photomatt

I had the same reaction, and I know Yoast! Seems out of character.

Thank you -- I really appreciate that.

Automattic, company behind Akismet, Gravatar, WordPress.com, Polldaddy, now has 72 Automatticians across 17 states and 21 countries. We have an office in pier 38 in SF, but only about 6 of us are in the area. We're completely location agnostic.

Must love open source, and preferably use WordPress or one of our products already. The vast majority of our codebase is PHP/MySQL, with smatterings of Erlang and Java for our XMPP and search stuff, and we serve billions of requests a day across our services.

We have a number of positions open, but the code and systems wrangler ones are probably most interesting to the HN audience. Let us know you found the job here.

http://automattic.com/jobs/

We (Automattic) love hiring open source contributors and creators, they always go to the top of the queue.

In the original essay I used the word "basic" there which is probably closer to what I meant. Simple, but not simplistic.

Whew, glad that one is done.

I don't think this is a case of fair use. There is linking, which in the manner which themes work and are loaded inside of WordPress is very deep, and there is also copy and pasted WP code included in Thesis.

We've never incorporated anyone's code without their full participation and there's no code in Thesis I would want anywhere near core anyway. Thesis is a triumph of marketing, not technical competence. (In fact it relies on people not being able to question its incredulous claims about structure and SEO.) The few cool ideas it has were done in other themes first anyway. On a tech level, WooThemes is doing far more interesting work. (And they have been involved in core development.)

I believe I won this one. Drop me an email at m@mullenweg.com. :)

I like the Posterous guys and have sent a number of users to their service before we (WordPress.com) had our own email feature. I hope when they launch the WordPress one it's nicer in tone. I've been very impressed that even though Tumblr is growing aggressively they've consistently taken the high road,

Okay on bet.

Can you email me details of the backtick bug?

Moving wp-config.php out of public_html is mentioned on that page, section 9. I think renaming the wp-admin would probably break more than it protects.

Not sure on the second question.

It's hidden a bit, you have to enable it in the config file, and of course it still requires subdomains and such to be properly configured. I expect this to make not much difference for WordPress users, but should be night and day for people who were running MU.

I bet you $10 it won't this time. :)

What I suggest for most folks is to tie it to a stable branch, that way you get overnight fixes but nothing potentially backward-incompatible. When a major release comes out, you need to svn switch to the new branch.

Many folks in the WP community, including myself, svn up to trunk. I wouldn't recommend that for the general public, but I think it's only broken my site once in the past year and I fixed it by running svn up again. If I was smarter I would script it to svn up, check the site, revert if it was blank. WP.com syncs to WordPress trunk pretty regularly, as well, sometimes daily depending on where WP is in its release cycle or if we have to do any database migrations.

Sure, this page is pretty comprehensive:

http://codex.wordpress.org/Hardening_WordPress

(And much is applicable to many web apps besides WordPress.)

Sure -- the simplest way to keep it secure is just keep it updated.

To this end we work with numerous third-party hosts to help them update their customers, and have invested significantly in a notification and upgrade system for 10k+ plugins, 1k+ themes, and of course the core software. This was a particular PITA because runs on so many platforms with wildly different constraints and configurations. We blog, tweet, and email 200k people whenever there's a new release and offer free help on our forums to anyone who is stuck. Someday we might even offer auto-update in core just like many hosts already do.

My comment was more aimed at the HN audience which might want pro tips for staying updated or more defense in depth. For example I have a cron job run `svn up` on my site every morning which keeps it up to date whether I'm in front of my computer or on a beach sipping mai tais.

Because I'm curious!

I'd be happy to share the usage stats of WP.com's post-by-email feature if Posterous would be willing to do the same.

Come on guys -- it's been a while. We oversee or advise on blogs for basically every major media site (CNN, WSJ, NYT, IHT, TechCrunch, GigaOM...) as well as running WordPress myself (and WP.org) for 7+ years and have never had an application level exploit. If WP was really as insecure as you suggest, all of the news sites would look like 4chan.

It's possible to run WP in a secure manner. Just because some people don't doesn't mean you can't. It doesn't require crazy wget hacks, just updating. You can even automate it with SVN.

If anyone has questions or would like best practices for running WP in a secure manner, I'd be happy to answer them, here or over email -- m@mullenweg.com.

It also seems to have not as many users.

The sweet spot so far looks to be 25. The really fascinating data is slicing it up based on type of user, where they were referred from (Daring Fireball users will pay more than TechCrunch), what price they were shown versus what they want to pay, and of course how many blogs they have. There's also the clever guy from YC who put in -$500. :)

We're showing 10-30 to different visitors and seeing how that affects pricing, like a behavioral economics experiment.

Fixed!

It was fun to build. :) Check out how the a/an changes when you switch to "enterprise" and how we add an extra question if you're non-personal.

Quite the opposite, and in fact we list a ton of commercial theme folks here:

http://wordpress.org/extend/themes/commercial/

All are GPL.

I'm a big fan of Eben Moglen as well, which is why we contacted him and the Software Freedom Law Center to analyze WordPress and give an opinion on themes specifically:

http://wordpress.org/development/2009/07/themes-are-gpl-too/

WordPress.com has servers in two datacenters run by LayeredTech and one by Server Beach, around 1,200+ total. When one datacenter fails we (hopefully) fall over to the other two. We have DNS and monitoring services at half a dozen other locations, and of course utilize CDNs for frequently-accessed content.

Support is handled by a worldwide team of some of the nicest and sharpest people you'll ever meet, with escalation to the core people behind WordPress. We've seen and worked with more high-profile blogs than probably anyone else.

The typical floor for VIP is 1 million pageviews a month. Many clients do many times that, or host dozens of sites with us.

For what it's worth, the vast majority of compromised sites we look at are because of host vulnerabilities or issues rather than something at the WordPress layer, which is pretty far up the stack.

An up-to-date WordPress, which is easier than ever using the built-in upgraders, is secure. There are more bad sysadmins in the world than people who can't click the upgrade button.

We do code reviews to make sure VIP WordPresses are as fast and stable as possible, but more of that information could be documented. You're right and it's something we're actively working on.

There is going to be a dedicated VIP portal with documentation of all the special functions, lots of theme and system info, and best practice coding guidelines for WP.com.

The cool thing about VIP is you can get, say, a direct link from the Yahoo home page and it doesn't break a sweat. It's specialized to just WordPress, but more people every day are running their entire site through WP.