310
Representatives for developers of the remaining three plugins couldn’t be reached because they provided no contact information on their sites.
You're asking for trouble if you're using such random plugins on production sites.
this post was submitted on 25 Jun 2024
310 points (99.1% liked)
Technology
59675 readers
3701 users here now
This is a most excellent place for technology news and articles.
Our Rules
- Follow the lemmy.world rules.
- Only tech related content.
- Be excellent to each another!
- Mod approved content bots can post up to 10 articles per day.
- Threads asking for personal tech support may be deleted.
- Politics threads may be removed.
- No memes allowed as posts, OK to post as comments.
- Only approved bots from the list below, to ask if your bot can be added please contact us.
- Check for duplicates before posting, duplicates may be removed
Approved Bots
founded 1 year ago
MODERATORS
oh boy, the average wordpress site has like 30 plugins and the top bar is getting cluttered with so many plugin upsells that it fills the whole screen. There's a huge industry of people making wordpress sites who shouldn't.
It's quite frustrating to be asked as a dev to "fix" people's site as my usual response is "shut it off and redo it well".
It's really a shame because by now WordPress itself actually works quite well. Sure, it's fueled by unspeakably ugly spaghetti code. But at least it's unspeakably ugly spaghetti code that works and receives regular automatic updates.
And other than putting up a verification program I don't see what they could do to improve the plugin situation.
I agree. I don't hate wordpress. It seems a bit dated by today's standards and bloated in some aspects but you can definitely make a solid, fast website with it. It's getting a bad reputation for its toxic plugin dev scene and crappy sites built using Elementor.
Elementor shudders
What an absolute nightmare that was
As someone who found elementor the only thing that was working at the time - any suggestions to do better? I have no coding experience fyi
Coding is pretty much the only way to make a site that is both flexible and fast. If you wanna stay with page builders, I'd recommend something like webflow or framer but going with these closed systems is really not that amazing longterm. You're gonna sink a lot of money into a system that will almost certainly enshittify in the future.
If you're willing to pick up coding, try to make your own theme with something like Advanced Custom Fields in wordpress or switch to something like Kirby CMS which is more flexible out of the box than wordpress and has great docs.
Regular automatic updates on ugly spaghetti code feels like it's just asking for trouble.
Theoretically, someone could untangle the spaghetti. Nobody will, but automatic updates at least opens up the possibility.
There’s a huge industry of people making wordpress sites who shouldn’t.
And this is why I hate the state of the whole hacking scene and that now nation states are also carrying out en masse attacks. Everyone should be free to make a site on Wordpress or whatever. If they can't, that's how we get everyone on like 3 corporate platforms like Facebook.
Funnily enough, I was hearing this from developers in the early 2010s when I was just starting my career (IT adjacent, but not a developer).
Seriously, people have been saying this stuff about WordPress as long as it’s been around, and I’m always surprised that it still exists. This was definitely one of those technologies that sounded bad enough that it could never last. Joke is on me.
Of course I thought the same with JavaScript but was forced to learn it last year
Of course I thought the same with JavaScript but was forced to learn it last year
Use TypeScript. It's still built on a giant steaming pile of shit but at least if you're careful most of your own code can be reasonably correct.
It’s not my choice. I’m only here to help others fix their code, not to actually do the coding. I have to someone know best practices and how to fix common bugs
That's a shame. If you can convince them to use TypeScript that would be for the best, otherwise good luck, you're going to need it. I can't say you couldn't pay me to write JavaScript, but I can say what I would demand to do it is way more than anyone would be willing to pay.
If i were to take a shot every time vulnerabilities are found in the WordPress ecosystem i'd be comatose by now...
I'd guess it's not because of the inherent insecurity of WordPress, but the sheer size of the ecosystem and the fact that like 40% of the Internet is WordPress sites.
And inherent insecurity. It wasn't designed to be secure, it was designed to be full-featured, so it has a pretty big attack surface.
That's the ecosystem. WordPress itself is pretty basic, these things attack plugins, and their often not-very-experienced creators and users. The thing with WordPress is that this kind of vulnerability comes with the problem space, not the particular solution. If there was a different product in the same space, it would not fare better by default.
Also, I'd bet that a ton of CVEs are filed for C++ libraries, yet nobody is harping on about how insecure C++ is.
Exactly. A plug-in architecture is a feature, and it's really hard to secure. Instead of going that route, they should have instead solved specific problems. When you make it easy to add someone else's code, you also make it easy to forget to remove it later, or to not stay updated on which plugins are deprecated/abandoned.
A plug-in system is insecure by design for a public-facing service. YAGNI, so pick a handful of stuff you actually need.
It's not the product, it's the cavalier consumption of unsigned add-ons despite knowing better.
What are alternatives of WordPress if I wanted to add something to my website?
What are you trying to achieve?
- static site like a blog? - Hugo
- add comments? - Commento paid, or you can self-host
- cloud stuff (e.g. Google Drive replacement) - NextCloud
There's a ton you can do, you don't need WordPress just because you want a website. Figure out what you want your website to do, then look for tools to do that.
Just a side note, Commento is kinda dead on the self-hosting front at least as it's been years since an update, which is probably not great for a public service.
However, Comentario is a updated fork that's being maintained.
If you want to add something to your website then you're already running WordPress, no?
No, I haven't added nothing. I was going code a basic html 5 page but I wanted a blog like atmosphere, since the website is all about my writing.
If you want a mostly straightforward WordPress-alike that's not WordPress, you probably should at least consider Ghost. I'm using it for my blog and it's got a slightly weird focus on "paid blog members", but it's super solid and doesn't have a multi-decade history of endless security problems.
And, soon, it'll be a happy member of the Fediverse.