[_yosefk]

I use WordPress, a huge PHP blob with a database, for my self-hosted blog. I somewhat agree with the parent and sister comments in that, as a programmer, the way these things work irks me out.

However, I don't agree with the apparently widespread conclusion that it follows, from this sentiment, that not publishing is better than publishing using a less-than-lovely platform. I also don't agree with the widespread corollary, "build your own blog", when as a result you get less features than the irksome WP would give you (a common omission is support for comments - I got some amazing comments over the years, if you think it's not worth having this feature, I think I see where you're coming from, and I think you should reconsider.)

I treat blogging software as I treat any other - I dislike most programs that I run, but I often still choose to run them because the result is worth it. I can't see how "it's not worth" to run PHP+DB in order to be able to publish your thoughts. This is not to say that, given today's alternatives, WP or similar should be chosen over those alternatives, just that not using any of the available options because they're all too irksome feels over the top.

[lmm]

I use github pages for my blog, disqus for comments. Pages is just a convenient place to host - I have my entries in a git repo, the pages are statically generated with Jekyll, I'm sure I could run it myself if github started doing anything onerous. For comments it's just become too hard to self-host anything given how much spam there is, so I've given in and use disqus in the same way that I've stopped self-hosting email and use gmail.

[_yosefk]

It's pretty easy to hack a comment form so that there's no real heavyweight craptcha but on the other hand a bot will not know to fill it unless your site is specifically targeted. Security by obscurity. Works like a charm for me.

[roghummal]

Have you ever had to change your form because a spammer added an exception for you?

[quanticle]

>However, I don't agree with the apparently widespread conclusion that it follows, from this sentiment, that not publishing is better than publishing using a less-than-lovely platform.

After having had to deal with the aftermath of a hacked Wordpress site that was sending out massive amounts of spam, I would respectfully disagree. I consider Wordpress (and Wordpress plugins, especially) as essentially a security hole that allows malicious actors to gain free access to relatively powerful hardware on fat datacenter pipes, making the Internet worse for everyone around them.

By all means, publish. But don't publish using a platform that allows unauthorized users to misuse your hardware and turn it into a spam zombie/DDOS box/staging box for hacks, etc.

[TheOtherHobbes]

I see

"GET /wp-login.php HTTP/1.1"

about eight times a day on my lowest traffic sites. And I don't even have WP installed. (Or PHP.)

WP is a distributed botnet farm. I know people who have given up reseller hosting businesses because keeping customer WP installs clean was becoming a 24/7 job for them.

Unfortunately Hugo, Jekyll, etc are a poor substitute for WP, because they're much too difficult for non-coders to use. They're also a poor substitute economically - the WP template & plug-in market is huge.

It must surely be possible to build a blog engine that's secure, easy to use, and easy to customise?

[liotier]

> I don't agree with the apparently widespread conclusion [..] that not publishing is better than publishing using a less-than-lovely platform

And moreover, I don't agree that not communicating is better than communicating using a less-than-lovely platform... Static generators are fine for publishing but taking into account the requirements for blog-style bidirectional communication (comments, trackback, pingbacks etc.) excludes static sites unless one surrenders control to third parties such as Discus & al.

Wordpress is fine - as long as one carefully selects plugins and culls the unmaintained ones mercilessly.