WordPress 3.6 arrives with better post locking, built-in HTML5 media player

http://thenextweb.com/apps/2013/08/02/wordpress-3-6-arrives-with-new-blog-centric-theme-better-post-locking-built-in-html5-media-player-and-more/

by Lightning • 13 years ago

71 63 13 years ago

thenextweb.com

uladzislau• 13 years ago

I tried to submit the official Wordpress.org announcement and got "stop spamming us". http://wordpress.org/news/2013/08/oscar/ Is Wordpress.org domain banned on HN?

ck22• 13 years ago

Yeah all wordpress links here get immediately blocked as article submissions, I do not understand why.

Maybe some wordpress.com blogs were being used for spam but wordpress.com != wordpress.org

bl00djack• 13 years ago

I've also been wondering for a while now, what's the difference between those two sites ( wordpress.com and wordpress.org) ??

jacques_chester13• 13 years ago

And now begins the wait for 3.6.1 before I let it get anywhere near the blogs I host.

hillbillyjack• 13 years ago

Have you ever had an intrusion on your blog network because you updated to quickly?

Just curious whether or not your fear is from a previous experience.

Will you upgrade to new releases day 1 when WordPress implements auto-updating on the security updates?

anu_gupta3• 13 years ago

It's not necessarily about security issues. It's a fairly standard practice across a lot of different software products to not jump on the .0 release of something. For all the testing that gets done prior to release, inevitably some bugs will be shaken out after release.

jacques_chester13• 13 years ago

What I've had is multiple experiences of upgrades fucking with my data. Sometimes to the point of destroying posts and comments.

Yes, I have backups. It pisses me off having to use them.

piratebroadcast• 13 years ago

Same thing with iOS and OSX releases- I never jump on a .0 release- Some pople have and have lost everything on their device.

dbarlett• 13 years ago

Changelog: http://codex.wordpress.org/Version_3.6

sehrope3• 13 years ago

I've never used WP but I've read about it quite a bit. Usually it'd be after site X on HN goes down for not enabling caching and not being able to handle the load. There's always links to "best practices for caching" or other tidbits. Out of everything I've read though nothing is as funny as wp-cron[1]. If you're not familiar with it then it's worth a read for a good laugh. See [2] for a nice article about it, in the meantime here's a summary:

If you don't have a native cron installation (eg. shared hosting or Windows) you can config WP to act as a cron daemon (actually might be enabled by default). The catch though is since everything is WP is triggered by HTTP requests the way wp-cron works is to check if there is a job to run every time a WP page is hit. Yes you understood that correctly, every single page that is rendered also checks if it should fire off a cron job. The jobs get executed async in the background so it doesn't hold up the ongoing request but it has two interesting properties.

1. If your site gets a large influx in traffic the server runs wp-cron for every page hit and further slows things down.

2. If your site gets no traffic then it doesn't run at all.

Funny eh?

[1] http://core.trac.wordpress.org/browser/tags/3.6/wp-cron.php

[2] http://wp.tutsplus.com/articles/insights-into-wp-cron-an-int...

toble2• 13 years ago

It's just a hack for people without access to cron. It was more of problem back in the day when hosting services didn't offer control panels and most wouldn't let you have command-line access. If you knew your hosting company well, you could maybe talk someone into setting up a cron job.

I remember doing something similar for a stats script that would wipe old data every time it was viewed by an admin.

jacques_chester13• 13 years ago

I used wp-cron as one of the motivating examples for a different architecture; I talked about it on HN last week -- https://news.ycombinator.com/item?id=6106248

Essentially, given the constraints of the LAMP architecture, wp-cron is the only way to do it.

You overlooked that wrapping WP in layers of caching restricts wp-cron's supply of triggering events. It's a mess.

sehrope3• 13 years ago

Yes that's exactly why it came about. I still find it very interesting (and humorous) solution though. I've seen the same inner platform effect in legacy systems at large corporations.

yogo• 13 years ago

Lol the inspiration must have come from the session gc, except it doesn't hurt if the gc isn't run due to a lack of page requests. On the other hand I guess something is better than nothing. I have had to use servers with real cron to execute scripts on servers without it to get around this.

8ig82• 13 years ago

Given the constraints, what are some better ways of implementing this?

onli• 13 years ago

There is none.

colinsidoti• 13 years ago

The glory of this system is that WP retains their stupid easy install.

I suspect they pull down the data for whether a cron needs to be run in an initializing query that also pulls down a ton of other data (site name, for example). So in theory, they're only doing a few time comparisons of extra work per request.

Also - I haven't looked too deep into WP's implementation, but are they actually doing it on page load? I've seen it in other php software (I believe phpBB) as a 1px image. This kinda solves the caching issues others are talking about...your server might still get hung up, and that picture might never load, but if you're cached properly I think it won't stop anyone from reading.

Ignoring the bugs though...I've had my shared hostgator plan handle a couple of top page HN post with no additional caching installed, which makes me think it's probably not a problem for most people running WP. (I just double checked to make sure that's actually true, and it is.)

rmccue5• 13 years ago

I haven't looked too deep into WP's implementation, but are they actually doing it on page load?

On page load (that is, when WP actually runs), WP fires off a non-blocking HTTP request to itself. This runs at maximum once per minute, and shouldn't actually run if you're using Super Cache or similar and hit a cache page.

jacques_chester13• 13 years ago

So in theory, they're only doing a few time comparisons of extra work per request.

And if a plugin has registered a long-running function, you're kinda screwed.

Also - I haven't looked too deep into WP's implementation, but are they actually doing it on page load?

Yep.

I've had my shared hostgator plan handle a couple of top page HN post with no additional caching installed, which makes me think it's probably not a problem for most people running WP.

HostGator install WP Supercache by default.

rmccue5• 13 years ago

There's two options that could have been taken here.

1. On hosts that don't support cron, tell users to use an external service to do it, and in the meantime their scheduled posts and other functionality breaks.

2. Implement a workaround like this.

Yes, it's not the greatest solution, but the point is that it works.

In addition, "every single page that is rendered also checks if it should fire off a cron job" is incorrect. A lock is used to avoid running more often than once per minute. If you're at the sort of load where this is an issue, you should be running proper cron anyway.

chrisguitarguy• 13 years ago

It's easy to turn off:

    remove_action('init', 'wp_cron');

Then just set up your own real cron job to run the `wp-cron.php` script however often you'd like.

If your site gets a large influx in traffic the server runs wp-cron for every page hit and further slows things down.

Which involves a single database hit and a `foreach` loop. Or, if you're using an external object cache (memcached, APC, etc), no DB hits.

Probably not as dire a situation as it seems. This...

If your site gets no traffic then it doesn't run at all.

...is a huge problem.

Pengwin• 13 years ago

> If your site gets no traffic then it doesn't run at all.
...is a huge problem.

Why?

If you are relying on things to happen at an exact time, them you should know not to use wp-cron. However, for the scope of internal wordpress tasks that don't need to happen every load, I don't see any problem with it happening when wordpress is prodded eventually, and the time it was scheduled to run at has passed.

oinksoft• 13 years ago

So ... you dropped by to take a pot-shot at WordPress? Request-based cron imitations have been around for a while particularly for software targeting cheap LAMP hosts (Drupal has an implementation, for instance).

wodenokoto• 13 years ago

How would you run cron without cron?

And it only checks if it needs to run a job at page load, it doesn't actually run it everytime, which isn't that big of a deal to check.

Wordpress has a very high focus on readable code which does seem to affect it's speed. But it is easy to use, setup and hack, which is why it is popular. And as Yahoo and wordpress.com clearly shows, it does scale.

will_work4tears3• 13 years ago

If you have a hosting where you can't set a cron (most of the shared hosting I've used has crons though) you can use a free service like https://www.setcronjob.com (not affiliated).

will_work4tears3• 13 years ago

It's easy enough to disable the built in wp-cron and write your own cron that hits the wp-cron file on your own intervals. This is what I've always done on my WP sites. It's a hack, sure, but I too think the wp-cron thing is rediculous.

capex• 13 years ago

Everything's great, but their text editor still can't accept markdown by default.

jacques_chester13• 13 years ago

Shipping caching by default would be a better start. The Wordpress team have said that the hosting implications of writing to disk make it a non-starter; but for some reason that didn't stop them from shipping auto-update or one-click plugin/theme installation in mainline.

Viper007Bond• 13 years ago

The WordPress leads speak from experience. Caching objects to disk was introduced in WordPress 2.0, released in 2005. Turns out it actually slowed down the vast majority of sites.

Databases are really, really good at storing and retrieving data, much more than filesystems, especially when those filesystems are often remotely mounted drives.

The functionality was pulled back out of WordPress in a later version, leaving all of the various hooks needed for a plugin to super-easily implement it on its own. I use a memcached powered one for example.

rmccue5• 13 years ago

This is exactly what plugins are for. Most people aren't going to need this, and for those that do, there's a tonne of plugins out there that will add this functionality for you.

mattkrea• 13 years ago

I have to admit I'm surprised a community like HN would upvote such a vulnerable package. Hell, even our sites that have been converted to static HTML still receive requests for /wp-admin/ by bots all the time.

Thanks for allowing non-technies to set up their own site but no thanks--I'm good.

smcnally• 13 years ago

It's vulnerable because bots request resources in that subdirectory?

If there's a request for cgi-bin should we throw apache away, too?

rmccue5• 13 years ago

What serious exploits have popped up in WordPress lately?

nkuttler2• 13 years ago

I guess http://www.openwall.com/lists/oss-security/2013/06/11/3 isn't serious enought? Oh, right, it's just in some third party code WordPress passes unsanitized data to.

I also find it interesting that you as a core dev narrow down possible answers by using "serious" and "lately" in your question. Of course you specifically ask for "WordPress exploits" as well, maybe because themes and plugins run with the same privileges as WordPress core code, and there's no review process for official plugins hosted on wordpress.org? Not to mention from other sources..

rabino• 13 years ago

This proves it's popular, not insecure.

toble2• 13 years ago

HN users often view PHP and those products built using PHP with disrespect. Sure they have their problems, but these products have been around for an eternity (in internet terms). Lots of programmers wouldn't have long standing careers without them.

jboynyc• 13 years ago

FWIW, I just tried to update my dev site, the install failed, and now the site fails to load. Yikes.

In all fairness, I think that's because the admin has been playing around with file permissions on the server side. I can't even log in right now to read the errlog.

8ig82• 13 years ago

Might as well link to the source of TNW's regurgitation:

http://wordpress.org/news/2013/08/oscar/

WordPress 3.6 arrives with better post locking, built-in HTML5 media player

Related Stories