WordPress.org's latest move involves taking control of a WP Engine plugin

It's a freemium plugin though, the advertisements for the pro-version and the update-funnel are how you pay for it.

If WP had only fixed the error but not removed all of those things & and hadn't claimed authorship themselves ("By Wordpress.org", and putting themselves at the top of the contributors while they're certainly the one with the fewest contributions), that argument would be different, I believe.

Would wordpress.org allow WooCommerce to be forked, uploaded with no modifications beyond the all references to WooCommerce being changed to YouCommerce and all mentions of Automattic being wiped? I don't see that being allowed.

It has premium features, it may be a grey area, but that makes it a premium plugin IMO.

Wordpress did not fork the plugin. They just took ownership of the plugin.

Wordpress removed all premium features after the hijacking of the plugin.

https://plugins.trac.wordpress.org/changeset?new=3167679%40a...

My understanding is that it was actually matt who did that, and he did it so he could denounce WPEngine to their customers, due to his personal vendetta against WPEngine, because WPEngine refused his shakedown attempt for money.

This is cited in WPEngine's lawsuit. Like you said, I wouldn't be surprised if this behavior of matt's was a breach.

wow, they deleted 300 lines, many giving credit to others, just to replace it with

> Security - ACF defined Post Type and Taxonomy metabox callbacks no longer have access to $_POST data. (Thanks to the Automattic Security Team for the disclosure)

If I was on that security team, I would be livid they used my team's name on this behavior.

If this was done by that security team, their ethics are disgusting, and likely non-salvageable...

Still looking for the security exploit worthy of a plugin takeover though.

edit; best I can figure tonight is it's some concern over CSRF, but they don't even sanitize $_GET nor $_SESSION, only _POST and _REQUEST... so either it's more complicated than it looks on the surface, or this "fix" is partial at best, and wasn't written by someone from security. (It's also possible or likely that I'm missing some context, it's been a long time since I've had to work on php)

     -        public $version = '6.3.6';
     +        public $version = '6.3.6.2';

Why would you break the version standard? Maybe there are scripts expecting a specific format or some such. Also, given the majority of this change, I think 6.4.0 or even 7.0.0 is more in order, but at least 6.3.7.

Edit: To make matters worse, elsewhere in the code, it's referenced as 6.3.8. Very confusing.

For those reviewing the changeset: There are two places where they read a value directly from $POST into an $args array. There is no validation applied, which means an attacker can inject whatever value they wish.

I do see various security fixes in that patch, but most of the changes are removing references and code for a "pro" version of the plugin.

I'm guessing the WP security team has been pentesting any WPEngine code they could get their hands on to find an excuse to make all of these changes. The security issues do look bad (once again proving that WordPress' worst vulnerabilities come from the plugins they install) but I think the branding removal is pretty wild.

A quick skim through the plugin development guidelines does seem to indicate that trialware isn't allowed, and the plugin seems to be doing all kinds of other stuff that isn't really permitted by the guidelines. I don't know if WordPress is as strict in enforcing those as they are with this plugin, but the changes do seem to be based on them.

With WPEngine recommending people to install their (vulnerable) version, I once again feel like there's no right side in this conflict. What a mess.

Fundamentally yes, though it hasn't really been tested in court and I'm not sure that plugins really are obviously derivative works - you can create a plugin that doesn't depend on WP but can be used with WP, but I'm not a lawyer.

Matt and WP's position however includes that this applies to the PHP code but not to accompanying assets like images, CSS, JS (because those can obviously be used without WP). Those only need to be GPL if you want to host it on wordpress.org which the commercial versions of those freemium-plugins are not.

As far as I've understood, the copyleftness of the Wordpress's GPL tainting themes and plugins is or at least has been controversial (I'm not in the WP community, but have read stuff regarding this drama). Wordpress itself uses React and other non-GPL licensed software in the core that yes, may be GPL-compatible but doesn't enforce everything to be GPL'd. When it comes to themes and plugins, I'd consider that userspace, akin to installing Spotify on Ubuntu doesn't make Spotify suddenly GPL'd.

> At this point, this looks more like a war between personalities.

There only seems to be one personality at play to me.

Who’s the other “personality”?

What about "Press"?

Just call it TextPress.

If the new project offers a more stable platform, one that cannot be controlled by a single person, the community might like that more and might move; then there will be little left to freeload.

Is that an option btw? I.e. is it possible to offer hosting with seamless migration from wordpress.org?

Where is it in the license that you need to contribute to the project if you make big bucks? We have open source licenses for a reason, contributing back is never a requirement. If you believe that is his issue, I have a bridge to sell you.

WPE contributes to WordPress; Matt is just full of shit on this. It's an excuse, not a reason.

On one hand, the claim is that WP Engine contributes nothing to the WordPress ecosystem. On the other hand, the necessity for Automattic to fork a plugin developed by WPE suggests that WPE has been contributing something significant—so significant that its continuation is essential for the community.

That one of Matts claims. Personally I suspect the actual trigger was WPE removing Automattic's affiliate key from WooCommerce and costing them $m/y of revenue.

That was my impression too, but now we learn that they have made plugins available, so they are contributing to the Wordpress community, but they're doing it wrong?

I feel like Wordpress is going down the same path as Elastic and other companies have done, make something, open source it and then make a fuss when other companies "misuse" their code? If you want that tight control over how others use your code, then maybe consider not picking an open source license?

The claim is they spent over a year trying to convince WP Engine to pay up. But based on what I've seen, it was probably increasingly pouty complaints and demands leading up to the threat to go nuclear at WCUS 2024.

I wouldn't take how this played out as evidence that WP Engine was opposed to making more significant contributions like sponsoring a real, independent foundation or even putting a significant portion of its revenue toward the project.

I can only imagine how worse it will be if wordpress is hastily replaced with some javascript contraption

I think their current PR seems to be Matt Mullenweg himself.

And the more I hear him speak - having never really concerned myself with anything he said - the more loopy and disconnected from reality he seems. Post-economic!

Sometimes it’s great to have a slightly crazy visionary with utopian ideals who is prepared to say whatever they think will effect change. But also: Elon.

Yeah, but pretty sure some of the employees/volunteers are in on it or "just following orders."

This is wild. Surely Matt isn't tweeting from the official account - marketing would not allow that, right?

Who is she, though?

Mullengweg taking a leaf out of Musk PR playbook, clearly.

I thought I was reading a tweet from Wendy’s.

Seems to be unavailable to me now, but Archive link here: https://archive.is/WKx4a

What's that in response to? I don't have an account so don't seem to see anything beyond 'Sorry, who are you?'

The author of a library has lost all control over the codebase, and a third party is now making changes to it. That's pretty much the textbook definition of stage one of a supply chain attack.

Considering what Matt has already done, it wouldn't even remotely come as a surprise if a future ACF update would, say, brick all WP installations using ACF on a WP Engine host.

Injecting code that creates misleading or malicious dashboard warnings is a supply chain attack, even if it’s the intent of the supplier and not a malicious third party interfering with the supply chain.

This is how users will unknowingly update from ACF to Secure Custom Fields:

https://x.com/Brugman/status/1845195750550143424

https://archive.is/u6ZbY

They could have backed down and allowed WPEngine to publish an update or even published it on their behalf. Instead they've doubled down and taken this ridiculous action that undermines the whole wp/plugin eco system.

None of this is necessary.

Good advice, but it's a subscription I'm paying on behalf of a customer for a website I made 5 years ago. It's one of the few Wordpress websites I made as I hate the development process and the bloat of it all.

I agree, If I were an IT manager this sort of stuff would make me start looking at alternatives.

If an app/pluging/package is maintrained and published by X, I want to make sure no one else can interefere with it - even if they have good intentions.

What Automattic should have done is removed the plugin from distribution and told WP Engine to fix the problem. By doing what they did they have breached the trust of their users.

The thanks come from the upstream release notes for 6.3.8, FWIW.

wordpress itself is GPL, so anyone, not just WPEngine, should be allowed to freely provide hosting.

This is exactly what elastic search faced, which necessitated their changing of their license, and subsequently, caused AWS to fork elastic search.

Elastic search cannot, and do not, have the right to demand payment from AWS.

After this, who would trust his second try?

We agree on both points, so I don't get what the bad take was.

In my experience, Markdown isn't the barrier. It's the:

- Plugin ecosystem. Marketing people want to use specific plugins for SEO, automatic internal linking, etc. Those plugin only work with wordpress.

- Marketing people want to deploy to production. They hate waiting for dev to do anything (which brings us back to the importance of the plugin ecosystem, to add functionality without developers).

- It's a familiar system that doesn't need to be "learned" by end users (the same way VS Code, VIM, or whatever is your preferred code editor)

If it weren't for the first 2 barriers, I think the 3rd (learning markdown) is the easiest to overcome. Especially with side-by-side realtime markdown rendering, which itself is a form a WYSIWYG.

Edit: FWIW, we moved to Webflow at my company, used to be on Wordpress, and before that used to have a Markdown-compiled site, help docs, and blog. Markdown-compiled was my favorite as a developer (and also the most performant), but it was everyone else's least favorite because it required me to deploy and make code changes, and they weren't patient enough to put a ticket in for every change request. They also understandably didn't want to login Github to make updates to markdown files.

I think the trademark issue is weak in this case anyway. WP Engine has been around for 14 years with that name, and has been part of the Wordpress community.

But absolutely nothing about a trademark dispute excuses the lies, unethical behavior, and just downright personal animus Mullenweg is pouring into this takedown.

The wording you use “effective for building trust” is a misnomer. As someone who uses ACF, I am suddenly an outcast in the world of Matt/Wordpress.org? And people who I know make money from plugins, are they next in line for the hostile take over treatment?

This IS a violent breach of consumer/user trust. Whatever you thought before of this takeover/stealing, this is what trust gone looks like.

>If I understand it correctly, the core of the dispute is trademark and that WPEngine somehow implies WordPress affiliation.

No, the core of the dispute is Matt wants either money from WP Engine or for them to contribute to WordPress. He's using the trademark as leverage. However, their usage of WordPress does not imply affiliation instead saying stuff "We bring WordPress to the masses".

The use of WP in their name was them actually following WordPress' trademark policy where they asked people not to use WordPress in their names but WP.

They could also buy WP Engine. Or vice versa.

I doubt it will result in a mass migration. Many wouldn't move to a fork. We are very engaged in this kind of news, but the kinds of users who use WordPress often aren't. Our small company actually uses WP Engine, and I asked our owner (who also handles content, marketing, etc, and who I report to) if he had heard of what was going on, and he hadn't.

Yep. And they’ve gone 0-to-100 within days.

I think he has a fair point - I’d be totally comfortable with a standing expectation in a community like Wordpress for companies to pay their way (or be looked down on & excluded from taking part in community events).

But the expectations have to be a fair & transparent, and ideally communicated from the start, so people and companies can make informed choices about how they want to be involved. Not suddenly enforced with no lead time, with demands of money amounts seemingly made up on the spot, and “scorched earth” tactics when the demands aren’t met.

As a rule of thumb, bikes can start and stop fast. Cars should be more predictable on the roads. And trucks should accelerate and turn more slowly still.

If you’re big and powerful (government, standards body, maintainer of a huge opensource project, etc) you need to telegraph your moves and act slowly and predictably so other people can react to you. This is not how you do that.

> The real problem is that automattic want wpengine to “contribute their share” - by development or rev share, and they’re using dirty tricks and smear tactics to do so.

Again I don't see what's wrong with this ? Clearly they have no recourse through GPL but they have trademarks and infrastructure. I don't see anything unreasonable about his behavior.

They are the single largest contributor to the project ?

Not contributing back to the project you're basing your business (eg. the smallest example being infrastructure they are cut off from).

Honestly zero sympathy for WP engine, and I don't really see a better way to force them to pay.

Explain it then?