Browse: Home / wordpress
Who’s Responsible For Keeping Your WordPress Site Up To Date?

Who’s Responsible For Keeping Your WordPress Site Up To Date?

By Jeffro on September 15, 2009

So who do you think is responsible for keeping WordPress updated? The New World Order? Matt Mullenweg? You tell me by voting in the poll. I am hoping that 100% of the votes will be for a particular answer but judging by the usual voting crowd, I have a feeling some of the voters will opt for one of the other choices.

Who’s Responsible For Keeping Your WordPress Site Up To Date?

  • The End User (68%, 50 Votes)
  • The New World Order (12%, 9 Votes)
  • Matt Mullenweg (9%, 7 Votes)
  • WordPress (8%, 6 Votes)
  • Automattic (3%, 2 Votes)

Total Voters: 74

Loading ... Loading ...

Posted in | Tagged , , , | 24 Responses

Ideas To Improve The WordPress Release Strategy

Ideas To Improve The WordPress Release Strategy

By Jeffro on September 15, 2009

releasethehoundsMuch has been said in recent weeks regarding WordPress upgrades, security, and responsibility. While I still think end users are the ones responsible for what happens regarding their WordPress powered site, I do think there are areas of improvement that the WordPress team should consider. The following is a list of some of my own ideas as well as a few presented by other folks involved in the conversation.

Better Release Posts – As I was doing research for this idea, I checked out the release posts between 2.7 to 2.8.4 and the one thing about all of them is that they are all different. Different in that the information presented within them are in different locations. Sometimes, the information presented is different from release to release depending on its severity or whether it’s a point release or full version release. To compound the issue, more than one person has access to write the release posts and each person has their own style of conveying the information. What I am proposing is a structured format. The format would go as follows:

[Summary containing (to the point) information regarding the release]

[Some major or minor issues resolved with a link to their ticket in trac]

[A link to all of the issues resolved in the release version. This is generally added to release posts already]

[What type of release is this? Security? Maintenance? What is the urgency level for this release?]

[Since trackbacks are the only forms of communication on the development blog, there should be an official thread in the WordPress support forum setup for each release so that we as a community have a central area to communicate and ask questions regarding the new version]

[Important information that theme/plugin authors need to know]

[Either a link that shows all of the changed files in the released version or a list of all the changed files. Also, a download link to download only the changed files which would serve as the secondary upgrade procedure if automatic upgrade is not possible or does not work]

[Last but not least, a link to download the new version]

These development blog posts should be the go-to source for all of the important information not only for site owners but for plugin and theme authors as well.

WordPress Threat Levels – This is an idea that came up in a conversation I had with someone in the community. WordPress would have three threat levels. Green, Yellow, and Red. Green would mean that upgrading wouldn’t need to be a high priority. This would probably be confined to bug fix or feature releases. Yellow would stress that upgrading sooner rather than later is recommended perhaps based on a core feature or an important fix that effects plugins or themes. Red would signify upgrade as soon as possible. Obviously, WordPress 2.8.4 would be considered Red. Using threat levels such as this might be the way to avoid constantly telling people to upgrade as soon as possible. Not all versions of WordPress require people to upgrade the minute it is available.

Email Notifications – While there are more than enough ways to find out that a new version of WordPress is available, I’ve been giving it some thought and I now believe that it would be a good idea for there to be some sort of box that I can check which would allow WordPress to send an email to the address tied to the site administrators account. Email is still the method of communication everyone uses more than anything else so it would just make sense. This would also take care of the need for the WP-Announcements email list which is not used anyways.

Dougal Campbell – The following is a large excerpt from Doug’s post on the WP-Hackers mailing list which contains his thoughts and ideas on this entire subject.

As has been pointed out time and time again, WordPress is easier than ever to keep updated. When a new version is released, a nag appears in the Dashboard. From there, it’s just a couple of clicks to upgrade. And yet, people *still* lag behind. The reasons are varied, and _mostly_ invalid (depending on your perspective). Some of it is simply “fear of breaking something”. Some of it is just simple stubbornness (“I just upgraded, I don’t want to do it again so soon!”). Some of it might be ignorance and laziness (they see the nag, but don’t look at the WordPress News blocks in the Dashboard, or go to the main site to read about it).

So, what more can we do? Not a *whole* lot, but I do have a suggestion:

You can read Dougals entire post on the WP-Hackers mailing list archive here.

What Do You Think?

So what other ideas do you have to improve the WordPress release strategy?

Posted in | Tagged , , , | 8 Responses

List Of The Best WordPress 404 Pages

List Of The Best WordPress 404 Pages

By Jeffro on September 15, 2009

wpbeginnerlogoThe folks over at WPBeginner.com have put together a comprehensive list of the best 404 page designs they have come across from sites using WordPress. This showcase is good for inspiration for your own 404 page, a page which I usually neglect when it comes to WordPress themes. As long as the error shows up, I don’t go much beyond that point. Funny as it sounds, I tend to favor humorous 404 page designs instead of helpful ones. One other good bit of information is the list of tips that WPBeginner provides in order to add helpful information to the 404 page template within your WordPress theme.

What’s the best 404.php template you’ve seen come with a WordPress theme without modification?

Posted in | Tagged , , , , | 6 Responses

WordPress Dev Chat For 9-10-09

WordPress Dev Chat For 9-10-09

By Jeffro on September 11, 2009

wordpresslogo This weeks meeting consisted of an agenda that was light to non existent. However, we still managed to find some things to talk about such as the addition of changed files that are linked to in a release post, quite a few issues dealing with the plugin repository and more.

So far, two people have volunteered to help make the administration area of WordPress more accessible. Jane is giving it till Monday and then she’ll try to get a group together to figure out the best approach.

the question of downloading single file vs full upgrade process

Thanks to Mark Jaquith who dived around in Trac, it looks like it is possible to show a link in the backend of WordPress during an upgrade which will contain a zipfile of just the changed files for that version. This link and zip file will also be shown in future release posts.

One interesting question I had regarding this new upgrading option is whether uploading just the changed files counted as a full upgrade? Ever since I have used WordPress, upgrades have always been a matter of overwriting the previous package. Mark Jaquith told me it should be the same, if the zip file of changed/added files is accurate. This is good news because I wanted there to be an option in-between the auto upgrade not working and uploading the entire package of WordPress. Auto upgrade should be the primary upgrade method with uploading only the changed files coming in second. Last would be replacing all of the files.

If we find any issues related to the new site wide profiles site, who do we report them to? Andy Peatling or what?

Jane told me we should report issues within this forum thread.

Has anyone heard anything at all about 2.8.4 being affected by the latest attacks? I have not.

MarkJaquith – jeffr0: what’s likely happening, if you hear about that, is that they didn’t clean up, and someone has continuing access, even though their install is clean.

Most of the discussion from this point on deals with plugins, the repository, removing bad plugins, reporting compatibility, etc. I’ll just provide a few tidbits of the conversation as nothing much was decided, just a bunch of ideas discussed.

azaozz – there’s another thing about plugins too. Some submit nicer code to get in the repository and then start to add base64_decode stuff
junsuijinany – ideas for handling that type of thing tho azaozz?
azaozz – at the moment the simplest way is to start a forum thread about it
junsuijin – i mean short of scanning any and all plugin submissions for base64 and making it illegal in wp or something
junsuijin – azaozz: would it be worthwhile to have some kind of cron script running over the entire plugins/themes repos, scanning (preg_match) for predefined ‘illegal’ functions like base64, eval, etc. and temporarily disabling any plugins/themes that have uploaded files containing such functions? could also push status messages to end-users that may have gotten the filthy versions
westi - junsuijin: automatic scanning like that will likely just trigger false-positives
scribu – junsuijin: exactly, there are legitimate uses for eval
azaozz – it can only flag some plugins, they will have to be checked by hand..
junsuijin – true westi, it could, but i don’t know any other easy way to make sure that kind of stuff doesn’t happen, and it would be quite possible to make exceptions for any authors that need eval or whatnot

If you’re interested in reading the rest of the conversation, visit the log file and start at Sep 10 21:39:01 2009. If you’re interested in the conversation related to reporting plugin compatibility, start here and work your way up.

How To Participate:

If you want to suggest a topic to be discussed at the next meeting, you can by visiting the WordPress development updates blog. If you would like to participate in the chat next week, install IRC or an IRC compatible client and connect to the following IRC server.

chat.freenode.net or any random server on the Freenode network and then join this channel at 5PM Eastern time or 9PM UTC Thursdays. The meeting day was changed to accommodate European users.#wordpress-dev.

Posted in | Tagged , , , , , | 4 Responses

Matt Mullenweg Video Biography Interview

Matt Mullenweg Video Biography Interview

By Jeffro on September 10, 2009

mixergylogoI was tipped off by Brad Williams on Twitter, to this video based interview between Matt Mullenweg and Andrew Warner on Mixergy.com which focuses on interviews with ambitious folks. During this video interview, Matt pretty much covers all the bases between his first involvement with open source software to the creation of Automattic and much more. While just about every interview with Matt covers the same general information, I always listen to the interviews because I always pick up a few new things such as this one regarding Akismet. In the interview, Matt mentions that because his mom wanted to start a blog on WordPress.com, it served as a large portion of inspiration to create Akismet to battle spam since it usually contains some nasty stuff.

The interview is a long one, just over an hour long but it’s filled with good stuff. If you’re interested in the audio portion only, Andrew has that available for download.

Posted in | Tagged , , , , | 1 Response

Do You Think WordPress Is Secure?

Do You Think WordPress Is Secure?

By Jeffro on September 8, 2009

Considering all of the security talk of the past week, I figured the poll question ought to deal with the subject. Plain and simple, do you think WordPress is secure? Let’s talk about it.

Do You Think WordPress Is Secure?

  • Yes (52%, 30 Votes)
  • This Is A Trick Question (40%, 23 Votes)
  • No (8%, 5 Votes)

Total Voters: 58

Loading ... Loading ...

Posted in | Tagged , , | 17 Responses

How Gadgetwise Uses WordPress

How Gadgetwise Uses WordPress

By Jeffro on September 7, 2009

gadgetwisePaul Boutin over at VentureBeat  gives us a look at how the NYTimes uses WordPress for their blogging needs. Paul explains the process of getting a post published onto Gadgetwise which is a blog focused on teaching people how to buy and use stuff. The process is similar to a newspaper only more streamlined. Before a post hits the public’s eyes, it goes through something called a Division Of Labor. This is a team of people with expertise on a particular aspect of a blog post whether it be image display or editing. This really gives the writer the chance to focus on what they do best. Write.

The only troublesome thing about the article is the screenshot of WordPress. According to that backend user interface, Paul had to have been using a version within the 2.6 branch. Either that is an old screenshot or that site is using a fairly old version of the software. Not good considering the recent worm attacks going around.

*Update*

I viewed the source and indeed, the site is running WordPress 2.6.5.

Posted in | Tagged , , | 1 Response

Security This, Security That

Security This, Security That

By Jeffro on September 6, 2009

wordpresslogoOver the weekend, news quickly spread throughout the WordPress community of a worm that was taking advantage of older versions of WordPress. I found out about the problem through Lorelle’s twitter account where she linked to an article on her blog covering the details of the attack. Mark Ghosh of WeblogToolsCollection.com quickly followed up with a post of his own acknowledging that the plugin competition blog had been compromised. News of the attack quickly spread with over 150 posts in this WordPress support forum thread alone, but unlike so many people, I had no need to panic since this site is upgraded within a day or two of a release whether it’s security related or not.

I spent most of the weekend reading all of the coverage this series of attacks was gaining. Most notable was a post by Robert Scoble, a tech evangelist who forgot to apply the basics of security to his self-hosted WordPress site and ended up burned. Even more interesting was the series of exchanges between Robert Scoble, his followers on FriendFeed and Matt Mullenweg which you can read here.

While reading all sorts of comments published on blogs discussing the attacks, I couldn’t help but notice how many short sighted WordPress users there are in existence. I must have read over a dozen different excuses for why a particular site was not upgraded in a timely fashion. It seems functionality trumps security. However, Dave Coveney made a great point in the forums yesterday in that although everyone was being told to upgrade to solve their problems, being secure goes far beyond keeping WordPress up to date. Just because WPTavern is running WordPress 2.8.4 doesn’t mean that I’m safe. I’m just ‘safer‘.

WordPress is web based software. The speed at which things move is incredibly fast. I expect new versions of WordPress on a regular basis. If there is a new version that fixes one line of code to combat a security vulnerability, I want that code released ASAP so I can have it running on WPTavern. WordPress has added the ability to do a one click upgrade which to this day has worked flawlessly for me. I know it doesn’t work for 100% of the people out there but even if it works, it’s as if people can’t even press a button to initiate the process. It’s getting to the point where the only way to make it easier to upgrade WordPress is for someone to do it for them, probably without a price.

Broken plugins are no excuse to stay on a particular version of WordPress, especially when it comes to security. If your website truly depends on a particular plugin to function, send a note to the plugin author to let them know it’s broken or better yet, hire a developer to build and maintain the plugin for you. Plugins and to a lesser extent themes have to continuially evolve with their parent software. That’s just the way it is. Unfortunately, there is a perception amongst the general WordPress userbase that upgrading is most certainly going to break plugins. While that is a risk, I don’t think it’s as bad these days as it once was. Besides, there are hundreds of guides that have been written which explain how to create a test environment to mimick a public site to test new releases to see if plugins break or not. Although if it’s a security release, I would upgrade now, test later.

What I think this all boils down to is a lack of responsbility from a lot of WordPress users. Everything can not be handed on a silver platter. Running a WordPress powered site requires effort as well as the responsibility to make sure everything is on the up and up. Quite frankly, if you’re running a WordPress powered site or multiple sites, you should be tuned into the WordPress development blog as that is where all the information is published regarding new releases. Speaking of the development blog, please read Matt’s latest post which is a breath of fresh air regarding the latest round of attacks and why upgrading is an important step in the grand scheme of things.

Before I let you go, it’s important to note that had the majority of people actually upgraded their sites to 2.8.4 prior to the worm being released on the web, we wouldn’t be talking about the attacks that took place during this past weekend. Oh and if you have yet to upgrade, get 2.8.4 now.

Posted in | Tagged , , | 29 Responses

Sitepoint Interview With Matt Mullenweg

Sitepoint Interview With Matt Mullenweg

By Jeffro on September 4, 2009

sitepointlogo The folks over at Sitepoint.com have released episode 25 of their podcast which features an interview with Matt Mullenweg. The interview contains news and tidbits related to WordPress development, some hints as to what we can look forward to in WordPress 2.9, three major issues that are bouncing around Matts head and more. In fact, Brad even asked Matt a question dealing with Commercial plugins and the repository, something I wrote about yesterday and continues to be talked about. The following is from the Sitepoint Transcript of the interview. I apologize for the large quote but this covers this specific point in the interview.

Brad: Yeah, actually I have been getting involved in WordPress. I would say I guess I’m one of the people I’m talking about. I work more on the WordPress side than I do MU but you’re right, I probably should be more MU involved.

I want to talk about WordPress.org a little bit, the actual web site. Now I know recently you released or you launched the commercial themes page. It got a lot of press, a lot of buzz, a lot of people talking and I think it’s a great feature, and I think that was kind of the general consensus. Are there any plans to do the same for plug-ins and have a commercial plug-in section that essentially just kind of promotes those commercial plug-ins that are GPL compliant?

Matt: Probably not in the near term. Honestly, there’s not that many people asking for it. It’s really just been like one or two people and they’re asking a lot but it’s not that many in terms of number of folks versus the themes page where there is a ton of folks… I think themes are a little bit different from plug-ins in terms that… a theme is more like the basis for designing your web site and it’s kind of the building block, where a plug-in is often just one smaller part of it. So honestly I feel like there’s a better commercial case for themes than there is for plug-ins.

Brad: Yeah, I would agree. That was actually the follow up I had to that is it feels like that’s kind of the mindset of everyone, that commercial themes are accepted and kind of understood by the community; whereas commercial plug-ins are almost frowned upon. If I were to release a plug-in and charge for it, more people would almost probably tell me that I shouldn’t do that, even if it’s still GPL compliant.

Matt: And it would also be more likely that someone would create a good free alternative, where with design that’s less likely to happen.

Brad: That’s exactly right. Maybe I’m the same way, I come across a plug-in that costs money and chances are you’re right, there is a free alternative out there that’s going to do something similar or very close to that functionality.

Matt: Most features for WordPress start as plug-ins first. So if all plug-ins were to be commercial, that would seriously inhibit because even though they’d be GPL, the guys obviously would want us to put functionality in WordPress and that would seriously inhibit, I think, the growth of WordPress.

Brad: Some plug-ins warrant a price tag, some of the more complex e-commerce forms, things like that… those plug-ins if you look at the source behind them, there’s a lot of work that has been put into plug-ins.

Matt: It’s not a function though of the amount of work because obviously there’s a lot of amount of work put into WordPress.

Brad: True. That’s a very good point and ultimately, it’s everyone’s decision on how they want to release that. I’m a big…

Matt: I like to say that best things in life are free.

Brad: Hey, WordPress is a great example of that. I’m a big fan of GPL and I like to see things that released GPL. I really don’t have a problem if people pay or ask for money for certain things.

Matt: Also, if you look at the direction of the commercial theme page, they’re not really charging for the downloads, less and less; they’re more charging for the support and the customization and work around it. I think plug-ins totally can go that direction as well.

Brad: Yeah, that’s actually a great business model and I know a few plug-ins like that that go that way. I think the e-commerce plug-in is one of them. The download is completely free and then if you want support, you pay for that. I think that’s probably a good business model for plug-in developers to look towards.

Overall, a good interview conducted by Brad Williams.

Posted in | Tagged , , , | 16 Responses

Mark Jaquith Is A Very Active Man!

First Signs Of WordPress Using BuddyPress With Project Wide Profiles

By Jeffro on September 3, 2009

While we briefly talked about this during episode 70 of WordPress Weekly with Andy Peatling, today during the early part of the WordPress developer chat, Jane Wells passed on a link to http://profiles.wordpress.org which is the first public instance of BuddyPress in action on the WordPress.org domain. Let’s take a look at Mark Jaquith’s profile since he is a core committer and very active across the project.

Mark Jaquith Is A Very Active Man!

Mark Jaquith Is A Very Active Man!

This profile page shows the plugins that user has created, the topics they have created in the WordPress.org forum, their replies to forum threads, ideas they have created, ideas they have replied to, their activity on Trac, plugin trac activity, and BuddyPress trac. That is what I found listed on Mark’s profile page but I’ve seen others listed as well on other profiles such as WPMU topics, WPMU Trac, bbPress Trac, etc. All of the Trac activity contains links to specific changesets as well as tickets along with a short description of the ticket. Pretty awesome to say the least!

The profile editing page gives users the chance to enter their job title, website URL etc. It covers most of what you would see in typical web profiles. However, you can also define how you use WordPress either for Personal use or Business. You can also select the option to be added to the WordPress Consultants list. This is interesting in that potential clients will have the ability to see just how active those consultants are within the WordPress project/community. Definitely worthy of a selling point for most clients.

Easy Way To Track Activity Of WordPress Consultants

Easy Way To Track Activity Of WordPress Consultants

Since BuddyPress is in action, we can also manage friends or friend requests. This is all part of the BuddyPress project so if anyone has used that software before, none of these features should come as any surprise.

Logging In For The First Time:

If you have a WordPress.org forum user account, that same information can be used to log into the Profiles website. Only when you log into the site for the first time -will- a site wide profile be created for your account. If you don’t login, no profile will be created for you.

This is exciting stuff! I’m already playing around with my profile and going around adding people as friends. Definitely get on board and help test out this install of BuddyPress. However, if you come across any problems, I’m not sure who to contact so I would just post a new thread in the WordPress.org support forums.

Last but not least, add me as a friend!

*Update*
I just spoke with Andy Peatling and he says that the friends feature is going to be turned off on profiles for now and that it’s not supposed to be there. So no friendships for us!

Posted in | Tagged , , , | 18 Responses

Page 25 of 37« First...510...242526...3035...Last »