photomatt

I've been typing Dvorak over 10 years now and more than anything I appreciate the comfort. Even though I type all day long I've never had a typing-related hand problem.

Which of Automattic's services (WordPress.com, Akismet, Gravatar, IntenseDebate, and Polldaddy) do you consider famously insecure?

Last month we got 688,000 new blog posts via XML-RPC, so desktop clients are still meaningful. (XML-RPC API is also used by other folks like Flickr.) APP may be better, I don't have a strong opinion, but it's hardly used and in fact we had trouble finding clients to test with when writing support for it. Regardless, we try to have the best support for APP possible.

Same thing with feeds -- we offer every feed in a choice of 4 formats (two Atoms, two RSSes). It's the same content and there's no overhead to us (it's just a template file) so why not let people choose what they like best.

Welcome to the family, Raffi. :)

We do support XMPP! Check it out:

http://im.wordpress.com

Wow no reason to be so angry -- it's just some pings going back and forth. There's no need to make it personal. Besides, I've had way worse ideas.

We've always planned to have a variety of update notifications available -- the first we did was Jabber/XMPP, now RSS Cloud, after this we'll do some others. I mentioned this in my post on the subject, which you can check out here:

http://en.blog.wordpress.com/2009/09/07/rss-in-the-clouds/

We've supported other things before, like Atom Publishing, that to this day get almost no use (literally less than but we support them anyway because it can't hurt and might help. In general I would consider myself API- and format-agnostic.

I agree! This is on the roadmap.

This is fantastic advice -- for many WP blogs I manage I just have them svn update on a cron job nightly.

You should check out "child theme" functionality, which allows you to make lazy changes to the style without modifying any core files, which is highly recommended against.

That's not the issue here -- the worm doesn't require any files to be writable.

WP.com, to my knowledge, has never had a code or security breach.

There are communities (like Club Penguin) where they are quite promiscuous with their passwords and share login details with each other regularly, and then "hack" each others blogs.

It's been an interesting 6 years. Many attacks we protect against now (XSRF, most types of XSS) were basically unknown then. Some (cryptographic splicing) were popularized by researchers auditing WordPress. A mixed blessing of being popular is that everyone is looking at your code. However we try to turn around fixes as quickly as humanly possible, and with few exceptions (Scoble not upgrading) high profile WordPress blogs (CNN, NY Times) have never had any security problems.

Before we can auto-upgrade people we need to figure out how to do so in a way that's fool-proof. Can you imagine the outrage if everyone woke up one morning to broken sites because of an auto-applied update?

You should check out Bloxsom.

It depends on the context people are interacting with the site.

A blog is "owned" by the author, and comments are from guests who aren't invested enough in the site to register, but who still make up the core of the community.

On a forum, or Metafilter, or Hacker News, the content is produced and owned by every participant who will likely interact over and over and in the process build up their localized reputation and profile on the site as part of their ownership. I think that any of these could be done effectively without registration, but it's not as common.

(I think partly because there are business reasons for registration -- it makes it easier to opt-in people. Even people without the business reasons follow the convention.)

Running an online system is a responsibility, one which includes keeping up with vendor updates.

Is it possible to run WordPress securely? Absolutely, we do it for 8 million blogs, including some of the most high-target blogs in the world like CNN's.

In the case of WP we consciously take a perception hit versus some of our competitors by not batching security updates every few months but putting fixes out there immediately, even when there's no public disclosure.

I think this worth it though it can be painful in cases like this comment where people have permanently internalized their negative perception of the platform.

Automattic runs WordPress.com, Akismet, Polldaddy, IntenseDebate, Gravatar, and more. Here are our open positions:

http://automattic.com/jobs/

And information about how we work, which is a lot like an open source project:

http://automattic.com/about/how-we-work/

If you apply mention [HN] in the subject it'll make it stand out. We typically do a paid trial project of 2-3 weeks on contract before making a full-time offer.

:)

There are dozens of successful businesses selling GPL-complaint themes, sometimes in their own directories. There are hundreds of businesses who get some or all of their distribution through WordPress plugins. There are millions of websites using WP as a tool to publish and make money other ways, like TechCrunch or GigaOM.

We considered doing a marketplace on WordPress.COM, not .org, which is a big distinction.

I don't think a market on .org makes much sense, unless you decide to ignore the GPL.

Automattic isn't unique, we just follow the same Open Source business models everyone else does. We do hosting, and provide extra services.

There are at least 1,000 plugins in the directory that do the same thing. There are plugins for Youtube, Adsense, Lijit, Flickr, Sharethis, Twitter, Paypal, translation systems, backup services, Statcounter, Facebook...

I'm not sure what that has to do with being GPL or not, or who exactly he claims I've mislead.

I'd be willing to sponsor this.

I agree, if I'm low on sleep I'm lucky if I can get through email, much less write anything coherent. If I'm not traveling I can usually get a full night and be fine during the day, but sometimes I still overdo lunch (I love food) and shut down in the afternoon.

Yep. :)

Sometimes, that's why a single song on repeat lets my brain put it in the background.

They asked me to wear headphones for the shoot because it was in an original version of the story, I very rarely use those headphones anymore -- they're more from my in-office days.

Nope.

This is my favorite comment here, ever. :)

Recently switch all of the WordPress.com load balancers to be nginx. They push a little over a gigabit of traffic right now and about half a billion requests per day, no sweat. We use Spread + Wackamole for failover, there's more info on Barry's blog:

http://barry.wordpress.com/2008/04/28/load-balancer-update/

I wouldn't recommend DNS round robin for load balancing. (We did it for a while, many problems and flaws in the approach.)

Akismet doesn't use Bayesian filtering.