[CM30]

It's just because they don't want to break anything in existing sites, sorta like how Microsoft doesn't generally want to break programs on Windows. So, changes are fairly incremental, and the quality is about what you'd expect from a piece of software that's decades old with no plan for what happens if it got this far.

But what do you do in that situation? If they change the structure too much, then either they make it impossible to upgrade an existing site, or potentially break a whole bunch of things said sites depend on (mostly themes and plugins). And that ease of upgrading is likely what stops a lot of people just migrating away to other solutions.

[9dev]

Even just introducing emulation layers for the old parts and making the new parts opt-in would be better than just giving up and keep on going. Plugin authors can choose the new subsystem as they publish updates or new plugins and themes, and in return they get speed and security guarantees.

And since the WordPress foundation controls the extension marketplace, they can reliably determine which parts of the API surface are in use, or even invest a chunk of money every month to send AI-written patches to plugin maintainers to ease the transition.

There would be so many ways to improve the situation (to the benefit of WordPress maintainers, customers, and ecosystem vendors alike, mind you!), but alas, they are stuck to their ways and will not.

[ValentineC]

> And since the WordPress foundation controls the extension marketplace, they can reliably determine which parts of the API surface are in use, or even invest a chunk of money every month to send AI-written patches to plugin maintainers to ease the transition.

What WordPress foundation?

[9dev]

The, uh, WordPress Foundation[0]?

[0]: https://wordpressfoundation.org

[ValentineC]

I don't know if things have changed since, but my understanding remains that Matt runs WordPress.org using his own servers and money, not the foundation's:

https://news.ycombinator.com/item?id=42689906

The foundation was, at some point in time when the drama was at its peak, mostly a feel-good non-profit initiative.

[liveoneggs]

they broke tons of stuff with Gutenberg/block editor and didn't seem to be bothered by backwards compat

[stefanfisk]

Not only did they break classic WordPress stuff, but they also keep breaking Gutenberg APIs at a really frustrating rate.

It’s clear that the core WordPress developers have a very different idea of project stewardship than the Gutenberg devs do.

[sunaookami]

Blame Matt Mullenweg

[CM30]

Fair enough. The way they added Gutenberg was a complete mess. Like yeah, the idea is a good one, and the editor can be pretty good if used correctly. But the way it was built was certainly not ideal, and was probably the worst of all worlds. Felt like someone saw SquareSpace and co, thought WordPress was falling behind and decided to push for those features to be added as quickly and inefficiently as possible.

[antonymoose]

If the existing at-risk functionality is a security issue I feel like that’s a good time to throw the proverbial flag on the play and make it an issue. Letting consumers play host to malware and phishing portals is the worse move.

[tonyedgecombe]

This isn’t some problem that has developed over time. It was shit from day one.

[marysol5]

Wordpress is a great web shell, shame it also comes with a blog

[jaredklewis]

Is it? I did a project with WP a very long time ago and was kind of baffled. Like it's nice to have an good rich text editor, I got that part. But the absolute monstrosities people developed to extend WP, when they could have just used MySQL and PHP directly, astounded me. Like I couldn't figure out what WP was offering? It was just like a blog that you could painfully hack into something else if you wanted to. But even at that time there were already loads of great, batteries included PHP frameworks like Symfony or Cake. Why not just skip the painful part and code what you want directly?

Anyway, I probably shouldn't comment as maybe WP has progressed but it doesn't sound like it.

[CM30]

Honestly, the reasons could mostly be summed up as "we already used WordPress for the blog, we now need to add a shop onto the existing site, might as well extend the former rather than rebuild or maintain two systems".

Alternatively, folks that aren't particularly technical hacking together a solution that works 'well enough' for what they need, and agencies that only have the interest/capacity to use one platform deciding that each and every customer needs to use that platform.

If you're a skilled programmer WordPress is probably not a good solution for your issues, but if you're more of a designer or hobbyist that wants a somewhat hacky extendable blog system it's pretty easy to use.

[tredre3]

I suspect you missed the joke: A web shell is a script to execute arbitrary commands, i.e. Remote Code Execution.

[jaredklewis]

oh haha. Yea, my brain somehow interpreted shell as framework.

But yes, I agree, WP is very useful for those times when you need to run a quick `sudo rm -rf /` command but can't get to a terminal.

[Exoristos]

You may be missing the point that the WP ecosystem is aimed at non-programmers.