setting up a simple form isn’t a big deal.

            If dynamic content is required and you’re not a developer, you are at a crossroads. You can host your own Wordpress and get hacked eventually, or pay a cloud service like squarespace or wix, etc. but you’re at the mercy of price increases and a la carte features.

            To be fair to Wordpress, they’ve come a long way. The core product isn’t horrible. However, they have no way to control 3rd party code, and that’s where all the malicious stuff comes from.

      • sugar_in_your_tea@sh.itjust.works
        link
        fedilink
        English
        arrow-up
        2
        ·
        4 months ago

        Wordpress does a lot of things. You need to specify which things you want to do in order to narrow down a replacement. For example:

        • static site? - Hugo, Jekyll, etc - just generates regular HTML
        • personal cloud? - NextCloud/OwnCloud
        • ecommerce? - consider nopCommerce or OpenCard

        The more you can narrow your requirements, the easier it will be to find a secure solution.

        • Anon518@sh.itjust.works
          link
          fedilink
          English
          arrow-up
          1
          ·
          4 months ago

          static site? - Hugo, Jekyll, etc - just generates regular HTML

          These are either vastly more limited, or they require you to be able to code.

          ecommerce? - consider nopCommerce or OpenCard

          I’ve never heard of these, but I have seen people say that if you want to do ecommerce you should only use Shopify, because even small differences can result in people not purchasing your products.

          • sugar_in_your_tea@sh.itjust.works
            link
            fedilink
            English
            arrow-up
            1
            ·
            4 months ago

            Yes, Jekyll and Hugo are vastly more limited, that’s the point. There’s no dynamic content, you just write in Markdown (the same thing Lemmy uses), pick a theme, and you’re good to go. No need to code anything, just a couple config files and Markdown.

            Shopify is fine if you want something hosted. But since we were talking about WordPress, I assumed self-hosting was a desired quality. All of the platforms I mentioned are self-hosted, open source, and at least one from each category is compatible with PHP-only hosting providers, just like WordPress.

            If we’re optimizing for easy, Squarespace should be on the table for static websites as well. I assumed we were talking about direct replacements for WordPress, not hosted alternatives.

            • Anon518@sh.itjust.works
              link
              fedilink
              English
              arrow-up
              1
              arrow-down
              1
              ·
              4 months ago

              you just write in Markdown (the same thing Lemmy uses), pick a theme, and you’re good to go

              That is far too basic for most websites. It’s absurd to suggest that’s a valid alternative for something like Wordpress + Elementor.

              Squarespace should be on the table for static websites as well.

              How so? It’s not static that I’m aware of, unless you’re exporting it to a file after using the UI to create it?

              I assumed we were talking about direct replacements for WordPress, not hosted alternatives.

              Well, as you said, Wordpress does a lot of things. Shopify, Wordpress, Squarespace, etc., are certainly interchangeable/competitors to a large degree. Wordpress has hosted options and is a default/main option for many hosting companies.

              You can build a full website with every major function and design option with Wordpress. You can’t with Jekyll and Hugo unless you can code.

              • sugar_in_your_tea@sh.itjust.works
                link
                fedilink
                English
                arrow-up
                2
                ·
                4 months ago

                That is far too basic for most websites

                Well yes, but that’s my point. WordPress does everything, and I’m offering tools that do one thing well.

                If all you need is a static site, use a static site generator, not WordPress. If all you need is ecommerce, use an ecommerce tool, not WordPress. And so on.

                unless you’re exporting it to a file after using the UI to create it?

                I’m saying that if all you need is a static site, but you want something simple and hosted, Squarespace would be a decent alternative. Whether it’s actually static is beside the point, it’s probably more secure than a self-hosted WordPress site since you can’t just throw on a dozen plugins serverside, only use one or two, and then get hacked.

                A swiss army knife can do everything, but it doesn’t do everything well, and it’s easy to use it insecurely, which opens you up to these sorts of attacks. I’m not going to suggest a drop-in replacement for WordPress (they do exist) because the problem is fundamental to the “one tool for everything” approach.