Use Elixir to create the next Wordpress?

Such a platform requires pluggable add-ons. Elixir can achieve that but it’s not trivial, and security can definitely be an issue.

This is not unique to elixir though. Any platform without sandboxing has that problem, including PHP/Wordpress itself.

Yep, true. In fact I don’t know of a language/platform that does this well. I still remember people breaking Java’s security subsystem years ago, maybe that was improved in the meantime.

I think, this is the greatest problem.
This is also true if you wanted to program an extensible Ecommerce system, for example. There are some comments about this here in the forum.

Yes. Unless we get a hard sandbox for the BEAM VM then I don’t think such efforts will ever go anywhere.

Of course there are other options like just use a Lua engine to program plugins but then the single language paradigm of such platforms goes down the drain and you might as well not use a BEAM language at all.

I am sure there are ways around it but it’s probably too hard to be worth it.

Or accept the security implications like many other systems, which provide runtime supplied pluggable functionality.

Yes. I still wouldn’t mind (if it was my job) because Elixir still has a ton of advantages compared to JS or PHP for such projects. But it needs to be said that it’s not at all easy to pull off.

I’ve thought about this a lot, and have come to the conclusion that plugins basically destroy the premise of doing this in most languages (not an Elixir thing). It feels like PHP is actually uniquely positioned as the best foundation for a WP-like system.

You could totally build a drop-in plugin system in Elixir, although it would be much more involved because you’d need to compile the plugins and add the compiled source to the application. The code_server process can handle this dynamically, I believe. Then questions like, what would prevent a plugin from overwriting an existing module? The security can of worms is big on this project.

The even harder thing about plugins is that they can completely change the operation of core wordpress operations. So having a pure core separate from the plugins isn’t really applicable in practice. I don’t think you could simply ignore it because the UX depends on having a powerful plugin system that can change the operation of the system. Modifications to wp-theme.php are the bane of any WP developer, but is also quite common because software is hard.

I’m curious why you think PHP is uniquely positioned for such a system? By my understanding PHP has exactly the same issues. Sure there’s compilation, but the beam and elixir have quite nice api around doing that even at runtime. The statefulness of the system means you need to be a bit more diligent with unloading stuff compared to the “load everything from scratch each request” in PHP, but other than that I don’t really see a big difference.

My main reason for this is that everything in PHP is drop-in and evaluated on every request. So you literally just need to put files there and it works. The devil is in the details—it just works in PHP but you’d need to replicate it to have the same effect, and I’m not sure it’s super easy to do. The other thing about it is that PHP files are edited live in pretty much any major WP installation. It’s just a feeling though, I don’t have a ton of empirical evidence here because I haven’t seen it attempted in earnest.

I suppose you could build that type of system in other languages (dealing with compilation as needed, setup files correctly, etc), but I’m not aware of other systems that have replicated this.