In 2010 WordPress seemed like important technology. It wasn’t perfect, was a big and fruitful hacking target, but it had been built and refined and had a big ecosystem.
I’m not sure how and why controlling it today is seen as an important thing. It’s not irreplaceable, you could reimplement all its basic features easily in a weekend with AI, as well as the plugins and theme you’re using with it. And you could pick a language other than PHP while you’re at it. You might have your own security vulnerabilities, but anything’s better in that department than running WP.
Why do people care about wrestling over control of this particular ship?
you are less likely to have the same vulnerabilities as everyone else though, so unless somebody is targeting you, those vulnerabilities might not matter all that much
I mean... you can literally do that now. You can set up a loop to iteratively pentest, review and patch a codebase (with human supervision as you prefer) and it'll find and fix more vulnerabilities in a day than a pentest team used to find in a quarter, for a tiny fraction of the price.
This isn't a joke, this is now part of my pre-launch SOP. I even have it tracking everything so I can log stuff to fix vs. known shippables vs intentional design/false positives vs. upstream stuff which doesn't have a fix available yet, and keep track of which builds have the fixes. Almost entirely automated, I mostly review the findings and do some categorization/enrichment during the pentest review stage, and do a human code review pass as patches are submitted.
Stuff that used to take me multiple hours to write a fix for and then weeks to get code reviewed and deployed now get done in minutes.
How do you actually do that? Is it all running locally? Cloud agents? Would love to hear about this. I see these deep agent loops mostly just burning tokens, but when I guide the AI I get very good results, so I’m not sure where the disconnect lies.
I use Zed (https://zed.dev) as my agent harness and either the $20 ChatGPT sub + Sol for personal/independent projects or an enterprise Claude account for sponsored/paid work. From the stats for my current work I use about $400/mo in tokens and a lot of that is non-coding work like pruning JIRA, managing business documentation, making dashboards - so my true coding agent cost is significantly less.
It's pretty simple, you could probably set up something like that by:
Configure some kind of CLI tool to talk to your ticketing system and git repo so you can programmatically interact with them. If you don't have a ticketing system, instruct the agent to use local text or markdown files to track issues and progress.
Ideally, make your code runnable in a way the agent can use. For my webapps I build a test harness so that I can run all the endpoints and workflows via reproducible tests against an embedded database. This is easier than it sounds, e.g. there are libraries out there to embed PostgreSQL or SQLite into source code, you can set up a test harness so you can run unit tests, integration tests and workflow tests that use your real frontend, server and database.
Paste this comment thread into the agent prompt and tell it to run a similar loop on your code base: a session that searches for vulns and writes up a report, some way for a human to do a review pass on the report, a session that indexes the reviewed findings into tickets, and sessions that fix the fixable issues and submit patches to your repo. The next search session should first read all the open issues so it doesn't duplicate work of earlier sessions.
LESS IS MORE - avoid fancy agent tooling and skills, don't cargo cult from others, build your own tools as you find your own needs. If something can be automated, use the agent to write tools and tests for it, don't just keep prodding the agent to do it.
I used to ask this question back ~2015 - I was seeing companies with massive, clunky CMS installs just so their non-technical/less-technical staff could update their websites without filing tickets to IT/dev. It seemed to be more about those departments wanting autonomy and not having to wait weeks or months for internal IT/dev to make site updates. The consensus within one dev group was that the company would have been better served by hiring someone who knew HTML/CSS/Javascript to embed with the non-technical people and edit a straightforward frontend site for them.
In most web frameworks its not terribly hard to extern content (you probably do this already for translations) and just have a nice little yaml or json thats easily edited.
A lot of people know it, there are a huge number of existing installs that work well, the ecosystem is huge and not everyone wants to vibe code replacements.
It is very empowering for people with limited skills.
Definitely stay away from anything Matt Mullenweg is involved in. Part of what led up to this was a feud he had with a plug-in author, that led to Mullenweg signing his own plug-in as an update to the original author's plug-in, in the official Wordpress plug-in repository.
In 2010 WordPress seemed like important technology. It wasn’t perfect, was a big and fruitful hacking target, but it had been built and refined and had a big ecosystem.
I’m not sure how and why controlling it today is seen as an important thing. It’s not irreplaceable, you could reimplement all its basic features easily in a weekend with AI, as well as the plugins and theme you’re using with it. And you could pick a language other than PHP while you’re at it. You might have your own security vulnerabilities, but anything’s better in that department than running WP.
Why do people care about wrestling over control of this particular ship?
Why would you have vulns if you vibe coded it in a weekend? Just tell it to not have any security vulnerabilities. Boom!
you are less likely to have the same vulnerabilities as everyone else though, so unless somebody is targeting you, those vulnerabilities might not matter all that much
Because LLMs output is always so unique and original. That's why it looks all the same right?
Wot? You are incredibly likely to have the same vulnerabilities as everyone else (as they exist in your LLM’s training corpus).
So security through obscurity.
I mean... you can literally do that now. You can set up a loop to iteratively pentest, review and patch a codebase (with human supervision as you prefer) and it'll find and fix more vulnerabilities in a day than a pentest team used to find in a quarter, for a tiny fraction of the price.
This isn't a joke, this is now part of my pre-launch SOP. I even have it tracking everything so I can log stuff to fix vs. known shippables vs intentional design/false positives vs. upstream stuff which doesn't have a fix available yet, and keep track of which builds have the fixes. Almost entirely automated, I mostly review the findings and do some categorization/enrichment during the pentest review stage, and do a human code review pass as patches are submitted.
Stuff that used to take me multiple hours to write a fix for and then weeks to get code reviewed and deployed now get done in minutes.
How do you actually do that? Is it all running locally? Cloud agents? Would love to hear about this. I see these deep agent loops mostly just burning tokens, but when I guide the AI I get very good results, so I’m not sure where the disconnect lies.
I use Zed (https://zed.dev) as my agent harness and either the $20 ChatGPT sub + Sol for personal/independent projects or an enterprise Claude account for sponsored/paid work. From the stats for my current work I use about $400/mo in tokens and a lot of that is non-coding work like pruning JIRA, managing business documentation, making dashboards - so my true coding agent cost is significantly less.
It's pretty simple, you could probably set up something like that by:
Configure some kind of CLI tool to talk to your ticketing system and git repo so you can programmatically interact with them. If you don't have a ticketing system, instruct the agent to use local text or markdown files to track issues and progress.
Ideally, make your code runnable in a way the agent can use. For my webapps I build a test harness so that I can run all the endpoints and workflows via reproducible tests against an embedded database. This is easier than it sounds, e.g. there are libraries out there to embed PostgreSQL or SQLite into source code, you can set up a test harness so you can run unit tests, integration tests and workflow tests that use your real frontend, server and database.
Paste this comment thread into the agent prompt and tell it to run a similar loop on your code base: a session that searches for vulns and writes up a report, some way for a human to do a review pass on the report, a session that indexes the reviewed findings into tickets, and sessions that fix the fixable issues and submit patches to your repo. The next search session should first read all the open issues so it doesn't duplicate work of earlier sessions.
LESS IS MORE - avoid fancy agent tooling and skills, don't cargo cult from others, build your own tools as you find your own needs. If something can be automated, use the agent to write tools and tests for it, don't just keep prodding the agent to do it.
Can you share with the class the web apps you’ve built this way?
I used to ask this question back ~2015 - I was seeing companies with massive, clunky CMS installs just so their non-technical/less-technical staff could update their websites without filing tickets to IT/dev. It seemed to be more about those departments wanting autonomy and not having to wait weeks or months for internal IT/dev to make site updates. The consensus within one dev group was that the company would have been better served by hiring someone who knew HTML/CSS/Javascript to embed with the non-technical people and edit a straightforward frontend site for them.
In most web frameworks its not terribly hard to extern content (you probably do this already for translations) and just have a nice little yaml or json thats easily edited.
This also describes sharepoint
A lot of people know it, there are a huge number of existing installs that work well, the ecosystem is huge and not everyone wants to vibe code replacements.
It is very empowering for people with limited skills.
Definitely stay away from anything Matt Mullenweg is involved in. Part of what led up to this was a feud he had with a plug-in author, that led to Mullenweg signing his own plug-in as an update to the original author's plug-in, in the official Wordpress plug-in repository.