Hacker News Reader

Comment by moneylotion | Hacker News Reader

A million people trusted WPE’s resources. WPE, in turn, relied on someone else’s. The real issue here is that WPE completely overlooked the fact that they haven’t done the work to maintain the availability of their apps. It’s like buying a fridge, stocking it with $200 worth of food, and forgetting to plug it in.

View on HN

More like buying a fridge and then the landlord stops paying for electricity suddenly

With the wrinkle that your landlord enthusiastically invited you to move in, and never made you sign a contract, but after your dog shed all over the place he started making ominous noises about how you'd better sign one equal to eight percent of your gross revenue, and every conversation with him is now very strained

Buying a fridge. Plugging it into the neigbours outbouse, who also gives you free food, and you use both to run your cafe. Which is fair because the neighbour gives free food away to look the most christian and you pay for the fridge and most people don't want to run a fridge so they rely on your cafe.

This is accurate if by landlord you mean "the person in whose house you have been squatting without paying rent or signing a lease."

Actually, it's the person who signed a contract with me to give me a free house.

What is the contract that gives WP Engine the free house?

The GPL, and WordPress's trademark policy, which up to a week ago stated " The abbreviation “WP” is not covered by the WordPress trademarks and you are free to use it in any way you see fit."

On the other hand, the use of WordPress servers is in no way covered by the GPL. WP Engine can pay for their own servers the same way Bluehost used to.

That someone gives you the right to use their code doesn't mean they're required to be a free hosting provider for you.

Using the resources of the non-profit you control to kneecap a competitor to the for-profit you control makes that a bit more complicated.

I think it's obvious WPE wouldn't be in the clear with Matt even if they went and hosted a mirror/cache of the WP.org packages.

wp.org is not a non-profit, despite the name. The actual non-profit [1] had expenses of $41k in 2022, which wouldn't come anywhere near paying for wordpress.org infrastructure and personnel. I guess Wordpress is going the RHEL route. You can clone it, but can't use their trademarks or infrastructure.

[1] https://projects.propublica.org/nonprofits/organizations/205...

> wp.org is not a non-profit, despite the name.

Automattic's associate legal counsel begs to differ [1]:

> Let’s apply this to the WordPress trademarks (also called simply “marks”). The WordPress Foundation owns the right to use the WordPress marks for non-commercial purposes. It can also sublicense out this right for particular events (e.g., WordCamps) and to people supporting the WordPress project and community. The Foundation also licensed the name WordPress to the non-profit WordPress.org, which runs a website that facilitates access to WordPress-related software.

(Take it up with them, not me.)

[1] https://automattic.com/2024/10/02/wordpress-trademarks-a-leg...

The man himself goes into copious detail otherwise!

"We could not get wordpress.org being part of the foundation approved by the IRS."

https://youtu.be/OUJgahHjAKU?t=342

I think if we're being pedantic about this, we can agree that WordPress.org itself is not a 501(c)(3) entity or similar, or run under such an entity.

Automattic's legal team somehow considers it a non-profit though.

They tried to set it up that way and were denied. Apparently the flip side of that is they no longer feel constrained to not "Us[e] the resources of the non-profit you control to kneecap a competitor to the for-profit you control."

So like I said, at this point it's no different than RHEL's very stringent trademark protections, and restrictions on using their update servers (cdn.redhat.com) if you're not paying them. The only difference here is that if WP Engine was itself a non-profit, Matt wouldn't be going after them. RHEL is not as generous.

Apparently these are the new rules. If you're a for-profit entity advertising "Wordpress Hosting" instead of "Hosting with Wordpress installed" and want access to the infrastructure of wordpress.org (which costs millions of dollars a year) you now have to pay, either in cash or equivalent contributions.

Personally that seems fair. It should have come with a minimum 90 day public notice period, and the stuff about being a cancer etc. is pretty crazy. Changing marketing language and setting up your own plugin mirror like Bluehost did (https://github.com/bluehost/pluginmirror) is not the end of the world.

WordPress definitely did not sign a contract with WPE to provide free electricity.

Not a lawyer, but I think contracts require consideration to be enforceable.

This is 100% correct as a position of principle, but it's not a foregone conclusion that WPE was able to take the necessary steps here.

To be very specific about at least one of the issues:

* The URLs pointing to the WP plugin directory on wordpress.org are hardcoded into WordPress

* If WPE forks WordPress to fix that, and continues to say they host WordPress, IANAL but they probably have a trademark violation problem on their hands.

There are certainly workarounds which exist, but it's hard for us to conclude casually on Hacker News whether they can be deployed at WP Engine scale and in compliance with whatever agreements WP Engine is bound to.

So yeah you're right about what the right thing to do is. But frequently reality is not that simple. They needed time and maybe even assistance from wporg (in helping them to be free of wporg. errrr)

> * The URLs pointing to the WP plugin directory on wordpress.org are hardcoded into WordPress

But they can be changed via filters. I do that all the time to manage when certain request are being made (and making sure it's in a cron job and not a user-request).

WP Engine does run their own plugin in the instances they host, though I assume it's not obligatory. Still, every site I ever had to look at that was on WPE had it installed and enabled.

WP does come with its own CA certs, but that file could be appended (or replaced, again via filter) as well. Since they're comfortable changing things like the revision settings, I doubt this would be something they wouldn't do.

I'm not saying Matt is reasonable, but "it's not an easy thing to do" isn't true.

It's academic now, the mirroring has been a done deal since Oct 1. WPE operates their own mirror and API server now. Matt of course did not help at all in this effort.

Reply on news.ycombinator.com