Hacker News new | ask | show | jobs
by higherpurpose 4074 days ago
I for one would like to see a serious Go-based alternative to Wordpress. Virtually every major CMS out there uses PHP, and all of them are highly prone to hacking.
9 comments

Question to Matt Mullenweb, co-founder of WordPress and Automattic: If you could instantly rewrite WordPress in any programming language, which would it be?

Answer: http://www.reddit.com/r/IAmA/comments/1jg781/i_am_matt_mulle...

I don't think you're going to see a serious competitor to Wordpress in anything but PHP for a long time. The core target audience for a CMS is content creators and designers without strong compsci backgrounds. The things that make it hackable (trivial to modify in-place, extremely forgiving of type errors, no internal sandboxing, etc.) are the very things that make it attractive to non-developers.

Nothing is going to dethrone Wordpress unless it's at least as easy to cargo cult, and anything that does will more or less by definition annoy experienced developers more than what it replaced.

The beauty (which can also be seen as a disadvantage) is that writing Go does not exactly require comp sci skills. I suspect that Go is even simpler than modern PHP as a language.

You can of course go full comp sci implementing clever algorithms in Go, but you could do that in PHP, too, and none of content creators is usually interested in this.

Go requires knowledge of types, which already puts its cognitive complexity ahead of PHP for the typical content creator.
Go's types can be explained as some sort of templates for values (especially record types). Any CMS user knows about templates.
Are data types that complex a concept to grasp? When I started programming in VB I don't remember it being.
Data types aren't the bottleneck, the deployment model is. Editing a Go application requires the following steps:

  1.  Edit the project's files.
  2.  Open the (scary and alienating) command line.
  3.  Run `go build` and hope it works right.
  4.  Find and stop the old running server process and start the new version
Oh, and you'd better hope step 3 goes smoothly, because a tiny mistake anywhere in your application will cause this weird thing called a "compiler error" that means that the entire thing will break. Editing a Wordpress site, on the other hand, looks like this:

  1.  Edit the project's files.
  2.  There is no step 2.
As developers, we're comfortable with the first workflow. We happily accept the added complexity because of all the other nice things it gives us and because we're probably using other tools like version control that end up making our experience much more uniform between the two. But to a user whose primary experience is with editing Word documents there is a huge jump there.
Maybe not, but it definitely requires you to sit down and learn & understand what's going on, often longer than most of these people want to spend on one particular subject that may not be part of their regular job.
Prone to hacking because of PHP or just bad programming habits and poor plugins?
I would also like to see a serious Go-based alternative for forums. Simple Machines is truly excellent, but it's still in PHP. Go would be a far better alternative to build upon from the standpoint of security.
> Virtually every major CMS out there uses PHP

This probably has to do with the majority of cheap web hosts out there offering only PHP, Perl, and (if you're really lucky) Rails.

It's honestly one of the main reasons I got so late into the "my own web project" game. PHP and Perl to me are a ghetto. I refuse to touch them, learn them, look at them, know about them. And combine that with MySQL which is still worse IMO than Postgresql and "open source" web programming with the LAMP stack was just.................ugly.

I sound like a bad person. I can't help it.

I'm working on Journey[1] which, while "just" a blogging engine, has plugin support via Lua in the development branch. That feature is not stable yet, but hopefully in the next few days.

[1] https://github.com/kabukky/journey

I've had the same thought, but using Node (which is more accessible to a wider group of people). Part of the (sad) state of affairs that made WordPress so popular was accessibility to the code. Can't be overlooked.
Ghost (https://ghost.org) is built with Node
Would you say that they are prone to hacking solely because they are written in PHP? Is secure PHP impossible?
Secure PHP is certainly possible, and not even that difficult. The problem is that insecure PHP is even easier to write.

In my experience, most vulnerabilities tend to come from insecure, poorly written, unvetted third party plugins and libraries.

Someone writes a plugin that creates a widget, security is either a non-thought or an afterthought. They think someone else might like the widget so they publish it. Thousands of people find it useful, even years after originally released. They are all unknowingly using an insecure piece of software.

Even Node or Ruby based static site generators can't compete with WP & PHP on the server. The ubiquity of PHP on web server installations is astounding and the ease of use of WP sp. for non techies in contrast with the technical knowledge and expertise expected to build and maintain a Jekyll powered website or [insert your favorite Nodejs generator] powered website.
Sorry but that's doesn't seem like a compelling argument. We're not talking about editors... You don't choose the language based on the ubiquity of the language on UNIX/Windows servers, otherwise everything would be running on Perl probably.

I guess most people, like me, choose the language they know/like and then setup the server accordingly.

We're talking about two completely different market segments here; the corporate/enterprise market which provides more room for creative & cutting edge solutions to be implemented and then there's the SME & consumers which favor more conventional, user-friendly and "popular" solutions like WP and the likes.