4 ms·

"If they’re willing to do this, I wouldn’t trust any plugins hosted on WordPress.org." Yep yep yep. Jesus Fuck Matt, put down the crackpipe and open the windo

"If they’re willing to do this, I wouldn’t trust any plugins hosted on WordPress.org." Yep yep yep. Jesus Fuck Matt, put down the crackpipe and open the window. You are _totally_ out of control here. I am 100% going to start another much more urgent discussion at work on Monday about how we remove all risk of relying on anything from Automattic, wordpress.org, or The WordPress foundation. This will include opening a discussion with WPEngine (where we host about two dozen internal and customer sites) about what their short/medium/longterm plans are and what sort of guarantee they are planning to provide about updates and security fixes to the plugins and themes we rely on. It will include an internal discussion of whether we own it to all our clients running WP to inform then of this stupid stupid drama and the risks in represents and what we are doing to mitigate them. It will also include a very serious discussion about a million dollar government RFQ we submitted last month for a project that has a plan to use WP for the public facing website component.

outsomnia 2y ago
You have been and continue to trust Automattic for the core code. If for example, Automattic instead had said they will bundle the plugin functionality with the core, there are many historical cases of that, unpleasant as it is for the third party usually... results are identical, right?
- bigiain 2y ago
  > continue to trust Automattic for the core code That is absolutely no longer true. Which is very very sad.
  - outsomnia 2y ago
    This plugin can only operate on top of the core code, whoever distributes the plugin to you. It means you have to decide to either bin the whole ecosystem, or use the core and plugin from the same people. It's also open to the plugin people to distribute the core themselves, but since they don't have a history of working on it, why would you imagine for core maintenance, you can trust a smaller private equity-funded group that historically leeches on the core project, more than the originating project for the core?

outsomnia 2y ago

You have been and continue to trust Automattic for the core code. If for example, Automattic instead had said they will bundle the plugin functionality with the core, there are many historical cases of that, unpleasant as it is for the third party usually... results are identical, right?

bigiain 2y ago
> continue to trust Automattic for the core code That is absolutely no longer true. Which is very very sad.
- outsomnia 2y ago
  This plugin can only operate on top of the core code, whoever distributes the plugin to you. It means you have to decide to either bin the whole ecosystem, or use the core and plugin from the same people. It's also open to the plugin people to distribute the core themselves, but since they don't have a history of working on it, why would you imagine for core maintenance, you can trust a smaller private equity-funded group that historically leeches on the core project, more than the originating project for the core?