[HN Gopher] Things I'd Want to See Improved in WordPress Core
___________________________________________________________________
Things I'd Want to See Improved in WordPress Core
Author : mooreds
Score : 45 points
Date : 2022-05-23 18:30 UTC (4 hours ago)
(HTM) web link (masterwp.com)
(TXT) w3m dump (masterwp.com)
| mikece wrote:
| Support for PostgreSQL and SQLite -- that's all I want. (For
| now.)
| thunderbong wrote:
| https://github.com/stokry/wp-sqlite
|
| Not official though. Submitted a few days ago (97 comments)
|
| https://news.ycombinator.com/item?id=31396732
| dmje wrote:
| The thing I want to see, above all else (and it is coming, but
| slowly and without any kind of apparent over-arching strategy -
| which it badly needs) is designer / developer control.
|
| Gutenberg gives remarkable agency to editors, which from one
| angle is great - lovely to be able to add a column, shift a block
| upwards, pad that image over to the right without any technical
| skills.
|
| On the other... I don't know a web designer in the world who
| wants to give their editors complete control. And rightly so. Web
| design - good web design (and by proxy, UX) - is about constraint
| as much as it is about freedom. Probably more so. Knowing what
| not to include, and when not to include it, is _the_ single skill
| that a great visual / web designer brings to the table.
|
| So to see interfaces like Gutenberg where anyone can ...shift,
| adapt, grow, shrink, add to, remove... pretty much any element in
| the interface - is a total disaster.
|
| Here's how "clever" it has become (and it is, technically, and in
| a fun sense - clever) - you can go into the edit screen of your
| Gutenberg website, and then you can pull up a tab to the "Block
| Pattern Directory" [1], hover over _any_ block in the list, copy
| it, then jump back into your website and paste it. Wow.
|
| Even if (and man, it isn't) that list of block patterns was
| beautifully, thoughtfully designed, what kind of awful, awful
| FrankenDesign is going to result from your client taking a random
| smattering of block patterns and pasting them into pages on their
| site?
|
| As I said, there are slow steps appearing around being able to
| lock blocks and block patterns - but WordPress should have been
| much, much more thoughtful about being open, up-front and
| strategic with their acknowledgement of this. I know many
| WordPress designers who have upped and left to look at other
| platforms because they _need client constraint_ , not "ultimate
| freedom".
|
| [1] https://wordpress.org/patterns/
| vgb2k18 wrote:
| > I don't know a web designer in the world who wants to give
| their editors complete control.
|
| I'm thinking this might be aimed squarely at scenarios where
| the editor, designer and admin are all the same person.
| dmje wrote:
| Some truth in that, for sure. I think they're clearly aiming
| at the Squarespace / Wix market which is probably the
| scenario you describe.
| dschiffner wrote:
| > I know many WordPress designers who have upped and left to
| look at other platforms because they need client constraint,
| not "ultimate freedom".
|
| This is a reason why some build custom themes and blocks
| dmje wrote:
| That's what we do. But (at least until now, it's slowly
| changing...) you could still take a beautifully designed
| theme and butcher it by doing some of the things I describe
| above.
| BusySkillFool wrote:
| For me at least, Craft CMS answers many of the problems you
| describe here. I can't see WP as anything but a dumpster fire
| in comparison.
| Vanderson wrote:
| I hesitate to even post here about my software, but "web
| designer first" is a key idea behind the CMS I've worked on for
| some time now.
|
| https://archetypewebsites.com/
|
| A key premise is that the designer decides where things go, and
| the content editors really just want forms to fill out to get
| content where the designer says it should go. But like any
| system, there is full WYSIWYG editable regions as well. (where
| the pink blinky text will show up...)
|
| I've not marketed Archetype widely (but I went through Startup
| School a few times with YC) because of the same reasons every
| other developer has, Archetype has warts.
| waynesonfire wrote:
| no mention of security... good luck. i stopped using wordpress
| after i got hacked. good reason that static sites are the rage.
| allenbina wrote:
| was it due to the core or a plugin?
| dschiffner wrote:
| his admin creds were probably
|
| admin / abcd123!
| waynesonfire wrote:
| Guessing passwords? You don't even have to try that hard.
| Have you seen the list of WordPress CVEs?
|
| Here is one just from January of this year,
|
| https://www.debian.org/security/2022/dsa-5039
|
| "Several vulnerabilities were discovered in Wordpress, a
| web blogging tool. They allowed remote attackers to perform
| SQL injection, run unchecked SQL queries, bypass hardening,
| or perform Cross-Site Scripting (XSS) attacks."
| dschiffner wrote:
| Sure have! Mentioning the admin creds were more so tongue
| in cheek because there are a lot of folks who use the
| default 'admin' username.
| waynesonfire wrote:
| very vanilla wordpress, it was a basic blog site. I think the
| only plugins I used were google analytics and some basic
| theme. I would keep it updated whenever I remember but maybe
| it wasn't often enough. Not exactly sure what the vector was
| and from whatever quality of analysis I did, the system
| didn't appear damaged beyond the changes made to the
| wordpress folder and luckily, the damage didn't seem to
| escape the www-data user that the http server ran as.
| dmje wrote:
| I'm gunna suggest compromised hosting. The issues I've seen
| (once plugins / core / php is up to date and obvious stuff
| sorted) has been almost entirely on shared hosts.
| waynesonfire wrote:
| Oh, interesting, indeed could have been php.
| dvh wrote:
| I only used wp once but the most surprising thing for me was that
| default installation used 7 SQL tables and their schema uses 3
| different conventions (table.ID/table.table_id and
| table.foo/table.table_foo). Maybe if DB themselves enforced some
| kind of limits like [a-z0-9_] this would never happen.
| billpg wrote:
| Since everyone else is posting their wish-list, here's mine.
|
| Use a database like SQLite so I can back-up a website into a ZIP
| without being concerned about keeping a separate MySQL database
| backup in sync. (I wrote about this three years ago:
| https://billpg.com/dear-wordpress-please-stop-using-mysql/ )
|
| Include TOTP one-time-password login in the core. (I hate having
| to deal with plug-ins.)
|
| Full backup in the core. When triggered by cron, save a complete
| backup to some folder. The setup, once the DB is configured,
| would have a option to restore from a backup, including
| populating the database, themes, wp-content, etc. Skip doing a
| backup if nothing has changed since the last one.
|
| Make multi-site easier. There's so many steps where I have to
| paste stuff into config files. Instead, have all of it ready for
| me to create a new site and if I never stray into that section
| and create a new site, no problem.
|
| Lose the URL settings and work it out from the request. If a
| request (after URL rewriting) comes in looking like
| example.com/thing/index.php?abc=xyz, then you know what the base
| URL is. If I install wordpress as localhost:8080 and suddenly
| requests start coming in as example.com:443, I really don't want
| a redirect back to localhost:8080.
| mszmszmsz wrote:
| The biggest mess IMO is the media library. Unsustainable,
| chaotic, impossible to keep in order if you happen to publish
| more than just a few images.
|
| It's not a library. It's a file dump. If you want to reuse an
| asset on a non-trivial site, it's easier to reupload the file
| rather than to find it in a flat list of thousands of thumbnails.
|
| Folders, please.
|
| And the four hopeless fields to provide an image with textual
| metadata (alt, caption etc). It's impossible to understand
| intuitively. So anti-human, lacking understanding of what users
| need and are capable of grasping.
|
| Reveal the complexity gradually, please.
|
| Same goes for the myriads of options (special love goes to the
| media link/image size selector with its thoughtless defaults you
| have to scroll down the media library modal to even reveal
| itself) just to insert an image into the text.
|
| Just to name a few problems.
| pathartl wrote:
| Folders are something that's been needed in WordPress for 10+
| years and hasn't gained any traction. It's to the point where
| it's beyond terrible and is a large reason I don't use WP
| anymore.
| skrowl wrote:
| Port it to a modern language so PHP can finally die, add support
| for PostgreSQL and MS SQL
| password4321 wrote:
| If all you're worried about is Core:
| https://apps.peachpie.io/Item?id=PeachPied.WordPress.AspNetC...
|
| > _All of WordPress as a .NET Standard assembly, without PHP._
|
| Mentions both performance and security benefits.
| sibit wrote:
| Some of us like PHP. I'd even go so far to say there are dozens
| of us... DOZENS!
| [deleted]
| cultofmetatron wrote:
| not a fan of php either but I wouldn't go that far. I'd love to
| see it reimplemented with modern conventions over Laravel. As
| much as i dislike php in general, I have to admit the laravel
| guys have done some amazing stuff.
| michaelbrave wrote:
| I've not played with it yet but I've heard good things about
| the newest version of PHP, could anyone confirm?
| dgb23 wrote:
| There is a bunch of relatively new stuff in place that really
| help: Enums, match, readonly (classes), attributes for
| metadata, union types in function signatures (very useful),
| improved destructuring. Also some issues with traits and
| interfaces have been resolved since a while.
|
| Those kind of changes are good for PHP, because they give you
| more tools to write compact, simple code that plays nicely
| with some of the legacy builtins/libraries and so on. It's
| remarkable how much it has been improving.
|
| However, it's still a clunky language, because almost every
| feature has its weird caveats and limits that a more modern,
| well designed language just doesn't have.
| mkranjec wrote:
| Care to point out what bothers you in the latest versions of
| PHP?
| pathartl wrote:
| I was a WP dev for 5-7 years before moving on to bigger and
| better things. It's easy to hate on the platform, for both
| justified and unjustified reasons.
|
| As a writer, it's good not great. As a low code dev, it's the
| best because you can do 99% of what you need to do with no
| licensing costs. As a regular beginner dev it's a great platform
| to learn on. As an experienced dev it's just terrible to get
| anything done and too many people never graduate from it for
| larger build outs. Here's just a random list of hot takes I have
| (keep in mind I have not worked on the platform since Gutenberg
| got introduced, though I imagine much of the backend code hasn't
| changed)
|
| - It's not an application framework, so stop treating it like
| one. It's good at blogging and decent for laying out web pages.
| If you need it to do other things, use Laravel or Grav or
| something
|
| - File management is completely unmaintainable for anything more
| than a personal site. I've worked on some larger 2000+ page sites
| and it's nothing short of a nightmare.
|
| - Post/page versioning is basic. There are plugins that do a much
| better job at accomplishing this, but it's time that it makes it
| into core. I'm talking about an actual publishing workflow with
| visual diffs and such.
|
| - The backend API is atrocious. Using methods like get_post or
| the_content are great examples of why people hate PHP.
| Inconsistent naming, unclear usage, no namespacing, etc etc makes
| it really hard to read code. I'm a .NET dev so I'm probably a bit
| biased but with the amount going on under the hood, a service
| layer is necessary.
|
| - Being able to rapidly prototype with themes and plugins is
| great and part of the dev experience, but unfortunately most
| projects never mature past the prototyping stage.
|
| - The community surrounding WP is great, and Wordcamps are a
| great experience. I've given a couple of (admittedly bad) talks
| at WC Milwaukee and was surprised at the range of people that
| attend them.
|
| - One of the talks I hosted was about how to use Xdebug with WP.
| Maybe things have changed, but I threw the talk together because
| _maybe_ 1% of devs I ever interacted with in the WP space asked
| if I had stepped through my code with a debugger. var_dump is a
| terrible crutch that PHP devs rely on way more than they should.
| I know things have improved with Docker compared to the days of
| Vagrant, but even at the time WP devs seemed to lag behind the
| rest of the industry in this regard.
|
| - Last thing, I have terrible nightmares still about the database
| schema. Too many plugins/themes rely on post_meta and (whether
| you agree with them or not) I think WP needs a proper ORM.
|
| Quick Edit: I will praise WP's for its plugin architecture with
| actions/filters. I've replicated this in our own .NET-based
| application and really love just being able to hook into places
| without dealing with nasty hierarchy structures.
| deltarholamda wrote:
| >Using methods like get_post or the_content are great examples
| of why people hate PHP
|
| The big problem with people getting into PHP via Wordpress is
| that Wordpress isn't, really, written in PHP. It's a WP-flavor
| subset of PHP, and a lot of it goes way, way back to when PHP
| could only be written with a hammer and chisel. It's been kept
| because a lot of things depend on it not changing. (I give the
| devs credit for not breaking a whole lot over the years.)
|
| But compared to anything that's a bit more modern, or even
| writing something from scratch, it's a bit of a slog.
| ericcholis wrote:
| I think your two points about Xdebug and PHP naming conventions
| aren't a fair lense on PHP as a whole. Seems that they're
| framed around how wordpress uses PHP (poorly) for some of the
| more basic abstractions.
|
| You aren't likely to find those issues in any modern PHP
| Framework out the box.
| noisymemories wrote:
| I've worked mainly on Wordpress themes and plugins for the last
| 7-8 years, and I've yet to see anything resembling common best
| practices regarding testing, CI/CD or even deployment coming from
| Automattic, especially regarding themes. That would be very nice
| to have.
|
| Most of the issues regarding the instability and lack of security
| of the platform come straight from the mantra "upload the file
| using ftp and the edit them straight on production server"
| advertised by Automattic. This is not a serious answer from a
| platform that allegedly controls roughly 30-40% of the websites
| around.
|
| What I'm afraid is that most of those choices (not moving to
| current development and deployment standards, doing the bare
| minimum in terms of upgrades to core functionalities of the
| platform, forcefully intertwining data, content and appearance of
| the website in the same SQL tables) are well intentional, and
| Automattic is "pulling an Internet Explorer 6", making sure that
| most users are locked-in on their platform by staying very away
| from any modern tech that could somehow make easier for
| developers to move to a different platform.
|
| It's very, very complicated to move anything written on Wordpress
| on a different platform _without losing some content along the
| way_ .
|
| When your website is actually just a huge ball of: pictures
| loosely related to your content by their dynamically generated
| file name, textual content placed inside layout-defining
| shortcodes all stored together inside a single SQL query and
| dinamically rewritten by some inline php written in a single
| functions.php file, forget about moving anything to Squarespace,
| Ghost, Hugo or whatever without having to actually rewrite by
| hand all of your posts.
|
| Oh, and also - I'd love to see some actual moderation in the
| Plugin marketplace. It's become incredibly common to find a
| plugin being acquired by another developer and being completely
| replaced between versions with a completely different plugin
| having just a very passing resemblance with the original set of
| features but also integrating a slew of unrelated paid
| "marketing" services and subscriptions. Just today I found out a
| "maintenance page" plugin has just morphed into a full visual
| builder who immediately started nagging about having a
| subscription for the inevitable "pro version".
| Neil44 wrote:
| I would like as much as possible of the php source moved out of
| the webroot. e.g. to ../
|
| All day long bots are firing queries and POSTs at any and all php
| files causing massive server load and security headaches.
|
| Just include them from the core and route to them via the core,
| taking care of sanitation in the process preferably.
___________________________________________________________________
(page generated 2022-05-23 23:01 UTC)