Earlier quoted context omitted.
WPE contributes to WordPress; Matt is just full of shit on this. It's an excuse, not a reason.
What does WPE contribute? I ask from a place of curiosity. Code, money?
[deleted]
WordPress.org's latest move involves taking control of a WP Engine plugin
131–140 of 222 posts
Re: WordPress.org's latest move involves taking control of a WP Engine plugin
#132To me, WordPress used to be the thing you used if you wanted a website that was easy to put together but was full of third party php spaghetti code and security holes. Now, it's completely radioactive.
[deleted]
Re: WordPress.org's latest move involves taking control of a WP Engine plugin
#133Earlier quoted context omitted.
> Where is the CVE? What risk is there continuing to use the original plugin? Here’s the diff showing what has changed: https://plugins.trac.wordpress.org/changeset?new=3167679%40a...
For those reviewing the changeset: There are two places where they read a value directly from $POST into an $args array. There is no validation applied, which means an attacker can inject whatever value they wish.
And 2 problems jn the fix:
- It’s a specific symptom fix: The same problem could occur with $_COOKIE or $_REQUEST always being available
- The cleanup is not done in a finally{}, so random missing vars when an exception occurs.
Exec summary: Horrible code as always in WP.
Re: WordPress.org's latest move involves taking control of a WP Engine plugin
#134To me, WordPress used to be the thing you used if you wanted a website that was easy to put together but was full of third party php spaghetti code and security holes. Now, it's completely radioactive.
I wouldn't even really call it that. I only think Wordpress is easier if one of two things is true:
1. You are actually building a dynamic site; eg WooCommerce is much easier than building your own storefront.
2. Your users refuse to use Markdown, and are paying you enough to double the overhead and put it all on you.
It gives me a good chuckle when I see posts on here like "We use Wordpress and then scrape the static assets and serve it as a static site from S3". I won't denigrate those people; I'm sure there are good contextual reasons to do that. I just think it's a pretty damning indictment for it to be downgraded from "the software that runs the website" to "a web-hosted WYSIWIG editor for people who can't/won't do Markdown".
Re: WordPress.org's latest move involves taking control of a WP Engine plugin
#135can someone please explain the feud for those of us who are out of the loop?
Matt Mullenweg - owner of wordpress.org (open-source project) and wordpress.com (paid WordPress hosting provider)
He is angry that WPEngine makes money with Wordpress hosting. He thinks wordpress.com should be the only paid WordPress hosting provider.
He demanded 8% of revenue of WP Engine or he would embark on a “scorched earth nuclear approach” to WP Engine.
Re: WordPress.org's latest move involves taking control of a WP Engine plugin
#136Re: WordPress.org's latest move involves taking control of a WP Engine plugin
#1371. Release your code as open source.
2. Make a fortune.
3. Complain that people are freeloading.
4. Abuse your power as project founder to punish them, torching the community trust you’ve built up over decades.
5. Profit?
Whatever Mullenweg hoped to gain by undermining WPEngine can’t possibly be worth the damage he’s done to WP and his own company.
Re: WordPress.org's latest move involves taking control of a WP Engine plugin
#138I just cancelled my ACF subscription as it's up for renewal in 30 days. I'll wait and see how the dust settles.
My advice would be to make plans to move away from WordPress entirely. While I think that the “supply chain attack” is hyperbolic, if technically true, it’s indicative of an organization that cares about winning more than ensuring any form of stability whatsoever to their users and clients. Beware.
I agree, If I were an IT manager this sort of stuff would make me start looking at alternatives.
If an app/pluging/package is maintrained and published by X, I want to make sure no one else can interefere with it - even if they have good intentions.
What Automattic should have done is removed the plugin from distribution and told WP Engine to fix the problem. By doing what they did they have breached the trust of their users.
Re: WordPress.org's latest move involves taking control of a WP Engine plugin
#139Mullenweg calls it a fork. I could see that being somewhat okay if it's indeed for security fixes, but removing the upsells is petty at the very least. But a fork doesn't take control of the original, so I wonder what they did there? Perhaps a redirect from the ACF entry to SCF? To be honest, none of this makes WordPress look good... It just seems like a douche move.
It can hardly be called a fork when you wipe every mention of the original dev team in the codebase, and start a fresh changelog with 'Patched security fixes' whilst thanking his team. It's an absolute takeover not a fork.
The thanks come from the upstream release notes for 6.3.8, FWIW.
Re: WordPress.org's latest move involves taking control of a WP Engine plugin
#140To me, WordPress used to be the thing you used if you wanted a website that was easy to put together but was full of third party php spaghetti code and security holes. Now, it's completely radioactive.
I wouldn't even really call it that. I only think Wordpress is easier if one of two things is true: 1. You are actually building a dynamic site; eg WooCommerce is much easier than building your own storefront. 2. Your users refuse to use Markdown, and are paying you enough to double the overhead and put it all on you. It gives me a good chuckle when I see posts on here like "We use Wordpress and then scrape the stati…
In my experience, Markdown isn't the barrier. It's the:
- Plugin ecosystem. Marketing people want to use specific plugins for SEO, automatic internal linking, etc. Those plugin only work with wordpress.
- Marketing people want to deploy to production. They hate waiting for dev to do anything (which brings us back to the importance of the plugin ecosystem, to add functionality without developers).
- It's a familiar system that doesn't need to be "learned" by end users (the same way VS Code, VIM, or whatever is your preferred code editor)
If it weren't for the first 2 barriers, I think the 3rd (learning markdown) is the easiest to overcome. Especially with side-by-side realtime markdown rendering, which itself is a form a WYSIWYG.
Edit: FWIW, we moved to Webflow at my company, used to be on Wordpress, and before that used to have a Markdown-compiled site, help docs, and blog. Markdown-compiled was my favorite as a developer (and also the most performant), but it was everyone else's least favorite because it required me to deploy and make code changes, and they weren't patient enough to put a ticket in for every change request. They also understandably didn't want to login Github to make updates to markdown files.