Consider this the iOS versus Android equivalent on the web. You can either take the app store approach to themes and plugins and police every bit of code upload

Consider this the iOS versus Android equivalent on the web. You can either take the app store approach to themes and plugins and police every bit of code uploaded to codex or it can be the Andoriod model where there is no proactive policing. Somehow, I don't think the Wordpress app store is going to make much progress at Automattic. It will require them to put in considerable resources to policing the code than improving the core. The other way is to have a the Wordpress core bootstrap allow only a whitelist of functions to be called, which would have the effect to severly curtailing the flexibility that is required by plugin/theme developers. Mind you, these problems are there not just with PHP/Wordpress. You can have the same issues with Chrome/Firefox extensions, bookmarkelets and most of the add-on models where you are running code that has not been subject of a decent audit. The trouble for Wordpress/PHP is the footprint they have on the web now, which makes them pre-Vista/7 days for Microsoft on the web. You could probably do similar nasty things with a fancy jQuery plugin, but it is much better bang for the for the buck for the evil guy to have a go at something that is so widely installed and used by a large number of people who would not know it even if you were to show them code that does nasty things. On other hand, a certified/curated theme/plugin/app store for all ecosystems that follow the reactive model to policing add-ons is a great idea for a start-up. I have been amused that nobody's done it so far. I know there are directories, but they don't test/audit the apps. Someone should give it a shot.