19 ms·
WordPress.org's latest move involves taking control of a WP Engine plugin
- withinboredom 2y agoThey either have some of the best or worst legal counsel; or they just ignore the legal counsel.
- sureIy 2y agoSome people just think they're above the law. This Matt guy has gone mental.
- withinboredom 2y agoYeah, but pretty sure some of the employees/volunteers are in on it or "just following orders."
- speedgoose 2y agoYes, no one stopped the co-funder and it's unlikely he did the fork and the change of ownership only by himself. Other people at Automattic are responsible too.
- sureIy 2y agoConsidering how many people stayed, it's clear that they've been brainwashed to think what he's doing is ok.
- slyall 2y agoOr they didn't feel confident about quickly getting a new job in this market. Especially since Automattic is mostly/entirely WFH. It's pretty unlikely the company will go completely broke any time soon so their jobs are probably fairly safe.
- hello_moto 2y agoIn this job market? Damn, where's common sense and logic?
- InsideOutSanta 2y agoAll the sane people left when Matt offered them $30,000 or six months of salary to quit.
- threeseed 2y agoThey also have the worst social media team I have ever seen: https://x.com/WordPress/status/1845121130207535524 https://x.com/WordPress/status/1845121130207535524
- docdeek 2y agoThis is wild. Surely Matt isn't tweeting from the official account - marketing would not allow that, right?
- pwdisswordfishz 2y agoWho is she, though?
- InsideOutSanta 2y ago1. It doesn't matter. 2. It takes one click to find out that she's the "founder of http://Client-Portal.io http://Client-Portal.io, a WP plugin for freelancers to use with their clients to keep track of all the deliverables in a centralized portal"
- ablation 2y agoMullengweg taking a leaf out of Musk PR playbook, clearly.
- raverbashing 2y agoWhile the situation is much less problematic, I think WordPress management could listen to their lawyers more
- labster 2y agoOne of Automattic’s statements was issued by Neal Katyal, who was Acting Solicitor General of the United States. I would tend towards thinking the client himself may be the problem.
- LeoPanthera 2y agoPreviously on Hacker News. https://news.ycombinator.com/item?id=41821400 https://news.ycombinator.com/item?id=41821400
- r721 2y agoAlso https://news.ycombinator.com/item?id=41821336 https://news.ycombinator.com/item?id=41821336 (165 comments, including 5 by photomatt) https://news.ycombinator.com/item?id=41824852 https://news.ycombinator.com/item?id=41824852 (63 comments)
- nelblu 2y agoYesterday's link https://news.ycombinator.com/item?id=41821400 https://news.ycombinator.com/item?id=41821400
- vintagedave 2y ago> It’s not clear what security problem Mullenweg is referring to in the post. Where is the CVE? What risk is there continuing to use the original plugin? No details at all. This results in fear: we don't know if the original is safe to use. > Going forward, Secure Custom Fields is now a non-commercial plugin Does this imply that Wordpress is potentially going after a revenue stream from WPEngine? If the plugin had Pro options* then are those closed source and so not available to Wordpress in their fork of the codebase? It's not clear. * https://www.advancedcustomfields.com/pro/ https://www.advancedcustomfields.com/pro/
- aeurielesn 2y agoMy understanding is ACF injected notices for their personal legal gains on everyone's dashboards. I wouldn't be surprised if such thing is a breach.
- ImPostingOnHN 2y agoMy understanding is that it was actually matt who did that, and he did it so he could denounce WPEngine to their customers, due to his personal vendetta against WPEngine, because WPEngine refused his shakedown attempt for money. This is cited in WPEngine's lawsuit. Like you said, I wouldn't be surprised if this behavior of matt's was a breach.
- maxloh 2y ago> Where is the CVE? What risk is there continuing to use the original plugin? Here’s the diff showing what has changed: https://plugins.trac.wordpress.org/changeset?new=3167679%40advanced-custom-fields&old=3143016%40advanced-custom-fields#diff-legend https://plugins.trac.wordpress.org/changeset?new=3167679%40a...
- grayhatter 2y agowow, they deleted 300 lines, many giving credit to others, just to replace it with > Security - ACF defined Post Type and Taxonomy metabox callbacks no longer have access to $_POST data. (Thanks to the Automattic Security Team for the disclosure) If I was on that security team, I would be livid they used my team's name on this behavior. If this was done by that security team, their ethics are disgusting, and likely non-salvageable... Still looking for the security exploit worthy of a plugin takeover though. edit; best I can figure tonight is it's some concern over CSRF, but they don't even sanitize $_GET nor $_SESSION, only _POST and _REQUEST... so either it's more complicated than it looks on the surface, or this "fix" is partial at best, and wasn't written by someone from security. (It's also possible or likely that I'm missing some context, it's been a long time since I've had to work on php)
- shdon 2y agoMullenweg calls it a fork. I could see that being somewhat okay if it's indeed for security fixes, but removing the upsells is petty at the very least. But a fork doesn't take control of the original, so I wonder what they did there? Perhaps a redirect from the ACF entry to SCF? To be honest, none of this makes WordPress look good... It just seems like a douche move.
- k1kingy 2y agoIt can hardly be called a fork when you wipe every mention of the original dev team in the codebase, and start a fresh changelog with 'Patched security fixes' whilst thanking his team. It's an absolute takeover not a fork.
- mananaysiempre 2y agoThe thanks come from the upstream release notes for 6.3.8, FWIW.
- sccxy 2y agoMullenweg is hijacking existing users with supply chain attack.
- shprd 2y ago> supply chain attack. Where's the "attack" part? I thought that was a crucial part in the definition
- crote 2y agoThe author of a library has lost all control over the codebase, and a third party is now making changes to it. That's pretty much the textbook definition of stage one of a supply chain attack. Considering what Matt has already done, it wouldn't even remotely come as a surprise if a future ACF update would, say, brick all WP installations using ACF on a WP Engine host.
- mimsee 2y ago> brick all WP installations using ACF on a WP Engine host That tactic would work, if WP Engine had access to the update server hosted at wordpress.org.
- shprd 2y agoIt's like claiming going to the bank is stage one in a robbery. So if you go to the bank you're a thief. WordPress have the rights, just like the responsibility and possible liability of everything distrubted on their platform.
- nurettin 2y agoYou make an opensource project, provide hosting services, then others take your project, modify it for their needs, cut into your hosting market share and then you try to get rid of them. ...What was the end game plan?
- dangsux 2y ago[dead]
- gorbachev 2y agoAt this point I wouldn't be surprised if he'd had secured funding for a new CMS platform startup and is secretly working on it. He seems absolutely hellbent on assuring nobody should use Wordpress.
- maccard 2y agoI don’t think this is a reasonable argument. The landscape when Wordpress was released was wildly wildly different to how it is today, and we shouldn’t begrudge someone for not foreseeing how this would unfold from the landscape in the mid 2000’s. We should judge for how it’s being handled now.
- RobotToaster 2y agoHe didn't make shit, wordpress is a fork of b2/cafelog.
- mirzap 2y agoAutomattic was an early investor in WPE in 2011, but then they made a mistake and sold their shares. In addition, the GPL allows you to do what you mentioned. You can take any GPL-licensed code and use it for commercial purposes without having to contribute back. The license is designed to protect you in this way, and it aligns with the spirit of GPL. Expecting something in return for open-sourcing code is not in line with the spirit of GPL and open-source software. If you're not comfortable with other people making money from your code, it's best not to open-source it.
- dangsux 2y ago[dead]
- mananaysiempre 2y agoBoth Mrs Bakewell’s fourteen-year-old son and the couple of guys setting up the large company’s microsite are both downstream of what’s in among the larger web dev community, they’re just lagging behind it by several years (possibly; I wouldn’t be so sure about the fourteen-year-old). There are of course platforms (it’s always platforms) that have survived losing their in-ness and are still in widespread use (even PHP, arguably), but those are generally described as proven, reliable, stable, well-supported, and so on. I’m not convinced that at this point Wordpress still has that road open to it, instead of only the usual slow decay of widely-deployed software, but either way I don’t think that a transition to a legacy status is a nonevent. It just takes some time to show up in the deployment statistics.
- Havoc 2y agoThis is starting to be just vanilla sad. Pity that there isn’t a comparable eco system that is less…mercurial
- msephton 2y agoWow, the WordPress name is being ploughed into the ground with this sort of behaviour.
- josephg 2y agoWell, they banned Wpengine from updating their package in the repository. Then the package maintainers found security problems - which they can’t fix with an update because they’re locked out. It makes a weird sort of sense. Ie, wp.org backed themselves into a corner where they needed to close the security hole. And to do that, they needed to patch it themselves, which in turn requires them taking over the package. It’s shocking, yeah. But it would probably be worse if they just left the (known, publicised) security vulnerabilities in.
- srmarm 2y agoThey could have backed down and allowed WPEngine to publish an update or even published it on their behalf. Instead they've doubled down and taken this ridiculous action that undermines the whole wp/plugin eco system. None of this is necessary.
- pluc 2y agoThis was engineered and deliberate, they were never gonna let WPEngine have their space back. We called this a week ago: https://news.ycombinator.com/item?id=41751856 https://news.ycombinator.com/item?id=41751856
- spiderfarmer 2y agoI just cancelled my ACF subscription as it's up for renewal in 30 days. I'll wait and see how the dust settles.
- labster 2y agoMy advice would be to make plans to move away from WordPress entirely. While I think that the “supply chain attack” is hyperbolic, if technically true, it’s indicative of an organization that cares about winning more than ensuring any form of stability whatsoever to their users and clients. Beware.
- spiderfarmer 2y agoGood advice, but it's a subscription I'm paying on behalf of a customer for a website I made 5 years ago. It's one of the few Wordpress websites I made as I hate the development process and the bloat of it all.
- DoubleGlazing 2y agoI agree, If I were an IT manager this sort of stuff would make me start looking at alternatives. If an app/pluging/package is maintrained and published by X, I want to make sure no one else can interefere with it - even if they have good intentions. What Automattic should have done is removed the plugin from distribution and told WP Engine to fix the problem. By doing what they did they have breached the trust of their users.
- gtvwill 2y agoThis is gonna be a hard move for some of the IT companies I've seen who have based their entire business around WordPress websites. They literally don't have the skill to use anything else as WP is all they know. Rip.
- thih9 2y agoThe appropriate twist here would be to have WPEngine find a trusted third party (one or more), start a foundation together and successfully fork wordpress.
- bravetraveler 2y agoIf not for Microsoft I'd suggest calling it "Word", no need for the Press.
- nopakos 2y agoWhat about "Press"?
- bravetraveler 2y agoI like it, a lot of room to play with things like 'imPress'
- Ey7NFZ3P0nzAe 2y agoI think PressWord sounds nice
- mrweasel 2y agoJust call it TextPress.
- stefanos82 2y agoEven if they find a middle ground to this mess that Matt has created, I very much fear that the damage to the community is done and it's only a matter of time before the popularity of the once famous platform that almost everyone uses in one way or another collapses.
- Etheryte 2y agoFor better or worse, I would optimistically say that that might be a good thing. WordPress has given a lot to the internet over the years, but a very large portion of its giving has been pwned sites and security issues. If this leads to either the birth or popularization of a tool that's modern and secure, that would be a net win for everyone involved.
- seydor 2y agoI can only imagine how worse it will be if wordpress is hastily replaced with some javascript contraption
- gjvc 2y agoGood. WordPress is merely the tallest dwarf.
- switch007 2y agoDepends how good their PR is. By all accounts, their current PR is not very good
- saaaaaam 2y agoI think their current PR seems to be Matt Mullenweg himself. And the more I hear him speak - having never really concerned myself with anything he said - the more loopy and disconnected from reality he seems. Post-economic! Sometimes it’s great to have a slightly crazy visionary with utopian ideals who is prepared to say whatever they think will effect change. But also: Elon.
- arend321 2y ago
- danielovichdk 2y agoI like this whole so-called debate because it mostly shows that if 40% of Websites can be run on top WP then there is clear telling that we either haven't gone very far as an industry or that people that make websites couldn't give less fucks about who owns what plugin and what the fuck else people are yapping about. Hats of to Matt for at least showing some personality and showing a bit of faith. Now, go build another CMS. Use Rust or Go perhaps and make sure it can scale wildly
- RobotToaster 2y agoWordpress banned forks from the plugin directory a while ago, so they're doing what they ban everyone else from doing. https://make.wordpress.org/plugins/2021/02/16/reminder-forked-premium-plugins-are-not-permitted/ https://make.wordpress.org/plugins/2021/02/16/reminder-forke...
- asddubs 2y agoThat post seems to be about forking open source plugins which cost money. From what I can tell they did fork this plugin but are not offering its premium features for free. Just to preempt people arguing with me, please note that this comment isn't meant to be an ethical defense of them one way or the other, but just a factual correction.
- luckylion 2y agoIt's a freemium plugin though, the advertisements for the pro-version and the update-funnel are how you pay for it. If WP had only fixed the error but not removed all of those things & and hadn't claimed authorship themselves ("By Wordpress.org", and putting themselves at the top of the contributors while they're certainly the one with the fewest contributions), that argument would be different, I believe. Would wordpress.org allow WooCommerce to be forked, uploaded with no modifications beyond the all references to WooCommerce being changed to YouCommerce and all mentions of Automattic being wiped? I don't see that being allowed.
- sshine 2y agoMarketplaces work best when they’re not tied directly to the products, and when they’re not run by Lord of the Flies.
- supermatt 2y agoIt’s not a premium plugin.
- RobotToaster 2y ago
- Crazyontap 2y agoSo, ACF injected notices into everyone's dashboards to push their own legal agenda. It’s a move that reeks of self-interest more than community benefit. While everyone’s ready to grab their pitchforks at Matt, this actually sounds somewhat reasonable. Still, given its impact, this could easily be seen as a breach of trust. Definitely a move that's going to stir the pot.
- beezlewax 2y agoWhat notices were these?
- aimazon 2y agoWhere does this claim come from? The article doesn't include it. Matt hasn't made this claim either.
- kioleanu 2y agoThey should do that for all plugins that do it then, if it’s reasonable, right? Which is a lot of plugins. PS: isn’t WooCommerce doing the exact same?
- RobotToaster 2y agoHonestly, everyone involved in this situation seems terrible. With my own experience of the WP "community", that isn't a surprise.
- echoangle 2y agoAssuming the notices are real and a problem, Automattic should cite that instead of making it about security issues. As it stands, that's just a claim.
- DonnieBurger 2y agoI believe you may have the story confused. Please correct me if otherwise. WordPress was the one who injected notices into everyone's dashboard. This started because the WP dashboard shows the blogs from wordpress.org, and then they published this post: https://wordpress.org/news/2024/09/wp-engine/ https://wordpress.org/news/2024/09/wp-engine/ The result was WP Engine removing the widget that shows wordpress.org blogs on their installs.
- 2-3-7-43-1807 2y agoNow who's the heel and who the face?
- chrishare 2y agoNot a WordPress client but seems like this Matt dude has go-away heat
- rafaelmn 2y agoHonestly I don't get the backlash Mullenweg is getting - a corp is trying to freeload on OSS community, GPL let's them have the code - but I'm all in favor of kicking then off of everything else.
- maccard 2y agoIt’s a bit two faced. He’s clearly abusing his position, annd every time this topic comes up (see elasticsearch, terraform, redis from recent memory) HN has clearly been on the side of the open source license. But, that’s not why he’s getting backlash. He’s getting backlash because he does what the “other side” did in all of these scenarios - invent reasons that are unrelated to the license dispute to cause the split. In this case, delisting their plugins from the central marketplace and implying trademark violations - while claiming that the problem is that they don’t contribute back to the ecosystem. The real problem is that automattic want wpengine to “contribute their share” - by development or rev share, and they’re using dirty tricks and smear tactics to do so.
- deleted 2y ago[deleted]
- josephg 2y agoYep. And they’ve gone 0-to-100 within days. I think he has a fair point - I’d be totally comfortable with a standing expectation in a community like Wordpress for companies to pay their way (or be looked down on & excluded from taking part in community events). But the expectations have to be a fair & transparent, and ideally communicated from the start, so people and companies can make informed choices about how they want to be involved. Not suddenly enforced with no lead time, with demands of money amounts seemingly made up on the spot, and “scorched earth” tactics when the demands aren’t met. As a rule of thumb, bikes can start and stop fast. Cars should be more predictable on the roads. And trucks should accelerate and turn more slowly still. If you’re big and powerful (government, standards body, maintainer of a huge opensource project, etc) you need to telegraph your moves and act slowly and predictably so other people can react to you. This is not how you do that.
- bagels 2y agoTo me, WordPress used to be the thing you used if you wanted a website that was easy to put together but was full of third party php spaghetti code and security holes. Now, it's completely radioactive.
- saaaaaam 2y agoAbsolutely. I moved a big revenue generating content site away from Wordpress about 18 months ago. With this absurd debacle going on, I’m so glad I made that decision.
- deleted 2y ago[deleted]
- everforward 2y agoI wouldn't even really call it that. I only think Wordpress is easier if one of two things is true: 1. You are actually building a dynamic site; eg WooCommerce is much easier than building your own storefront. 2. Your users refuse to use Markdown, and are paying you enough to double the overhead and put it all on you. It gives me a good chuckle when I see posts on here like "We use Wordpress and then scrape the static assets and serve it as a static site from S3". I won't denigrate those people; I'm sure there are good contextual reasons to do that. I just think it's a pretty damning indictment for it to be downgraded from "the software that runs the website" to "a web-hosted WYSIWIG editor for people who can't/won't do Markdown".
- cj 2y agoIn my experience, Markdown isn't the barrier. It's the: - Plugin ecosystem. Marketing people want to use specific plugins for SEO, automatic internal linking, etc. Those plugin only work with wordpress. - Marketing people want to deploy to production. They hate waiting for dev to do anything (which brings us back to the importance of the plugin ecosystem, to add functionality without developers). - It's a familiar system that doesn't need to be "learned" by end users (the same way VS Code, VIM, or whatever is your preferred code editor) If it weren't for the first 2 barriers, I think the 3rd (learning markdown) is the easiest to overcome. Especially with side-by-side realtime markdown rendering, which itself is a form a WYSIWYG. Edit: FWIW, we moved to Webflow at my company, used to be on Wordpress, and before that used to have a Markdown-compiled site, help docs, and blog. Markdown-compiled was my favorite as a developer (and also the most performant), but it was everyone else's least favorite because it required me to deploy and make code changes, and they weren't patient enough to put a ticket in for every change request. They also understandably didn't want to login Github to make updates to markdown files.
- justinclift 2y agoWell, I hope he's going to pay people to maintain that plugin now. Because the original author (or team?) is probably motivated to move on to other endeavours instead.
- dustingetz 2y agocan someone please explain the feud for those of us who are out of the loop?
- sccxy 2y agoMatt Mullenweg - owner of wordpress.org (open-source project) and wordpress.com (paid WordPress hosting provider) He is angry that WPEngine makes money with Wordpress hosting. He thinks wordpress.com should be the only paid WordPress hosting provider. He demanded 8% of revenue of WP Engine or he would embark on a “scorched earth nuclear approach” to WP Engine. https://bullenweg.com https://bullenweg.com
- chii 2y agowordpress itself is GPL, so anyone, not just WPEngine, should be allowed to freely provide hosting. This is exactly what elastic search faced, which necessitated their changing of their license, and subsequently, caused AWS to fork elastic search. Elastic search cannot, and do not, have the right to demand payment from AWS.
- ChrisArchitect 2y ago[dupe] discussion: https://news.ycombinator.com/item?id=41821400 https://news.ycombinator.com/item?id=41821400 https://news.ycombinator.com/item?id=41821336 https://news.ycombinator.com/item?id=41821336
- mikl 2y ago1. Release your code as open source. 2. Make a fortune. 3. Complain that people are freeloading. 4. Abuse your power as project founder to punish them, torching the community trust you’ve built up over decades. 5. Profit? Whatever Mullenweg hoped to gain by undermining WPEngine can’t possibly be worth the damage he’s done to WP and his own company.
- karel-3d 2y agoIf I understand it correctly, the core of the dispute is trademark and that WPEngine somehow implies WordPress affiliation. I can see both sides of the story here, but the scorched earth strategy doesn't seem to be very effective for building trust
- skywhopper 2y agoI think the trademark issue is weak in this case anyway. WP Engine has been around for 14 years with that name, and has been part of the Wordpress community. But absolutely nothing about a trademark dispute excuses the lies, unethical behavior, and just downright personal animus Mullenweg is pouring into this takedown.
- DonnieBurger 2y agoSpeaking of potential trademark issues, it looks like "Secure Custom Fields" retains some ACF branding: https://x.com/TDKibru/status/1845178985308881146/ https://x.com/TDKibru/status/1845178985308881146/ https://archive.is/sjuHl https://archive.is/sjuHl Ironically, Automattic is actively taking legal action against a premium plugin reseller for trademark infringement on modified WooCommerce plugins: https://www.reddit.com/r/Wordpress/comments/1fqw2eh/automattic_is_suing_festingervault_i_have_not/ https://www.reddit.com/r/Wordpress/comments/1fqw2eh/automatt...
- prox 2y agoThe wording you use “effective for building trust” is a misnomer. As someone who uses ACF, I am suddenly an outcast in the world of Matt/Wordpress.org? And people who I know make money from plugins, are they next in line for the hostile take over treatment? This IS a violent breach of consumer/user trust. Whatever you thought before of this takeover/stealing, this is what trust gone looks like.
- itfossil 2y agoWhat the hell is Mullenweg smoking? Seriously. This dude has completely lost what little was left of his mind.
- gg-plz 2y ago[dead]
- pluc 2y agoGot a call today from a client I hadn't heard from in 5 years. They use ACF, they use another plugin that WPEngine acquired to move their uploaded files to S3. They're freaking out at all this and worried about how the next thing might impact their business... so they want off WordPress. Thanks for the work, Matt!
- nikcub 2y agoa very common story. not just damaging for WP but OS as a whole when it comes to large companies attempting to decide on a stable outcome.
- 2024user 2y agoThe whole thing is confuinsing. It turns out WP Engine is not part of WordPress (despite the name) and has never contributed to WordPress. WordPress are trying to take more control of their name/trademark.
- chii 2y agoThere's more to the story, as recounted in other threads here. It isn't as one sided as you would imply.
- 2024user 2y agoExplain it then?
- misnome 2y agoThey do contribute, that’s a lie. Also, the wordpress trademark policy _explicitly_ listed what they were saying as OK until it was updated last week when they refused to pay his protection racket.
- deleted 2y ago[deleted]
- tiffanyh 2y agoDidn’t WPE change ACF to pull updates from WPE (on Oct 2nd), essentially at Matt’s request … because one of Matt issues with WPE, is that they were putting undue infrastructure load/cost on Wordpress.org And then days after WPE makes this update, Matt then hijacks their plugin. Am I understanding this correctly? https://www.advancedcustomfields.com/changelog/ https://www.advancedcustomfields.com/changelog/
- recursivegirth 2y agoJust finished submitting our companies RFP to 4 vendors for our 2025 website redesign. We are moving from WP to a React enterprise CMS. Thanks for the job security Matt :).
- PeterZaitsev 2y agoI think it is interesting spotlight on bigger picture - marketplaces and distribution channels. Linux distribution maintainers for example can modify the open source software they include to their liking. What about Docker ? Github ? What those folks can and can't do is likely not to be question of (Open Source) license but rather what agreement you have with them...