4 ms·

Giving Matt the benefit of the doubt, the answer to “Why now?” is that enough is enough. Why does Matt deserve the benefit of the doubt? Because his companies h

Giving Matt the benefit of the doubt, the answer to “Why now?” is that enough is enough. Why does Matt deserve the benefit of the doubt? Because his companies have been contributing to WordPress while WP Engine has not. Matt claims he has been privately discussing with WP Engine for ~18 months about their level of contribution. Automatic contributes the equivalent of 75 full time employees to WordPress and WP Engine contributes 1, despite the companies being comparable in size. Matt’s actions may have been bad for optics, but I do not fault him for using the resources at his disposal to correct what he sees as injustice.

wslh 2y ago
I really wonder what that mean contributing to WordPress... from the cybersecurity point of view in 2024, there is/were no contributions: it is common to be hacked when you use Wordpress (e.g. [1]). [1] https://www.reddit.com/r/ProWordPress/comments/1cv15mt/would_malware_even_be_an_issue_on_a_wordpress_site/ https://www.reddit.com/r/ProWordPress/comments/1cv15mt/would...
- dns_snek 2y ago
  That discussion is largely about themes and plugins. Severe vulnerabilities in WP Core are quite rare.
  - wslh 2y ago
    I believe WP Core and plugins should not be viewed separately in terms of security. Plugins are omnipresent. Integrating security measures across both could create a more robust system overall.
  - yencabulator 2y ago
    Themes and plugins are the severe vulnerability of WP Core.
- claudiulodro 2y ago
  WordPress is secure enough that whitehouse.gov runs on it and zero-day vendors pay $100,000+ if you have an exploit for the core WordPress software. It's not "magically secure" though -- you wouldn't say that AWS is insecure because some people set it up wrong or use bad integrations.
  - wslh 2y ago
    I'm curious, do you have any information on how much whitehouse.gov spends on cybersecurity testing and customization? I imagine it's considerably more than the $100,000 you mentioned for a WordPress exploit. I work in this space and have experience with offensive security tests, including on Amazon itself.
- tempaccount420 2y ago
  Time for a Rust rewrite?
  - wslh 2y ago
    I don't think the first problem is about Rust or not but about having a security mindset to develop software. Even if it is PHP.
minimaxir 2y ago
> Matt’s actions may have been bad for optics, but I do not fault him for using the resources at his disposal to correct what he sees as injustice. Of course, there are consequences to using said resources inappropriately.
- glenstein 2y ago
  Note the attempt to reframe bad actions as bad optics, to make it about perceptions instead of concrete actions. But perceptions are downstream from actions in a smoke/fire kind of way, and it shouldn't be used as a way to get out of answering for actions.
  - Zamiel_Snawley 2y ago
    No. Put me on the record as saying his actions are just. I’m not reframing or deflecting anything, I agree with Matt’s actions. The public perception seems to be against him, and managing public perception is important.
    - glenstein 2y ago
      Well as I said before, perception is downstream from the actions themselves. And attempting to reroute the conversation away from actions towards the phenomenon of how they're being perceived is, despite your protestation to the contrary, a way of reframing the conversation that focuses on something other than the merits of what he chose to do.
FireBeyond 2y ago
Why, then, is he asking for WP Engine to pay licensing fees to Automattic, which is not the open source project, nor the Foundation, but his for-profit competitor. Ostensibly, Automattic has no ability to license WordPress (an open source project that it does not own). That sounds like an injustice to me. That sounds like someone who has been using Automattic and WP.com (and Pressable), WP.org, and the Foundation interchangeably, depending on what best fits his needs.
- glenstein 2y ago
  Elsewhere in this thread I'm seeing people say that Automattic is the exclusive commercial licensee with the ability to sub license. So it's possible that that's the answer there.
  - lolinder 2y ago
    The code is GPL, that's not even possible.
    - evanelias 2y ago
      The dispute is about trademarks and use of the brand name, so the relevant issue is a trademark license, not a software license.
      - FireBeyond 2y ago
        Up until a couple of days ago, when Matt retroactively changed (which is going to be hard to make stick) the trademark license explicitly permitted the use of "WP" by anyone and everyone. The trademark license also cannot prohibit nominative usage - that's protected. If you actually, factually offer WordPress hosting, you can say so, in those exact words. You may need to call out somewhere (and WPEngine does) "WordPress is a trademark of the WPF", but no license can prohibit you saying so. What they can't (but don't) say, is anything that implies that they are WordPress - which is exactly why Matt is trying to make some big deal in his head that "my mom thought they were us" (while ignoring the elephant in the room of "Well, wordpress.COM isn't WordPress, either, it's just a licensee", because of course, nobody could be confused by that).

wslh 2y ago

I really wonder what that mean contributing to WordPress... from the cybersecurity point of view in 2024, there is/were no contributions: it is common to be hacked when you use Wordpress (e.g. [1]). [1] https://www.reddit.com/r/ProWordPress/comments/1cv15mt/would_malware_even_be_an_issue_on_a_wordpress_site/ https://www.reddit.com/r/ProWordPress/comments/1cv15mt/would...

dns_snek 2y ago
That discussion is largely about themes and plugins. Severe vulnerabilities in WP Core are quite rare.
- wslh 2y ago
  I believe WP Core and plugins should not be viewed separately in terms of security. Plugins are omnipresent. Integrating security measures across both could create a more robust system overall.
- yencabulator 2y ago
  Themes and plugins are the severe vulnerability of WP Core.
claudiulodro 2y ago
WordPress is secure enough that whitehouse.gov runs on it and zero-day vendors pay $100,000+ if you have an exploit for the core WordPress software. It's not "magically secure" though -- you wouldn't say that AWS is insecure because some people set it up wrong or use bad integrations.
- wslh 2y ago
  I'm curious, do you have any information on how much whitehouse.gov spends on cybersecurity testing and customization? I imagine it's considerably more than the $100,000 you mentioned for a WordPress exploit. I work in this space and have experience with offensive security tests, including on Amazon itself.
tempaccount420 2y ago
Time for a Rust rewrite?
- wslh 2y ago
  I don't think the first problem is about Rust or not but about having a security mindset to develop software. Even if it is PHP.

minimaxir 2y ago

> Matt’s actions may have been bad for optics, but I do not fault him for using the resources at his disposal to correct what he sees as injustice. Of course, there are consequences to using said resources inappropriately.

glenstein 2y ago
Note the attempt to reframe bad actions as bad optics, to make it about perceptions instead of concrete actions. But perceptions are downstream from actions in a smoke/fire kind of way, and it shouldn't be used as a way to get out of answering for actions.
- Zamiel_Snawley 2y ago
  No. Put me on the record as saying his actions are just. I’m not reframing or deflecting anything, I agree with Matt’s actions. The public perception seems to be against him, and managing public perception is important.
  - glenstein 2y ago
    Well as I said before, perception is downstream from the actions themselves. And attempting to reroute the conversation away from actions towards the phenomenon of how they're being perceived is, despite your protestation to the contrary, a way of reframing the conversation that focuses on something other than the merits of what he chose to do.

FireBeyond 2y ago

Why, then, is he asking for WP Engine to pay licensing fees to Automattic, which is not the open source project, nor the Foundation, but his for-profit competitor. Ostensibly, Automattic has no ability to license WordPress (an open source project that it does not own). That sounds like an injustice to me. That sounds like someone who has been using Automattic and WP.com (and Pressable), WP.org, and the Foundation interchangeably, depending on what best fits his needs.

glenstein 2y ago
Elsewhere in this thread I'm seeing people say that Automattic is the exclusive commercial licensee with the ability to sub license. So it's possible that that's the answer there.
- lolinder 2y ago
  The code is GPL, that's not even possible.
  - evanelias 2y ago
    The dispute is about trademarks and use of the brand name, so the relevant issue is a trademark license, not a software license.
    - FireBeyond 2y ago
      Up until a couple of days ago, when Matt retroactively changed (which is going to be hard to make stick) the trademark license explicitly permitted the use of "WP" by anyone and everyone. The trademark license also cannot prohibit nominative usage - that's protected. If you actually, factually offer WordPress hosting, you can say so, in those exact words. You may need to call out somewhere (and WPEngine does) "WordPress is a trademark of the WPF", but no license can prohibit you saying so. What they can't (but don't) say, is anything that implies that they are WordPress - which is exactly why Matt is trying to make some big deal in his head that "my mom thought they were us" (while ignoring the elephant in the room of "Well, wordpress.COM isn't WordPress, either, it's just a licensee", because of course, nobody could be confused by that).