We've got to maintain a certain level of 'street-cred'.

Dogfooding Clojure and Security

When "Clojure: What are the Benefits of Bringing Java and Lisp Together?" was posted here a few days ago we had completely rewritten the site, including blog, from scratch using Clojure.

I really like the language. Maybe it appeals to my Mathematical nature. We have used it on a few things internally and on a project that never made it past the first lap so it has not been one we have put into production before. But the real reason the site needed an overhaul was WordPress. Don't misunderstand. It is a great platform but its feature set, breadth, and ubiquitousness make it a target by those that are not well intentioned. We have covered this topic in more detail in Custom Software Offers Increased Security.

We were spending an inordinate amount of time dealing with brute force attacks on the admin login. So we installed a plugin to slow that down and block IPs. That plugin sometimes locked us out of the site and required manual intervention to login. We needed caching to offset all the plugins did to our performance. Then the constant security updates to the W3 Total Cache plugin or base platform required full cache emptying and reuploading assets to the Content Delivery Network (CDN). So things got busy here one week and a critical security update came in that we did not patch immediately. The malevolent people saw their opportunity and used a zero-day that the update would have addressed and did their damage. This locked users out of TOUCH and some clients' blogs as well.

Certainly one can spend the time to keep WordPress hardened. It has issues mainly because the feature set is so large. But when there are so many other things to do, managing this is not good. There is no reason for us to need a login or a slick page to write our posts on. We wrote the site in Clojure, ported the previous posts from Wordpress, setup a new Nginx environment (oh my Apache sucks at Named Virtual Site proxying) all in about 24 man hours. We have already noticed improvements. The biggest difference we did not plan for was performance. We are no longer using a CDN or paying that cost. The performance is 4x faster even without the CDN.

It might be possible to make the source code available but have not pending a full review. We utilied Ring, Compojure, Noir, enlive, postal, markdown-clj, and clj-time. The posts are simple markdown files that are hand edited. While this site is not a large production install like we do for some clients, I thoughly enjoyed using Clojure for something "real" and hope that a project lets me use it more soon. Do you need help optimizing your workflow?