Free and Open Source from the Roots Up

Free and open source from the roots up. “Open source” can be much more than a development methodology. For me, it also constitutes a world view that upends institutionalized notions of competitive advantage that saw their apex in the twentieth century.”

Excerpt from Paul Kim‘s “Why I Joined Automattic” published September 9, 2009.

Freedom by Abnel Gonzalez, Hosted on Flickr, CC by

Freedom by Abnel Gonzalez, CC by, Flickr Hosted

I’ve come to think of the people who build open source and free culture into their businesses as not only having the creativity and resolve to put their values at the core of their businesses, but also the foresight and humility to know that the future is always built on the past, that the future is outside of their control, but possibly not their contribution.

This is one of the main reasons I so enjoy working with Matt Mullenweg, Toni Schneider, the rest of the Automattic crew, and the WordPress.com VIPs and WordPress businesses I get to so regularly interact with. I’m ecstatic that Paul has joined us!

Everything In Our Power

WordPress is a community of hundreds of people that read the code every day, audit it, update it, and care enough about keeping your blog safe that we do things like release updates weeks apart from each other even though it makes us look bad, because updating is going to keep your blog safe from the bad guys. I’m not clairvoyant and I can’t predict what schemes spammers, hackers, crackers, and tricksters will come up with with in the future to harm your blog, but I do know for certain that as long as WordPress is around we’ll do everything in our power to make sure the software is safe. We’ve already made upgrading core and plugins a one-click procedure. If we find something broken, we’ll release a fix. Please upgrade, it’s the only way we can help each other.

Matt Mullenweg, September 5, 2009, “How to Keep WordPress Secure“,

Do read the rest of the potent post — articulate, insightful, and honest.

wp-content in Code is a Tell for Common WordPress Coding Mistakes

Regularly while reviewing themes and plugins, I’ll see URLs or paths that include ‘wp-content’. This is a often a hint of a WordPress coding mistake.

Consider this simple example:
<link rel="stylesheet" href="http://example.com/wp-content/themes/default/style-ie.css" type="text/css" media="screen" />

If as part of a migration or server change, WordPress ends up in a sub-directory this will break.

For file system based access, if I see ABSPATH . '/wp-content/ … things are likely OK, though if WP_CONTENT_DIR or similar are changed, this will also break.

I’m tempted to use the constant STYLESHEETPATH or is it TEMPLATEPATH? But, those are static variables initialized early in the WordPress run.

I’ve been meaning to write this article for a while. Serendipitously, when I went to write a first draft of it, Mark Jaquith‘s had just published “Force CSS changes to “go live” immediately“.

In the comments, demetris suggests using STYLESHEETPATH, but Will Norris quickly points out “sure, but you still have the same problem of bypassing any plugins that may be using the ’stylesheet_directory’ hook to pull the stylesheet from some place else entirely.”

Mark’s solution beautiful illustrates how to get the the URL location of the theme’s files and also directly the URL for the main stylesheet style.css:

<link rel="stylesheet" href="<?php bloginfo('stylesheet_url'); echo '?' . filemtime( get_stylesheet_directory() . '/style.css'); ?>" type="text/css" media="screen, projection" />

What Will describes is exactly what WordPress.com depends on. We have a similar, but much more complex solution to deal with the CSS in the content delivery network (CDN) going stale on updates, and also some web browser’s with their funky caches not keeping up. Our solution is both for WordPress’s front end and dashboard (also dealing with the various ways CSS can be called or @imported).

I do have one niggle about Mark’s solution, and it’s the same with most WordPress code out there, the use of bloginfo(). Strings within strings within strings within strings give me headache, so to ease readability and make it more verbose replace:

bloginfo('stylesheet_url'); with
echo get_stylesheet_uri();

bloginfo('stylesheet_directory'); with
echo get_stylesheet_directory_uri();

If you look up in the codex get_stylesheet_directory() you’ll see that would be the file system path, which is confusing given the behavior of bloginfo('stylesheet_directory'); returning the URL. This presents another reason why I favor the consistency of always using the specific getter function calls. Also, when I’m using bloginfo() calls, I have a tendency to get in a mind set where I think I’m directly retrieving the option in the database (accessing directly the info shown in wp-admin/options.php). By using the specific getter function, I remember that there are hooks (actions, filters) that might be triggered.

Some of the other areas, I see wp-content is in CSS style sheets themselves. Relative paths are almost always the correct solution.

Far more painful for me are the plugins that assume where plugins are, because this can take quite a bit of debugging to unwind the assumptions.

That is a topic for me to postulate on another day. Will has written the very relevant “WordPress Plugin Pet Peeve #2: Direct Calls to Plugin Files“. Duane Storey has taken a crack at a “WordPress Plugin Checker“  for these and other common problems (which I’m certain he would enjoy feedback on).

GPL Isn’t a Good License for Proprietary Software

Yesterday, I wrote about the clarification regarding WordPress Themes and the GPL (v2). Daniel Jalkut, who I featured as a personal WordPress Hero earlier this year, wrote one of the most interesting responses to “[WordPress] Themes are GPL, too“. Written on Thursday and temporarily taken offline by the fireball, Daniel’s “Getting Pretty Lonely” article laments that WordPress is GPL, and that any open source software that uses a GPL license discourages developer community participation.

At first this article left me very upset, maybe because I found it quite persuasive, but then I reflected that for anyone developing and selling proprietary software, Daniel’s is the only position to believe in and promote.

Commercial WordPress Themes’s PHP Code is GPL 2 Too

I’m hoping that my boss Matt Mullenweg sharing the legal opinion on “Themes are GPL, too” will put the issue to rest for the majority of the community (emphasis mime):

PHP in WordPress themes must be GPL, artwork and CSS may be but are not required.

Even though graphics and CSS aren’t required to be GPL legally, the lack thereof is pretty limiting. Can you imagine WordPress without any CSS or JavaScript? So as before, we will only promote and host things on WordPress.org that are 100% GPL or compatible. To celebrate a few folks creating 100% GPL themes and providing support and other services around them, we have a new page listing GPL commercially supported themes.”

The legal opinion was provided by Software Freedom Law Center. Council James Vasile provided the findings and blogs at hackervisions.org . James also has posted about this on his own blog in the article “CMS Themes and the GPL“. As I commented there, my fear is:

“people read what they want to get out of it, and case law is the only thing that moves them.”

The legal finding and unchanged policy  are consistent with the intentions of the WordPress developer community and what has been promoted for the four years I’ve been involved.

Talking about licensing really is the suck. Matt’s article became necessary lately as some commercial theme developers have been very aggressive to WordPress community members, who have shared theme code as allowed by WordPress’s viral GPL v2 license.

It frustrates me when I read commercial theme developers complaining about people “stealing” their themes after the thousands of hours they have worked. They make no mention of the hundreds of thousands of hours others have worked on WordPress (counting on the  GPL protecting their freedoms ).

The incredibly exciting news is seeing the various commercially developed and supported themes embrace the GPL in the last 9 months. Theme collections like ThemeShaper (Thematic FrameWork), StudioPress (previously Revolution 2),  and WooThemes are all 100% GPL — those are just the ones I’m familar with, be sure to check out the theme offerings of the other commercially supported GPL themes.

WordPress.com Still Blocked in China

I’ve seen some reports lately that “WordPress is blocked in China”, including some Mashable articles. To clarify, it’s WordPress.com that is blocked, not all sites that run self-hosted WordPress.

Mashable’s “China Blocks Twitter (And Almost Everything Else)” seems to suggest that the block relates to the 20th anniversary of Tiananmen massacre on June 4th. That may be the case for the other major web publishing and social networking sites, but WordPress.com has spent much of the time since the beginning of 2006 blocked by the Chinese government.

It’s an incredibly frustrating, sad situation.

In “Blogging guru chips away at Great Firewall of China” my boss Matt Mullenweg shares:

After some discussions, Mullenweg realised the site would be allowed back online if he agreed to block certain words or topics and give up information to the Chinese communist government about users.

“I started thinking about the DNA of the company,” he said. “That sort of company is not one I would wake up every day and feel passionate about working in.”

The site remains blocked, although Mullenweg, unable to suppress a giggle, points out that the official Chinese line insists it is freely available.

There was a break in the blocking around the time of the Beijing 2008 Olympic Games, but that ended with the games. That was the longest time I know of when people could consistently access WordPress.com from across China.

Part of the Chinese government’s approach seems to be to sometimes allow western hotels access and other specific points — likely to deceive Westerners and cause confusion.

There does not seem to be a reliable way to automate detection of WordPress.com being blocked, regardless of what tools might promise. I’m not surprised that http://greatfirewallofchina.org/ gave up. This is the message on the site’s homepage:

“Because of the ever stricter measures of censorship China imposes on the Internet, the team of www.greatfirewallofchina.org at present can no longer vouch for the reliability of its test tool. We have therefore decided to take the test tool offline.”

Herdict <http://www.herdict.org/>, a project of the Berkman Center for Internet & Society at Harvard University, seems to be a novel, survey based approach to find out which locations are blocking or censoring web sites.

The tool of choice to let people dodge surveillance is Tor <http://www.torproject.org/>. Please consider your own safety and technology expertise before using any such tools. Reporters without borders <http://www.rsf.org/-Anglais-.html> seems like an excellent resource if you are considering reporting from a dangerous place.

Monday, June 8th Update

A reliable source in China shares that Twitter is back. The same source also shares:

Specific blockages do appear to coincide with major events, like those in Tibet last year and the recent anniversary, but are also part of general and ever-changing blanket censorship.

The Twitter blockage is really the only new story of the last week (apart from 5 second delay foreign television news blackouts) but the news media wanted to turn it into a larger story, including the WordPress angle.

WordPress has been blocked for years now. Youtube has been blocked for the last 3 months. Twitter went done last week.

While the dates for the last two occurred at the same time as sensitive periods or events, I think both are more about controlling new forms of communication and networking than the particular events. Censorship in China is generally a one-way street with periods of activity ramping up around specific times. I think of it in the same way tax auditors get busy around tax season and government ministries around budget time. The difference being once a site is blocked by thePublic Security Bureau (PSB) here in China, it is very difficult to get it unblocked; given the public security connection in an already opaque closed-door administrative system. A good analogy is trying to get someone off a no-fly list in a bureaucratic security system that lacks transparency.

Domestic blogging sites are heavily controlled and censored (though in an ad hoc way). Chinese video sharing sites are coming under increasing regulation and many believe it was only a matter of time before Twitter, as the newest uncontrolled networking site, was shut down.

SourceForge Projects Moving to WordPress

Open source project hosting has long been a topic that interests me. I stopped recommending venerable SourceForge.net some years ago, as it’s proprietary stack (open source prior to 2001) became crufty and fell behind some of the newer and more agile offerings.

Well, I think it’s time to revisit.

I received an email on Tuesday from the “SourceForge.net Team” with the geeky and lame title of “SourceForge.net feature deprecation upcoming: forums, DocManager, TaskManager, Diary/Notes”. Deprecated should be deprecated from email subject lines, as should negative sounding email subjects.

The meat of the email is the second half (emphasis mine):

We will provide an easy-to-use migration path to move the data to the provided replacements.  We will also provide dumps of this data in case
projects want to do something different with their data.  Additional information on how to obtain or migrate your data will be provided when the
timeline is announced, in a future mailing.

The following applications are due to be deprecated, replaced by high-quality Open Source applications we have in our Hosted Apps offering:

* TaskManager will be replaced by TaskFreak!, dotProject and Trac
(tickets).
* DocManager will be replaced by MediaWiki and Trac (wiki).
* Discussion Forums will be replaced by phpBB.
* Diary and Notes will be replaced by WordPress.

To solicit your feedback on how the migration should be handled, and alternate options you would like us to consider, we are running a survey
for the next 30 days for the user base of each of these applications.  For links to the surveys, please see our Site Status post at:

http://tinyurl.com/q3g8o3

Trac and WordPress (really!) are two of my favorite open source web applications. And all of the applications in that list are highly regarded.

It’s fantastic to see SourceForge getting back to open source — ironic, no. It will be interesting to see how active they are in particulating in those projects. I dont’ think I’ve seen any SorceForge team members participating recently on WordPress’s Bug Tracker (Trac).

It’s also fantastic to see SourceForge engaging their community by posting this on a WordPress powered blog and also using surveys to solicite feedback about the migrations and the tool choices.

I would love to find out how long this change has been in the works and what people made it happen.

I also notice that SourceForge’s own documentation is now in a trac wiki. Wow, as well as Subversion, you can also use either Mercurial or Git.

The SourceForge team has done an incredible amount for open source, and I’m excited to reconsider using SourceForge.net again to future projects.

WordCamp SF Here I Come!

Only two more weeks until WordCamp San Francisco 2009. I can’t wait!

This is the original WordCamp. Every year has been fantastic!  There is no other event that brings so many of WordPress‘s elite together.

They’re friendly people to boot! Thankfully, the elite are welcoming and generous with their time, knowledge, talent and bad jokes (puns). It’s a great learning environment.

The best kept secret about WordCamp is that the speaker line up includes many technology and web luminaries – Matt Cutts, Philip Greenspun, Tim Ferriss, Tara Hunt to name a few of the incredible speakers.

Can you believe it is near free — the $25 cost doesn’t even cover the cost of the food. Thank you sponsors!

Even if WordPress wasn’t your thing (shame!), if you’re in the web, it should be a must attend event. It’s a great event for all bloggers and anyone publishing online.

There is also an after party celebrating the sixth anniversary of WordPress!

And Sunday, we’re hosting a barcamp-esque WordPress developer day:

…expect more hardcore geek content like heavy WordPress performance optimization, BuddyPress internals, an intro to Erlang, a guide to secure coding, WordPress-as-CMS discussions, and more. If there’s a topic you’d like to lead start thinking about it now…

There are only 64 spaces left for WordCamp, so sign up now! (Already 536 people have registered.)

I hope to meet you there.

Budd Family helping at Genius Bar WordCamp SF 2008

Budd Family helping at Genius Bar WordCamp SF 2008, as seen at http://central.wordcamp.org/

Mozilla SEO & Firefox Tips & Tricks Web Page Bugs

Update Thurs, May 7th (2 days later): Mozilla is working on the issue for Mozilla.com “Bug 491985 – Title tag changes for select product pages on Mozilla.com to help SEO rank “. To clarify, the improvement is more search engine clicks than ranking.

I provided some feedback to Mozilla just over a month ago about the Mozilla Firefox Start Page tip of handy tips & tricks (how meta):

“Get the most out of your Firefox! Improve your skills with some handy tips & tricks.”

I’m sure web browser developers share my passion for these web page details, but nothing has changed yet.

As I often see other sites with similar issues, I might as well share this web development tip & trick ;-) and other suggestions.

<Title> Tags

First, the <title> field is bad SEO. Says
<title>Mozilla Products | Tips &amp; Tricks</title>
instead of including “Firefox”:
<title>Firefox Tips &amp; Tricks | Mozilla Products </title>

Actually, all the product pages are likely in need of switching the “Mozilla Products” to the end.

This made a big difference for WordPress.com search traffic way back when.

I work with many of our WordPress.com VIP new customers on this issue. Their instinct is to always have their brand or blog name first. But think of which search result you would be more likely to click on? In fact, WordPress historically made it to easy to get this wrong, so in version 2.5 a 3rd parameter ‘seplocation’ was added to wp_title() to make it easier to do it correctly.

So http://www.mozilla.com/en-US/products/ title would become

<title>Firefox Web Browser &amp; Thunderbird Email Client | Mozilla Products</title>
(Plus title case for the win.)

I suggested they give it try and see what happens ;-) I’d be surprised if it does not squeeze a little more juice out.

Wow, there are lousy <title> tags all over their sites ;-)

http://www.mozilla.org/projects/ title is just <title>Featured Projects</title> Hopefully, David Boswell will have a chance to coax out of someone some work here during the current redesign ;-)

Firefox Tips & Tricks

The Manage Your Downloads is an advanced tip? Say what?

“Find it a Flash” intermediate tip reads:

The Find As You Type feature is another handy timesaver. Rather than
using the “find” bar to search for a word on page, just click anywhere
on that page and start typing the word you want. Your cursor will
immediately jump to the first instance of that term.

“You can use it for links, too. For example, instead of moving your
mouse across the page to a “learn more” link, just start typing the
word and when the cursor finds it, press enter.

It does not say that this is disabled by default, and can be enabled at Advanced > Accessibility or any other hint or tip ;-) Also, the phrase “on page” feels awkward, maybe “on a page”.

PS. I would not recommend enabling this, because it breaks some web apps that have click to edit.

Daniel Jalkut, WordPress Hero!

Daniel Jalkut, the proprietor of Red Sweater Software, is the developer of the excellent Mac desktop blog editor MarsEdit. He is also a code contributor to WordPress.

I became acquainted with him about two years ago when he started submitting detailed bug tickets (often with patches!) to WordPress.

I’m the developer of MarsEdit, a Mac desktop blogging application that works with WordPress. When my customers have trouble with the “upload image” functionality, the error responses from WordPress are lackluster. I tracked this down to a simple failure case in xmlrpc.php where the verbose error returned by wp_upload_bits is not being propagated out to the response text.

I’m attaching a proposed diff which addresses this. The diff is against /trunk/ as of today, but I would really love to see this integrated into the 2.1.x branch, because it will have a major impact on my customers’ ability to debug MarsEdit interoperability with their WordPress blog.

Daniel Jalkut
Red Sweater Software

That’s the description of ticket #3981: “Patch: Improve error propagation from newMediaObject failure in xmlrpc.php”.

Starting with #3981 he has participated in 50+ bug reports and fixes in the XML-RPC and ATOMPub areas. He has literally participating every month for the last two year! He collaborates regularly with Joseph Scott and the other members of the WordPress XML-RPC and AtomPub community.

As I have been navigating around the edges of the Mac development communities lately, I’ve learned what a well regarded, active participant Daniel is the indie Mac developer community. I highly recommend his and Manton Reece‘s podcast Core Intuition if you are interested in Mac development.

Daniel comes across as a pragmatic, thoughtful, eloquent person. As the bug above suggests, it’s in the interest of giving his customers fantastic service that he participates in WordPress development. And WordPress is much better software thanks to his participation!

He also regularly recommends the WordPress.com service or the WordPress.org software depending in his customers’s needs and tech savviness.

Daniel Jalkut is a WordPress developer and advocate. He is a WordPress Hero!