EmDash uses Clef to moderate the plugin registry(emdashcms.com) |
EmDash uses Clef to moderate the plugin registry(emdashcms.com) |
Otherwise you just have to trust the random plugin publisher and the permissions/sandboxing doesn't really matter.
samtp - I think you're looking for the answer to two or more problems here.
- Can I trust that a plugin is (relatively) secure?
- Can I trust that the plugin will be maintained?
- Can I trust that the plugin will be good quality and work as described?
That's something WordPress haven't been able to do - so I'd say well done to the EmDash team! And, if I wasn't building my own CMS (with a very similar permission model) then I would probably be trialling it right now :)
I've spent a lot of time browsing and using plugin/extension marketplaces. One of the main questions that you have when deciding on a plugin is your last one question - specifically the quality of the plugin and if does what it says it will do. But when I look at the EmDash marketplace, there is almost no way to judge the quality of the plugin (especially the UI/UX without screenshots) or if it actually does what it says it will do. And that is usually the first question you ask before going into the security and maintenance. Because if it looks terrible, slows down your site, and doesn't really work - who cares if it's maintained and secure?
But, that has very little to do with the work described in the OP. Maybe EmDash will fail to gain sufficient traction to have their own network effects, but in the meantime, doing moderation on plugins in their marketplace is still important work. Automated moderation to prevent abuse and malware is useful, and is orthogonal to the social proof you're talking about.
What I am saying is that there are different levels of types trust when it comes to incorporating outside code into your project (in the form of packages/plugins/extensions):
1. Being able to quickly understand what the code does and what effect it will have (screenshots are pretty big here for CMS plugins)
2. Being able to examine the code before installation
3. Seeing feedback from others on the quality of the code and how well it meets the objectives
4 Limiting what the code can do once you install it
Right now the EmDash plugin catalog really only does #4. I don't see any screenshots of the UI of these plugins, there is no link to the repo, there is no indication if a plugin is used by 100 people or no one, and there is no feedback from anyone who has used it.
The bottom line is that there are several layers of trust that outside code has to pass before you even install it and consider what permissions to grant it. Ignoring that makes it very difficult for someone to start trying out different plugins. And it also makes me hesitant to develop a plugin, because it seems like it has very little chance of standing out from all the rest, even if it becomes popular.