News for hackers. Stuff that matters.
Re:New attacks today against Wordpress (lots of sites hacked) by jerf on Friday May 07, 2010 @03:09PM (#1328424)
This is a Turing Tarpit; the only infinitely customizable blog platform is "PHP" (or your choice of other actual language). And as your customization possibility space increases, the customization inevitably starts to look like a language. Because it is.

That's why nobody's "solved" this problem in the last ten years; you can't have programming language flexibility without programming language complexity.

Re:New attacks today against Wordpress (lots of sites hacked) by staunch on Friday May 07, 2010 @04:01PM (#1328554)
Wordpress is like Apache or Sendmail. A 500-headed monster. It's simple enough to use and does everything. It's also sloppy and overgrown. Most people don't need all the extra stuff it does. Certainly not at the expense of security.

Apache => Nginx

Sendmail => Postfix

Wordpress => _______

That is room for an enterprising open source developer.

Re:New attacks today against Wordpress (lots of sites hacked) by jseliger on Friday May 07, 2010 @09:19PM (#1329312)
"It's also sloppy and overgrown. Most people don't need all the extra stuff it does. Certainly not at the expense of security."

The problem is that everyone needs a different 20% customized. This is what Joel Spolsky basically argues in Bloatware and the 80/20 Myth: http://joelonsoftware.com/articles/fog0000000020.html . He's talking about desktop software, but you can see the same essential thing in blogging software; I'm using Wordpress for Grant Writing Confidential at http://blog.seliger.com chiefly because it has everything I want and is easy to use.

The extra stuff I use includes themes and a couple of plugins, like one for generating an XML sitemap and another for cacheing. I know that blogging platform X probably has the particular set of features I need -- until I find something that it can't do.

Re:New attacks today against Wordpress (lots of sites hacked) by tptacek on Friday May 07, 2010 @04:09PM (#1328575)
I trust Apache.

I don't trust Sendmail but there's an emotional component to that; I would have laughed at you for using it in 1999, but I think 2 decades of analysis has to produce some result.

There's something more going on with Wordpress than simple complexity.

Re:New attacks today against Wordpress (lots of sites hacked) by pquerna on Friday May 07, 2010 @05:42PM (#1328869)
I'm sorry, what?

Apache doesn't have security issues at all like Wordpress, you are confusing FLEXIBILITY with INSECURE software.

Re:New attacks today against Wordpress (lots of sites hacked) by staunch on Friday May 07, 2010 @05:48PM (#1328885)
It's had its fair share of problems. Mostly in the past at this point though. It is heavily bloated and overgrown compared with something lean and mean like nginx.

Even if Wordpress didn't have security issues there'd be room for an nginx of blogging.

Re:New attacks today against Wordpress (lots of sites hacked) by elidourado on Friday May 07, 2010 @03:25PM (#1328471)
Understood, but I don't think people need infinite customizability. They need roughly Wordpress-level customizability, security, and relatively cheap hosting. Can no one really supply this?
Re:New attacks today against Wordpress (lots of sites hacked) by jerf on Friday May 07, 2010 @04:17PM (#1328611)
"Understood, but I don't think people need infinite customizability."

Need, no. Want? Yes. Literally "infinite"? No. But variable beyond belief? Yes.

Elsewhere in the thread, you complain about hardcoded URL structures! That's pretty far out there on the "I demand customizability!" front, if you consider the horrible things that will do to your platform's internals. Random users running code in their templates, another feature you request, implies that we need to sandbox and resource limit the templates, if we also want to maintain the ability to have "cheap" hosting (which breaks if our users start writing infinite loops into their templates). (Sorry, did I say "if"? I meant "when".) Take your needs, and two other customers with the same level of detailed desires, but different desires, take the union of them, and you've got a freaking complicated product spec'ed out. One that, incidentally, is going to be pretty complicated to actually customize. Oh, and the odds of it suffering the classic "endless interacting-feature bugs because nobody ever said no to a feature" is basically 100%.

Re:New attacks today against Wordpress (lots of sites hacked) by drusenko on Friday May 07, 2010 @04:33PM (#1328673)
Weebly is trying to strike a balance between the two. We don't let you upload PHP code to our servers, but we are extremely customizable.

I mentioned more of our features below: http://news.ycombinator.com/item?id=1328512