Emdash: Don't use This Thing

A Note: I currently use Cloudflare for my security and CDN. I'm looking at options to replace it, but I don't have a great idea of what I want to use instead yet. I still think that Cloudflare should not have as big of a footprint on the web as it does, but it does make it very easy to get started.

Cloudflare officially unveiled a new, self-hostable, open source content management system last week. Emdash is their attempt to take on Wordpress, but there's a lot to unpack here and it's not good. Emdash intends for itself to be a complete frontend to work exclusively with Astro, one of the newer static site generators out there. The exclusivity is the first red flag. Tools should be about making your life easier, but not at the expense of your freedom. Your data and your site should be as portable as possible, but emdash is built to lock you in. But first, how did Emdash come about? Why, with the power of AI of course!

The cost of building software has drastically decreased. We recently using AI coding agents. But for the past two months our agents have been working on an even more ambitious project: rebuilding the WordPress open source project from the ground up.

From Cloudflare's announcement post

That's right. They are openly lauding the idea that they told AI agents to rebuild WordPress from the ground up using Astro as the static site framework. Why would they go to such lengths?

WordPress’ plugin architecture is fundamentally insecure. 96% of security issues for WordPress sites originate in plugins.

Ah yes, Security. Using notoriously insecure development practices to ensure a more secure ecosystem. Great. Well, at least you can run it on your own hardware! Finally, an open source SSG that you can run on your own hardware or any platform you like that has security as a major priori– what? Oh, silly you. Even if you deploy on Netlify, your home server, Nekoweb, or whatever else, you're gonna need a subscription to Cloudflare. You didn't think security was free did you?

EmDash depends on Dynamic Workers to run secure sandboxed plugins. Dynamic Workers are currently only available on paid accounts. Upgrade your account (starting at $5/mo) or comment out the worker_loaders block of your wrangler.jsonc configuration file to disable plugins.

From Emdash's GitHub page

So security is the number one point, but you're generating the code with AI and also charging people for the privilege to run plugins at all? Woof. Great job. Just stellar work. If you're interested in writing a blog and using a static site generator, you do not need a CMS. It helps, but there's great ways to build and deploy a site without it and you may just learn something!