While working on the TypePad and Movable Type AtomPub Exporters (still in progress), programmer Ronald Heft Jr had a problem interacting with the WSSE authentication both use. The problem ended up being in his own code, but it also led to some interesting observations about how the authentication works.

TypePad doesn’t require as secure code.

This is a good reminder that allowing programmers a less secure option, and they will likely take it because they trust you, and have other deadlines.

WSSE authentication is inheritantly insecure.

When Ronald looked in his Movable Type database he found that the passwords were stored in plain text. WordPress remote access development lead Joseph Scott explains that the only way to support WSSE is to store the passwords in plain text on the server, which is one of the reasons why WordPress won’t be supporting WSSE.

If I wasn’t clear my video really is in no way a comment of the MT Pro product — I’ve never tried it. All the Six Apart teams are clearly very talented, so I’m sure it’s a great product. Though I’m pretty sure it won’t live up to “setting social networking free”.

Let’s break it down:

focus more on telling a story

People that know me, know that I’m all about the story that a product tells, and I think their video failed in the very way that he thinks they succeeded. I didn’t see a compelling story about the experience of Movable Type Pro. As my voice-over reflects, I saw a story that looked like any blogging platform and comments.

Both of us are extremely biased at opposites ends of the spectrum, so neither of us will get it right on this one. I would love to know the results of a diverse group of people each separately watching the video and sharing their reactions.

Honestly, we assume that that everyone else on the web will respond by copying great ideas, as they usually do. Hell, we want them to, so that more people can benefit from open communities on the web.

If you are familiar with Anil’s writing, you may end up with the conclusion, like I have, that he is actually obsessed with being first — or that is one of the SIx Apart key messages anyway. Maybe, it all started because he was Six Apart’s first employee. Check out the Movable Type blog, “A WordPress 2.5 Upgrade Guide” [sic] article for a bit of a taste. If you enjoy the flavor, a Google search will lead you across the Web.

Of any software spaces, blogging is one of the richest for borrowing from each other and providing a consistent experience to customers — everyone benefits from this! I’d like to think WordPress has had as many firsts as any blogging platform, but even if that isn’t the case, I’m much more interested in focusing on doing it well. An example is the TypePad iPhone app was an iPhone launch partner, but the WordPress iPhone app is much more popular, has more reviews, and is higher rated, and we are still busy fixing and improving it.

Until then, they’ve created a parody of our video.

So me spending a couple hours playing around with iMovie in my own time (my 1st time using it), somehow becomes the Automattic answer to MT Pro?! And as I mentioned, no link love, no mention of my name (Lloyd Budd) — very, very bad blogger etiquette. Is iMovie that good that Anil thinks it’s a first rate production? I don’t think so, listening to it again, it is clearly the crap job that I remember doing for my own amusement.

without having your it look like another Facebook or MySpace clone

Did I voice-over the wrong video? I’m pretty sure it was their video that started with Digg, Facebook and MySpace. I might have misspoke, but I thought it would be obvious that I was referring to having social features beyond commenting like those platforms.

Our long-held reputation for publishing highly scalable, “Digg-proof” pages.

That is one of Anil’s favorite sound bites. I know Anil can’t seriously be suggesting that a file based “cache” is a whole solution to being highly scalable.

The funny part is that substitute in WordPress and you have at least an equally true assertion, ‘[WordPress's] long-held reputation for publishing highly scalable, “Digg-proof” pages.’ The reason why this sometimes looks not to be true is because of WordPress’s popularity.

I would bet, with no hesitation, that WordPress sites are far more often dugg, and that unfortunately some of those sites dugg, like my own, are on inexpensive, shared hosted environments that aren’t Digg ready.

For most WordPress customers the dynamic, responsive experience is far more important than “Digg-proof”, but for those that do want to prepare for a digg storm, there are high quality plugins like Super Cache and Batcache and many others that suit your specific configuration and needs.

There is no question that WordPress is scalable, fact is WordPress powers far more of the web than Movable Type, both in terms of web pages served and web sites. Fact is Movable Type doesn’t even power Six Apart’s hosted TypePad, and to my great frustration is incompatible in numerous ways — wonder why there is no Movable Type app for iPhone anyone?

remedy some of the missing features in WordPress if you have enough free time to find the appropriate plugins

Talking out the other side of his face, Anil will point out Movable Type’s rich plugin and theme collection. I’m pretty sure, Pro has even been presented as plugins built on top of MT at one time — bundling.

Of course, there is a huge collection, much larger, of WordPress plugins and themes, and I haven’t heard complaints that it’s hard to find the appropriate plugin. The wordpress.org/extend/plugins gives you information about popularity, and the interface will continue to evolve.

This past weekend, during Matt’s “State of the Word” at WordCamp SF 2008 (video will be online soon!), spoke to how that experience will change and how the actually WordPress plugin usage data will directly help WordPress evolve, with top plugins are polished and integrated into WordPress.

prominent independent security researchers do warn, “[T]he abysmal security practices of WordPress plugin developers places the entire Internet at risk”.

Why pick on the plugin developers brother?

That’s on top of WordPress being one of top ten least secure applications around

Each of the most popular blogging and CMS made the list, as does Linux.

the Department of Homeland Security’s data showing WordPress having twelve times as many reported security vulnerabilities as Movable Type

Should I even touch this one? Since Anil discovered that Home Land Security site I think that has become his favorite. I think it’s more telling that the Department of Homeland Security, and many other US government offices use WordPress (conversation).

And Anil’s article is one of the worst security related articles I’ve ever read. No security expert, nor scientific minded person would sign their name on it with it’s broad, sloppy brush strokes.

There is shame. Security was part of Matt’s State the Word. I don’t know anyone in the WordPress community that is happy with our security history, but it’s getting better and so are our developers.

There is appropriate optimism. With each release I see more potential security issues being reviewed and, when genuine, fixed earlier in the release process. The foundation of WordPress is also being improved to make security mistakes more difficult.

No one justifies the security issues because of popularity, but the IBM’s paper does reflect with popularity comes scrutiny. The loudest message from the paper might be that the bad guys have moved their focus from Windows to open source and to the web.

It seems only in the last couple of years has web security come to the forefront of the industries collective mind, and we’re all learning a lot. All three “top ten”, WordPress, Drupal and Joomla are benefiting from each others improvements, and the larger PHP community is helping a lot.

If Movable Type was as popular, and under the same amount of scrutiny, I can’t imagine they would still be storing passwords as plain text.

I’m confident that WordPress’s security record will get better and better!

The great technology rests on top of world-class support, an incredibly talented professional services group, and a media services team that will help your site and your community succeed.

That last link there is a 404, and maybe that is meta irony there. All those links go to Six Apart services, as does one from earlier in Anil’s article “(We’ll even help you design it.)”.

This is probably the largest difference between Movable Type and WordPress. WordPress is community developed and support — world class.

I remember reading Anil’s comment on Josh Catone‘s Read Write Web article “Six Apart Gets Into Microblogging with Activity Streams“. Here Anil didn’t like that WordPress Prologue — actually that’s a great example of someone not getting the idea, the story — but what bothered me was his attitude towards WordPress plugin developers:

There’s also an important distinction that this is a key part of our platform, developed by the core MT team itself. That means that it’s not a PHP script somebody cobbled together on their own to try to make a lifestream, it’s a framework to actually help open up *all* of these services

I read that as disrespectful to independent developers, WordPress or otherwise.

I see the Automattic team as the WordPress guide. WordPress is completely community created and supported. Automattic takes on the big (scalability) problems that the community doesn’t have the resources for like: providing the free WordPress.com service and fuding usability testing of a new WordPress dashboard experience.

We work with our community, not compete with our community. The work Automattic does is open source, released under the GPL.

Though the WordPress Consultants list, wp-pro and WP jobs are pretty good tools, currently, I expect much of the WordPress professionals’ work through personal relationships in the community. I think this is one of our greatest opportunities as a community. If you agree (blog about it) get in touch with Toni.

I mentioned that the work Automattic does is open source, whenever possible (Akismet is an exception). This isn’t the case with Six Apart’s Movable Type. I’ve written at length, “Movable Type 200% Open Source!“, about the missed opportunity.

With the release of Movable Type Pro, I think Six Apart’s current approach is bad for open source and actually dilutes open source. It seems others share my opinion, as on every thread there seems to be an open source advocate upset about MT Pro not being open source.

At first I was excited to see that the open source information was now on MovableType.com’s download page:

But then I realized the game this table plays is that the open source version isn’t good enough for “Bloggers”, only freetards like myself. I’m pretty sure, I’ve also read Six Apart telling people that the open source version isn’t tested or supported (but it’s the same software without some plugins, promise).

First, we set publishing free. Next up, social networks.

Actually, the WordPress community can take that first credit (not that I’m obsessed with 1sts) by creating the most popular installed blogging software, and it being open source. I don’t know about the next up, but there are many contenders, and WordPress and BuddyPress communities would be honored to be among them.

If I wanted to use Movable Type Pro for a social network with that Six Apart’s pricing it would probably be a social network of one. Anyway, without it being open source, it won’t be setting any one free, just making it a little easier to disobey the boss.

And that is why I think, Anil, people are so excited about BuddyPress, because it is among the real possibilities of setting social networking free.

our lead by planning to provide some of these abilities for WordPress in a collection of plugins that you should be able to assemble around Christmastime or so

There are so many reasons why I don’t know whether to laugh or cry.

Anil Dash has been pissing all over the web calling BuddyPress vaporware. See his comments at:

• CNET Webware “Movable Type, WordPress becoming social platforms“
• Mashable, “Six Apart Provides Social Networking Capabilities with Movable Type Pro“

Where I come from, vaporware is a derogatory term. It’s clear that he doesn’t like WordPress BuddyPress being part of the conversation.

BuddyPress isn’t vaporware, a community is developing it today. You can download the code today. It is open source today!

I get emails and IMs from friends that have checked it out and are already grooving on where it is going.

Collection of plugins

That is just a packaging issue, and packaging issues are easy.

Christmastime or so

This coming from a key member of the team that made a press release seven months before the open source flavor of Movable Type — well over a year, if a public bug tracker is an important detail to you. The community will decide when the code is ready to be called a product.

Wow, this is way long. I’ll wrap it up here.

I didn’t find the Movable Type Pro introductory video well done or sincere, hence the parody. Am I really so bad for poking fun at the competition? Does the tension date back to Six Apart not being invited to the Blogger and WordPress dance off?

I thought it was ripe for parody, and so here is my voice-over:

Update: Six Apart shared my video with all of their customers, but gave no link love or attribution to me (no Lloyd Budd anywhere in sight), see my response “Movable Type Pro, Setting Social Networking Free, Vaporware, WordPress, BuddyPress“

I whole heartily recommend you try the open source flavor of Movable Type. It is clearly a great product created by fantastic people.

If you are thinking you only have time to try one other blogging software than WordPress, my time and money is on Drupal. People bringing Drupal into the conversation as an alternative has been one of my favorite parts of the discussions. Built on the same PHP stack that powers WordPress and much of the rest of the high performance web. Drupal is the full featured CMS with the heart and minds of the open source communities (I hang out with). Its blogging experience isn’t as polished out of the box as WP or MT, but it’s getting there — and we’re working hard at staying focused and one step ahead of them

If you have time please do share what you love about these other personal publishing environment, particularly if it relates to something that annoys you about WordPress. This way WordPress participants can respond by letting our code do the talking.

If you are currently using WordPress then your highest priority will likely be to plan to take a look at WordPress 2.5 as a release candidate will be coming very soon — watch the WordPress Development blog for the news.

I’m disappointed by Anil’s “upgrade guide”, but not surprised. I used to greatly respect Anil Dash, but in the last year I’ve grown to mostly only respect his abilities. He speaks of sincerity, but I don’t see any other way to interpret the following comments, and other parts of his argument, other than being patronizing and insincere:

I should think that the WP community would be more frustrated with Automattic not having the 2.5 release ready (or even a release date) than with someone pointing out that there are good options for bloggers.

And from the same comment:

And honestly, it may well be that Matt isn’t used to the way that competition works when you’re a well-funded company with tens of millions of dollars in the bank. I know it took us a while to adjust to the reality of how perceptions change in that situation. But given that Automattic’s raised many millions more dollars than Six Apart, I certainly don’t think it’s unfair for us as an underdog to point out our strengths.

The least Anil could do was give us some time to spend some of the money before playing the underdog card.

He is also very passionate in the “upgrade guide” about doing everything first. I’m not really interested, nor do I think most people are, in who did what first. When I get focused on firsts, my friends generously either help escape my nostalgia or my indulgent in the latest fad. I’m reminded to refocus on substance, on how the details come together to create the experience, and what real problems we need to solve together.

Solving problems together is the spirt of open source. I explicitly pointed out that Anil’s post is on the .com blog, because although Six Apart has improved its open source message since I wrote ”

Movable Type 200% Open Source!” Six Apart can be an even greater open source ambassador. As I wrote in the discussion around the 200% article, the lack of open source messaging on movabletype.com is one of the things as an open source evangalist I find disheartening. Looking today I could only find a mention of the Movable Type open source flavor [sic] on movabletype.com down in the Pricing FAQ. I find it awkward then that Anil’s “upgrade guide” talks heavily about open source technologies.

I’m a little upset at Michael Sippey’s response “we’re here to compete” in support of Anil’s “upgrade guide”. I had hoped that Anil had made the mistake of writing such an article on his own. In responded to one part of his article I wrote there:

If you think WordPress is “provided by Automattic”, you don’t understand WordPress and how we and most other open source products operate. WordPress is nothing without the participation of the community.

All those other flavors of Movable Type aren’t open source. As I’ve been discussing with Darren Hoyt regarding Expression Engine:

A popular open source platform ensures maintainability (or transition to another popular open platform) and no vendor lock. Sure, it can be good for your own business to use tools that require specialized knowledge and much fewer people have expertise in but even then having to maintain it may affect your sanity later

Boris Mann, champion of Drupal, and VP of Product Development at Raincity Studios says it even more poignantly:

The “enemy” here is proprietary systems (and those really are quotes around enemy, as I recall having a great discussion with a proprietary Java based system developer this morning at CCI2008). They are not good for business, they are not
good for communities, and they are not good for the growth of this
interlinked web of data that is becoming truly useful.

As Matt wrote in “WordPress is Open Source“, “Movable Type has 8 different licenses and the [open source] one doesn’t allow any support.”

Matt wrote “WordPress is Open Source” partially in response to Movable Type product manager and lead developer Byrne Reese’s comment:

@Sunnduwn – I think that is a question better asked of Automattic. Anil, and certainly not Six Apart, has never been briefed, nor has anyone for that matter been presented with an accounting of what is open and closed source at Automattic.

Byrne you or anyone else just have to ask. Actually, I remember you have asked related questions and I answered you as best as could there.

What we produce that isn’t open source relates to some of the work I’ve quietly (out of the public eye, anyway) long been doing with our hosted solutions. I’m always asking, what isn’t open source and why isn’t it?

Please continue to challenge us here, and challenge us more. Sometimes we won’t answer you as quick as you like or provide the source code as quick as you like, but where we hesitate it is most often to make sure that you don’t have to trudge through some quick hacks, but instead get to benefit from what we learn from them. As Matt says “there is more GPL stuff on the way, as well. ”

I do love the passion of the conversations that are taking place! But please don’t take my, Anil, Michael, or Matt’s passionate words on what is a better solution, we are all incredible biased — I don’t trust myself when it comes to talking about WordPress or the competition.

I remember reading the title of Don Dodge’s post “Vista more secure than Linux, Apple OSX, and Windows XP” and thinking “this ought to be rich”. I did have my problems with the article, and shared my thoughts on it (reading it now, I was a little too intense in my arguments — see what I mean about passion), but I came away really respecting Jeff Jones, Director of Trustworthy Computing at Microsoft [sic].

Here is how Jeff ends his post “Exactly how biased am I?”

Am I biased? I do not think so, but let’s just all keep assuming I am, because I don’t mind. If I make comparisons, I’ll lay out my metrics. I’ll lay out my assumptions. I’ll describe the methodology. Then, if you want to dispute the results, debate the assumptions, or critique the methodology, I’ll ask the same of you. Regardless of the outcome, all sides will get presented, progress is made and that’s a win for interested readers.

That is where Anil’s article fails. His post is one sound bite after another without at least the minimum of links to the technical details. I also got a kick out of how he is motoring along with his “comparision” [sic] with WordPress, and then switches into “A Dashboard That Measures Success”, “Design Matters”, “Get Support Right From The Source”, which I’m not sure are ways MT differentiates itself positively or maybe at all — anyway, his case there is even less clear than the rest of the article.

Jay Allen also wrote “Nothing was said that was untrue about Movable Type or WordPress and, aside from the cheeky title, the post spoke much more to me about the pride and excitement the team has in their new version which they wanted to communicate to the world.”

If the article was about his team’s pride and excitement that would be awesome, but a large part is actually comparisons without context or substance.

But maybe I’m wrong. Or maybe Shelley Powers’ is correct and “Anil’s post was rather funny, and tongue in cheek”. Or just maybe, Anil read and misunderstand “Overcoming Bias: My Favorite Liar”

I’m really glad for Anil’s “upgrade guide”, because it presents to our face some of the Six Apart FUD that potential customers come to us with when considering either WordPress.com VIP hosting or the Automattic Support Network. As I said, it’s a great launching point for more conversations.

Competition is awesome. Most important is having different open source solutions with focus on different problems, or different solutions to the same problems.

It doesn’t really matter what I think. You all know where all our heart and mind lies. I’m most interested in hearing from people still living in a neutral nation, digging in and getting diry with the design decisions and technical details of the real challenges you need to solve, and how well the WordPress experience treats you in response.

This is good news for all bloggers. Someday soon trackbacks can be retired.

The greatest reason why this is good news is because pingbacks, unlike trackbacks, require us to do nothing. Trackbacks require you to copy and paste a special URL

As he suggests, “[pingback] is marginally less spammy than TrackBack”, but he has the greatest reason wrong. The reason why it is as implimented in in WordPress is because WordPress follows the “MAY requirement” — he has you there — of confirming that the link exists in the article that pung.

Regardless of how “many WordPress blogs out there, it would be a disservice to Movable Type users not to”. If you are using some other blogging platform that doesn’t automattically linkback articles using pinkback, ask them to end the madness (or give us something even better)of an experience that unnecessarily requires your work, trackback.

TrackBack is pretty broken as it stands today. The discovery mechanism is god-awful, and the protocol is prone to exploitation and spam. Generally speaking, given the percentage of TrackBacks that are spam, it makes me wonder why bother at all.

If you are a software developer I highly recommend you read the whole article, because it sounds like he is describing some problems with pingbacks and the opportunity for an even better linkback technology.

Mon, Feb 11 Update: Byrne explains that I was mistaken and that Trackback does have an autodiscover mechanism. Long before getting involved in WordPress someone explained it to me that those are the reason you see a special URL in Movable Type blogs was so you could copy and paste it and use it to link your article to that article’s comments, and I never questioned it.

This discussion leads me to the conclusion that there is no reason to include a “Trackback URL” visually in the viewers experience.

Go to the Scot Hacker Bird House and read Notes on a Massive WordPress Migration. Scott, the webmaster of the UC Berkeley Graduate School of Journalism, and O’Reilly author knows his stuff, and backs it up with the data. Brilliant insights!