{"id":4574,"date":"2026-04-03T01:32:27","date_gmt":"2026-04-03T01:32:27","guid":{"rendered":"https:\/\/frontlinenewsng.org\/?p=4574"},"modified":"2026-04-03T01:32:27","modified_gmt":"2026-04-03T01:32:27","slug":"matt-emdash-feedback","status":"publish","type":"post","link":"https:\/\/frontlinenewsng.org\/?p=4574","title":{"rendered":"Matt: EmDash Feedback"},"content":{"rendered":"

So, two other Matts at Cloudflare<\/a> announced EmDash \u2014 the spiritual successor to WordPress that solves plugin security<\/a>.<\/p>\n

(Is it nominative determinism<\/a> or a simulation glitch that everyone trying to terraform the web has some variation of \u201cMatthew\u201d in their name? I was in a call set up by Matthew Prince, talking to Matt Taylor and Matt Kane, with my right hand there, Mat\u00edas<\/a>.)<\/p>\n

First, I\u2019m going to tell you why this isn\u2019t spiritually tied to WordPress at all, then why they haven\u2019t solved plugin security, and finally offer some suggestions.<\/p>\n

The Spirit of WordPress<\/h2>\n

WordPress exists to democratize publishing. That means we put it everywhere<\/a>. You can run WordPress on a Raspberry Pi, on your phone, on your desktop, on a random web host in Indonesia charging 99 cents a month, and you can run it scaled up on AWS or across multiple datacenters. <\/p>\n

The same code. When you download WordPress Playground<\/a> you\u2019re running the same code that\u2019s being attacked a thousand times a second at WhiteHouse.gov<\/a>. That\u2019s what we mean when we say democratization<\/em>.<\/p>\n

It\u2019s all built on open source and web standards. You can run it anywhere; there\u2019s no lock-in.<\/p>\n

That\u2019s why we do what we do. It\u2019s really hard. You can come after our users, but please don\u2019t claim to be our spiritual successor without understanding our spirit.<\/p>\n

The Spirit of EmDash<\/h2>\n

I think EmDash was created to sell more Cloudflare services. And that\u2019s okay! It can kinda run on Netlify or Vercel, but good stuff works best on Cloudflare. This is where I\u2019m going to stop and say, I really like Cloudflare! I think they\u2019re one of the top engineering organizations on the planet; they run incredible infrastructure, and their public stock is one of the few I own. And I love that this is open source! That\u2019s more important than anything. I will never belittle a fellow open source CMS; I only hate the proprietary ones.<\/p>\n

If you want to adopt a CMS that will work seamlessly with Cloudflare and make it hard for you to ever switch vendors, EmDash is an incredible choice.<\/p>\n

Claimed Plugin Security<\/h2>\n

In another example of them not understanding the spirit of WordPress, the fact that plugins can change every aspect of your WordPress experience is a feature, not a bug! And their sandboxing breaks down as soon as you look at what most WordPress plugins do. <\/p>\n

I know we get a bad rep because there are 62k plugins with wildly variable engineering quality, and more every day, and when one installed on 0.01% of our user base has a vulnerability, a bunch of websites write breathless articles that get clicks saying \u201c122,000 WordPress Sites Vulnerable!\u201d<\/p>\n

That, by the way, I think we\u2019ll be able to fix in the next 18 months with AI. The plugin security only<\/strong> works on Cloudflare.<\/p>\n

Critical Feedback<\/h2>\n

As I said, we had a call with Cloudflare on March 23rd, where they asked for feedback on this thing they built but didn\u2019t tell us the name, said it would probably launch in their developer week towards the end of April, and some top colleagues and I offered to help. I wish I could say the things I\u2019m saying in this blog post on that call, and if they had just shared the announcement post I could have, but in the spirit of open source here\u2019s what I would have said:<\/p>\n

    \n
  1. If they had said the name I would have asked if they had any other options because I have an amazing colleague named Emdash<\/a> who is doing some of the most exciting stuff with WordPress and AI. (BTW I think our Em will have more impact on the web than this in five years.)<\/li>\n
  2. I actually think the product is very solid, there\u2019s some excellent engineering, migration tools, it\u2019s very fast, and the Astro integration is nice.<\/li>\n
  3. I\u2019d be surprised if this doesn\u2019t get tens of thousands of sites on it.<\/li>\n
  4. The UI is in the uncanny valley<\/a> of being sorta-WordPress sorta-not. I know it wasn\u2019t a weekend vibecode project, but it has some of that smell. Stuff breaks at the edges.<\/li>\n
  5. I think using TinyMCE is a regression, and they should adopt Gutenberg<\/a>, which we licensed and created to be used by other CMSes.<\/li>\n
  6. The Skills are amazing<\/a>, a brilliant strategy, and we need to do the same as soon as possible. I\u2019ve been working on something similar and got some good ideas from their implementation.<\/li>\n
  7. I\u2019m not going to say which parts, but they copied a lot of things we\u2019re planning to kill. Build from first principles. Make it better. Skate to where the puck is going.<\/li>\n<\/ol>\n

    There\u2019s a new CMS every other day. And that\u2019s great! I love building CMSes and I totally get why other people do, too.<\/p>\n

    In Conclusion<\/h2>\n

    Some day, there may be a spiritual successor to WordPress that is even more open. When that happens, I hope we learn from it and grow together. Until then, please keep the WordPress name out of your mouth.<\/p>","protected":false},"excerpt":{"rendered":"

    So, two other Matts at Cloudflare announced EmDash \u2014 the spiritual successor to WordPress that solves plugin security. (Is it nominative determinism or a simulation glitch that everyone trying to terraform the web has some variation of \u201cMatthew\u201d in their name? I was in a call set up by Matthew Prince, talking to Matt Taylor […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"advanced_seo_description":"","jetpack_seo_html_title":"","jetpack_seo_noindex":false,"jetpack_post_was_ever_published":false,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[1],"tags":[],"class_list":["post-4574","post","type-post","status-publish","format-standard","hentry","category-latest-news"],"jetpack_featured_media_url":"","jetpack_likes_enabled":true,"jetpack-related-posts":[],"jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/frontlinenewsng.org\/index.php?rest_route=\/wp\/v2\/posts\/4574","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/frontlinenewsng.org\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/frontlinenewsng.org\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/frontlinenewsng.org\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/frontlinenewsng.org\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=4574"}],"version-history":[{"count":0,"href":"https:\/\/frontlinenewsng.org\/index.php?rest_route=\/wp\/v2\/posts\/4574\/revisions"}],"wp:attachment":[{"href":"https:\/\/frontlinenewsng.org\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=4574"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/frontlinenewsng.org\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=4574"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/frontlinenewsng.org\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=4574"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}