Top
Best
New

Posted by elithrar 1 day ago

EmDash – A spiritual successor to WordPress that solves plugin security(blog.cloudflare.com)
668 points | 490 commentspage 2
bzmrgonz 1 day ago|
Welp, it looks like if you selfhost, the sandboxing of plugins benefit goes out thr window from what I'm reading. What kind of open source is that? Opencore? More like openinsecure, for thr security version, pay the Piper. I might still give it a try, but I sure hope we can put monthly monetary ceiling, had ceilings on our accounts. Anyone knows if cost-caps are possible on CLOUDFLARE??
bzmrgonz 1 day ago||
Also, it looks like there are egress charges to download R2 object storage. So he day we choose to exit stage left, we will be taxed. Wanna setup independent backups for compliance, we will get taxed on egress. Am I reading this right guys??
psz 22 hours ago||
You read it wrong. Egress from R2 is free. https://developers.cloudflare.com/r2/pricing/
mpeg 1 day ago|||
Honestly, you'll struggle to find a cloud platform cheaper than cloudflare.

The $5/mo gets you 10 million dynamic requests (static assets are not included in this limit, so often a single pageview will be 1 dynamic request) and that would be across the whole workers product for your account, no extra pricing for extra websites, domains, or anything else like you'd see in most "wordpress hosting"

I run all my personal sites and client sites (one of them for a fortune 500 company) in the $5/mo plan, and the only time I went over that was when a client got hammered with malicious requests (and it was like $100)

Disclaimer: I have no relationship to cloudflare, I'm just a happy customer

arch-choot 1 day ago||
I run a rust webserver on a €4 VPS from hetzner that serves 300M (million) requests a day. Way cheaper than doing that on _any_ "serverless" request-based platform, I think.
mpeg 1 day ago|||
Yes perhaps I should have specified you can't get much cheaper for serverless platforms.

You can certainly run a VPS like that for cheaper, you could probably even beat the raw request numbers from those 1€ a month vps from ovh or similar. The key difference is with cloudflare your site is globally distributed by default, and you get to buy into the whole ecosystem, if you want.

withinboredom 1 day ago||
> The key difference is with cloudflare your site is globally distributed by default, and you get to buy into the whole ecosystem, if you want.

The real question nobody asks: do you even really need global distribution?

mpeg 1 day ago||
Most of the time: no

But sometimes you do have clients in both sides of the atlantic and it's nice being able to cut their request times by a few hundred ms "for free". Personally, that's not the main reason I use cloudflare, but it can be handy!

dust-jacket 1 day ago|||
interesting, I'd assumed the lowest tier of hetzner (4.50/m, 2 cpus, 4GB ram) wouldn't hold up to that.

must be very light, for so much traffic. any more details?

arch-choot 18 hours ago||
It's a BitTorrent tracker

tracker.mywaifu.best:6969/announce

Running https://github.com/ckcr4lyf/kiryuu

(Disclaimer: I'm the author of kiryuu)

CPX11, so 2vCPU/2GB

Tepix 1 day ago||
Unless someone adds this feature, this is completely uninteresting to me, as well as dishonestly presented by Cloudflare.
amiga386 1 day ago||
> While EmDash aims to be compatible with WordPress functionality, no WordPress code was used to create EmDash. That allows us to license the open source project under the more permissive MIT license.

Ha ha, that's really funny timing given the recent launch of Cleanroom As A Service, promising that you can licensewash other peoples' code quickly and easily: https://malus.sh/

I'm not saying they did that, but it's ironic timing.

lurkshark 1 day ago|
Malus is (well crafted) satire.
earthlingdavey 1 day ago|||
So well crafted in-fact, that if you pay them, they will provide the service.
richbell 1 day ago|||
https://fosdem.org/2026/schedule/event/SUVS7G-lets_end_open_...
joeyoungblood 3 hours ago||
Without a theme marketplace and possibly a plugin marketplace, this is just another open source CMS. However, since it is MIT licensed perhaps someone out there will build upon this and make an actual spiritual success to WordPress.
rgbrenner 1 day ago||
> Solving scale-to-zero for WordPress hosting platforms > WordPress is not serverless

Just not accurate. WordPress doesn't prevent this.. It's up to hosting providers to work on their infra so it can run in a serverless fashion.

For example: https://www.agiler.io

That's serverless wordpress that scales to zero.. no changes to WordPress, plugins or anything else.. just platform infra.

solarkraft 1 day ago|
Last time I checked Wordpress was completely fine living in a couple of PHP files on a webspace. That’s like the pinnacle of „serverless“, is it not?
rgbrenner 1 day ago|||
mysql/mariadb and the shared filesystem requirements are a bit different than what lambda/etc provides. So not really, but it's all solvable clearly.
droptablemain 1 day ago|||
Not even a little bit.
TheTaytay 1 day ago||
It looks like I'm in the minority after reading this comments, but I'm quite happy to see this announcement.

A "good" standard, free CMS with theming and plugin support without the issues of Wordpress is _welcome_. (And the issues are many: Licensing, trust, drama, security, and cost).

I'm guessing that a lot of cynicism here is coming from this crowd not being the target market of Wordpress in the first place? What were you recommending to non-technical friends and family who wanted a good, open source, affordable CMS to back their website? Wordpress has all the right _ideas_, but the wrong implementation.

9dev 1 day ago||
There are great standard CMSes that do everything technically better than Wordpress (not that it's harder to jump higher than a rock, but hey). That's not the hard part. Every developer should build a good CMS once.

The hard part is displacing Wordpress market share; building a community of bloggers, marketeers, agencies, web designers, and so on; creating a huge ecosystem of paid and free plugins, allowing plugin devs to commit to your marketplace and lock customers in.

Wordpress is awful. The only thing it's got going is its moat, but that's not an engineering problem, but a people problem instead.

lupu 1 day ago|||
Those standard CMSs that are technically "better" than WP, I would bet they are at least over a decade old, some have even come out during the same time with wp when there was no market share to speak of and still were left in the dust.

The problem is that people misunderstand why WP was and is better than all alternatives that tried to take it's place, I have no idea either but I know that others have tried same thing as CF and failed.

9dev 1 day ago||
I have been one of the maintainers of a moderately successful CMS back in the day, but there are definitely well-groomed alternatives that have popped up a lot more recently than that, especially from the headless variety.

I'm convinced the thing that WP did better was being the first simple and accessible blogging platform when blogging was still a thing. IIRC, the alternatives were things like Joomla or Drupal - awful behemoths for enterprise users. WordPress was a breath of fresh air compared to those, and out of the blogging scene, people started to use it for agency projects, while others published an ever-increasing number of plugins and themes. The rest is just momentum of that movement.

MrFurious 1 day ago||||
I find it hard to believe that people used to WordPress, with its flaws and virtues(yes, wordpress have virtues), will switch to this, no matter how much it's from Cloudflare.
TiredOfLife 1 day ago|||
> There are great standard CMSes that do everything technically better than Wordpress

Like?

9dev 21 hours ago||
CraftCMS for example is a great example of what you can achieve with PHP; there's Directus or Strapi for headless CMS, for example; or Ghost, Contentful, Storyblok and more as SaaS alternatives.
voganmother42 1 day ago|||
I think the cynicism is related to cloudflares recent previous releases that were considered to be slop that significantly overpromised on its capabilities/completeness. Trust can take a long time to rebuild.
notahacker 1 day ago||
Throw in the the bragging about slop and cleanroom clones to avoid AGPL, the name and April 1st launch date, and maybe the high priority afforded to agent-friendly crypto payment infrastructure if anyone was paying attention. Maybe they prompted the marketing agent with "how can you get HN to loathe a product as innocuous as an open source headless CMS?"

Other than that, it seems it might be a half decent headless CMS, if the bit of WordPress you want is its interface, and not the number of plugins and devs and not being tied to Cloudflare's infrastructure.

Yokohiii 1 day ago|||
> I'm guessing that a lot of cynicism here is coming from

...the fact that CF just dumps tokens to generate some slop to compete with the single biggest web platform and casually adding a vendor lock in. It's just buzz, an inexpensive attempt to grab a valuable market share.

If you set security as a selling point for EmDash, then I am baffled. The WP lock file has 30k lines, the brand new EmDash has 16k lines, but it LESS verbose yaml. JS is the cornerstone of anti-security that WP couldn't dare to compete with. The plugin isolation is also bogus, WP plugins are insecure because they have all access to everything, but they need at least some, mostly DB, how is that even solved? Isolation does shit there.

I am not a fan of WP, but CF doesn't even try to get this right.

thedevilslawyer 1 day ago||
Frankly, you're wrong. This is a fundamentally better plugin architecture that WP, and if you can't see it, then it's your understanding of security that's not right.
Yokohiii 1 day ago||
If you have arguments, then make them. This is just saying stuff for the sake of it.
thedevilslawyer 1 day ago||
The post literally does that. it talks about how plugin access to core is handled. So to be explicit: if you don't see that as a very significant security improvement over WP's open world, then it may help to understand why. The post also talks about WP ecosystem downside due to this.
Yokohiii 23 hours ago||

  | "network:fetch" // ctx.http is available (host-restricted via allowedHosts)
  | "network:fetch:any" // ctx.http is available (unrestricted outbound —   use for user-configured URLs)
  | "read:content" // ctx.content.get/list available
  | "write:content" // ctx.content.create/update/delete available
  | "read:media" // ctx.media.get/list available
  | "write:media" // ctx.media.getUploadUrl/delete available
  | "read:users" // ctx.users is available
  | "email:send" // ctx.email is available (when a provider is configured)
  | "email:provide" // can register email:deliver exclusive hook (transport provider)
  | "email:intercept" // can register email:beforeSend / email:afterSend hooks
  | "page:inject"; // can register page:fragments hook (inject scripts/styles into pages)
That are the plugin capabilities. I have no clue how it could replace any serious WP plugin. Of course it's secure ;)
carlosjobim 1 day ago||
Surreal CMS. Nothing is more simple and robust for non-technical people to use. Not open source, but that's never a requirement in these cases.
smetannik 1 day ago||
IMO unlike WP, EmDash can he harder to host.

With WP you can find a plethora of cheap PHP hostings that offer WP preinstalled. If you need to tweak a theme - just download a .php file via FTP, tweak it and upload back.

No server management or restart is required.

One big potential benefit that EmDash has - every WP deployment is basically a honeypot.

amanzi 1 day ago||
So this is just a "similar" CMS to WordPress in that it has themes and plugins, and you can publish pages, posts, tags, categories, etc. But there are lots of similar CMS out there, and this one isn't "compatible" with WordPress since you obviously can't just take a WordPress theme or plugin and install it in your EmDash site. So I don't even know why the focus on WordPress here - this is just yet another CMS that offers similar features.
alluro2 1 day ago|
WordPress is the most popular CMS, and, at any moment in time, especially lately, there are a lot of people looking for a "WP alternative". I agree that it's not actually compatible, but it seems they tried to make it similar just enough to be able to use the word without 100% lying and attract people that way.
lupu 1 day ago||
Nobody is looking for wp alternatives, if they were they would have moved long ago, as there are tens of similar CMS's that were supposed to be much "better" on paper yet never took of like octobercms,gravcms,ghost,netlify,wagtails,etc
gnz11 22 hours ago||
Wagtail is fantastic. Pretty much the go to Python-based CMS to use these days.
spankalee 1 day ago||
It's a shame they don't seem to try to address the divide between CMS's and static sites.

Most WordPress sites could just be static, but WordPress has a nice editor interface, so they're not - unless you use a SSG plugin. Building that into the core workflow (which I believe Astro supports) and giving users a nice hosted editor that produces a static site would be welcome innovation.

pwython 1 day ago||
I've been migrating a few Wordpress sites from Wordpress to Astro + Strapi recently, working in 'hybrid mode' so the entire site is static except for post previews in Strapi (only that one route is SSR).

Editing content in Strapi, once customized with CKEditor and such, is Wordpressy enough for the human Editors familiar with WP.

So far I'm loving the stack.

MattieTK 1 day ago|||
EmDash with some aggressive caching and SWR is effectively this, and we're getting closer to that every day. When the cost of maintaining the data part of the CMS is effectively free, you're basically working with a static site anyway.
Y-bar 1 day ago||
I haven’t used Wordpress for a few years. But with WP Super Cache (1) we also always did pretty much that: On saving a post/page the static HTML would be written to a cache directory and be the default content served to visitors.

[1] https://wordpress.org/plugins/wp-super-cache/

RobotToaster 1 day ago|||
The issue with static sites is they can't do comments.
input_sh 1 day ago|||
Astro would call that an island: https://docs.astro.build/en/concepts/islands/

I guess this is our answer to the question of why Cloudflare acquired it in the first place.

__david__ 1 day ago||
Isn’t that just the way old school Perl/ruby/php web apps from 20 years ago did things but with a fancy name?
qingcharles 1 day ago||||
I bet 99.9% of live Wordpress sites no longer have comments enabled.
spankalee 1 day ago||||
So many WordPress sites don't have comments.
Closi 1 day ago|||
They can - it’s just more complex.

You just put the comments into something like firebase/supabase etc or use one of many off the shelf solutions. Free tier is fine.

RobotToaster 1 day ago|||
Is it still a static site then?

You could just do it with CGI scripts, without the external dependencies, but that isn't really static either.

Closi 1 day ago|||
Depends what you would call that architecture then I guess!

I run my local theatre website by writing the posts in markdown, and then have some github actions which use Hugo to turn it in to a static site and then uploads the content to an S3 bucket. The site itself has dynamic content like within-website ticket buying from eventbrite and a contact form that sends email using an external service. It also calls in things like google analytics.

Does this still count as static? Personally I think so, Even though there are 'dynamic' elements.

IMO static refers more about how the content is served rather than saying that the content can’t be ‘dynamic’ as lots of Wordpress sites have static/non interactive content but still regenerate the html on each page load.

DANmode 1 day ago|||
I run static sites for my clients, with embedded forms.

Performance says they’re definitely still static sites!

egypturnash 1 day ago|||
"Just" sure is doing a lot of heavy lifting in this sentence.
carlosjobim 1 day ago||
I don't even think the WordPress editor is very nice. It's completely separated from how the actual results look. There are CMSs which lets you edit directly in the web page exactly as it will look when published.

As do most productivity software, like MS Office, Photoshop, Apple's iWork, etc.

Imagine making a document in Word, and it looks completely different when published.

ymolodtsov 1 day ago||
In my view, Astro is the most reasonable choice for a blog-like website these days. All the simplicity and all the capabilities that you need. Excited to check this out and see what they have added on top of it.
earthlingdavey 1 day ago|
Why not a templating language, like Nunjucks EJS or JSX, with vanilla JS for interactivity?
ymolodtsov 1 day ago||
You can use JSX in Astro if you prefer, but a CMS is more than just templates (not a LOT more I'd agree considering it's still static).
earthlingdavey 1 day ago||
I know you can, but do blog-like sites really Island architecture?

IMO most sites like that would be better to pick no-framework, vanilla or jQuery for interactivity.

I can't image average WP users would be happy to move to EmDash, only to have a constant stream of dependabot updates for Astro.

It has 55 direct (non-dev) dependencies https://www.npmjs.com/package/astro?activeTab=dependencies - while ejs has 0 and nunjucks has 3.

I'm weary of updates, maybe it's just me, but I doubt it.

ymolodtsov 1 day ago||
After all these cases like axios it's definitely reasonable. But many people already use Astro. And with static website there are far fewer attack surfaces compared to a full-on PHP running WordPress on a VPS.
kelvinjps10 1 day ago|
I don't like that they see the main selling point that the license, is not GPL, and that plugins don't have to license it that way either. I understand that not all developers are comfortable with the GPL license, but it allows to the code continue to be open source and that most plugins are open source also
benatkin 1 day ago|
A big issue with WordPress is the GPL. There hasn't been much clarity about it and the interpretations I've heard from Automattic in regard to which code is and is not covered by the GPL come from Automattic, not from the GPL. https://redsweater.com/blog/825/getting-pretty-lonely
rasso 1 day ago||
For what it's worth: they live up to their own standards. Here, for example, is the source code that powers their VIP platform product:

https://github.com/Automattic/vip-go-mu-plugins

It must be open sourced because it's based on WordPress. I still love that.

More comments...