Hacker News Reader

Comment by safety1st | Hacker News Reader

Hi Matt, great that you're participating here and I'm broadly supportive regarding your concerns with the trademark and WP Engine's conduct.

However I do not understand why you chose to make 1.5 million enemies in the WordPress community in one weekend by shutting down their ability to update plugins with zero warning and consequently reducing the security of their websites.

To be entirely blunt it's all damage control for us at this point when your name comes up, and it's because of that one singular mistake, if this was just WPE and Automattic duking it out in court no one would really care, but now the reliability of the WPOrg infrastructure is being questioned by a big chunk of the people who depend on WordPress and they will probably be inclined to walk away from your infrastructure and deeper into the arms of someone like WPEngine when they get the chance.

If you care about the broad perception of your efforts and your business practices I think you need to address this. Again I see that there are plenty of reasons to take issue with WPE's conduct but this singular decision you made has people calling for you to step aside and let someone else run WordPress. It's not going to go away on its own.

View on HN

> make 1.5 million enemies in the WordPress community in one weekend by shutting down their ability to update plugins with zero warning

AWS and Digital Ocean run local Ubuntu download servers and do not depend on Canonical to run their business. WPEngine is a hosted service and could make very simple changes to download updates from their own servers.

> WPEngine is a hosted service and could make very simple changes to download updates from their own servers.

This all kicked off when he publicly accused WP Engine of “butchering” WordPress for disabling revisions:

> What WP Engine gives you is not WordPress, it’s something that they’ve chopped up, hacked, butchered to look like WordPress, but actually they’re giving you a cheap knock-off and charging you more for it.

— https://wordpress.org/news/2024/09/wp-engine/

Disabling revisions is a configuration change. This is the simplest possible change you could make, and it’s unacceptable in his eyes.

Making WordPress contact something other than api.wordpress.org requires altering the codebase. Making this configurable is something he has explicitly rejected:

> Why would I build that? The built-in source works great, for tens of millions of servers.

— https://news.ycombinator.com/item?id=41676885

So according to Mullenweg:

- If WP Engine alters WordPress, even just to alter its configuration, they are “butchering” it.

- If WP Engine doesn’t alter WordPress and leaves it pointing at api.wordpress.org, they are unfairly using community resources.

– Huge numbers of people using api.wordpress.org is actually “great” and scales to tens of millions of servers.

As far as I can see, he doesn’t have a consistent position. He’s just grabbing hold of the nearest accusation that he thinks will harm WP Engine in the heat of the moment, regardless of what he has previously claimed or who else it hurts.

I don't understand why wp engine don't just maintain a fork

Have a look at the WordPress core. ;-)

Here's a nice example: https://github.com/WordPress/WordPress/blob/92d9e70f849c337c...

So in your opinion what's wrong with that code? To me it seems to be nicely documented and everything.

That it is - it better be.

It's an example of the kind of backwards compatibility WordPress needs to deal with the myriad of crazy content generated by people (and plugins!) over the years. Often this gets very chatty and very inefficient.

Besides backwards compatibility, this codebase grew like a jungle, with people just piling code on, not always with much forethought. Part of it's due to the limitations of PHP in the old days, and of course it's inherent with projects of this size, but there are varying degrees of messiness. WordPress is an example of a project that started out too messy and only became more messy over time.

Just to pile on: the WPDB class is another example of continued messiness. The first thing I do whenever I write a plugin, is to add a little database wrapper that just uses PHP PDO instead. Anything better than to deal with the hopeless, inefficient, inflexible mess that is WPDB. (To whoever wrote it: sorry mate!)

Edit: this guy said it better: https://news.ycombinator.com/item?id=41729827

So even better, WP engine could rewrite it from scratch in a better way. Maybe even use another language.

Or maybe it is just fine for their use case and they are making already enough money with it...

> Disabling revisions is a configuration change. This is the simplest possible change you could make, and it’s unacceptable in his eyes.

Actually this is wrong. Yes the constant WP_POST_REVISIONS exists. But WP Engine has disabled this constant. They do in fact "butcher" WordPress in the sense that they remove a feature, you can't turn it back on by yourself, and you need to talk to their support to get a limited version of it re-enabled by them.

Add to that, revisions are a big deal for a certain type of customer. Say, an enterprise scale publisher for example who has built an extensive publishing workflow around WP. (Hacker News consistently underestimates how massive some WordPress installs are; the scale of the world's biggest publishers, many of whom rely on WordPress, blows your nice little startup out of the water.)

So I am aware of a case or two where this actually became a negotiating point in an enterprise contract. The customer was entirely unaware that revisions were just a free thing built into WP, and it influenced the resulting contract and cost. Dirty dirty on WPE's side, really.

BTW this is documented at https://wpengine.com/support/platform-settings/ and you can see on that page that they limit their environment in many other ways. In the abstract this may not be a huge problem, hosts have costs and security and various limitations to think about. In my personal experience there are limitations which are not listed on that page and those are more frustrating.

The revision system is terrible though. Even we limit it for our clients. It doubles or triples the amount of queries your site and admin needs to run. Have some multi language plugin on top and your site will be eating memory and cpu. If WordPress would have made an actual usuable revision system, this wouldnt have been an issue at all

I think this is where Matt's perspective actually makes sense: "So, you guys built a $400M/yr business on our open source project, and when you had problems with the revision system, instead of contributing improvements, you just turned it off (and maybe converted it into an enterprise upsell some people are paying extra for!)?"

Intel, Google, even Microsoft etc. develop improvements to Linux knowing full well that their competitors will also get access to those improvements. For sure it's disappointing that WP Engine contributes almost no time to Core.

WPEngine has tons of developers working on the WordPress ecosystem. This contribution argument doesn't work with me. They're contributing plenty of hours into WordPress plugins that their competition also can use.

Is there a list ?

No they don't. They contribute 40 hours a week.

That's the amount of hours they contribute to the "Five for the Future" program which specifically refers to work on a subset of the WordPress project managed by Automattic. For example, WPEngine own and develop Advanced Custom Fields, a plugin used by hundreds of thousands of WordPress websites. The work they do on that isn't covered in the 40 hours. Likewise, WPEngine run the DE{CODE} conference but that isn't included in the 40 hours either.

> https://www.advancedcustomfields.com/blog/reflecting-on-two-...

Oh, I remember now. I was wondering why ACF didn't become part of the core.

Is there a list of wordpres plugins WPEngine actively maintain ?

To recap, every post is stored in the wp_posts table and revisions have a post_type of 'revision' and a post_status 'inherit' (attachments also inherit). There's no gradual improvement you can do to this. More, their codex does not discourage accessing the database directly at all rather points out there's a class to make it easy https://codex.wordpress.org/Database_Description so moving revisions to a separate table will break every plugin which wants to access revisions and uses the wpdb class to do so which is just not acceptable: "WordPress strives to never break backward compatibility. It’s one of our most important philosophies, and makes updates much easier on users and developers alike".

We can have debates about whether this philosophy is the right one or not but there's no point. It's what it is and it makes fixing things like this simply not possible.

WordPress is infamous for its terrible codebase. Everything is jammed into a single wp_posts table including revisions. The frontend code is just as bad. I'm sure they blame the need for backwards compatibility. The entire thing should be retired.

The entire thing makes money and serves the purposes of people using it even for free.

It's a well-engineered product whether you want to accept it or not. Unlike more than half of the tech world that's unprofitable and is just a fart in the wind of tech memory.

No, it's not well-engineered (speaking with over 25 years as a professional software engineer), at least the portions of the code I have looked at. Things I vaguely remember (it's been ten years since I looked at it) are lack of data normalization (and not in a performance optimizing way), template includes that depend directly on order of inclusion and variables in other templates, very little code isolation, and PHP.

WP is a well-delivered product that works well for its user base in most situations. Plenty of code is well-marketed, profitable, and fulfills users' needs, but not well-engineered.

By the way, I know the PHP gripe is contentious, but it's not the reason why I think WP is badly engineered, it's just the reason it was easier to engineer it badly.

See https://eev.ee/blog/2012/04/09/php-a-fractal-of-bad-design/ for more details on PHP.

One excerpt from that page:

There is a whole lot of action at a distance. Consider this code, taken from the PHP docs somewhere.

@fopen('http://example.com/not-existing-file', 'r');

What will it do?

If PHP was compiled with --disable-url-fopen-wrapper, it won’t work. (Docs don’t say what “won’t work” means; returns null, throws exception?) Note that this flag was removed in PHP 5.2.5.

If allow_url_fopen is disabled in php.ini, this still won’t work. (How? No idea.)

Because of the @, the warning about the non-existent file won’t be printed.

But it will be printed if scream.enabled is set in php.ini.

Or if scream.enabled is set manually with ini_set.

But not if the right error_reporting level isn’t set.

If it is printed, exactly where it goes depends on display_errors, again in php.ini. Or ini_set.

I can’t tell how this innocuous function call will behave without consulting compile-time flags, server-wide configuration, and configuration done in my program. And this is all built in behavior.

I would argue that Wordpress is a great example of how something doesn't need to be "well-engineered" (when it comes to abstractions, maintainability, etc) to be widely useful for many.

Although I think the exception there is security (and yes I know many will say clean and well engineered code is secure code). Security has to be solid or it will impact too many people negatively.

Ah yes, the infamous 12-year-old fractal of bad design article which is almost entirely obsolete.

Nope, as someone who has coded modern PHP recently I would say it is mostly still relevant. Some of the issues have been fixed but most remain.

It's amazing how many people's opinion of PHP is stuck in a time warp from 10-20 years ago. It's now a much better language than it was then. It's fascinating to see programmer snobbery in real time.

> instead of contributing improvements

Yeah good luck with that. Something so deeply embedded in WordPress Core impossible to improve upon.

Are you able to name of the publishers that you say run massive WP installs?

I do know they exist of course, Sony being one.

I’m coding up a little something that I feel is more modern and superior compared to WP, and I’d like to learn what their business requirements and use cases are that keep them on WP.

Thanks in advance!

I don't want to discourage you...but there's so many WP alternatives out there that are supported by bigger companies, have a big ecosystem around them with agencies and developers for many years. Why would massive WP installs switch to "a little something"?

I just see the opportunity to provide developers and users a better experience using modern tooling, and feels open and simple enough for anyone to download and use without worrying about security vulnerabilities.

Something that feels powerful and safe; like WP of 10 to 15 years ago.

WP's strength is its size and history. WP is entrenched, it's good enough and it's got an enormous talent pool.

Digital First Media/MediaNews Group, one of the largest newspaper publishers in the US, runs its 100+ local newspaper (NY Daily News, Chicago Tribune, Denver Post, etc.) websites on WordPress.

Thank you for the info! This is a solid response :)

"A third party will complain" is not a valid reason to provide poor service to your customers.

I’m not really focusing on WP Engine’s service here. I’m pointing out that the constraints Mullenweg has voiced appear to be self-contradictory and unsatisfiable by any WordPress host.

I'm sorry but WP-ENGINE lost my vote when they started quoting evangelizing and ambassadorship events as "contributions". Everyone knows that's a 50/50 self-marketing and brand outreach. I don't understand why people are taking WP ENGINE's side, in the past 5 years, the evils and exploits of VC investments have been widely documented. This is a clear and present danger/example of what is wrong with VC in America. Look at VC in other parts of the world, they are heavily regulated for this particular reason. This industry has taken the premise of the movie "pretty woman" and escalated to new hights of corporate GREED.

Sure, but to do that they'd need to know they are about to be cut off, something which they were given zero warning about. Had they known they 100% would have ensured that customers didn't lose service. Matt chose to surprise them.

It's a very nuanced thing. The world could be very different today. There would have been very little pushback against Matt's crusade if he'd just thought about making sure service to users was uninterrupted.

Instead he dragged 1.5 million sites into the middle of this in a way that made him look like the bad guy.

I hope that WordPress will continue to be open and Matt will continue to lead it, but he just cost himself a lot mindshare. That's why I asked him to explain why he made the choice he did.

Hopefully he has a PR person who is advising him on how to handle this situation. Were it me, I would say something like: "My passion for keeping WordPress open source got the better of me and I made a hasty decision which caused problems for end users. I've learned from this and it's not a mistake I will ever repeat. Going forward if there are changes to how we administer WPorg's services we will discuss them with the community and announce them well in advance because we want them to be rock solid and reliable for all of the millions of websites which depend on them."

This type of statement would go over well with a lot of people including the big enterprise customers who are depending on WP, who Matt really wants and who are constantly being courted by WP's competitors. In followup messaging you can reiterate all the strengths of open source e.g. how it reduces vendor lock-in.

But what do I know, I've only sold a couple million dollars worth of WP contracts, meanwhile Matt is worth 400 of those big M's. :)

> Sure, but to do that they'd need to know they are about to be cut off, something which they were given zero warning about

According to Automattic they had been in discussions for 20 months. Your anger should be with WPEngine for taking your money while knowing full well their service depended on servers ran by a company they were on (best case) shaky terms with.

Up until about 8 months ago, Bluehost (another big paid hoster of WordPress sites) ran its own plugin mirror with no issues: https://github.com/bluehost/pluginmirror

> According to Automattic they had been in discussions for 20 months.

They could have give a warning 20 months ago that this may happen and then this would not be a thing.

Yea, WPE should have done that.

Matt's behavior is inexcusable and shows that WordPress needs a complete restructuring without him. Too many sites rely on WordPress to endanger them because of one man's temper tantrum. I don't understand how you can defend this reckless behavior by him. Who cares what WPE could have should have done. He needs to step down immediately.

Did Automattic tell WPEngine that they'd cut off plug-in updates 20 motnhs ago?

Or is the 20 months thing just completely irrelevant to the point that Automattic should've given a heads up before cutting off plug-in updates

"WPEngine should have foreseen something that has never happened in the 20 years of the software's history".

I mean yeah, companies should have contingency plans for things that are extraordinarily rare but let's be reasonable about it. No one, including you, saw this coming.

I challenge you to find a single blog post, tweet or HN/Reddit comment that suggests Matt could one day shut off wp.org access to a single company running 1.5 million sites without any notice to that company, or the community members who will be affected. It's unconscionable. Or at least it was.

Be reasonable.

Leftpad happened.

Newfold Digital, which owns Bluehost, is the only entity with a commercial trademark sub-license agreement from Automattic per the recently updated WordPress Foundation Trademark Policy:

https://wordpressfoundation.org/trademark-policy/#:~:text=If....

Even without dragging the wordpress.org infrastructure into the mess, MM's blackmail campaign wouldn't have played well with the community. But it would have blown over as just more #wpdrama, whereas this ... I think we're likely to see the WordPress trademark invalidated. Even if it isn't, this case winning means every last WP host can just line up and cite it, making the trademark as good as generic anyway.

But from the very beginning, Canonical/Ubuntu chose to make mirroring the repo easy, and encouraged the usual network of public mirrors to participate, much as Debian and other distros had done for years. (It wouldn't be unfair to say that Canonical/Ubuntu had to meet the expectation those distributions had set.)

That is something the WordPress community (albeit centralised in the WordPress.org decision makers) could have been doing for decades.

> WordPress.org decision makers

That would be Matt as the sole owner of wordpress.org, not a plural 'decision makers'

Because Canonical makes it easy to clone their entire repositories and host your own mirrors. You can change your ubuntu mirrors changing the configuration files themselves (or via graphical programs on desktop systems), unlike in WordPress where you'd need to "butcher it" (Matt's words, regarding disabling revisions by WPE) modifying the source code to point to another server.

Butchering is a right afforded by the GPL. As long as you pass along the dog food.

It's not about what WP Engine could have done, but how Matt acted. If he wanted WPE to use their own Plugin repository, he could have told them so and given them a date. But cutting off access to updates without warning to all these sites is inexcusable. Matt chose the "nuclear option" without realizing that the fallout would also hit WordPress and himself. In addition to hundreds of thousands of websites that had nothing to do with his gripes.

From the lawsuit:

In a social media post on the platform X, he boasted that as a result of his actions, WPE is now a “distressed asset,” worth just a “fraction” of what it was before, because “[c]ustomers are leaving in droves” – calling into question whether Defendants’ motivations extend beyond mere interference and extortion, and are in fact a thinly disguised attempt to artificially drive down WPE’s valuation in hopes of acquiring it on the cheap

Its not unlikely that the gameplan all along was slander and disrupt them so much that the company would become worthless, then acquire it. He was trying to blackmail/extort WPE's CEO into coming to work for him, after all! (text message screenshots are in the lawsuit too)

> AWS and Digital Ocean run local Ubuntu download servers

I would think that is a cost-saving measure as well. A hell of a lot of that data would be downloaded by users every day. Being able to pull it locally saves all that. Also, it is faster and does provide some security.

> They do not depend on Canonical to run their business.

That depends on how you look at it. If for some odd reason Canonical vanished tomorrow, that would be a big problem for both DO and AWS.

They do rely on Canonical developing, fixing upgrading the distros.

But then Amazon does have their own in-house Linux distro, which is/used to be somewhat associated with RedHat/ Centos https://github.com/amazonlinux/amazon-linux-2023

I would expect AWs,Google etc have specific internal only distros that make up the foundation of their cloud business but that is just a guess.

A million people trusted WPE’s resources. WPE, in turn, relied on someone else’s. The real issue here is that WPE completely overlooked the fact that they haven’t done the work to maintain the availability of their apps. It’s like buying a fridge, stocking it with $200 worth of food, and forgetting to plug it in.

More like buying a fridge and then the landlord stops paying for electricity suddenly

This is accurate if by landlord you mean "the person in whose house you have been squatting without paying rent or signing a lease."

Actually, it's the person who signed a contract with me to give me a free house.

What is the contract that gives WP Engine the free house?

The GPL, and WordPress's trademark policy, which up to a week ago stated " The abbreviation “WP” is not covered by the WordPress trademarks and you are free to use it in any way you see fit."

On the other hand, the use of WordPress servers is in no way covered by the GPL. WP Engine can pay for their own servers the same way Bluehost used to.

That someone gives you the right to use their code doesn't mean they're required to be a free hosting provider for you.

Using the resources of the non-profit you control to kneecap a competitor to the for-profit you control makes that a bit more complicated.

I think it's obvious WPE wouldn't be in the clear with Matt even if they went and hosted a mirror/cache of the WP.org packages.

wp.org is not a non-profit, despite the name. The actual non-profit [1] had expenses of $41k in 2022, which wouldn't come anywhere near paying for wordpress.org infrastructure and personnel. I guess Wordpress is going the RHEL route. You can clone it, but can't use their trademarks or infrastructure.

[1] https://projects.propublica.org/nonprofits/organizations/205...

> wp.org is not a non-profit, despite the name.

Automattic's associate legal counsel begs to differ [1]:

> Let’s apply this to the WordPress trademarks (also called simply “marks”). The WordPress Foundation owns the right to use the WordPress marks for non-commercial purposes. It can also sublicense out this right for particular events (e.g., WordCamps) and to people supporting the WordPress project and community. The Foundation also licensed the name WordPress to the non-profit WordPress.org, which runs a website that facilitates access to WordPress-related software.

(Take it up with them, not me.)

[1] https://automattic.com/2024/10/02/wordpress-trademarks-a-leg...

The man himself goes into copious detail otherwise!

"We could not get wordpress.org being part of the foundation approved by the IRS."

https://youtu.be/OUJgahHjAKU?t=342

I think if we're being pedantic about this, we can agree that WordPress.org itself is not a 501(c)(3) entity or similar, or run under such an entity.

Automattic's legal team somehow considers it a non-profit though.

They tried to set it up that way and were denied. Apparently the flip side of that is they no longer feel constrained to not "Us[e] the resources of the non-profit you control to kneecap a competitor to the for-profit you control."

So like I said, at this point it's no different than RHEL's very stringent trademark protections, and restrictions on using their update servers (cdn.redhat.com) if you're not paying them. The only difference here is that if WP Engine was itself a non-profit, Matt wouldn't be going after them. RHEL is not as generous.

Apparently these are the new rules. If you're a for-profit entity advertising "Wordpress Hosting" instead of "Hosting with Wordpress installed" and want access to the infrastructure of wordpress.org (which costs millions of dollars a year) you now have to pay, either in cash or equivalent contributions.

Personally that seems fair. It should have come with a minimum 90 day public notice period, and the stuff about being a cancer etc. is pretty crazy. Changing marketing language and setting up your own plugin mirror like Bluehost did (https://github.com/bluehost/pluginmirror) is not the end of the world.

WordPress definitely did not sign a contract with WPE to provide free electricity.

Not a lawyer, but I think contracts require consideration to be enforceable.

With the wrinkle that your landlord enthusiastically invited you to move in, and never made you sign a contract, but after your dog shed all over the place he started making ominous noises about how you'd better sign one equal to eight percent of your gross revenue, and every conversation with him is now very strained

Buying a fridge. Plugging it into the neigbours outbouse, who also gives you free food, and you use both to run your cafe. Which is fair because the neighbour gives free food away to look the most christian and you pay for the fridge and most people don't want to run a fridge so they rely on your cafe.

This is 100% correct as a position of principle, but it's not a foregone conclusion that WPE was able to take the necessary steps here.

To be very specific about at least one of the issues:

* The URLs pointing to the WP plugin directory on wordpress.org are hardcoded into WordPress

* If WPE forks WordPress to fix that, and continues to say they host WordPress, IANAL but they probably have a trademark violation problem on their hands.

There are certainly workarounds which exist, but it's hard for us to conclude casually on Hacker News whether they can be deployed at WP Engine scale and in compliance with whatever agreements WP Engine is bound to.

So yeah you're right about what the right thing to do is. But frequently reality is not that simple. They needed time and maybe even assistance from wporg (in helping them to be free of wporg. errrr)

> * The URLs pointing to the WP plugin directory on wordpress.org are hardcoded into WordPress

But they can be changed via filters. I do that all the time to manage when certain request are being made (and making sure it's in a cron job and not a user-request).

WP Engine does run their own plugin in the instances they host, though I assume it's not obligatory. Still, every site I ever had to look at that was on WPE had it installed and enabled.

WP does come with its own CA certs, but that file could be appended (or replaced, again via filter) as well. Since they're comfortable changing things like the revision settings, I doubt this would be something they wouldn't do.

I'm not saying Matt is reasonable, but "it's not an easy thing to do" isn't true.

It's academic now, the mirroring has been a done deal since Oct 1. WPE operates their own mirror and API server now. Matt of course did not help at all in this effort.

>However I do not understand why you chose to make 1.5 million enemies in the WordPress community in one weekend by shutting down their ability to update plugins with zero warning and consequently reducing the security of their websites.

yup. I'm about to make a new site and I dont care about the platform, I just want to write. but I'm not gonna use wordpress ever again now, probably. Matt seems friendly but this is evil CEO garbage

> but this is evil CEO garbage

Correction: this is Evil CEO vs Evil CEO garbage. Casting WPEngine as some sort of saint is highly inaccurate.

But only one of them also controls the Wordpress foundation so who cares about the CEO of WPE?

If you were not a user of WPE, you were not affected. If you are a user of WPE, presumably you care about the actions of their CEO?

Well said, I hope that there will be forum to discuss the ethos of these actions and see if there isn’t a better way to go about this, and how we can strengthen the community of open source.

An interesting article was written by Dries (Drupal Founder) and others.

Link?

https://dri.es/solving-the-maker-taker-problem

Good thread on reddit too: https://old.reddit.com/r/Wordpress/comments/1fup9gb/solving_...

I have not heard of anyone being turned off from using WordPress from this. That does not mean it does/has not happened, I am sure some folks got mad.

It is a stupid hissyfit and some bad judgments. People make mistakes.

There are far better purely technical / code issues to turn people away from WordPress, but WordPress is spectacularly popular.

Uhh. I am. I've launched probably 30 websites using WP over the last 10 years, a couple for household name brands. WordPress stopped being "cool" awhile ago (because "PHP sucks" and the like), I've defended my usage of it in plenty of past comments, despite it being long past "cool". The way MM talks about enforcing the trademark, the licensing distinction (i.e. the commercial use of "WordPress" to Automattic only) -- am I allowed to call myself a "WordPress" developer and charge people money for it anymore? Or do I have to worry about a trademark troll?

I'll admit that I'd already been looking for a modern alternative. I'm a web developer, I almost exclusively write in TypeScript, something running on Node just makes more sense for me. I recently built a project on PayloadCMS and NextJS -- Payload has since integrated directly into Next's server and has a really nice "website" template to get started. I'll be using that from now on.

Up can run WordPress just fine headless. Not my own cup of coffee but it works

I think the data schema in Wordpress is decent. With the addition of Pods it has become a lot more flexible. (There were other solutions that mostly cost $$)

Most of my issues with WP has to do with the front end.

To me, the military language used in a few of their execs messages was telling.... I have seen that more than once in anti competition lawsuits and Heather has as well

Reply on news.ycombinator.com