4 ms·

Is there a single plugin that has been granted the badge? The policy docs don't seem specific enough in areas where plugin developers need help (ie. don't use

by nikcub 10y ago

Is there a single plugin that has been granted the badge? The policy docs don't seem specific enough in areas where plugin developers need help (ie. don't use superglobals, raw sql or PHP scripts outside of the plugin load process) while being an over burden in less important areas (ie. requirement that each project have a security expert, and CI builds) Having an audited plugin repository for Wordpress is an idea i've had in the back of my mind for a while now. I believe it's something a lot of businesses would pay for

dankohn1 10y ago
The badge project is less than a year old, and there are several WP plugins registered, though none at 100% yet: https://bestpractices.coreinfrastructure.org/projects?q=Plugin&sort=badge_percentage&sort_direction=desc https://bestpractices.coreinfrastructure.org/projects?q=Plug... I agree that a big part of wpengine's value is the validation they do of certain plugins. A business model that could charge for information of which plugins are most safe would be challenging. The goal of the Badge project is to incentivize improved behavior by the plugin authors.
dwheeler 10y ago
Some WordPress plugins have started working on getting a CII best practices badge. None have gotten it quite yet, but there's no reason they can't. There's no cost for the badge, and the criteria are general "common sense" criteria that most people would agree are reasonable. That shouldn't be surprising. The CII badge process opened in May 2016, so it's only been available for about half a year. I expect that most WordPress plug-in authors don't even know about it (yet). > I have to wonder if WordPress added a small cost and verification system at front, similar to the app store, if third-party code would be of higher quality. I think that's likely. At the very least, someone could run some static analysis on the plug-in with rules very specific to WordPress (e.g., "don't use superglobals"). That could really help. However, there are many general "good things" that plug-ins should do. Trying to recreate a list of general good practices would take a lot of time, and be a pain (trust me!). Instead of reinventing the wheel for a list of general good practices, I suggest using the CII best practices badge identify general good practices, and then if you wish, create a separate list of rules specific to WordPress. That'd be much easier. Disclosure: I'm technical lead on the CII best practices project. But it's still a good thing :-).

by nikcub 10y ago

dankohn1 10y ago

The badge project is less than a year old, and there are several WP plugins registered, though none at 100% yet: https://bestpractices.coreinfrastructure.org/projects?q=Plugin&sort=badge_percentage&sort_direction=desc https://bestpractices.coreinfrastructure.org/projects?q=Plug... I agree that a big part of wpengine's value is the validation they do of certain plugins. A business model that could charge for information of which plugins are most safe would be challenging. The goal of the Badge project is to incentivize improved behavior by the plugin authors.

dwheeler 10y ago

Some WordPress plugins have started working on getting a CII best practices badge. None have gotten it quite yet, but there's no reason they can't. There's no cost for the badge, and the criteria are general "common sense" criteria that most people would agree are reasonable. That shouldn't be surprising. The CII badge process opened in May 2016, so it's only been available for about half a year. I expect that most WordPress plug-in authors don't even know about it (yet). > I have to wonder if WordPress added a small cost and verification system at front, similar to the app store, if third-party code would be of higher quality. I think that's likely. At the very least, someone could run some static analysis on the plug-in with rules very specific to WordPress (e.g., "don't use superglobals"). That could really help. However, there are many general "good things" that plug-ins should do. Trying to recreate a list of general good practices would take a lot of time, and be a pain (trust me!). Instead of reinventing the wheel for a list of general good practices, I suggest using the CII best practices badge identify general good practices, and then if you wish, create a separate list of rules specific to WordPress. That'd be much easier. Disclosure: I'm technical lead on the CII best practices project. But it's still a good thing :-).