Top
Best
New

Posted by elithrar 2 days ago

EmDash – A spiritual successor to WordPress that solves plugin security(blog.cloudflare.com)
675 points | 490 commentspage 6
woodylondon 2 days ago|
Reading the comments below, have we all fallen for a 1st April Fools' joke?

Actually, rebuilding WordPress without the ecosystem is kind of the point. For example, would Divi or the major page builders rebuild their entire products to support this? I doubt it

crabmusket 1 day ago||
Does it bother anyone else that the capability tags in their example seem to follow different noun:verb conventions?

    capabilities: ["read:content", "email:send"],
lioeters 1 day ago|
Now that you mention it.. List of capabilities:

  read:content
  write:content
  read:media
  write:media
  network:fetch
  read:users
  email:send
  email:provide
  email:intercept
Also:

> ### Trusted Mode

> Trusted plugins are npm packages or local files added in `astro.config.mjs`. They run in-process with your Astro site.

> - *Capabilities are documentation only.* Declaring `["read:content"]` documents intent but isn't enforced — the plugin has full process access.

> - Only install from sources you trust. A malicious trusted plugin has the same access as your application code.

sourcecodeplz 2 days ago||
This part is interesting:

"Plugin security is the root of this problem. Marketplace businesses provide trust when parties otherwise cannot easily trust each other. In the case of the WordPress marketplace, the plugin security risk is so large and probable that many of your customers can only reasonably trust your plugin via the marketplace. But in order to be part of the marketplace your code must be licensed in a way that forces you to give it away for free everywhere other than that marketplace. You are locked in."

There was much drama with wordpress some time ago and the plugin marketplace.

p0w3n3d 1 day ago||
I used to host a wordpress on my server for some people who configured it. However, when some bots got there, I was unable to keep them at bay. I upgraded WP's version, but the Wordpress had some vulnerable plugin, and I was unable to find out what path did the attack go. I only could find that the malicious files were uploaded into images/ directory and run from there. That's something I blame PHP for (and of course my lousy LAMP configuration skill, but the directory was not allowed to run the code from, I must impress). I tried also to block IPs attacking my server, but this was like cutting one of the hydra's heads.

So, long story short I ended up removing write permission to all the folders, thus disabling upload, and later they went to another server. They host it fine there, I still maintain redirection from the main domain to their host. However I failed, but really this is sad the WP is so vulnerable just by the plugins installation.

Since then I am looking for WP replacement that would not mix up the code and the images from the upload directory (presumably in rust or golang), but this would need to be opensource anyways.

wiradikusuma 1 day ago||
"We think of it as the spiritual successor to WordPress. It’s written entirely in TypeScript" — A major reason why WP is popular is that it's PHP-based and works with shared hosting.

Will EmDash work with shared hosting?

megnu 2 days ago||
The UI doesn't seem geared to power users. E.g. Why is the featured image taking up so much space above the content editing area when it's sized appropriately for the sidebar? Imagine you need to update the text of several posts... Well, now you gotta scroll down half the page to the content area of each one.

And all that padding gets you quite the narrow content area. Not to mention it looks like a very basic TinyMCE. Seems like more of a POC than an actual "spiritual successor".

cutler 1 day ago||
Typescript, isolates, Cloudflare dynamic workers, serverless. You've already lost the market WordPress serves.
pettycashstash2 1 day ago||
Played with this for 30 minutes. looks promising, and of course its rough around the edges. im sure you're working on it, but could not figure out how to add section to page.
bluewavescrash 1 day ago||
Curious about the architectural choice: Why not build it as a pure headless CMS separate from Astro, and then ship an Astro adapter alongside it?
kunley 1 day ago|
"..aims to be compatible with WordPress functionality"

What does it mean, to be "compatible with functionality"?

At a first glance this statement promises a lot, but does it really mean anything technically?

More comments...