EC2 Reserved Instance Marketplace - <AUTHOR> http://aws.typepad.com/aws/2012/09/amazon-ec2-reserved-instance-marketplace.html <comment> e-dard I based my PhD thesis on the idea of trading computational cloud (or any, really) resources. I went a little further though, and looked at how to design algorithms for the actual marketplaces, which allowed them to optimise how they competed with other marketplaces. A bit like London Stock Exchange competing with the New York Stock Exchange.

While my research was a little blue sky (what isn't) I do think that electronic trading of computation resources is the future, and I think Amazon are ahead of the game in this respect.

<comment><USER2> Would you be willing to share some links to your research? I find this area fascinating, and also believe this is going to be a big market in future.

<comment><USER3> Apparently [http://www.eddrobinson.net/papers/robinson_2011_phd_disserta...](http://www.eddrobinson.net/papers/robinson_2011_phd_dissertation.pdf)

</comment></comment></comment><comment><USER4> I wish they would allow sellers to receive the funds as AWS-credits as well. Creating a US bank account just for this will be too much of a hassle for many non-US companies.

<comment><USER5> Not to mention that if your bank has a fee for receiving wire payments, selling micro instances is pretty much pointless.

</comment></comment><comment><USER6> It's important to note this only works if you're a business with an American bank account. Everyone else can't sell EC2 instances there.

<comment><USER7> As I just discovered, would have been nice to unload a couple of instances. Don't hold your breath waiting for this to change, the level of interest for non-US DevPay support over the years has been huge, but it's just sat on some todo list somewhere.

<comment><USER8> I agree that that stinks, but international payments are _really hard_ to get right.

</comment></comment></comment><comment><USER9> This is so 'Amazon'. (There's a little hint of Enron, too... but the shard of Enron that made economic sense, markets for expiring capacity.)

<comment><USER10> The frightening part about Enron is how much of it made sense, in a theory kinda way.

</comment></comment><comment><USER11> It's late so maybe I'm missing something but is there a way to make money out of this for sellers and turn a profit? Not just recoup some costs of a reserved instance(s) they no longer need?

<comment><USER12> Probably not -- the 12% fee would severely limit the margin if you tried to trade them.

</comment></comment><comment><USER13> We made the mistake of buying a ton of reserved instances up front which we have been stuck with because we moved on to a different instance with the high IO. We have been complaining to them about the need for a RI secondary market at all the AWS events we could attend

<comment><USER14> Hi sum1randum,

Have you tried engaging the AWS customer service team on this? AWS has a public face that looks 100% robotic and automated, but I assure you there are AMAZING support & engineering teams behind the scenes who have a strong vested interest to make sure customers are successful using AWS.

IMHO, it might be worth a shot to send them a ticket that basically says, we bought RI's for the instance type we needed at the time, but now you guys released the new High IO type, and for us to be successful we really need to upgrade these RI's. So, the ideal outcome is you go buy your new reservations and then they give a prorated credit for the rest of your RI term on the old ones. I would imagine they might still steer you to the RI marketplace now but it's worth a shot if you can be persuasive enough.

</comment></comment><comment><USER15> I'm starting to think Amazon is cynically exploiting the edge cases of its pricing to make a large portion of its money.

This looked great at the start, but the details really make this shitty. You need to sign up as a seller and all the hassle it entails (I'd be happy with AWS credits, I'm just going to spend them on another instance), they charge 12% and then they _also_ round down to the nearest month.

In fact, a large portion of Amazon's business model seems to be selling the same thing multiple times. We still waste a lot of money because EC2 insists on charging for a full hour no matter what (eg even if the instance didn't even start!), and it seems a pretty scummy way of making a lot of extra margins. And now they're doing the same thing here.

<comment><USER16> Could Amazon be theoretically more efficient - sure. In fact, I wouldn't be surprised, if over time, the time requirement for owning (30 days) and the round off period (To the month, rounded down) and the fee (12%) is rounded down - but, this is a new service that did not exist before - so from that perspective, it's great. All the things that you used to be able to do (lend someone your EC2 instance) still exists.

</comment></comment><comment><USER17> It just seems like a long winded way to avoid just charging at shorter intervals for reserved instances.

I guess the margins on these things are really thin but I don't see why, they can't charge monthly or let you upgrade a reserved instance (this I find particularly silly)

<comment><USER18> I spoke to someone in Amazon's NYC event earlier this year, and they said the reservations are used to help guide their hardware purchases. Since the hardware will be around for quite a while, they require longer terms (for now, anyway)

</comment></comment><comment><USER4> Really cool! New startup idea: create a trading algorithm that acts as a market maker of reserved instances. You should probably be able to price the reserved instances pretty much like bonds, if you compare it to the on-demand instances. You lock your money for a while but you get some yield in return.

<comment><USER19> It's already being done by a startup I know, I think they might still be in stealth though.

<comment><USER20> Until this announcement, trading (buying and selling) of any EC2 entity was theoretically impossible.

Many companies claim to be working on things like marketplaces etc, but unless you can sell (buying is always trivial) and further unless you can sell to not just AWS but to a pool of other users, it ain't no marketplace.

</comment></comment></comment><comment><USER21> Looking at the pricing on the amazon site here: <http://aws.amazon.com/ec2/pricing/#lightUtilizationRILinux>

does it mean Small (Default) linux server only cost $69 for a whole year? likewise $138 for a medium instance for whole year?

<comment><USER22> I'm wondering about this too. Or is is 69+ regular hourly charges?

<comment><USER23> $69 is the upfront fee for a 1-year "light utilization", you pay hourly on top of that at $0.039/hour. Note this is half of the $0.080/hour normal price (non-reserved). If you wanted a dedicated (100% utilization) reserved small Linux instance, it would be $195 setup and $11.71/month (total $335/year) vs. non-reserved at $58.56/month (total $702.72/year). Note that the upfront fee is paid each time you renew a term, it's not really a "one-time" fee like with dedicated servers.

Edit: source: <http://calculator.s3.amazonaws.com/calc5.html>

</comment></comment></comment><comment><USER24> Great new business plans: Instance squatting. Instance futures trading. Instance futures trading analysts ...

</comment><comment><USER25> Absolutely fantastic idea.

I assume people have been doing this on a somewhat grey market up until now, so it's great that is now an approved system.

</comment><comment><USER26> This is great

</comment><comment><USER27> Awesome!</comment>


Why the PDF Is Secretly the World's Most Important File Format - <AUTHOR> https://motherboard.vice.com/en_us/article/pam43n/why-the-pdf-is-secretly-the-worlds-most-important-file-format <comment><USER2> "Perhaps the most important role of the PDF in the modern day is archival"

One of the reasons I am super picky about getting ebooks now in PDF is because it's pretty much the one format I feel confident I'll be able to read in a decade or two. Somewhere I have some old Microsoft Reader LIT ebooks from back in the day.</comment>


Meerkat is dying - <AUTHOR> http://bgr.com/2015/03/30/meerkat-vs-periscope-analysis-journalism <comment><USER2> I had a debate with one of TechCrunch's head editors about the journalistic coverage of Meerkat: [https://twitter.com/ryanlawler/status/582547758248136704](https://twitter.com/ryanlawler/status/582547758248136704)

Coincidentally TechCrunch published a more analytical approach a few hours later: [http://techcrunch.com/2015/03/30/schrodingers- meerkat/](http://techcrunch.com/2015/03/30/schrodingers-meerkat/)

What really annoys me is that no one took the devil's advocate approach to analyzing Meerkat. "It's a new paradigm in live-streaming," perhaps, but no one has considered that such a paradigm only fits in the narcissistic Silicon Valley culture.

Periscope atleast managed to appeal to non-techies, but even then, it appears to have peaked. In the first week of release.

There's a nonzero probability that everyone was wrong about personal livestreaming in the first place.

<comment><USER3> And, people forget that Justin.tv worked this space pretty hard before transitioning to video game broadcasting.

<comment><USER4> As a non-iPhone user that has seen neither meerkat or periscope, what's the new thing here? Justin.tv/twitch and ustream have been doing live streaming for a long time now.

<comment><USER5> I think there is an interesting conversation to be had about why, in a world with LiveStream, UStream, & YouTube Live Events, people see Meerkat/Periscope as revolutionary. Also apply that question to Spotify vs Rhapsody.

<comment><USER6> Timing. I was a Rhapsody user in 2003. I even had an AV receiver that supported Rhapsody back in 2005 or so, assuming it was connected to my computer (for stuff like track listing and whatnot on the device). But it didn't take off because timing wasn't right. People were just at a place to start buying digital tunes -- streaming music was awkward.

But beyond that, it took the iPhone (and devices like it -- but really, let's admit it was the iPhone. I loved my Treo, BlackBerry and Windows Mobile devices too, but it was the damn iPhone) to usher in a device where people could stream on the go. Before that, using Rhapsody (or even Spotify, early on) was kind of a PITA.

Spotify made it easier by letting you sync offline stuff with your iPod or iPhone, but it took widespread 3G and beyond, good data plans and saturation of smartphones for people to be like, "yeah, I can replace my iTunes with streaming music."

The same is, to me, true of streaming video. You could do live streaming close to a decade ago. On your cellphone. Shit, I remember envying people using Qik on the Nokia phones in 2008. But it took a long time, there was massive latency and the quality sucked.

Meerkat and Periscope are fast, easy to use, have restreaming features and are easy to drop-in, drop-out of.

Whether they last or not, I don't know. But just as it took e-sports to make the Justin.tv model work (and I remember when they launched Twitch. All of us, myself included, thought it wouldn't work. But then the devices for livestreaming game videos became so inexpensive and the experience so compelling, Sony and Microsoft built it into consoles. It took the barrier getting super easy and the content being compelling for the user case to be seen).

So again, timing.

<comment><USER7> Speaking of timing, we can even say the same thing about Twitch.

Video game live broadcasting existed as early as 2005 from Korea, where we would get a 240p stream from OGN (a Korean cable channel), which would sometimes get replicated over users' personal servers. Only the most hardcore Starcraft Broodwar fans stayed up until 3am to watch these games live though.

</comment></comment></comment></comment></comment></comment><comment><USER8> Something I wrote recently on this

[https://news.ycombinator.com/item?id=9207290](https://news.ycombinator.com/item?id=9207290)

"It used to be common to see "paid advertisement" inserts in major magazines. Sometimes going on for a dozen pages. It was clear they were PR pieces: typeset differently and with a different editorial style than the rest of the magazine. Sometime in the mid-2000s they simply seemed to go away and now the magazine just uses the PR pieces as content filler, completely indistinguishable from the rest of the periodical."

<comment><USER9> Yeah they call it "native advertising" now.

<comment><USER10> Sort of. While it's not universal, many "native advertising" platforms that integrate with content sites will specify that the content is promoted, sponsored, or something similar. As an example, see nativo.net (disclaimer: I worked there briefly in 2013, and all ads/content served had those qualifiers).

</comment></comment></comment><comment><USER11> "STREAM OVER." That is all I've ever seen from Meerkat. I think they did a great job in terms of getting the users behind their product, but the user experience is terrible. I've tried to click on about 15 Meerkat streams in the last 2 weeks and I haven't seen one. At least Periscope has a video archive that lets you watch something even after it's over.

Being in SV and reading all the news, I will say that I thought it was bigger than it actually was. On the other hand, I've seen Periscope videos from all over the world. Twitter seems to have created something great, solving the usability issues which were in Meerkat's product.

<comment><USER12> haha... indeed. "STREAM OVER" is what I see from this app 9/10 times in Meerkat. I got so bugged of the notifications that I logged off from the app 2 days back; before reading this article.

</comment></comment><comment><USER13> 1:n mobile live video is probably simply not a mass market thing. Around 2008 there was whole set of those mobile broadcasting services already: _flixwagon[1], qik[2], kyte[3], ustream[4], bambuser_ just to name some. Also a shout out to the original _vine_ which was 2 times as long _12seconds.tv_.

Those headlines linking to mostly dead sites and blogs sound quite familiar:

[1] [https://hn.algolia.com/?query=flixwagon&dateRange=all](https://hn.algolia.com/?query=flixwagon&dateRange=all)

[2] [https://hn.algolia.com/?query=qik&dateRange=custom&sort=byPo...](https://hn.algolia.com/?query=qik&dateRange=custom&sort=byPopularity&prefix&page=0&type=story&dateStart=1167609600&dateEnd=1262390400)

[3] [https://hn.algolia.com/?query=kyte&dateRange=custom&sort=byP...](https://hn.algolia.com/?query=kyte&dateRange=custom&sort=byPopularity&prefix&page=0&type=story&dateStart=1167609600&dateEnd=1262390400)

[4] [http://techcrunch.com/2009/03/05/ustream-launches-mobile- vid...](http://techcrunch.com/2009/03/05/ustream-launches-mobile-video- broadcasting-apps/)

</comment><comment><USER14> I think accounts of Meerkat's life and death are both being greatly exaggerated here. It's a contender, it now has a war chest, lets see what the guys can do with it.

And I think it's unfair to suggest they just "cashed in" for the quick buck.

<comment><USER15> I'm gonna go ahead and guess twitter's "war chest" is a little bigger than Meerkat's.

<comment><USER16> I'm gonna go ahead and guess that those things aren't really comparable.

<comment><USER17> Aren't they, when Twitter now owns Meerkat's competitor Periscope?

<comment><USER16> How different teams use money is not comparable. Meerkat is a small team, 14mm is a huge amount for them. Twitter is a huge company. It is unclear how these things would be used to benchmark one or the other.

</comment></comment></comment></comment></comment><comment><USER18> I still don't understand how you can raise $14M for a social media app and not have an Android version. "Yes, Mr. VC, it's true that we aren't doing well on the iOS charts, and we purposely excluded 85% of the market from using it despite the proliferation of easy-to-use cross-platform dev tools. But we do have a lot of press and a cool logo....it's a Meerkat! Did Tom give you our wire instructions?".

<comment><USER19> Yeah Android user here. Always frustrating when it's iOS only when as you said, Android has 85% global market share. The usual rebuttal seems to be "iOS users are more sophisticated or wealthy, we'll release Android later".

<comment><USER18> _> The usual rebuttal seems to be "iOS users are more sophisticated or wealthy_

That actually can be a valid argument IF your revenue model is heavily skewed toward IAP or you are charging up front for the app. But for a free social media app whose sole purpose in life is to get as many active users as humanly possible, it's absurd not to have an Android version when it represents most of the market.

<comment><USER20> Social apps inherently need to be trendy and seem "hip" to catch on with the right crowd. Having limited resources, they chose to go with one platform at launch. I would bet that amongst their target taste-maker crowd (celebrities, YouTube personalities, etc.), iOS has higher market share when compared to the larger general smartphone market.

</comment></comment></comment></comment><comment><USER21> FTA: "Almost precisely one year later, the same crew of tech "journalists" who proclaimed Secret would be massively influential, declared Meerkat the next huge social media app."

Can these "journalists" be identified? I didn't follow the Meerkat craze when it happened, but if it's the same crew of people, that's pretty damning.

</comment><comment><USER22> Interesting seeing the activity on Twitter and how quickly Periscope caught up once it was released: [https://twitter.com/dacort/status/582570506043310080](https://twitter.com/dacort/status/582570506043310080)

<comment><USER23> Extrapolating by eye, with a biased look, one could describe that as "Total market is growing, Periscope briefly grabbed it, but will be gone within a week"

An eye biased the other way could say that Periscope managed to reach everybody interested in this kind of product, and made them all realize that they aren't really interested at the same time, whereas Meerkat was discovering that at a slower pace, concluding that both products are doomed.

Retention numbers might be able to prove either of these explanations wrong.

Either way, venture capital is aiming for greater gains by taking larger risks. Because of that, even if Meerkat fails, the decision to invest in it still might have been the right one.

</comment></comment><comment><USER24> Meerkat's Hourly Rankings in the last two weeks

[https://sensortower.com/ios/us/life-on-air- inc/app/meerkat-t...](https://sensortower.com/ios/us/life-on-air- inc/app/meerkat-tweet-live-video/954105918#category- rankings?category=0&chart_type=topfreeapplications&hourly=true&start_date=2015-03-01&end_date=2015-03-30)

Versus Periscope's

[https://sensortower.com/ios/us/twitter- inc/app/periscope/972...](https://sensortower.com/ios/us/twitter- inc/app/periscope/972909677#category- rankings?category=0&chart_type=topfreeapplications&hourly=true&start_date=2015-03-24&end_date=2015-03-30)

</comment><comment><USER25> Doesn't the relative flipflop between Meerkat and Periscope have more to do with Twitter cutting Meerkat out of the social graph and Periscope having insider trading knowledge of the Twitter platform? How is this not like Microsoft pushing Internet Explorer?

</comment><comment><USER26> > The ugly truth that U.S. tech media

The ugly truth that U.S. tech media doesn't make any effort to investigate startup launches, they copy and paste articles that are handed to them :)

<comment><USER27> If readers were willing to pay for good journalism, they would receive some.

<comment><USER28> >If readers were willing to pay for good journalism, they would receive some.

This is it. Tech journalism is a cesspit of clickbait, hysteria and social justice nonsense because nobody is paying for it and this appeal to the lowest-common-denominator of clicks brings in money.

But then nobody is going to be willing to pay these entities for the content they're using to current bring in revenue.

</comment></comment></comment><comment><USER29> What we don't know from the article is Meerkat's engagement stats. If reuse and retention is high, investors may feel they just need to work on an efficient new user funnel to create a healthy growth trajectory. Maybe meerkat was featured by apple and then inevitably lost downloads post-feature. The same thing will happen to periscope which is being featured now. I suspect the platform with the best network effects will reach success faster, and I'd put by money on periscope there because Twitter. But it's premature to say meerkat is dying at this point in time.

</comment><comment><USER30> Interesting because I only heard of meerkat starting about two weeks ago during SXSW. It seemed like it was everywhere, but not because of headlines, because I kept seeing [LIVE NOW] on all these tweets. Too bad all those links just went nowhere because I was too late.

Funny cause this week I saw Jim Gaffigan post a sernies of meerkat videos onto youtube. I thought, well doesn't that defeat the purpose of a snapchat style broadcast - if someone wants to save it? Clearly I wasn't the only one.

</comment><comment><USER31> The key differentiator is the subtle switch to 1-with-many (along with advancements in and proliferation of mobile technology + bandwidth). This leads to shared experiences, which are quite different from the 1:n (1-to-n) model.

The eye opening moment for me was jumping into a periscope stream, commenting on various things relating to the stream, and having the presenter comment and take action based on what I'd said ("high-five the Philz barista for an amazing coffee"). Really more of a conversation.

The feeling of controlling the experience partially, in my opinion, completely changes the dynamic. Also - I can enter streams of places I've never been to and join someone on their adventure. With enough syndication, eventually we can all join in on these adventures with people that have similar interests (subreddit style).

Meerkat opened the floodgates. Periscope is the better execution of the idea.

</comment><comment><USER32> First time I heard of meerkat is when I heard that it was getting beaten by periscope.

</comment><comment><USER33> Holy hell, the app is two weeks old, there are tens of thousands of tweets about it every day, and it has $20 million dollars in the bank. Is this really what we're calling "dying" now? Because if so, pretty much every other consumer product since the beginning of time is fucked.

I haven't turned off Meerkap notifications on my phone, mostly out of sheer curiosity, and I am seeing literally hundreds of meerkat streams _per day_ of my followers. Apparently you don't have to be at the top of the chart to get hundreds of thousands of downloads (not to mention the app being featured by the app store).

This is such shitty journalism I can't even stand it. Let's have a substantive discussion about a product, but calling it "dead" is bullshit clickbait and even the author must know it.

<comment><USER2> You're not exactly impartial when it comes to Meerkat: [https://news.ycombinator.com/item?id=9269693](https://news.ycombinator.com/item?id=9269693)

The reason companies take venture capital is to facilitate growth. If the company is trending downward _three days after funding_ , especially in the immediate response to a direct competitor, that's a very bad sign, both for the company, and the venture capital firm.

<comment><USER33> I never claimed to be impartial. I use both apps and have been following them closely. I think Periscope will win some portion of the market, and Meerkat another. Saying that it's screwed right now, while there's still so much excited activity, is still bunk.

Almost every app's growth slows after a viral launch. In a few days we'll see Periscope's growth slowing as well. That doesn't mean they all die.

<comment><USER2> "Slow growth" is not the same as _negative growth._

<comment><USER33> There are more people downloading the app than deleting it. That is still positive growth.

Falling down in the app-store rankings two days after launch is a poor metric to use to determine the future of a company with years of burn still in the bank.

</comment></comment></comment></comment></comment><comment><USER34> I suspect Periscope's meteoric rise has to do more with being prominently featured in the "Best New Apps" section since day one. It was well after Meerkat reached peak-blogger that it appeared in that section, and even so, I don't believe it was in the #1 slot.

</comment><comment><USER35> Both Meerkat and Periscope were hyped at launch. People jumped on the hype and both apps were then left to themselves to prove they can sustain the hype.

Periscope might actually make it because it does a lot of little things right to attract non-techies. I've shared vodka with a bunch of Russians and just this morning laughed with people in France.

Periscope is not without issues though, and it's hard to use when it takes forever to start a stream and constantly buffers in the middle.

It might be too early to call Meerkat dead, but I do think it lacks enough to carry it past the hype. Only time will tell though :)

</comment><comment><USER36> Periscope is good but there are too many features lacking at this point. To mention a few:

1) Privacy: What if I wanna share a stream with just my family?

2) Search: I can't search e.g. for 'racing'

3) Management/rules: Was watching a female from Dubai answering questions about life in Dubai. After about 45 seconds, an idiot came in acting as sex offender more than anything else, driving the level of the conversation down in no time. The 'author' should be able to ban accounts.

Other than that periscope is good and works fine.

<comment><USER37> Re: 1) I believe the lock button allows you to stream to only specified users

<comment><USER36> Hm, might be. Truth to be told, I tried streaming for a very brief period and didn't notice any lock buttons.

</comment></comment></comment><comment><USER38> >There is also no doubt that if Jared Leto and his merry band had realized a week ago that Meerkat would drop out of the top 500 iPhone app chart by Sunday night, they would have slammed their check books shut in a hurry. They were obviously blinded by the tech journalism flimflammery

If the above statement was true, that would mean that this ecosystem doesn't make much sense. Am I naive thinking that founding decisions aren't so emotional, "impulse purchases"?

<comment><USER5> That depends. Do you believe what is shown on Shark Tank?

</comment></comment><comment><USER39> I wonder if Meerkat could have held onto its market share better if it had an Android version also?

<comment><USER40> Periscope doesn't have an Android app, so I doubt it.

<comment><USER41> That actually makes the argument stronger imo.

</comment></comment></comment><comment><USER42> I've seen a couple of posts regarding this, but none even remotely explain:

WTF is Meerkat (aside from an Ubuntu release, and an animal)?

</comment><comment><USER43> I never heard of Meerkat before this article. So the press blitz wasn't that great.

</comment><comment><USER44> The article title probably promised too much but if Meerkat's downfall did take any "tech journalism" with it, it would be good riddance. I wonder what the consequences of investors not doing their due diligence will be...

</comment><comment><USER45> Thought of this. ([http://tapastic.com/series/101-uses-for-a-dead- meerkat](http://tapastic.com/series/101-uses-for-a-dead-meerkat))

</comment><comment><USER46> Every time I followed a link on twitter to Meerkat, I got the stream is over message. I would be that I'm not the only one and wonder if this might be the difference in the end.

</comment><comment><USER47> Bigger and faster is the buzz, quicker is the fall.

Meerkat has only one month of service on the store, and already 14M$ in pocket.

</comment><comment><USER48> Not all is lost for Meerkat if they do FB connect. The Twitter first strategy only works for SV.

As a caveat, Meerkat did make a bone headed move by abusing the twitter api with auto follows. Twitter probably stepped in to far also by cutting their social graph.

<comment><USER2> Does a FB Connect strategy actually work nowadays? Most startups I've seen try it get complaints like "do I HAVE to use Facebook?"

<comment><USER49> _Most startups I 've seen try it get complaints like "do I HAVE to use Facebook?"_

On Hacker News, yes. Amongst normal users it's absolutely fine, particularly if you're delivering some kind of social benefit (i.e. actually using the social graph you are given access to)

</comment></comment></comment><comment><USER50> Meerkat (the Oreilly news reader) died 9 years ago.

I used to use that site... Something about the name Meerkat.

[http://archive.oreilly.com/meerkat.csp?&p=1](http://archive.oreilly.com/meerkat.csp?&p=1)

</comment><comment><USER51> 15 minutes of fame isn't just for people.</comment>


Why Wordpress? - <AUTHOR> http://johnmaeda.com/whywordpress/ <comment><USER2> What are the alternatives? Is there any other free, self-hosted, open source CMS that out-of-the-box allows an average non-tech person to publish content, images, etc. with such ease and nicely designed admin GUI? Easy to install, can be installed on any cheap shared hosting and will work fine, has automatic updates, content is searchable, has tones of themes free or cheap to choose from, it's fairly easy to customize and reasonably safe, as long as developer doesn't get crazy with plugins and has a basic idea of web security it's just fine. Code is ugly as hell and I hate it as much as everyone else, but site owners don't care about it, as long as the interface is nice and easy and cheap to use. And also there's a ton of helpful videos and tutorials to give to your clients to learn how to use it (so they don't bug you at all on "how do I do this"). Developers are cheap and readily available if you don't want to provide support which is a huge benefit for the customer, not being stuck with a custom solution and having to pay a new site each time he changes the developer.

I'd be very happy to use something else, more secure and better written, but what comes even close?

<comment><USER3> Take a look at Concrete5. It's a LAMP stack like Wordpress, MVC under the covers, a common sense architecture, and highly extensible. It has an exceptional, in-context UI for content editing that is the best I've seen, and a good core team and community that is very active.

One area that Wordpress wins is with respect to the overall number of themes and plug-ins, but that's pretty much it.

<comment><USER4> I tried it a few years ago and it was not ripe yet. Community to small, bugs to severe.

The WYSIWYG editor is still nice though. But it adds a lot of complexity if you want something it can't do. Somme abstracted forms in wordpress are easier.

</comment></comment></comment><comment><USER5> Wordpress is a great platform if you use well rounded plugins, actively manage it, have it behind a Firewall, and run a security suite (like Wordfence.) But really, you should have any CMS install behind a Firewall.

I really like Wordpress, it gets a lot of hate; but it's easy to develop on allowing for fast turn around, has the best editor of any CMS around for client happiness, and has a robust ecosystem. I'm in charge of around ~150 websites that run Wordpress, and I moved them all under an active management platform with always up to date plugins, themes and core. I inherited a lot of them with my new job, but I am slowly putting them all behind Cloudflare's firewall and setting up the appropriate page rules to keep them safe. I often scan them and compare them against the core to make sure there have been no changing of core files by a hack. I also have them on scheduled back-ups to private Azure blobs and have alerts set up with Azure's monitoring tools.

It takes a while to set all of that up, but once it is set up your install is pretty safe against any sort of attack relative to other CMSs. Another great thing about WP is if it IS hacked, it's pretty easy to fix. Other CMSs getting hacked is quite the chore to hunt down, especially the other major PHP based CMSs. I'm looking at your Magento & Drupal.

I think about what is best for turn around, has the best cost/benefit, and what makes clients happiest, and so far that is Wordpress is the answer 90% of the time. Until that changes, Wordpress will continue to run a huge chunk of the web. I do grant you that a lot of lazy developers and unmanaged/out-of- date installs from agencies, small businesses and individuals are hacked very often and are often turned into zombie sites. There's no doubt about that. But just taking some basic common sense security measures can do wonders and keep you and your clients safe(r) from attack.

<comment><USER6> Do you have a good guide for setting up a bunch of WP sites securely/properly? The ones I've found all just have a few tips here/there and many conflict each other. Haven't found anything "complete".

</comment></comment><comment><USER7> I see WP Engine touted as a solution. My limited experience with a client several months ago was "hey, we're getting really big, we need better security and better performance", they shop around, and get sold (in a literal sense) on WP Engine. Signed up, and my friend started to try to migrate things over. Oh... yeah, they don't actually support many custom plugins - you could select from some blessed ones, but the client's traffic was all using a custom theme and set of plugins. Those wouldn't run on WP Engine.

I too (and many others) could make most WP hosting really secure if I got to say "you can only use these 9 plugins (or whatever the number was) and no, you can't put any custom code on the server at all".

EDIT: Indeed... every moderately-sized WP project I've worked on ends up being dozens of plugins (more than 15 being average, and one recent one having about 45 active plugins). Every time I mention that to anyone I know who 'does' WP they all recoil in horror and say "I'd never even work on that - that's impossible! Why would you need that many plugins ever?!" And then I think... they don't really understand WP, or they don't understand clients. Or... yeah, it must be my problem, because I'm somehow not good enough to deliver everything a client asks for _in wordpress_ (requirement) in the mythological "3-5 plugins" everyone tells me is their max.

EDIT2: The client project referenced above was getting tens of millions visits per month, and as such the WPengine number I was told was somewhere in the region of $1500/month.

<comment><USER8> What do they use so many plugins for?

I took over supporting/developing a WordPress site and one of the first things I did was delete a bunch of pointless plugins. I wound up writing quite a few of my own for different tools and left some third party plugins so there are still probably 10 active between 3 sites on a multisite install.

I installed Google analytics directly in the header of the custom themes on each of the multisites.

There were no comments so all of the comment plugins were pointless, as were all the form plugins except for one.

So, why so many plugins? Am I missing something?

<comment><USER7> Install woocommerce - you'll end up with 12-15 plugins off the bat.

Would you like to force everything to be SSL? Another plugin. Do you want a contact form? Another plugin. Do you want to disable the bizarre update messages from ignite woo that won't go away? Another plugin. Oh, you want some slider-carousel thing on some page? Another plugin. Caching? Another plugin. Image optimization? Another plugin. Some sort of 'maintenance mode' to deal with taking down the site for upgrades? Another plugin. Social sharing buttons? Another plugin.

I could keep going, but perhaps you get the picture. And the argument could be made that 90% of these are not needed, and there's other ways to deal with the requirements. In my most recent excursion, I'd taken over a project from someone else, and this was it. _Any_ changes to anything would require investigation, custom code, and still require some sort of UI to manage things, all of which cost time and money, which were in short supply, so this particular project kept going with dozens of plugins.

You want to do an upgrade to WP core? You've got 30+ plugins to test. Or... just click 'update' and hope for the best. Or test each plugin and upgrade process on a separate server. Again, back to relatively large amounts of time and money expended just to keep up with wp core to avoid inevitable hacking attempts.

I have another multisite install I was brought in on over the summer, with 165 plugins. It's just another version of 'crappy legacy software and undocumented crap with no documentation' which we've all seen, but it is also quantified by "number of wp plugins". No, not every site is using all 165. But there were/are > 40 sites, with various groups using various combinations - there's _0_ good reasons for all of these to have been combined (over several years) in to one massive multisite mess, but it was, and it's taken many people far too long to unravel some of the mess to extricate some sites.

Yes, some of this is just a 'bad code is bad code' rant, but given the mindshare that WP owns, it would seem to be incumbent on them to raise the bar with respect to tools for plugin management (as just one example), give developers better starting code and samples and guidance for what's acceptable and what's not. A paid certification program which would vet code for 'best practices' would be something I think would help improve the landscape in short order (and no doubt has been considered by some over the years).

<comment><USER8> So I think you're agreeing with me? I can't really tell.

I agree that knowledge of best practices is really important, because why would you need to run a plugin on top of your site to force HTTPS?

I use Apache to force HTTPS, Apache to handle error documents, etc. My themes each have their own cache manifest.

It's common sense / best practice to have a second server to test updates on, that's what I do. Given I only have 12 plugins with a handful on active on each site, it doesn't take too long. I also add and develop plugins on the second server.

IMO the shittiest thing about WordPress is the library so by and large I choose not to use it when it isn't necessary, so pretty much everything besides querying posts and accepting AJAX calls since they make it nearly impossible to otherwise.

In general, I try to develop apps/plugins that run 100% independent of WordPress and just write a wrapper for the library that's used for administration on the WordPress dashboard.

An example of this is a plugin that's more or less a long test, with some custom GUI and other requirements (save progress, download CSV, take notes, etc). I wrote it to WordPress standards and used a short code to add it to a page. It was slow, sooooo slow.

So, I rewrote the entire front end to be an independent app that uses a custom DB table, propagated by a plugin on the WordPress dashboard. Result? 80% faster load times.

Another example, I made a simple app that gets some data from another custom DB table and sends tweets, triggered by cron. It uses a SQLite DB to track a few settings and a list of users to mention.

I wrote a wrapper for the library with a simple API to manage settings in the WordPress dashboard.

Unless there is a drastic change to WordPress's plugin system these apps will always work. Even if there is a change, pretty much all the code that WordPress cares about is displaying the settings page and receiving AJAX requests.

It might not be by the book but it's faster and in my opinion, pretty logical. This way apps are portable and can be transferred to other platforms easily, not necessarily other WordPress sites on shared hosts but they're custom so that isn't the point.

* Edit to say, I wouldn't recommend any non technical user maintain a WordPress e-commerce site, anyways. Square makes it so easy, hosted secure and has tools for inventory and other things, too. All included in standard credit card processing fees.

I'm sure they aren't the only ones but I was amazed at how simply someone could set up a site, as I know someone who has a store and uses square for payment processing already.

<comment><USER7> > It's common sense / best practice to have a second server to test updates > on, that's what I do. Given I only have 12 plugins with a handful on active > on each site, it doesn't take too long. I also add and develop plugins on > the second server.

WP specifically makes this non-trivial, because post and db data has hardcoded path info in it. Export/import a database? You have to make changes to it. For something that is 10 years old... an import/export system that acknowledges the reality of plugins and separation of data would be nice.

SSL? When you're running wordpress, and you think "I want everything to be SSL"... you look for a plugin. _I_ wouldn't and don't, but this particular system was something I inherited.

20+ plugins in WP systems seems to be something I run in to far more often than the "expert dev/ops guy who knows about SQL and can handwrite in 5 plugins what takes 15 by normal folks" systems.

I think you're in the minority when it comes to being able to be 'good' with wordpress. As I was suggesting before, part of the appeal in wordpress is there's a low common denominator. Someone who came across your WP code that used custom tables, (instead of throwing _EVERYTHING_ in to either wp_options or post_meta)... they'd be lost. Honestly. Really. I see it quite often. People writing plugins and themes and selling WP solutions not having the foggiest idea how to write or use SQL.

"Square makes it so easy, hosted secure and has tools for inventory and other things, too. All included in standard credit card processing fees."

This particular client was sold on "you can customize everything in woo/wp". There were a number of technical things they wanted to do which Square and others do not do, and they'd already tried with other hosted solutions as well (3dcart, for certain, and maybe another).

What we inherited (and what I normally get in most projects that get referred) is an undocumented mess of stuff that is not in version control of any sort, a mishmash of various versions of libraries, etc.

 _CAN_ you build 'decent' code in WP? Without a doubt, it's possible, but the defaults still go against commonly accepted dev practices. The more configs go in databases ("wp_options for everything by default"), the harder migrating between various environments is (I can't just pull code, for example, because db configs are required for everything to run correctly). That's not insurmountable, but you're working in an environment where these common tools and practices are a) not provided and b) not-understandable or accessible by the majority of the developers in that community.

</comment></comment></comment></comment></comment><comment><USER9> Dismissed Wordpress for many years, then I found WPEngine (I know, mentioned below, but I have some points to make). Edit: Not affiliated with them in any way. Just a really big fan.

My number one reason for WPEngine is their excellent support, both in terms of response times and general knowledge. They have never let me or a client down.

My time is money (or the client's money). Yes it's much more expensive than self-hosting, but my hourly rates are much more than their professional plan costs each month. One unfortunate issue and they'll spend more on paying me than they'll save on hosting elsewhere for a year. This is also how I "sell" WPEngine to new leads. It's not a hard sell.

I now have 12+ client sites there. Some several years and none have suffered a single issue of a compromised site. I've actually used WPE's (free) service to migrate compromised sites to their platform and get them cleaned as a feature to garner new clients.

The WPE interface allows me to switch between them in an instant. Add to that general performance/caching, security/firewall, automatic updates, daily snapshots and reverting to a previous version with one click, on-demand backups, the staging site functionality, free automated SSL certs, CDN (pro plans), etc etc

It has come to the point that I don't accept any projects that don't agree on hosting there.

PS Fought battles with many different CMSs --e.g. don't even get me started on Joomla or even Drupal-- and don't believe that wordpress is any more vulnerable than other CMS sites. Moreover, there are so many WordPress developers out there, that I can safely promise that me getting hit by a truck is really not a problem.

Edit 2: I limit plugins to the absolute minimum. I avoid free plugins whenever possible. Buying highly rated plugins with support from places like ThemeForest is really really useful and well worth the money.

</comment><comment><USER10> I love wordpress, but I don't love PHP, updates, security flaws, or hosting. I haven't done it yet, but I'm considering using the Simply Static plugin[0] to migrate to generated static pages from my wordpress instance, which sidesteps all of those problems.

[0]: [https://wordpress.org/plugins/simply- static/](https://wordpress.org/plugins/simply-static/)

<comment> at-fates-hands I would also look into the myriad of static site generators that are probably much faster than the WP static site plugin and use modern tools and libraries.

[https://www.netlify.com/blog/2016/05/02/top-ten-static- websi...](https://www.netlify.com/blog/2016/05/02/top-ten-static-website- generators/)

Roots is mentioned, but the team has since developed Spike which is built on a more modern stack:

[https://github.com/static-dev/spike](https://github.com/static-dev/spike)

[https://www.spike.cf/](https://www.spike.cf/)

<comment><USER5> This all defeats the purpose of using Wordpress and making it user friendly for clients.

Wordpress could solve a lot of security issues by using a newer version of PHP, but they are scared of breaking legacy items. Also using things like Wordfence and Cloudflare solve most of the basic Wordpress security issues.

<comment><USER11> > Wordpress could solve a lot of security issues by using a newer version of > PHP, but they are scared of breaking legacy items.

There's nothing stopping you from running it on PHP 7.1 (and we are on our client sites). There's not a great amount that could be gained by WordPress (the project) by dropping support for the older versions; the main gains would be namespacing and closures.

That said, I do think it's time to drop 5.2 support. 5.2 is down to single digit percentages: [https://wordpress.org/about/stats/](https://wordpress.org/about/stats/)

</comment></comment></comment></comment><comment><USER12> Because people who don't actually know how to build websites are fooled into thinking they have a tool that will fill that knowledge gap, despite the security implications that they are oblivious to.

<comment><USER13> It's the first choice among a huge number of web devs though, which seems contrary to it being that the person deploying it doesn't know better.

<comment><USER14> It's the Microsoft Word of Web Content Creation, if the people you're building a site for have any pre-existing experience with creating and editing content online it's probably with Wordpress. That puts it ahead of 90% of the opposition off the bat because the client is already comfortable with the platform. Developers like programming more than they like teaching people how to use the sites they built.

</comment></comment></comment><comment><USER15> People keep saying wp is bad. Ye it is from your point of view. But there are maybe billions who have no clue how internet works but they want a site/blog/shop whatever. Many of them don't even think about paying someone to make a website, or pay for tools.

So they pick wordpress: 1 click install in cpanel, no html, css, js, php knowledge whatsoever, pick a free theme from millions of themes, pick plugins from millions free ones, done. Maybe a bit of google to personalize it but that's it.

What do you offer devs who can make a quick 50 bucks in afternoon installing a plugin/theme, or even 100 for a quick website with admin panel and all that easy stuff?

There is a market for everyone and cms's will live one way or another. The simple & free stuff will always be more successful.

<comment> yjftsjthsd-h I don't think anyone is questioning that WP fills an important niche. The problem is that as used in many cases, it has some serious problems. Being able to "pick plugins from millions free ones, done" is great UX out of the box and terrible in the long term when the inevitable compromises and lack of support sets in.

</comment></comment><comment><USER16> I used to have a WordPress-based blog. It was indeed a nightmare to keep up to date, unless a bit after version 2, where they included the option of automatic updates, and the whole thing was a bit more manageable. Not because it was too much of a problem before (download the compressed file, uncompress, move to the correct folder), but because sometimes an update came out and I didn't notice. Had malware installed once, was a nightmare to get rid of.

For a variety of reasons, the blog crashed and when I started a new one, I chose Pelican[1]. Haven't looked back.

[1] [https://github.com/getpelican/pelican](https://github.com/getpelican/pelican) (linking to the github repository because the main site happens to be down [https://github.com/getpelican/pelican/issues/2079](https://github.com/getpelican/pelican/issues/2079)).

<comment><USER17> Another not-WordPress alternative is a software called NibbleBlog [0] which is nice because it's also written in PHP and will likely be easy for existing wordpress admins to deploy. No change in tooling. This also doesn't require a DB, it can run from flatfiles.

[0] - [http://www.nibbleblog.com/](http://www.nibbleblog.com/)

<comment><USER18> >This also doesn't require a DB, it can run from flatfiles.

How difficult would it be to get WP to run off of sqlite? I'm not familiar with the code base to know.

<comment><USER17> No idea but from the one time I've looked into the code base I'd say that if it takes any modification of the source: very dificult unless one of the code maintainers is interested. Honestly, go take a look it was very scary. That's why I switched away from WordPress. A friend and I got attacked by some bots that did some emailing through our sites. After that I switched off and he did some intense web-admin work to make sure "it was never going to happen again" (tm).

NibbleBlog was drag and drop. My friend went to hell and back to fix these exploits. WordPress has more features but also more ins-and-outs to learn. The choice is up to you if it's worth it.

Also from what I remember NibbleBlog stores JSON files and doesn't use SQLite in flat-file mode. Very handy.

</comment></comment></comment></comment><comment><USER19> WordPress is fantastic for what it was meant to be: a blog. When people try shoehorning it into e-commerce and other things it turns into a real mess. There's no real structure to the application itself, which leads to promoting a procedural, "dump everything in a functions.php file" type of programming.

</comment><comment><USER20> Wordpress (with auto-updates enabled) + modsecurity with the owasp ruleset = I've never had a problem. I'm sure if someone targeted me specifically that statement wouldn't be true, but I don't fear having a Wordpress site on the Internet at the moment.

</comment><comment> at-fates-hands I never got into WP, but had multiple good experiences with Drupal. The problem for me is that WP gives you a good foundation, but if you don't know how to develop on that foundation, write your own plugins, or control your own security, you end up doing what 99.5% of the people do that use WP:

1 - use a C panel "one click" install of the CMS from your web host

2 - start looking for plugins to give you the functionality you want

3 - install said plugins without sand boxing them or even testing them for vulnerabilities.

4 - end up getting hacked and then wonder what happened

It's true that for the most part the WP _core_ is pretty solid, but its the billions of sketchy plugins that people use that create vulnerabilities and allows their sited to get hacked.

<comment><USER21> Anyone who invested in Drupal 6 got screwed because they only support one backwards version and Drupal 8 is a non-trivial migration and even Drupal 7 requires conversion of code.

</comment></comment><comment><USER22> One of the great things about WordPress is the plugin ecosystem. This is also a something of an achilles heel, especially when it comes to security. WordPress seems to attract a lot of lowest-common-denominator coders who create plugins. So while the WordPress core is now pretty solid when it comes to security, the various plugins are almost never coded to the same standard.

I have to wonder if WordPress added a small cost and verification system at front, similar to the app store, if third-party code would be of higher quality.

<comment><USER23> An alternative would be for plugin authors to achieve a Core Infrastructure Initiative Best Practices Badge, which is free and shows a commitment to secure coding.

[https://bestpractices.coreinfrastructure.org](https://bestpractices.coreinfrastructure.org)

Disclosure: I'm the co-author of the badge at the Linux Foundation.

<comment><USER24> Is there a single plugin that has been granted the badge?

The policy docs don't seem specific enough in areas where plugin developers need help (ie. don't use superglobals, raw sql or PHP scripts outside of the plugin load process) while being an over burden in less important areas (ie. requirement that each project have a security expert, and CI builds)

Having an audited plugin repository for Wordpress is an idea i've had in the back of my mind for a while now. I believe it's something a lot of businesses would pay for

<comment><USER23> The badge project is less than a year old, and there are several WP plugins registered, though none at 100% yet: [https://bestpractices.coreinfrastructure.org/projects?q=Plug...](https://bestpractices.coreinfrastructure.org/projects?q=Plugin&sort=badge_percentage&sort_direction=desc)

I agree that a big part of wpengine's value is the validation they do of certain plugins. A business model that could charge for information of which plugins are most safe would be challenging.

The goal of the Badge project is to incentivize improved behavior by the plugin authors.

</comment></comment></comment></comment><comment><USER25> WordPress is the most flexible and the most easy-to-use platform I've used. WordPress offers so many cool themes both free and premium. Here is the cutest WP theme I've ever found - [https://www.templatemonster.com/wordpress- themes/monstroid2....](https://www.templatemonster.com/wordpress- themes/monstroid2.html) . It can be used for setting any website, from a simple blog to a full fledged e-commerce store.

</comment><comment><USER26> The question should be "what".

Static HTML will often fit the bill

<comment><USER27> This is my everyday at the moment. WordPress's biggest success, in my opinion, is that it is synonymous with "website" for many incoming clients. I get "We need a WordPress site" far more often than "We need a website", and they're almost exclusively asking for the latter once we break down the business goals. Always feels like I'm starting from an entrenched position though.

<comment> yjftsjthsd-h Do you have a good way to let clients update their site if it's static? I'd love to ditch CMSs, but asking my clients to write HTML is a stretch and expecting them to sync changes over SSH is right out.

<comment><USER27> Yeah, absolutely. To be clear, we haven't ditched the concept of a CMS altogether, we've simply shifted the paradigm to get the client's focus back on managing _content_ instead of managing a _site_.

Our current setup is using a static site generator (we're Rubyists on Middleman - [https://middlemanapp.com/](https://middlemanapp.com/) \- but take your pick here) to build the actual site. However, the content itself lives in a cloud-based CMS (we're on Contentful, but Prismic and Siteleaf are also good choices) - this is what the client has access to. During the build proc, the SSG polls the CMS and grabs all the latest content to package into the static site.

On publish of any piece of content in the CMS, a webhook hits our build proc (either Codeship or Netlify) which in turns fires a rebuild of the site (which in turns pulls down the latest content).

For us, the best part about the setup is that it's virtually impossible for the client to _break_ the site. They could certainly make it look like hell - but they can't break it. On top of that, if they somehow, someway, manage to break the build by simply editing content, then the new site is simply never deployed.

Let me know if you have any more questions - I love talking about this stuff.

<comment> yjftsjthsd-h Oh, that's a great solution! Webhooks are probably the missing link, since I've already looked at and used generators. I could even host a text editor on a server for them; there are enough decent HTML5 editors that the UX wouldn't be an issue. Thanks!

</comment></comment></comment></comment></comment><comment><USER7> WP felt like a good default 'go to' choice 10 years ago. Certainly, in the last 5, it does not feel that way to me, even though I still do use it for some projects (myself and my clients) but it's not a default, nor is it by any means the only tech stack I work in (< 10% of my work is in wordpress - various PHP and Java/Groovy make up most of the rest of my work).

There are a few things which don't get called out very much, but which were/are some of the underlying motivating factors for people defaulting to wordpress (perhaps as a more root underlying reason behind some of the 'large ecosystem' reasons people typically default to).

A primary one which gets overlooked is that fact that WP is about the only 'framework' of any sorts in any tech stack which allows people to simply move files up to a server. There are no command line incantations to run, no npm/build stuff to use, no compiling, etc. It's about the only platform I can point someone to where they can do an install themselves, and still make modifications later (days/months/years later). Many do 'one click' installs via cpanel or whatever, but even outside of that, the process to install and make changes later is about as basic as you can get - editing and moving files - nothing else needed.

Secondly, in the realm of web frameworks (whether we describe it as one or not, wordpress is indeed a framework, albeit possibly reluctantly for a while), it's one of the few that comes with a username/password/registration process ready to use, out of the box. Anyone looking to build any extension/plugin can count on a standard user/pass/registration/recovery process being there. Most other web platforms shun this most basic aspect, comparing their routing options and ms-oriented benchmarks. I think ASP.NET MVC v4 came bundled with a standard user/reg system?, and one might throw Drupal/Joomla in that camp too. Outside of that - certainly all the major PHP platforms for years - symfony, zend, kohana, code igniter, ez, etc - all gave you parts, then told you to build it youself. Typical rationale was "everyone's needs are different".

So... people 'build it themselves', thinking their own needs were 'different' from everyone else's (hint - vast majority of times, they're not), then we wonder why things get hacked, and point the finger at the devs themselves who... shouldn't have to be reinventing that wheel every other month. Devise in Rails seemed to have been a go-to for a while, and many other languages tend to coalesce around 1-2 frameworks and 1-2 user/auth libraries, but the PHP world is just too damn big for much consensus...

Except in Wordpress. Whether it's good or not, it provided enough of the basics in a standard way to become the basis for people to build on. And... build they did - often extremely poorly (no, really, not _everything_ should necessarily go in to 'wp_options' \- session data? really? and I have to run my own stuff to clean it up?)

These low barrier to entries have been at the root of why WP has gained so much popularity and control.

I certainly know there are 'good' ways to develop with WP as a basis, if you wanted to. And some people really want to. But doing things too 'correctly' from a dev standpoint (migrations, testing, dev/staging/prod setups, etc) means you're now fighting against the WP core principles of 'move files up and execute'. The core of WP doesn't support these concepts, and tacking them on feels... tacked on. You're also alienating yourself from the 99% of wordpress developers (in every sense of that word) who do not even understand those concepts in the first place - they will never be able to use or contribute to your code/project/tool. At some point, doing things the 'developer' way conflicts so much with the core ethos of WP, that you're fighting the base, and there's probably not much benefit (outside of latching on to the name recognition) and you're probably better off in another tech stack.

WP itself providing some 'blessed' approaches for creating plugins with testing processes, standard/defined way of importing/exporting plugin data, and other attendant issues around plugins would solve problems for larger- scale developers/users, but might very well alienate many of the folks who were earlier adopters. But... at this point, where else would those folks go?

</comment><comment><USER28> If you have an existing web application (i.e. Rails or Django) and need to add in CMS, Wordpress becomes suboptimal very quickly. If you're doing work for a client website, they want you to spend as few hours ($$$) as possible launching a CMS. For that there are modern API-first CMS like [https://buttercms.com](https://buttercms.com) that were built to quickly integrate into any tech stack. Which means you remain very productive working in technology you're comfortable with instead of learning PHP (in the event you're well versed in Ruby or Python, for example).

</comment><comment><USER29> I hate wordpress. Always having to be updated, plugins that fall behind or also need to be updated, duplication of images instead of using original and styling or scripting it instead - same image creates 30 images in some templates. Change a template and things break. I've never understood why people keep touting it.

</comment><comment><USER30> can we talk about the action/filter hell, the mess that is wp_query and the hackish way to get structured data integrated in wp (see acf for example)? digital agencies loves wp, and you will always get to use it in a non blog way with messy plugins and themes, and this is a pain.

</comment><comment><USER31> Or you can dump it on medium, which looks better on mobile devices and looks cooler in general.

</comment><comment><USER32> I'd love WordPress to be on GitHub rather than squirreled away on... Actually I have no idea, I've never actually found it. I bet you can't find it within 2 minutes from reading this, go on, give it a go...

Told you. Get it on GitHub and watch how much better it becomes.

Also sorting out the versioning would make it more usable.

<comment><USER33> There's a mirror of it at the obvious place[1], with instructions on how to contribute in the header.

This took me the time it took to type in the URL as a guess. "wordpress github", "wordpress source" both have this as the first result.

[1]: [https://github.com/wordpress/wordpress](https://github.com/wordpress/wordpress)

</comment></comment><comment><USER34> Because you want to get hacked.

</comment><comment><USER35> Umm, wordpress is a useful widely supported lowest common denominator

</comment><comment><USER36> I'm looking at the "dead" comment by PravlageTiem. I understand that PravlageTiem was being sarcastic, and some people feel that sarcasm undermines the tone that is supposed to prevail on Hacker News. But still, PravlageTiem raises an important point:

WordPress has historically been a security nightmare.

Possibly there was a tone of anger in the way PravlageTiem expressed themselves, but the security flaws in WordPress are worth discussing any time that WordPress is discussed.

Certainly, when I have a freelance client, and they ask me "Should we use WordPress?" I typically answer with some long version of "It has a good admin section for non-technical users, and also designers love it, but it also has a lot of security flaws."

<comment><USER37> > WordPress has historically been a security nightmare.

This. And all this started around the same time - in 2006 -- when Stefan Esse, the PHP security expert "resigned".

In a blog post in 2006 (that can no longer be found) Esse was quoted as saying he quit > "because among other things they were resistant to his finding bugs in PHP, and had refused to patch some of the bugs he found."

Source(s)

[http://www.darkreading.com/risk/php-security-expert- quits/d/...](http://www.darkreading.com/risk/php-security-expert- quits/d/d-id/1128486)?

[https://preilly.me/2006/11/09/php-security-expert- resigns/](https://preilly.me/2006/11/09/php-security-expert-resigns/)

PHP is the backbone of WordPress and none of the core team members have taken any of it's security holes seriously, many of which can be traced back to PHP's security hole. They simply come out with "It's the Plugin-Developer's fault" every few months when a security hole is found.

I don't think it's in their best (business) interest to fix WordPress' security holes any time soon. Because Matt Mullenweg, and other "Wordpress Security" companies like Sucuri Security, even WP Engine, all charge an arm and a length (WP Engine is 100$ a month for a simple blog serving < 25K pageviews a month) by selling "Peace of Mind" security with Wordpress if you use them / host with them.

<comment><USER38> I believe you're referring to Stefan Esser. The blog post in question can be found here[0]

      [0]https://web.archive.org/web/20061215080243/http://blog.php-security.org/archives/61-Retired-from-securityphp.net.html

</comment></comment></comment><comment><USER39> [https://roots.io/](https://roots.io/)

Problem(s) solved.

Disclaimer: not affiliated in any way.</comment>


Q: Genderless Voice, created to end gender bias in AI assistants - <AUTHOR> https://www.genderlessvoice.com/ <comment><USER2> Is Siri in female voice because it's "preferred" or because it's better?

Related: [https://en.wikipedia.org/wiki/Bitching_Betty#Voice_gender](https://en.wikipedia.org/wiki/Bitching_Betty#Voice_gender)</comment>


Jonathan Haidt: "The Age of Outrage" - <AUTHOR> https://www.city-journal.org/html/age-outrage-15608.html <comment><USER2> > He drew on the moral resources of the American civil religion to activate > our shared identity and values: "When the architects of our republic wrote > the magnificent words of the Constitution and the Declaration of > Independence, they were signing a promissory note." And: "I still have a > dream. It is a dream deeply rooted in the American dream. I have a dream > that one day this nation will rise up and live out the true meaning of its > creed: 'We hold these truths to be self-evident, that all men are created > equal.'"

Martin Luther King Jr famously appealed to the Bible and founding documents of America as the basis for civil rights. Now that those two have been trashed by current society, to what broadly agreed upon standard will the civil rights reformers of today appeal?

<comment><USER3> I think both documents will continue to inspire people for a long time.

But you don't need old documents to inspire a movement. Greta Thunberg is doing fine without.

<comment><USER4> Greta is fine at preaching to the choir. I highly doubt that there were people who did not agree with her, but then after listening to her speech, agreed with her.

<comment><USER3> MLK was preaching to the choir, for that matter. Many of his white listeners had a general belief that segregation was bad, but didn't think they could change anything by themselves. When you get enough such people together, they start to act. Climate may be the same story, 50 years later.</comment></comment></comment></comment>


Exterminate All Operating System Abstractions (1996) [pdf] - vezzy-fnord http://www.cs.berkeley.edu/~brewer/cs262b/hotos-exokernel.pdf <comment><AUTHOR> This is one of the first papers introducing exokernels. The paper argues for breaking the shackles of OS abstraction and giving direct, (but mediated), control to the programs.

I like the idea, and am experimenting with it in my own OS. In the mainstream world, we see this paper's goals partially appearing with the people who give a network card directly to a server process in Linux.

If they said which architecture there were thinking about, I missed it. On x86 without IOMMU I can't think of any card I would trust. IOMMU implementation is so spotty I'm not sure I'd trust it either. There is a great deal to be said for keeping the device access locked away in the kernel where you know which features of the card you will use, and if it has a mode that lets it scribble elsewhere in memory, so aren't using it.

<comment><USER2> Yes, but do software companies really care about "giving direct, (but mediated), control to the programs".

What is the trade-off between that, and the added complexity in understanding all the different ways you can program something?

IMO, developers want a simple and standardized model to build applications on operating systems so they don't have to care about the internals.

This article represents a marginalized view by the larger industry as a whole.

<comment><USER3> When the authors talk about applications having their own OS, I think they have in mind infrastructure programs like databases and web servers: complex, low-level programs that have domain-specific needs from the hardware and can gain greatly by using it only in the way that they need to.

They obviously don't mean that every CRUD app should build its own OS, since that would be absurd.

<comment><USER4> A database is a good example. For example, a database engine might benefit from being able to read large raw blocks from a disk and directly optimizing its own disk seeks, rather than using the common abstraction of a file as being just a stream of bytes.

<comment><USER5> You're right: it was proven with the invention of object-based, disk storage that kept things simple. Think NoSQL key-value stores vs common SQL databases in performance. Eliminating complexity in the underlying mechanism while allowing the app to decide how it's used can certainly benefit performance.

</comment></comment></comment></comment></comment><comment><USER4> Pushing operating system abstractions into user-space was pretty much what IBM's VM/370[1] operating system did (starting in the late 1960s!). VM/370's control program (CP), which would be the "kernel" in today's terminology, controlled the physical hardware resources. Each "process" running under CP was a virtual machine whose operating system API was mostly just the IBM/370 instruction set (i.e., no abstraction above the hardware architecture). For example, CP provided only a virtual disk drive that you could manipulate with machine instructions like SIO (Start I/O) - the file system was implemented by the code running in user space. You could actually run a different guest operating system (i.e., a different set of OS abstractions at user level) on each virtual machine.

The authors of this paper do mention VM/370 in their "Related Work" section (page 5). They say their approach is similar, except that they "export" hardware resources rather than emulating them, which is more efficient.

[1] [https://en.wikipedia.org/wiki/VM_%28operating_system%29](https://en.wikipedia.org/wiki/VM_%28operating_system%29)

<comment><USER5> And KVM/370 was first to do it with some security. Unfortunately, people need ACM/IEEE membership for those papers. At least VAX VMM Security Kernel papers are still around. Pretty much anything Karger wrote will help new efforts. :)

</comment></comment><comment><USER6> "The poor reliability, poor adaptability, and poor performance of operating systems would be acceptable if applications could just ignore the operating system and implement their own abstractions."

My first thought was that it seems like we have this these days with VMs, although that can still be fairly complicated to set up due to the way that VMs reliably partition hardware resources. Skimming a bit further I see this is in some ways the opposite of what they have in mind, which is to even be able to save registers in a different "process".

I tend to think that operating systems don't provide enough isolation rather than too much. I don't care too much about how they go about implementing that. I can see the appeal of a more flexible OS implementation, but I don't agree about what the OS should ultimately provide.

I wouldn't mind seeing default-available VMs that are treated more like applications in terms of resource availability and scheduling. It seems like this would at least partly address many of the concerns within a monolithic kernel design.

Can anyone recommend other good papers on exokernels? I feel like I'm not really getting it yet.

<comment> vezzy-fnord The canonical paper is "The Exokernel Operating System Architecture", which came out two years later by the same author: [http://u.cs.biu.ac.il/~wiseman/2os/microkernels/exokernel.pd...](http://u.cs.biu.ac.il/~wiseman/2os/microkernels/exokernel.pdf)

</comment></comment><comment><USER7> Now, correct me if I'm wrong, but haven't we essentially got the exact opposite direction and strengthened the abstractions separating hardware and apps? I would assume elimination of abstractions would reduce portability unless suddenly the market moved to a unified hardware architecture, while we've gone the other way; we have numerous platforms of hardware AND software, and code is generally more portable than ever before due to the use of standardized languages and APIs.

<comment> vezzy-fnord Addressed in Section 4, Question 2.

<comment><AUTHOR> … in which the authors describe application level device drivers to map between the physical hardware and a presumably common abstract interface. That doesn't seem to change the world much over a kernel device driver mapping to a common abstract interface, except that you can implement a different common abstract interface if you wish. You'll just have to write new drivers for all the cards. This is fine for experimentation, but not nice for production.

I think the ground shift between 1996 and now is the democratization of kernel code. These mysterious "kernel architects" referenced in the paper who handed down a system from on high are now any decent C programmer with an itch to scratch. If you don't like the Linux/*BSD/whatever abstractions given to you, then make your own. If people like it and it doesn't offend an influential developer it can even be widely deployed.

<comment> vezzy-fnord I disagree. It's much harder now to scratch your itch than ever before. You can see it in how people like Linus Torvalds have an almost demigod status in that kernel hacking is considered to be a highly arcane activity. This is in stark contrast to the past, where writing operating systems was a much more mundane and common activity, not unlike writing your own web framework today.

Certainly some shortcuts like DDE, rump kernels and emerging flavors of libOS are now coming around, but it's still an uphill battle.

<comment><USER8> _writing operating systems was a much more mundane and common activity_

[citation needed] - outside of academic environments. I suppose the embedded environment might count as building your own micro-operating system (only one task? don't bother with a scheduler etc).

<comment><USER5> Just look at the Wikipedia Timeline of Operating Systems with special attention to number of distinct OS's in any given time period. You'll find it drops off sharply as it nears the present if you count stuff that was actually deployed or in working condition. Well, that was the situation when I looked at it a year ago. Hopefully you come back with good, contrary news. :)

Another example is sheer amount of dead, search results I get for OS projects on sites that track them. Almost all are before 2010 with most closer to the late 90's. I'm not sure why this is but there's just hardly anyone doing it anymore. Maybe it's because they google it and see how hard it is with all the dead projects. ;)

</comment></comment></comment></comment></comment></comment><comment><USER2> Abstractions are important as they reduce complexity, and simplify operations.

The foundation of computing is based off abstraction - using layers and interfaces to hide complexity, so developers can focus on higher-order problems.

This article argues against abstractions citing security, performance and cost. But time and again it has been shown that most costly component in software is human time - and simplifying the underlying architecture is worth the trade-offs

<comment><USER9> _Abstractions are important as they reduce complexity, and simplify operations._

...but only when used correctly. Abstraction is a means to an end, not the end itself. Unfortunately, years of CS education seem to have taught most people that it's the other way around, causing massive increases in design complexity that are only justified by dogmatic adherence to "more abstraction is better". Some programming language communities are more disposed to this effect than others (e.g. Java.)

Correct application of abstraction is not common in mainstream software, and rather difficult to describe, but the simplicity and clarity is unmistakable when one encounters it. The occasional articles on HN about seemingly impossibly tiny programs are good examples.

This article is a bit "X considered harmful" reactionary but I see their point - often, software today is on the side of _far too much_ abstraction.

<comment><USER2> " Unfortunately, years of CS education seem to have taught most people that it's the other way around, causing massive increases in design complexity that are only justified by dogmatic adherence to "more abstraction is better"."

Abstractions only create design complexity when they are applied incorrectly. Abstractions should scale horizontally across a layer of the software stack (VMs, Storage - NFS, APIs, etc). If you're create a single-use abstraction, it's not really an abstraction but a complexity

<comment> vezzy-fnord NFS is pretty much a canonical example of a poor abstraction.

</comment></comment></comment></comment><comment><USER10> Very interesting: this is directly analogous to something that happened in Java: people started out writing native code to conform to a standard Java interface. They ended up writing Java that mapped to the native code very closely, and then abstracted all of those implementations _in Java_. SWT is the poster child for this movement, but it happened in other places too.

</comment><comment><USER11> One of the paper's authors, Dawson Engler, went on to found Coverity.

</comment><comment><USER5> One of the few times they learn from the past (VM/370) with good results. Moving along that spectrum, they'll security-related projects that did this while enforcing a security policy on the processes or guests. KeyKOS nanokernel architecture is one. VAX Security Kernel is another more like what people do today. Start with most robust design, then optimize from there.

</comment><comment><USER12> Seems similar to the direction DirectX has taken lately?

<comment><USER13> DirectX and Vulkan are perfect examples of the exokernel philosophy. Another good example is the evolution of X11, culminating with Wayland, where applications draw the UI themselves using libraries instead of sending primitive draw commands to a server.</comment></comment>