Everything In Our Power

WordPress is a community of hundreds of people that read the code every day, audit it, update it, and care enough about keeping your blog safe that we do things like release updates weeks apart from each other even though it makes us look bad, because updating is going to keep your blog safe from the bad guys. I’m not clairvoyant and I can’t predict what schemes spammers, hackers, crackers, and tricksters will come up with with in the future to harm your blog, but I do know for certain that as long as WordPress is around we’ll do everything in our power to make sure the software is safe. We’ve already made upgrading core and plugins a one-click procedure. If we find something broken, we’ll release a fix. Please upgrade, it’s the only way we can help each other.

Matt Mullenweg, September 5, 2009, “How to Keep WordPress Secure“,

Do read the rest of the potent post — articulate, insightful, and honest.

wp-content in Code is a Tell for Common WordPress Coding Mistakes

Regularly while reviewing themes and plugins, I’ll see URLs or paths that include ‘wp-content’. This is a often a hint of a WordPress coding mistake.

Consider this simple example:
<link rel="stylesheet" href="http://example.com/wp-content/themes/default/style-ie.css" type="text/css" media="screen" />

If as part of a migration or server change, WordPress ends up in a sub-directory this will break.

For file system based access, if I see ABSPATH . '/wp-content/ … things are likely OK, though if WP_CONTENT_DIR or similar are changed, this will also break.

I’m tempted to use the constant STYLESHEETPATH or is it TEMPLATEPATH? But, those are static variables initialized early in the WordPress run.

I’ve been meaning to write this article for a while. Serendipitously, when I went to write a first draft of it, Mark Jaquith‘s had just published “Force CSS changes to “go live” immediately“.

In the comments, demetris suggests using STYLESHEETPATH, but Will Norris quickly points out “sure, but you still have the same problem of bypassing any plugins that may be using the ’stylesheet_directory’ hook to pull the stylesheet from some place else entirely.”

Mark’s solution beautiful illustrates how to get the the URL location of the theme’s files and also directly the URL for the main stylesheet style.css:

<link rel="stylesheet" href="<?php bloginfo('stylesheet_url'); echo '?' . filemtime( get_stylesheet_directory() . '/style.css'); ?>" type="text/css" media="screen, projection" />

What Will describes is exactly what WordPress.com depends on. We have a similar, but much more complex solution to deal with the CSS in the content delivery network (CDN) going stale on updates, and also some web browser’s with their funky caches not keeping up. Our solution is both for WordPress’s front end and dashboard (also dealing with the various ways CSS can be called or @imported).

I do have one niggle about Mark’s solution, and it’s the same with most WordPress code out there, the use of bloginfo(). Strings within strings within strings within strings give me headache, so to ease readability and make it more verbose replace:

bloginfo('stylesheet_url'); with
echo get_stylesheet_uri();

bloginfo('stylesheet_directory'); with
echo get_stylesheet_directory_uri();

If you look up in the codex get_stylesheet_directory() you’ll see that would be the file system path, which is confusing given the behavior of bloginfo('stylesheet_directory'); returning the URL. This presents another reason why I favor the consistency of always using the specific getter function calls. Also, when I’m using bloginfo() calls, I have a tendency to get in a mind set where I think I’m directly retrieving the option in the database (accessing directly the info shown in wp-admin/options.php). By using the specific getter function, I remember that there are hooks (actions, filters) that might be triggered.

Some of the other areas, I see wp-content is in CSS style sheets themselves. Relative paths are almost always the correct solution.

Far more painful for me are the plugins that assume where plugins are, because this can take quite a bit of debugging to unwind the assumptions.

That is a topic for me to postulate on another day. Will has written the very relevant “WordPress Plugin Pet Peeve #2: Direct Calls to Plugin Files“. Duane Storey has taken a crack at a “WordPress Plugin Checker“  for these and other common problems (which I’m certain he would enjoy feedback on).

Commercial WordPress Themes’s PHP Code is GPL 2 Too

I’m hoping that my boss Matt Mullenweg sharing the legal opinion on “Themes are GPL, too” will put the issue to rest for the majority of the community (emphasis mime):

PHP in WordPress themes must be GPL, artwork and CSS may be but are not required.

Even though graphics and CSS aren’t required to be GPL legally, the lack thereof is pretty limiting. Can you imagine WordPress without any CSS or JavaScript? So as before, we will only promote and host things on WordPress.org that are 100% GPL or compatible. To celebrate a few folks creating 100% GPL themes and providing support and other services around them, we have a new page listing GPL commercially supported themes.”

The legal opinion was provided by Software Freedom Law Center. Council James Vasile provided the findings and blogs at hackervisions.org . James also has posted about this on his own blog in the article “CMS Themes and the GPL“. As I commented there, my fear is:

“people read what they want to get out of it, and case law is the only thing that moves them.”

The legal finding and unchanged policy  are consistent with the intentions of the WordPress developer community and what has been promoted for the four years I’ve been involved.

Talking about licensing really is the suck. Matt’s article became necessary lately as some commercial theme developers have been very aggressive to WordPress community members, who have shared theme code as allowed by WordPress’s viral GPL v2 license.

It frustrates me when I read commercial theme developers complaining about people “stealing” their themes after the thousands of hours they have worked. They make no mention of the hundreds of thousands of hours others have worked on WordPress (counting on the  GPL protecting their freedoms ).

The incredibly exciting news is seeing the various commercially developed and supported themes embrace the GPL in the last 9 months. Theme collections like ThemeShaper (Thematic FrameWork), StudioPress (previously Revolution 2),  and WooThemes are all 100% GPL — those are just the ones I’m familar with, be sure to check out the theme offerings of the other commercially supported GPL themes.

WordPress.com Still Blocked in China

I’ve seen some reports lately that “WordPress is blocked in China”, including some Mashable articles. To clarify, it’s WordPress.com that is blocked, not all sites that run self-hosted WordPress.

Mashable’s “China Blocks Twitter (And Almost Everything Else)” seems to suggest that the block relates to the 20th anniversary of Tiananmen massacre on June 4th. That may be the case for the other major web publishing and social networking sites, but WordPress.com has spent much of the time since the beginning of 2006 blocked by the Chinese government.

It’s an incredibly frustrating, sad situation.

In “Blogging guru chips away at Great Firewall of China” my boss Matt Mullenweg shares:

After some discussions, Mullenweg realised the site would be allowed back online if he agreed to block certain words or topics and give up information to the Chinese communist government about users.

“I started thinking about the DNA of the company,” he said. “That sort of company is not one I would wake up every day and feel passionate about working in.”

The site remains blocked, although Mullenweg, unable to suppress a giggle, points out that the official Chinese line insists it is freely available.

There was a break in the blocking around the time of the Beijing 2008 Olympic Games, but that ended with the games. That was the longest time I know of when people could consistently access WordPress.com from across China.

Part of the Chinese government’s approach seems to be to sometimes allow western hotels access and other specific points — likely to deceive Westerners and cause confusion.

There does not seem to be a reliable way to automate detection of WordPress.com being blocked, regardless of what tools might promise. I’m not surprised that http://greatfirewallofchina.org/ gave up. This is the message on the site’s homepage:

“Because of the ever stricter measures of censorship China imposes on the Internet, the team of www.greatfirewallofchina.org at present can no longer vouch for the reliability of its test tool. We have therefore decided to take the test tool offline.”

Herdict <http://www.herdict.org/>, a project of the Berkman Center for Internet & Society at Harvard University, seems to be a novel, survey based approach to find out which locations are blocking or censoring web sites.

The tool of choice to let people dodge surveillance is Tor <http://www.torproject.org/>. Please consider your own safety and technology expertise before using any such tools. Reporters without borders <http://www.rsf.org/-Anglais-.html> seems like an excellent resource if you are considering reporting from a dangerous place.

Monday, June 8th Update

A reliable source in China shares that Twitter is back. The same source also shares:

Specific blockages do appear to coincide with major events, like those in Tibet last year and the recent anniversary, but are also part of general and ever-changing blanket censorship.

The Twitter blockage is really the only new story of the last week (apart from 5 second delay foreign television news blackouts) but the news media wanted to turn it into a larger story, including the WordPress angle.

WordPress has been blocked for years now. Youtube has been blocked for the last 3 months. Twitter went done last week.

While the dates for the last two occurred at the same time as sensitive periods or events, I think both are more about controlling new forms of communication and networking than the particular events. Censorship in China is generally a one-way street with periods of activity ramping up around specific times. I think of it in the same way tax auditors get busy around tax season and government ministries around budget time. The difference being once a site is blocked by thePublic Security Bureau (PSB) here in China, it is very difficult to get it unblocked; given the public security connection in an already opaque closed-door administrative system. A good analogy is trying to get someone off a no-fly list in a bureaucratic security system that lacks transparency.

Domestic blogging sites are heavily controlled and censored (though in an ad hoc way). Chinese video sharing sites are coming under increasing regulation and many believe it was only a matter of time before Twitter, as the newest uncontrolled networking site, was shut down.

SourceForge Projects Moving to WordPress

Open source project hosting has long been a topic that interests me. I stopped recommending venerable SourceForge.net some years ago, as it’s proprietary stack (open source prior to 2001) became crufty and fell behind some of the newer and more agile offerings.

Well, I think it’s time to revisit.

I received an email on Tuesday from the “SourceForge.net Team” with the geeky and lame title of “SourceForge.net feature deprecation upcoming: forums, DocManager, TaskManager, Diary/Notes”. Deprecated should be deprecated from email subject lines, as should negative sounding email subjects.

The meat of the email is the second half (emphasis mine):

We will provide an easy-to-use migration path to move the data to the provided replacements.  We will also provide dumps of this data in case
projects want to do something different with their data.  Additional information on how to obtain or migrate your data will be provided when the
timeline is announced, in a future mailing.

The following applications are due to be deprecated, replaced by high-quality Open Source applications we have in our Hosted Apps offering:

* TaskManager will be replaced by TaskFreak!, dotProject and Trac
(tickets).
* DocManager will be replaced by MediaWiki and Trac (wiki).
* Discussion Forums will be replaced by phpBB.
* Diary and Notes will be replaced by WordPress.

To solicit your feedback on how the migration should be handled, and alternate options you would like us to consider, we are running a survey
for the next 30 days for the user base of each of these applications.  For links to the surveys, please see our Site Status post at:

http://tinyurl.com/q3g8o3

Trac and WordPress (really!) are two of my favorite open source web applications. And all of the applications in that list are highly regarded.

It’s fantastic to see SourceForge getting back to open source — ironic, no. It will be interesting to see how active they are in particulating in those projects. I dont’ think I’ve seen any SorceForge team members participating recently on WordPress’s Bug Tracker (Trac).

It’s also fantastic to see SourceForge engaging their community by posting this on a WordPress powered blog and also using surveys to solicite feedback about the migrations and the tool choices.

I would love to find out how long this change has been in the works and what people made it happen.

I also notice that SourceForge’s own documentation is now in a trac wiki. Wow, as well as Subversion, you can also use either Mercurial or Git.

The SourceForge team has done an incredible amount for open source, and I’m excited to reconsider using SourceForge.net again to future projects.

WordCamp SF Here I Come!

Only two more weeks until WordCamp San Francisco 2009. I can’t wait!

This is the original WordCamp. Every year has been fantastic!  There is no other event that brings so many of WordPress‘s elite together.

They’re friendly people to boot! Thankfully, the elite are welcoming and generous with their time, knowledge, talent and bad jokes (puns). It’s a great learning environment.

The best kept secret about WordCamp is that the speaker line up includes many technology and web luminaries – Matt Cutts, Philip Greenspun, Tim Ferriss, Tara Hunt to name a few of the incredible speakers.

Can you believe it is near free — the $25 cost doesn’t even cover the cost of the food. Thank you sponsors!

Even if WordPress wasn’t your thing (shame!), if you’re in the web, it should be a must attend event. It’s a great event for all bloggers and anyone publishing online.

There is also an after party celebrating the sixth anniversary of WordPress!

And Sunday, we’re hosting a barcamp-esque WordPress developer day:

…expect more hardcore geek content like heavy WordPress performance optimization, BuddyPress internals, an intro to Erlang, a guide to secure coding, WordPress-as-CMS discussions, and more. If there’s a topic you’d like to lead start thinking about it now…

There are only 64 spaces left for WordCamp, so sign up now! (Already 536 people have registered.)

I hope to meet you there.

Budd Family helping at Genius Bar WordCamp SF 2008

Budd Family helping at Genius Bar WordCamp SF 2008, as seen at http://central.wordcamp.org/

Daniel Jalkut, WordPress Hero!

Daniel Jalkut, the proprietor of Red Sweater Software, is the developer of the excellent Mac desktop blog editor MarsEdit. He is also a code contributor to WordPress.

I became acquainted with him about two years ago when he started submitting detailed bug tickets (often with patches!) to WordPress.

I’m the developer of MarsEdit, a Mac desktop blogging application that works with WordPress. When my customers have trouble with the “upload image” functionality, the error responses from WordPress are lackluster. I tracked this down to a simple failure case in xmlrpc.php where the verbose error returned by wp_upload_bits is not being propagated out to the response text.

I’m attaching a proposed diff which addresses this. The diff is against /trunk/ as of today, but I would really love to see this integrated into the 2.1.x branch, because it will have a major impact on my customers’ ability to debug MarsEdit interoperability with their WordPress blog.

Daniel Jalkut
Red Sweater Software

That’s the description of ticket #3981: “Patch: Improve error propagation from newMediaObject failure in xmlrpc.php”.

Starting with #3981 he has participated in 50+ bug reports and fixes in the XML-RPC and ATOMPub areas. He has literally participating every month for the last two year! He collaborates regularly with Joseph Scott and the other members of the WordPress XML-RPC and AtomPub community.

As I have been navigating around the edges of the Mac development communities lately, I’ve learned what a well regarded, active participant Daniel is the indie Mac developer community. I highly recommend his and Manton Reece‘s podcast Core Intuition if you are interested in Mac development.

Daniel comes across as a pragmatic, thoughtful, eloquent person. As the bug above suggests, it’s in the interest of giving his customers fantastic service that he participates in WordPress development. And WordPress is much better software thanks to his participation!

He also regularly recommends the WordPress.com service or the WordPress.org software depending in his customers’s needs and tech savviness.

Daniel Jalkut is a WordPress developer and advocate. He is a WordPress Hero!

Official WordPress Logos and Fan Art

I know that Matt Mullenweg and Matt Thomas die a little each time they see WordPress fan art that uses a faux logo. I only notice the chubby W because I’ve been edumacated.

MT (the real) has updated WordPress.org/about/buttons with official WordPress logos in pngs and vector image formats.

WordPress Logos and WordPress Buttons

WordPress Logos and WordPress Buttons

There are also WordPress desktop wall paper in various official colors and sizes. The official WordPress colors are given in a variety of code systems. Pantone 7468 anyone?

Fan Art

The fan art page could use some fresh contributions.

These naturalized WordPress logos would be nice additions:

WordPress India Independence Logo by Allan Fernandes

WordPress India Independence Logo by Allan Fernandes

One or more of the WordPress Malaysia Independence Logos by Avijit Paul. My favorite are the one’s with the flower for the O:

WordPress Malaysia Independence Logos by Avijit Paul

I love the WordCamp Philippines logo:

WordCamp Philippines Logo by Andrew Dela Serna

WordCamp Philippines Logo by Andrew Dela Serna

What is your favorite WordPress art?

Lorelle’s category icons are brilliant. For example, she uses this image for WordPress News:

Anyone know the creator of this popular images?

Halo WordPress Logo

Same day correction: previously the article suggested the font is Dante, but both Matts have come to my rescue. It used to be the WordPress logo font. When Jason Santa Maria designed the new logo a few years ago, he chose the lovely Mrs. Eaves.

Adam Freetly identified the creator of the “lens flare” logo as being Dan Philibin.

WordPress Bright Logo

WordPress "Lens Flare" Logo by Dan Philibin

March 7th, 2010 update: I asked Matt Thomas what font is used on the “W” logo. “It does appear that Jason Santa Maria used Dante for the “W” logo. It’s clearly been heavily modified; no shipping version of Dante has the vertical proportions that our logo does. But yep — when they created the new logo, they kept a little vestige of Dante around. Maybe it’s a good luck charm. :)

WordCamp Shirt, Do You Do Spelling Bees?

One of the many things that Kathy Seirra’s session at WordCamp SF 2008 has me thinking about is what does WordPress say about us using it. And what do WordPress shirts say about the us wearing them.

About half way through her session she talks about “T-Shirt First Development (Guy Kawasaki)”. I have about 7 WordPress shirts. Occasionally, the ones with the WordPress logo will lead to a conversation — even here in quiet Victoria — with a blogger or web developer, but the ones that spark the most conversations are the WordCamp ones.

Here are some photos from Flickr of people rocking each year’s WordCamp SF shirts:

Joshua Wiltshire in WordCamp 2006 Tee

Chris Heuer in WordCamp SF 2007 Tee. Photo by Laughing Squid.

Alan Levine in WordCamp SF 2008 Tee.
















Although WordCamps are happening all over the world, understandably, for most, shirts are not in the budget.

Shirt not in the budget.

Shirt not in the budget for Dane Hurtubise. Photo by Michael Cummings.

I have found only one photo of a WordCamp tee from another WordCamp:

WordCamp South Africa 2008 Tee

WordCamp South Africa 2008 Tee

When wearing a WordCamp shirt, conversations with strangers often start, “WordCamp, do you do spelling bees?” After I get over my initial little bit of embarrassment, I explain “WordCamps are WordPress conferences. WordPress is the blogging software that I use and contribute to.” It’s a great ice breaker, and lets me pimp the Press.

I haven’t had any particular funny conversations or found myself in any strange situations, but I like to imagine that others have.

Kris Krug captured what looks like master of creating conversations Francine Hardaway giving everyone a flash of WordCamp during her Gnomedex session:

Jokes. Kris’s next photos reveal that Francine was doing an on stage costume change, or maybe transforming from mild mannered Francine (can’t imagine) to part of Generation Y (which her session was about). I can’t wait for the video!

Has a WordCamp shirt taken you to any strange places?


Photos Used (because WordPress captions feature doesn’t yet support links):

  1. Joshua Wiltshire self-portrait.
  2. Chris Heuer photo by Scott Beale.
  3. Alan Levine self-portrait.
  4. Dane Hurtubise photo by Michael Cummings.
  5. Photo by Flickr member StrategyOnline.
  6. Francine Hardaway photo by Kris Krug.

Thursday Update: Aiza sent me a link to “WordCamp [Philippines] Preparation

WordCamp Philippines 2008 Tee.

WordCamp Philippines 2008 Tee.

Broken WordPress Plugin or Theme, Blame Me

WordPress community superstar and regular web tools collection contributor Jeff Chandler (jeffr0) recently published a passionate article, “Stop Blaming The WordPress Team“. The article is about plugin developers blaming WordPress for too frequent updates without testing of popular plugins. His conclusion ends “So the next time you upgrade WordPress and realize your favorite plugin is broke, don’t blame the WordPress team, blame the source.” There are almost 200 comments on the article, and reading through them I imagine almost all perspectives are represented.

My hope is you don’t blame anyone. Maybe, it’s the core WordPress developers fault, maybe it’s the plugin or theme’s author, but that matters much less than everyone involved staying positively pumped.

The worse possible outcome is plugin developer and theme designer exhaustion. These people are as much the WordPress team as anyone is!

Thank contributors. For many that is all the compensation they are looking for, but don’t berate the contributor that is looking for more.

The blame game doesn’t help. Instead, if the plugins or themes you use are a gift to you (free), blog about, comment on forums, write the authors directly thanking them for the work that you miss because it isn’t working with the newest version of WordPress. Why wait till there is a problem, thank them today.

If you really need to blame someone, blame me. I can take it.