8 ms·

ACF Plugin no longer available on WordPress.org

221 points by michaelcampbell 2y ago

CodeWriter23 2y ago
IMO this situation is what the GPL was created for.
michaelcampbell 2y ago
"Advanced Custom Fields" developer accuses Matt Mullenweg of taking over, without consent, their WordPress plugin.
- deleted 2y ago
  [deleted]
denislour 2y ago
Wow, this is a big deal. Matt Mullenweg taking over ACF like that? Not cool. It's not just about messing with years of hard work, but think about all those WordPress sites now running code the ACF team didn't approve. Kinda scary when you think about it. Hope this doesn't become a trend in the open-source world.
- mrinfinitiesx 2y ago
  It needs to stop here.
- TiredOfLife 2y ago
  And this is different from WP Engine modifying Wordpress exactly how?
  - mingus88 2y ago
    Well, we can start with the fact that WP Engine hasn’t taken over any domain previously owned by Wordpress
  - odo1242 2y ago
    WP engine never modified WordPress. They took stock Wordpress and edited a configuration file to disable revisions. They didn’t actually change any code.
    - mgkimsal 2y ago
      I thought they'd also modified revisions to have a limit, instead of unlimited. Even when 'enabled', it's not how the rest of the wp installs would behave (iirc). Likely there was some code change there to enable that restriction.
      - CodeWriter23 2y ago
        You're out here on HN acting completely unfamiliar with the idea of configuring to limit resource consumption?
      - odo1242 2y ago
        No. They add the below to wp-config.php: define ('WP_POST_REVISIONS', 3);
      - mldevv 2y ago
        They use the parts of wordpress that are specifically built in to make modifications, as any other site maintainer would hosting their own install. You are mistaken.
  - dmje 2y ago
    Um, no: WP Engine changed a variable in wp-config
  - FireBeyond 2y ago
    Let's be really, really clear here. Matt might pontificate about "bastardizing and messing with" WordPress, but this is what he is actually referring to: A. Single. Configuration. Option. A. Changed. Default. Post revisions are a configuration option in the admin panel. They are enabled by default. Some hosting providers (and I expect WPE is not the only one) set it to disabled by default. That's it. This is not remotely comparable. Even without the ACF situation, Matt's description of WPE bastardizing the fundamental offering of WordPress is asinine at best, actively deceptive at worst (and that's where we seem to be, so far).
  - andix 2y ago
    WP Engine modified their own WordPress installations. WordPress.org modified third party WordPress installations.
gnabgib 2y ago
Discussions: (160 points, 23 hours ago, 174 comments) https://news.ycombinator.com/item?id=41821336 https://news.ycombinator.com/item?id=41821336 (383 points, 23 hours ago, 188 comments) https://news.ycombinator.com/item?id=41821400 https://news.ycombinator.com/item?id=41821400
chris_wot 2y ago
Hang on, the ACF plugin has been replaced by a different plugin, published by a different party? And install on every Wordpress installation?!?
- marpstar 2y ago
  That's correct. But not if you were using ACF Pro.
- chx 2y ago
  The whole thing is https://plugins.trac.wordpress.org/changeset/3167679/advanced-custom-fields/tags/6.3.6.2 https://plugins.trac.wordpress.org/changeset/3167679/advance... it's very close to functionality wise right now to ACF. Not identical, already. While I am not a lawyer it almost certainly violates the ACF trademark as the code and reviews contains a lot of reference to ACF and the Advanced Custom Fields trademark which is literally the project slug. Some suspect a request for emergency injunction might follow next week. And most certainly it also violates community trust very, very big time. This on top of the "swear fealty" checkbox on login which caused multiple high profile contributors to leave and now shut the accessibility team down https://i.imgur.com/0jCZnlm.png https://i.imgur.com/0jCZnlm.png
  - TavsiE9s 2y ago
    Excuse me for being OOTL: what "WP Engine checkbox"?
    - deleted 2y ago
      [deleted]
    - Crosseye_Jack 2y ago
      They added a checkbox to the wordpress.org login page https://login.wordpress.org/ https://login.wordpress.org/ stating "I am not affiliated with WP Engine in any way, financially or otherwise.", you can't login to the site without checking it.
system2 2y ago
Oh god, this gave me a minor heart attack. We are using over 20 ACF fields for 150+ sites. I thought it was completely out of the WordPress ecosystem. I am glad they have the zip download and continuing auto updates. EDIT: I confirm our ACF plugins on sites are all switched to secure custom fields. This is so shady, it broke our snippets because we are using prepend and append texts to wrap our field values. Now they are all broken and we have to update all our sites (also our client's sites). Let's see what comes next... EDIT2: There goes my Sunday. I received our first ticket regarding broken homepage widgets. I have to sit down and update every site one by one. Thank you Matt Mullenweg for ruining my Sunday plans.
- gg-plz 2y ago
  As someone who doesn’t use it, were those features removed into the patch? If they’re actively breaking people’s sites I’d hope they can get an emergency injunction ASAP, and maybe someone can start a CFAA investigation.
- yawnxyz 2y ago
  this is my nightmare
- btown 2y ago
  This should be the top comment. It's already scary for a package manager to take control of a community package, even more so when sites auto-update to new code... but to break existing sites by completely changing the code that is provided in an auto-update is beyond the pale. Not a lawyer, but I imagine many consultancies will be talking to lawyers about this one; there are entire sections of law about interfering with other companies' contracts with each other. At minimum it's an appalling breach of trust.
  - didgeoridoo 2y ago
    “Advanced Tortious Interference”
    - sharphall 2y ago
yidhsvc 2y ago
The official wp announcement of this said “we don’t plan on doing this to other plugins.” lol. anyone think they pinky promise? More like: build on Wordpress and unless you kiss the ring some guy named Matt will disappear your business.
- mikeyinternews 2y ago
  Exactly. He also ends his post with a "separate" boast about poaching one if WPE's engineers. It's so obvious that this is just a giant FU to WPE and nothing else https://wordpress.org/news/2024/10/secure-custom-fields/ https://wordpress.org/news/2024/10/secure-custom-fields/
- gg-plz 2y ago
  https://x.com/WordPress/status/1845180576531468375 https://x.com/WordPress/status/1845180576531468375 > Hey @WordPress. Are there any further plugins that we can expect to be forked? > There are no others we're aware of at this time, but you are welcome to suggest some.
  - aliasxneo 2y ago
    I thought that was satire, but they actually asked for suggestions…
    - CodeWriter23 2y ago
      Search for Mullenweg's comment, here: https://make.wordpress.org/core/2024/10/13/fields-api-team-seeking-new-leadership/ https://make.wordpress.org/core/2024/10/13/fields-api-team-s...
- Zealotux 2y ago
  The key word here is "plan".
maxbond 2y ago
To me this is indistinguishable from an account takeover attack executed by an insider. I doubt any prosecutor would be interested, but to my eyes WordPress.org has violated the CFAA by accessing WordPress instances outside the bounds of their authorization. They were authorized to modify WordPress instances in ways ACF prescribed, not in ways of their own choosing. I'm not saying I'd like to see Mullenweg in chains, I wouldn't. But WP.org's escalating legal exposure is really concerning. I feel like we're at risk of losing a cornerstone of the web. People are talking about a different open source CMS eating their lunch, but I think the more likely scenario is that people move to Square Space, Wix, Facebook, et cetera, and open source content management becomes niche.
- btown 2y ago
  IMO it's also notable that Mullenweg is in this state of mind and also has access to Tumblr data, with a history of allegedly doxxing the relationships between anonymous user blogs based on non-public information [0]. One doesn't need to agree with the moderation decision, or take sides on the political context around it, to understand that there is a tremendous amount of centralized power here, that norms are going out the window, and that an entire ecosystem is at risk. [0] https://techcrunch.com/2024/02/22/tumblr-ceo-publicly-spars-with-trans-user-over-account-ban-revealing-private-account-names-in-the-process/ https://techcrunch.com/2024/02/22/tumblr-ceo-publicly-spars-...
  - maxbond 2y ago
    In hindsight this should've been all the warning anyone needed. In the future, when a BDFL telegraphs that they're willing to abuse their powers like this, we need to fork immediately. Open source is more important than any single project or any single BDFL. We can't allow open source to appear risky or unreliable relative to proprietary software, subject to the whims of volatile personalities. Open source is kind of like libraries - an institution for the collective good people managed to erect in the past that would be neigh impossible to replicate today. Imagine convincing companies in any other industry to collaborate openly and freely with their competitors merely because it's good for society as a whole. You'd be labeled a socialist and laughed out of the room. If we lose it, it's probably gone for good.
didgeoridoo 2y ago
This is particularly bananas as ACF is basically table stakes for doing anything beyond blogging. I’d assume most websites that make actual money are thoroughly dependent on it. To twist the knife on a personal spat, Mullenweg just blew up uncountable businesses on a double-holiday weekend. At this point, seriously, fuck that guy.
- wmf 2y ago
  They replaced ACF with a forked version so the functionality is still there. That doesn't excuse it but the situation is not so dire for users.
  - GenerocUsername 2y ago
    Asking for a friend... What's the migration path to a different plugin look like? Seamless? Better be duckin seamless
    - CodeWriter23 2y ago
      Tell your friend to get ready to jump to the next thing.
    - mattrad 2y ago
      You don't need to migrate from ACF to a different plugin, you can still access ACF and received future updates indepedent of wordpress.org. See https://www.advancedcustomfields.com/blog/installing-and-upgrading-to-the-latest-version-of-acf/ https://www.advancedcustomfields.com/blog/installing-and-upg...
    - wmf 2y ago
      https://dorve.com/blog/ux-news-articles-archive/wp-forks-acf-to-create-scf/#first_scf_analysis_similarities_and_differences https://dorve.com/blog/ux-news-articles-archive/wp-forks-acf...
  - noapologies 2y ago
    There are examples of things breaking in this very comment section [1]. Given how widely used ACF is, it wouldn't be surprising to learn that a lot of weekends were ruined by the "fork". [1] https://news.ycombinator.com/item?id=41830709 https://news.ycombinator.com/item?id=41830709
sourcecodeplz 2y ago
[flagged]
rossant 2y ago
I don't see how Mullenweg could escape lawsuits on this one.
- ChocolateGod 2y ago
  IANAL but I don't think there's anything illegal in doing what he did here. But destroying trust in Wordpress? Absolutely
jeltz 2y ago
It is insane how Matt once again seem totally unable to understand the difference between Autoamattic and the WordPress Foudnation.
- FireBeyond 2y ago
  The challenge is that this drama seems to be unmasking the reality that for the past decade or more, Matt has grown used to referring to Automattic, WP.com, WP.org, and the WPF interchangably and synonymously. Concerning is not just the things he's said, but what he has done that go along with this. Self-dealing? Improper tax accounting?
  - tacon 2y ago
    In the Reddit megathread on the recent drama, someone posted a summary of the IRS responses to inurement by the Board of Directors of a non-profit. It isn't pretty! [1] If there is insider inurement, the IRS fine is directed to the Board of Directors (each one of them, however many) for 25% of the value of the benefit. If they do not pay in a timely manner, the bill is 200% of the inurement. Matt is the ultimate insider, "giving" the valuable trademarks to the foundation and then getting to use them for free, while leaning on other companies to pay millions. So the insider inurement is in the millions of dollars, per year, for years. Those two unknown board members of the WordPress Foundation? I hope they have great tax lawyers! [1] https://www.mercadien.com/resource/steep-penalties-for-excess-benefit-transactions/ https://www.mercadien.com/resource/steep-penalties-for-exces...
- throw16180339 2y ago
  There isn't an actual difference. He uses both of them as he sees fit.
  - arielcostas 2y ago
    Wait, and the IRS is happy with all that? With an individual using company resources for what would appear to be "personal" activity outside the company? Same with the foundation?
guluarte 2y ago
Not a single serious developer would release a plugin or theme on wordpress.org after this.
rasso 2y ago
While all of this is very bad, I still dislike the post. „Since 2011“, for example. The plugin was sold two times in the last two years and ended up in the hands of WPEngine in the end. Since then, it has been a bumpy road with ACF, even before this (hugely unsettling!) incident.
- mattrad 2y ago
  I don't know what you mean by "bumpy road". ACF has been solid for years, and has received excellent care and updates since moving to Delicious Brains and then WP Engine.
- dmje 2y ago
  There's been nothing "bumpy" about ACF. It has been solidly supported, developed and documented for years.
- mldevv 2y ago
  My opinion as well as many as my peers is that ACF could have been rolled into core or bought by Matt long long before it was acquired by WPE, which most of us found as a good thing, being that its a critical plugin and gained long term support. Plugins have bumps, that's part of the growth, and some of the changes ACF have made as of recent years, even the ones I disagree with, seem well intentioned and not malicious. I can't say the same for what is happening right now.
ChrisArchitect 2y ago
More discussion: https://news.ycombinator.com/item?id=41821400 https://news.ycombinator.com/item?id=41821400 https://news.ycombinator.com/item?id=41821336 https://news.ycombinator.com/item?id=41821336
dmje 2y ago
Long time WordPress agency owner here. At the heart of this - if you consider it generously - is a principle that we can possibly all sign up to, namely that "large commercial entities" should (should from a moral, not legal standpoint) "pay back" to the open source software that makes them money. The principle however has been totally undermined by MM's actions, which have been completely out of line. His behaviour has been abhorrent. I've been shocked (possibly naively) that a single individual could have such huge power over an open source project that they could literally turn it off (referring here to the update mechanism that WPEngine was using). I've been even more shocked and appalled by this plugin takeover. ACF is a central piece of pretty much all WP developers' / agencies toolkit. Those of us who have been in this game a long time remember WP before it, and the breath of fresh air that it was to finally be able to define complex relationships between posts and provide our users with a GUI that actually worked well for complicated sites. ACF have pushed and supported this technology for years and years - firstly under the expertise of Elliot Condon, now under the aegis of WPEngine. I know some of the developer team at ACF personally - they're excellent people, making brilliant code, and most of them are putting huge efforts into WP as an open source project even aside from their efforts in maintaining and extending ACF. The forking of a plugin is one thing. A fair way to do this would be to fork it, and start from zero installs. Automattic could have done that, promoted the hell out of "SCF" and got users in a way that was at least slightly (?) fair. Simply switching the name and keeping the slug - and thus the 2+million sites - should be thought of as theft. It's outrageous, it's totally petty, and I so far haven't seen a single person being supportive of this (probably?) unilateral action by one - apparently increasingly unhinged - individual. The wider problem of course is the effect this has on the vibrant WP ecosystem which as someone else in this thread has pointed out is a critical (erstwhile) open cornerstone of the web. I am still hoping that this will subside into history and it'll all sort but it has left me and many WP devs I know with a pretty bitter taste.
- hello_moto 2y ago
  > Simply switching the name and keeping the slug - and thus the 2+million sites - should be thought of as theft. He probably is trying to make a point what WPEngine is doing (based on his own perspective)
osbulbul 2y ago
After all this drama, it feels like WordPress has reached its peak and is now starting its decline. Of course, it will take years, and the process may be volatile, but the overall trend will likely be downward.
- andix 2y ago
  AFAIK there is just no other free and open source CMS with a similarly mature ecosystem, which could replace WordPress. So many websites, companies and agencies are built on WordPress, it would take a decade to move away. The only possibility I can think of is a fork.
  - CodeWriter23 2y ago
    The community is just one fork away from a plug-compatible replacement.
    - andix 2y ago
      Exactly. I don’t know if I’m missing something, but a fork is probably possible just by replacing the trademarked „Wordpress“ inside all translations, and a few minor code changes. Variable names/etc inside the code with „wp“ or „Wordpress“ probably don’t violate the trademark. I would estimate a proper fork could be done by 3 developers within two weeks, but whoever is doing it, should get some backing by a company (probably also easy) and some legal consulting.
  - mirzap 2y ago
    Developers are the core of any system. Once they move on, it's game over. What Wordpress.org did sent a clear message to any developer who makes a living on WordPress or a plugin - we can take your plugin and revenue any time we want. No rational person will continue to invest their time in such an ecosystem, no matter its "maturity". It clearly is not mature enough. I would keep an eye on PayloadCMS or Ghost. Those, among others, are the future, IMO.
    - 2y ago
kyriakos 2y ago
This would be the same as Google replacing Spotify with Youtube Music on Play Store and pushing Youtube Music in its place on all Android devices. Its insane.
- jantissler 2y ago
  Even worse: It would be Google taking Spotify‘s app and renaming it YouTube Music. That’s what Matt did. They didn’t develop a new plugin and put it in place of ACF. They just took the existing one and pretend it’s theirs. It’s horrifying. How am I supposed to trust a system that’s governed by a single person that thinks this is okay?
andix 2y ago
I guess the only way forward for now is forking WordPress and creating a new plugin registry. This should be rather easy, because all WordPress plugins are GPL-licensed because of the Copyleft. I don't care about the current dispute, but wordpress.org can't be trusted any more.
- arielcostas 2y ago
  Creating an open registry would be nice, or even for developers to be able to host their own repos for others to install plugins from (à la Linux package managers), to avoid such centralisation. Ideally, those repos would be hosted by each party, and then hosting providers would be able to host their own mirrors containing many packages for all the installs, giving a similar experience to what is now offered by Mr. Mullenweg's WP.org.
  - sangnoir 2y ago
    > Creating an open registry would be nice, or even for developers to be able to host their own repos for others to install plugins from (à la Linux package managers), to avoid such centralisation. The security trade offs for this would not be worth it, IMO, considering WPs auto-updating features.
    - ChocolateGod 2y ago
      One could create a registry that uses PSK similar to mobile applications so a install only auto accepts an updated package if it's signed by the author. Would prevent the issue above.
mikemitchelldev 2y ago
When the drama first started, I thought @photomatt’s plan might be to build ACF directly into WordPress (and maybe get rid of Gutenburg). I’m not sure if taking control of the plug-in is a step in that direction or if he probably could have incorporated ACF without taking over the plug-in. What’s the endgame?
Zealotux 2y ago
I received an email from ACF urging me to update my installs, while I appreciate the gesture, I see they mentioned Matt Mullenweg without specifying who he is or what he did. Now I'm a HN reader but it could be wise to give more context to their many users who are probably clueless of the whole drama.
deleted 2y ago
[deleted]
deleted 2y ago
[deleted]
fixymonk 2y ago
[dead]

CodeWriter23 2y ago

IMO this situation is what the GPL was created for.

michaelcampbell 2y ago

"Advanced Custom Fields" developer accuses Matt Mullenweg of taking over, without consent, their WordPress plugin.

deleted 2y ago
[deleted]

denislour 2y ago

Wow, this is a big deal. Matt Mullenweg taking over ACF like that? Not cool. It's not just about messing with years of hard work, but think about all those WordPress sites now running code the ACF team didn't approve. Kinda scary when you think about it. Hope this doesn't become a trend in the open-source world.

mrinfinitiesx 2y ago
It needs to stop here.
TiredOfLife 2y ago
And this is different from WP Engine modifying Wordpress exactly how?
- mingus88 2y ago
  Well, we can start with the fact that WP Engine hasn’t taken over any domain previously owned by Wordpress
- odo1242 2y ago
  WP engine never modified WordPress. They took stock Wordpress and edited a configuration file to disable revisions. They didn’t actually change any code.
  - mgkimsal 2y ago
    I thought they'd also modified revisions to have a limit, instead of unlimited. Even when 'enabled', it's not how the rest of the wp installs would behave (iirc). Likely there was some code change there to enable that restriction.
    - CodeWriter23 2y ago
      You're out here on HN acting completely unfamiliar with the idea of configuring to limit resource consumption?
    - odo1242 2y ago
      No. They add the below to wp-config.php: define ('WP_POST_REVISIONS', 3);
    - mldevv 2y ago
      They use the parts of wordpress that are specifically built in to make modifications, as any other site maintainer would hosting their own install. You are mistaken.
- dmje 2y ago
  Um, no: WP Engine changed a variable in wp-config
- FireBeyond 2y ago
  Let's be really, really clear here. Matt might pontificate about "bastardizing and messing with" WordPress, but this is what he is actually referring to: A. Single. Configuration. Option. A. Changed. Default. Post revisions are a configuration option in the admin panel. They are enabled by default. Some hosting providers (and I expect WPE is not the only one) set it to disabled by default. That's it. This is not remotely comparable. Even without the ACF situation, Matt's description of WPE bastardizing the fundamental offering of WordPress is asinine at best, actively deceptive at worst (and that's where we seem to be, so far).
- andix 2y ago
  WP Engine modified their own WordPress installations. WordPress.org modified third party WordPress installations.

gnabgib 2y ago

Discussions: (160 points, 23 hours ago, 174 comments) https://news.ycombinator.com/item?id=41821336 https://news.ycombinator.com/item?id=41821336 (383 points, 23 hours ago, 188 comments) https://news.ycombinator.com/item?id=41821400 https://news.ycombinator.com/item?id=41821400

chris_wot 2y ago

Hang on, the ACF plugin has been replaced by a different plugin, published by a different party? And install on every Wordpress installation?!?

marpstar 2y ago
That's correct. But not if you were using ACF Pro.
chx 2y ago
The whole thing is https://plugins.trac.wordpress.org/changeset/3167679/advanced-custom-fields/tags/6.3.6.2 https://plugins.trac.wordpress.org/changeset/3167679/advance... it's very close to functionality wise right now to ACF. Not identical, already. While I am not a lawyer it almost certainly violates the ACF trademark as the code and reviews contains a lot of reference to ACF and the Advanced Custom Fields trademark which is literally the project slug. Some suspect a request for emergency injunction might follow next week. And most certainly it also violates community trust very, very big time. This on top of the "swear fealty" checkbox on login which caused multiple high profile contributors to leave and now shut the accessibility team down https://i.imgur.com/0jCZnlm.png https://i.imgur.com/0jCZnlm.png
- TavsiE9s 2y ago
  Excuse me for being OOTL: what "WP Engine checkbox"?
  - deleted 2y ago
    [deleted]
  - Crosseye_Jack 2y ago
    They added a checkbox to the wordpress.org login page https://login.wordpress.org/ https://login.wordpress.org/ stating "I am not affiliated with WP Engine in any way, financially or otherwise.", you can't login to the site without checking it.

system2 2y ago

Oh god, this gave me a minor heart attack. We are using over 20 ACF fields for 150+ sites. I thought it was completely out of the WordPress ecosystem. I am glad they have the zip download and continuing auto updates. EDIT: I confirm our ACF plugins on sites are all switched to secure custom fields. This is so shady, it broke our snippets because we are using prepend and append texts to wrap our field values. Now they are all broken and we have to update all our sites (also our client's sites). Let's see what comes next... EDIT2: There goes my Sunday. I received our first ticket regarding broken homepage widgets. I have to sit down and update every site one by one. Thank you Matt Mullenweg for ruining my Sunday plans.

gg-plz 2y ago
As someone who doesn’t use it, were those features removed into the patch? If they’re actively breaking people’s sites I’d hope they can get an emergency injunction ASAP, and maybe someone can start a CFAA investigation.
yawnxyz 2y ago
this is my nightmare
btown 2y ago
This should be the top comment. It's already scary for a package manager to take control of a community package, even more so when sites auto-update to new code... but to break existing sites by completely changing the code that is provided in an auto-update is beyond the pale. Not a lawyer, but I imagine many consultancies will be talking to lawyers about this one; there are entire sections of law about interfering with other companies' contracts with each other. At minimum it's an appalling breach of trust.
- didgeoridoo 2y ago
  “Advanced Tortious Interference”
  - sharphall 2y ago

yidhsvc 2y ago

The official wp announcement of this said “we don’t plan on doing this to other plugins.” lol. anyone think they pinky promise? More like: build on Wordpress and unless you kiss the ring some guy named Matt will disappear your business.

mikeyinternews 2y ago
Exactly. He also ends his post with a "separate" boast about poaching one if WPE's engineers. It's so obvious that this is just a giant FU to WPE and nothing else https://wordpress.org/news/2024/10/secure-custom-fields/ https://wordpress.org/news/2024/10/secure-custom-fields/
gg-plz 2y ago
https://x.com/WordPress/status/1845180576531468375 https://x.com/WordPress/status/1845180576531468375 > Hey @WordPress. Are there any further plugins that we can expect to be forked? > There are no others we're aware of at this time, but you are welcome to suggest some.
- aliasxneo 2y ago
  I thought that was satire, but they actually asked for suggestions…
  - CodeWriter23 2y ago
    Search for Mullenweg's comment, here: https://make.wordpress.org/core/2024/10/13/fields-api-team-seeking-new-leadership/ https://make.wordpress.org/core/2024/10/13/fields-api-team-s...
Zealotux 2y ago
The key word here is "plan".

maxbond 2y ago

To me this is indistinguishable from an account takeover attack executed by an insider. I doubt any prosecutor would be interested, but to my eyes WordPress.org has violated the CFAA by accessing WordPress instances outside the bounds of their authorization. They were authorized to modify WordPress instances in ways ACF prescribed, not in ways of their own choosing. I'm not saying I'd like to see Mullenweg in chains, I wouldn't. But WP.org's escalating legal exposure is really concerning. I feel like we're at risk of losing a cornerstone of the web. People are talking about a different open source CMS eating their lunch, but I think the more likely scenario is that people move to Square Space, Wix, Facebook, et cetera, and open source content management becomes niche.

btown 2y ago
IMO it's also notable that Mullenweg is in this state of mind and also has access to Tumblr data, with a history of allegedly doxxing the relationships between anonymous user blogs based on non-public information [0]. One doesn't need to agree with the moderation decision, or take sides on the political context around it, to understand that there is a tremendous amount of centralized power here, that norms are going out the window, and that an entire ecosystem is at risk. [0] https://techcrunch.com/2024/02/22/tumblr-ceo-publicly-spars-with-trans-user-over-account-ban-revealing-private-account-names-in-the-process/ https://techcrunch.com/2024/02/22/tumblr-ceo-publicly-spars-...
- maxbond 2y ago
  In hindsight this should've been all the warning anyone needed. In the future, when a BDFL telegraphs that they're willing to abuse their powers like this, we need to fork immediately. Open source is more important than any single project or any single BDFL. We can't allow open source to appear risky or unreliable relative to proprietary software, subject to the whims of volatile personalities. Open source is kind of like libraries - an institution for the collective good people managed to erect in the past that would be neigh impossible to replicate today. Imagine convincing companies in any other industry to collaborate openly and freely with their competitors merely because it's good for society as a whole. You'd be labeled a socialist and laughed out of the room. If we lose it, it's probably gone for good.

didgeoridoo 2y ago

This is particularly bananas as ACF is basically table stakes for doing anything beyond blogging. I’d assume most websites that make actual money are thoroughly dependent on it. To twist the knife on a personal spat, Mullenweg just blew up uncountable businesses on a double-holiday weekend. At this point, seriously, fuck that guy.

wmf 2y ago
They replaced ACF with a forked version so the functionality is still there. That doesn't excuse it but the situation is not so dire for users.
- GenerocUsername 2y ago
  Asking for a friend... What's the migration path to a different plugin look like? Seamless? Better be duckin seamless
  - CodeWriter23 2y ago
    Tell your friend to get ready to jump to the next thing.
  - mattrad 2y ago
    You don't need to migrate from ACF to a different plugin, you can still access ACF and received future updates indepedent of wordpress.org. See https://www.advancedcustomfields.com/blog/installing-and-upgrading-to-the-latest-version-of-acf/ https://www.advancedcustomfields.com/blog/installing-and-upg...
  - wmf 2y ago
    https://dorve.com/blog/ux-news-articles-archive/wp-forks-acf-to-create-scf/#first_scf_analysis_similarities_and_differences https://dorve.com/blog/ux-news-articles-archive/wp-forks-acf...
- noapologies 2y ago
  There are examples of things breaking in this very comment section [1]. Given how widely used ACF is, it wouldn't be surprising to learn that a lot of weekends were ruined by the "fork". [1] https://news.ycombinator.com/item?id=41830709 https://news.ycombinator.com/item?id=41830709

sourcecodeplz 2y ago

[flagged]

rossant 2y ago

I don't see how Mullenweg could escape lawsuits on this one.

ChocolateGod 2y ago
IANAL but I don't think there's anything illegal in doing what he did here. But destroying trust in Wordpress? Absolutely

jeltz 2y ago

It is insane how Matt once again seem totally unable to understand the difference between Autoamattic and the WordPress Foudnation.

FireBeyond 2y ago
The challenge is that this drama seems to be unmasking the reality that for the past decade or more, Matt has grown used to referring to Automattic, WP.com, WP.org, and the WPF interchangably and synonymously. Concerning is not just the things he's said, but what he has done that go along with this. Self-dealing? Improper tax accounting?
- tacon 2y ago
  In the Reddit megathread on the recent drama, someone posted a summary of the IRS responses to inurement by the Board of Directors of a non-profit. It isn't pretty! [1] If there is insider inurement, the IRS fine is directed to the Board of Directors (each one of them, however many) for 25% of the value of the benefit. If they do not pay in a timely manner, the bill is 200% of the inurement. Matt is the ultimate insider, "giving" the valuable trademarks to the foundation and then getting to use them for free, while leaning on other companies to pay millions. So the insider inurement is in the millions of dollars, per year, for years. Those two unknown board members of the WordPress Foundation? I hope they have great tax lawyers! [1] https://www.mercadien.com/resource/steep-penalties-for-excess-benefit-transactions/ https://www.mercadien.com/resource/steep-penalties-for-exces...
throw16180339 2y ago
There isn't an actual difference. He uses both of them as he sees fit.
- arielcostas 2y ago
  Wait, and the IRS is happy with all that? With an individual using company resources for what would appear to be "personal" activity outside the company? Same with the foundation?

guluarte 2y ago

Not a single serious developer would release a plugin or theme on wordpress.org after this.

rasso 2y ago

While all of this is very bad, I still dislike the post. „Since 2011“, for example. The plugin was sold two times in the last two years and ended up in the hands of WPEngine in the end. Since then, it has been a bumpy road with ACF, even before this (hugely unsettling!) incident.

mattrad 2y ago
I don't know what you mean by "bumpy road". ACF has been solid for years, and has received excellent care and updates since moving to Delicious Brains and then WP Engine.
dmje 2y ago
There's been nothing "bumpy" about ACF. It has been solidly supported, developed and documented for years.
mldevv 2y ago
My opinion as well as many as my peers is that ACF could have been rolled into core or bought by Matt long long before it was acquired by WPE, which most of us found as a good thing, being that its a critical plugin and gained long term support. Plugins have bumps, that's part of the growth, and some of the changes ACF have made as of recent years, even the ones I disagree with, seem well intentioned and not malicious. I can't say the same for what is happening right now.

ChrisArchitect 2y ago

More discussion: https://news.ycombinator.com/item?id=41821400 https://news.ycombinator.com/item?id=41821400 https://news.ycombinator.com/item?id=41821336 https://news.ycombinator.com/item?id=41821336

dmje 2y ago

Long time WordPress agency owner here. At the heart of this - if you consider it generously - is a principle that we can possibly all sign up to, namely that "large commercial entities" should (should from a moral, not legal standpoint) "pay back" to the open source software that makes them money. The principle however has been totally undermined by MM's actions, which have been completely out of line. His behaviour has been abhorrent. I've been shocked (possibly naively) that a single individual could have such huge power over an open source project that they could literally turn it off (referring here to the update mechanism that WPEngine was using). I've been even more shocked and appalled by this plugin takeover. ACF is a central piece of pretty much all WP developers' / agencies toolkit. Those of us who have been in this game a long time remember WP before it, and the breath of fresh air that it was to finally be able to define complex relationships between posts and provide our users with a GUI that actually worked well for complicated sites. ACF have pushed and supported this technology for years and years - firstly under the expertise of Elliot Condon, now under the aegis of WPEngine. I know some of the developer team at ACF personally - they're excellent people, making brilliant code, and most of them are putting huge efforts into WP as an open source project even aside from their efforts in maintaining and extending ACF. The forking of a plugin is one thing. A fair way to do this would be to fork it, and start from zero installs. Automattic could have done that, promoted the hell out of "SCF" and got users in a way that was at least slightly (?) fair. Simply switching the name and keeping the slug - and thus the 2+million sites - should be thought of as theft. It's outrageous, it's totally petty, and I so far haven't seen a single person being supportive of this (probably?) unilateral action by one - apparently increasingly unhinged - individual. The wider problem of course is the effect this has on the vibrant WP ecosystem which as someone else in this thread has pointed out is a critical (erstwhile) open cornerstone of the web. I am still hoping that this will subside into history and it'll all sort but it has left me and many WP devs I know with a pretty bitter taste.

hello_moto 2y ago
> Simply switching the name and keeping the slug - and thus the 2+million sites - should be thought of as theft. He probably is trying to make a point what WPEngine is doing (based on his own perspective)

osbulbul 2y ago

After all this drama, it feels like WordPress has reached its peak and is now starting its decline. Of course, it will take years, and the process may be volatile, but the overall trend will likely be downward.

andix 2y ago
AFAIK there is just no other free and open source CMS with a similarly mature ecosystem, which could replace WordPress. So many websites, companies and agencies are built on WordPress, it would take a decade to move away. The only possibility I can think of is a fork.
- CodeWriter23 2y ago
  The community is just one fork away from a plug-compatible replacement.
  - andix 2y ago
    Exactly. I don’t know if I’m missing something, but a fork is probably possible just by replacing the trademarked „Wordpress“ inside all translations, and a few minor code changes. Variable names/etc inside the code with „wp“ or „Wordpress“ probably don’t violate the trademark. I would estimate a proper fork could be done by 3 developers within two weeks, but whoever is doing it, should get some backing by a company (probably also easy) and some legal consulting.
- mirzap 2y ago
  Developers are the core of any system. Once they move on, it's game over. What Wordpress.org did sent a clear message to any developer who makes a living on WordPress or a plugin - we can take your plugin and revenue any time we want. No rational person will continue to invest their time in such an ecosystem, no matter its "maturity". It clearly is not mature enough. I would keep an eye on PayloadCMS or Ghost. Those, among others, are the future, IMO.
  - 2y ago

kyriakos 2y ago

This would be the same as Google replacing Spotify with Youtube Music on Play Store and pushing Youtube Music in its place on all Android devices. Its insane.

jantissler 2y ago
Even worse: It would be Google taking Spotify‘s app and renaming it YouTube Music. That’s what Matt did. They didn’t develop a new plugin and put it in place of ACF. They just took the existing one and pretend it’s theirs. It’s horrifying. How am I supposed to trust a system that’s governed by a single person that thinks this is okay?

andix 2y ago

I guess the only way forward for now is forking WordPress and creating a new plugin registry. This should be rather easy, because all WordPress plugins are GPL-licensed because of the Copyleft. I don't care about the current dispute, but wordpress.org can't be trusted any more.

arielcostas 2y ago
Creating an open registry would be nice, or even for developers to be able to host their own repos for others to install plugins from (à la Linux package managers), to avoid such centralisation. Ideally, those repos would be hosted by each party, and then hosting providers would be able to host their own mirrors containing many packages for all the installs, giving a similar experience to what is now offered by Mr. Mullenweg's WP.org.
- sangnoir 2y ago
  > Creating an open registry would be nice, or even for developers to be able to host their own repos for others to install plugins from (à la Linux package managers), to avoid such centralisation. The security trade offs for this would not be worth it, IMO, considering WPs auto-updating features.
  - ChocolateGod 2y ago
    One could create a registry that uses PSK similar to mobile applications so a install only auto accepts an updated package if it's signed by the author. Would prevent the issue above.

mikemitchelldev 2y ago

When the drama first started, I thought @photomatt’s plan might be to build ACF directly into WordPress (and maybe get rid of Gutenburg). I’m not sure if taking control of the plug-in is a step in that direction or if he probably could have incorporated ACF without taking over the plug-in. What’s the endgame?

Zealotux 2y ago

I received an email from ACF urging me to update my installs, while I appreciate the gesture, I see they mentioned Matt Mullenweg without specifying who he is or what he did. Now I'm a HN reader but it could be wise to give more context to their many users who are probably clueless of the whole drama.

deleted 2y ago

[deleted]

deleted 2y ago

[deleted]

fixymonk 2y ago

[dead]