[HN Gopher] WordPress WASM
___________________________________________________________________
WordPress WASM
Author : skilled
Score : 146 points
Date : 2022-09-24 07:53 UTC (1 days ago)
(HTM) web link (github.com)
(TXT) w3m dump (github.com)
| 19h wrote:
| This is amazing for security, you'll just need to hook the file
| system calls and block FS writes at the wasm bridge level.
|
| It won't prevent obvious security bugs in the PHP code though,
| which arguably is the most important attack vector for spammers
| trying to post stuff on your WordPress installation
| mrweasel wrote:
| I am still impressed that this actually works. Very nice work.
| senko wrote:
| For a moment I read this as WordPerfect WASM and thought it a
| great way to preserve old but gold software in usable state.
| jokethrowaway wrote:
| This is great for the "I want a CMS but don't want to run a
| server" crowd.
|
| Oftentimes I run some CMS in some private network and then deploy
| a static build somewhere else
| ridruejo wrote:
| Nice! See also https://wordpress.wasmlabs.dev/
| mingodad wrote:
| On linux chromium 7.5GB of memory and 100% of one cpu.
| Thaxll wrote:
| Got SIGILL.
| gzurl wrote:
| The "why" and the "how" here:
| https://wasmlabs.dev/articles/wordpress-in-the-browser/
| franky47 wrote:
| Some ideas for persisting the SQLite database in IndexedDB:
|
| https://github.com/jlongster/absurd-sql
| samwillis wrote:
| The tldr, is that AbsurdSQL uses IndexedDB to make WASM SQLite
| ACID compliant. The alternative is to pause writes and dump the
| whole db as a string to indexeddb, very slow, and not durable.
|
| AbsurdSQL is an incredible hack, but is a hack at best.
|
| There is a new api, File System Access and the "origin private
| file system"[0], coming to browsers that has been design
| specifically with WASM SQLite in mind. I believe the Chrome
| team have been collaborating with the SQLite team to ensure it
| will work well. Once this drops it's going to bring a lot of
| innovation.
|
| 0: https://web.dev/file-system-access/#accessing-files-
| optimize...
| mizzao wrote:
| What does it even mean to run PHP in the browser... Is this
| supposed to be some sort of replacement for server-side PHP?
| franky47 wrote:
| Skip React/Vue/Svelte/next week's JS framework and client-side
| render your app directly in PHP, genius. /s
| have_faith wrote:
| This just replaces the frontend framework written in JS with
| a frontend framework written in PHP compiled via wasm. It
| doesn't eliminate the need for something to manage views and
| state on the front end, as that's where you're executing all
| of your code now?
| franky47 wrote:
| Yes indeed. The sarcasm may have been lost in my reply,
| running PHP in the browser is a great feat of engineering,
| but not a practical one.
| have_faith wrote:
| It's rare that I don't discern sarcasm, my bad!
| zelphirkalt wrote:
| Just wait what things on top of that WP-PHP people will
| come up with. This thing will blind enough people with
| the looks of "modern and shiny", that they might create
| something similarly vulnerable and mistake prone to
| original WP plugins. I mean, someone must be writing
| these plugins ... _shudders_
| cylinder714 wrote:
| It's an awesome hack, though. "Approved!"
| laundermaf wrote:
| First thing that came to mind is that I could load this up on a
| static host, saving content in a local SQLite (or even in
| SQLite in S3), make changes and then export the results to S3
| as static HTML files. All without ever running any PHP/SQL
| host. One could technically upload this to GitHub Pages.
|
| Endless possibilities!
| paulryanrogers wrote:
| What kind of download size though?
| 0xChain wrote:
| I was thinking the exact same, but with Cloudflare Pages in
| order to use the WAF to see if it may help thwart any PHP-
| related vulns
| samwillis wrote:
| I think this is a really compelling pattern for converting
| traditional server rendered apps to be offline enabled (or
| choosing to build new ones this way). I have seen similar
| examples using Python.
|
| Initially these are more of a "backed data" type app, with no
| offline public writes. [0]
|
| The next step is to have local/offline SQLite to server syncing,
| enabling writes while offline that are synced back to the server
| on reconnection. This would inherently be eventually consistent
| and brings its own issues with relational data integrity, however
| the SQLite Session Extension could be I good way to build such a
| system [1]
|
| The alternative is a new data store based on CRDTs (conflict free
| merging of offline edits), there are some exciting developments
| happening in that area. I have seen it suggested that the SQLite
| session extension is almost a crdt if you squint at it.
|
| 0: https://simonwillison.net/2021/Jul/28/baked-data/
|
| 1: https://www.sqlite.org/sessionintro.html
| euroderf wrote:
| I really like this idea. Distributed, loosely-coupled content
| creation & management that syncs up with "everyone else" on a
| time scale of minutes or hours.
| jcheng wrote:
| Sounds a lot like Lotus Notes!
| metadat wrote:
| This is certainly a cool idea, but I don't understand a few
| things about how reality would work with an async
| reconciliation process on the database layer:
|
| 1.) How would the auto-incremented ID fields be merged in such
| a system?
|
| 2.) How are unique constraint violations handled?
| djbusby wrote:
| Don't use auto-increment. Use a ULID or some other algorithm
| driven PK
| JustLurking2022 wrote:
| This seems like a "can't see the forest through the trees"
| project. If you don't want to run a server, there's no need for
| WordPress in the first place - just use a static site generator,
| or a SPA that uses static content as the backend. Have done a lot
| of WordPress development, and I love it, but it doesn't seem like
| it fits this use case better than other options.
| dgudkov wrote:
| Static site generators require a headless CMS and all the
| headless CMS I tried are much harder to use and way less
| flexible then WordPress.
| dmsnell wrote:
| As noted above seven hours before your comment ;) the purpose
| for this project is for embedding interactive WordPress
| installations in documentation and to provide a playground in
| the browser for testing code or learning how to write plugins,
| etc...
|
| The forest is shrinking the time and distance between code we
| care about and visualizing the results. WASM and an in-browser
| environment is the tree. Even for experienced devs it's not
| always readily available to have a web server, PHP, a database,
| and WordPress running where you can quickly make a change and
| test it out or demonstrate it to others.
|
| This makes it possible to ship a WordPress site as a demo site
| (with pre-filled content and structure) where anyone can show
| off their WordPress plugin or theme without needing to have a
| backend or worrying about securing it.
| abdullah2993 wrote:
| I'm too dumb to understand how would this work. Can anyone
| explain please. Wordpress server side is where all the magic
| happens data is stored and retrieved from the database. How would
| it look like in wasm? Will the wasm communicate with database? If
| so wouldn't it expose db credentials? What would the backend look
| like? I have so many questions
| axelthegerman wrote:
| This is more to play around and show off themes/plugins or test
| different PHP versions.
|
| The database also runs on the client in wasm (sqlite).
|
| But it's utterly useless if you want to put a blog online as it
| only runs locally in the browser and nobody else will see the
| posts.
| simonw wrote:
| There is no backend: the database itself is SQLite in WASM
| living in the user's own browser.
|
| This is more of a tech demo and test environment than something
| that would work as an alternative to server-side WordPress -
| since if you are using a CMS you generally want the results to
| be visible to people other than you!
|
| It's very, very cool though.
| [deleted]
| lizardactivist wrote:
| WASM has in a way picked up and succeeded where Java applets left
| off.
| ildon wrote:
| A very very interesting addition would be to add the ability to
| fetch data from a remote WP website's APIs.
|
| In this way the server could serve a cached page on first
| request, then the wasm file would be downloaded. From then the
| whole rendering could be client side, while still fetching data
| from the remote DB. This could significantly speed up things for
| users.
| hardwaresofton wrote:
| WASM may offer the most secure-by-default installations of
| Wordpress to ever exist.
|
| This is seriously impressive -- I think we're getting a glimpse
| of a world where people can really run server side apps on their
| computers easily.
|
| Add an app store and the web will have finished becoming the
| platform that everyone has been suspecting it is.
| Existenceblinks wrote:
| So from user perspective, they still have to run it like they
| would run local web server but more secure? It's improvement
| security wise, though it's still hustle for app distribution
| right?
| hardwaresofton wrote:
| Yup, that's why I put in that last part:
|
| > Add an app store and the web will have finished becoming
| the platform that everyone has been suspecting it is.
|
| Basically what we need now is a user-side "app store" that
| downloads apps packaged as WASM and runs them!
|
| Honestly this setup could probably work today, use something
| like Tauri[0] to build a simple app-store like experience.
| When someone installs an app, this thing downloads the WASM,
| and runs it with the necessary linked modules (local file
| access, network).
|
| Then, you can spin up a new window that _is_ the new
| application, and keep it running /do whatever else users
| would expect. I mean you could even launch the apps
| standalone/separate processes as well so that people can
| close the original one (or put it to tray, whatever).
|
| This could easily be like snap/flatpak but even better in
| some ways. Browser technology is almost assured to always be
| moving forward and getting more powerful/impressive because
| of the large interests involved.
| iampims wrote:
| https://wapm.io/
| hardwaresofton wrote:
| I'm thinking something a little more consumer focused
| than wapm. Maybe the tool I'm describing could _use_
| wapm.
|
| Consumers don't use CLIs to install things.
| croes wrote:
| And thanks to Chrome one severe bug will effect all around the
| globe.
|
| Monocultures are susceptible to pests and diseases
| maven29 wrote:
| Can't be worse than unpatched wordpress plugins.
| croes wrote:
| I bet there are more Chrome installations then Wordpress
| nulbyte wrote:
| I bet they are more up to date than most WordPress
| installations.
| rwalle wrote:
| People are already using Chrome or Chromium-based browser all
| over the world. VSCode, Spotify, Teams, Slack, Figma and many
| others use Electron or CEF which are based on Chromium. It is
| not necessarily going to be a bigger risk what what we have
| now.
|
| And I am sure a severe bug in Qt will also affect almost
| everyone, no different from the Chromium situation. And I
| trust the Chromium/Electron community more than the random
| "another cross-platform UI framework" that pops up on hacker
| news that probably will not be maintained in a year. (I am
| some people don't like this sentence but they have to face
| the fact.)
| mouzogu wrote:
| fixing a problem, by creating a new problem(s). that's what
| we do here.
| giovannibonetti wrote:
| Which is progress, as long as the new problem is smaller
| than the old one.
| brundolf wrote:
| "Your scientists", etc
| asadkn wrote:
| For those wondering about the "why", this post details the
| motivation: https://make.wordpress.org/core/2022/09/23/client-
| side-webas...
|
| Basically for learning/interactive tutorials, trying out
| something quickly in different PHP versions (which is cumbersome
| right now), secure and easy demos for themes and plugins.
| berry_sortoro wrote:
| metadat wrote:
| Pretty amazing to get all of PHP working in WASM. Next maybe we
| can get full MySQL, too (like the Crunchy Postgres port [0]
| [1]).
|
| Would also love to see it for Java, Go, Perl, Sed, and Awk :)
|
| What if Intelli-J could run in the browser? Yes please.
|
| I bet some of these even already exist. What a time to be
| alive, 15 years ago I'd never have guessed Javascript could
| evolve into this!
|
| [0] https://www.crunchydata.com/blog/crazy-idea-to-postgres-
| in-t...
|
| [1] https://news.ycombinator.com/item?id=32498435 (August 22,
| 2022; 814 points, 172 comments)
|
| ^ n.b. Submitted by @samwillis
| redanddead wrote:
| You mean to say that PHP and different versions of it are
| able to be simulated via JS on Web apps? Kind of crazy
| actually
| cdmckay wrote:
| I don't think it's via JS, it's via WebAssembly.
| WebAssembly doesn't use JS, it's separate, although you can
| interface with WASM via JS.
| jacooper wrote:
| This could give you a free WordPress website using Cloudflare
| Pages + workers.
|
| If it worked fully of course, which it currently doesn't.
| axelthegerman wrote:
| Even then, how would the database state be shared between
| workers? It's a local sqlite so there is just one in-process
| instance of it.
| jacooper wrote:
| Free managed databases exist.
|
| Also cloudflare has D2, which is based on SQLITE, but has yet
| to launch.
|
| I think it should launch by the end of this year.
| mmmmwhat wrote:
| It's probably the most secure way to deploy Wordpress soon.
| john-doe wrote:
| And the most convoluted.
___________________________________________________________________
(page generated 2022-09-25 23:02 UTC)