Has it really been 10 years? It seems just yesterday we were playing around on my blog, and the blogs of a few high school friends. Two of those friends are married, one isn’t anymore, two are still figuring things out, and one has passed away.

You were cute before you became beautiful. Wearing black and white, afraid of color, trying to be so unassuming. I know you got jealous when I wore those Blogger t-shirts. They were the cool kids at SxSW and I thought maybe you could grow up to be like them.

You wouldn’t have shirts of your own for a few more years. We didn’t know what we were doing when we made them and the logo printed ginormous. People called them the Superman shirt and made fun of them. But, oh, that logo — the curves fit you so well.

You showed the world you were growing up, and how much you cared about design and typography and other platonic ideals. You knew that open source didn’t have to be homely. I stretched myself too thin trying to get you there, and I did a stupid thing to pay for it. I hurt you, but instead of casting me away you held me closer, supported me, gave me another chance. I will never forget that. Akismet made me feel less guilty. I wouldn’t change anything, because the mistake made me understand how important it is to fly straight and take your time.

You’re so beautiful… I’m continually amazed and delighted by how you’ve grown. Your awkward years are behind you. Best of all, through it all, you’ve stuck with the principles that got you started in the first place. You’re always changing but that never changes. You’re unafraid to try new things that may seem wacky or unpopular at first.

I see you all over the world now, glowing from screens, bringing people together at meetups and WordCamps — you’re at your best when you do that. You’re my muse; you inspire me, and I’ve seen you inspire others. You become a part of their life and they become a part of yours. I hope we grow old together.

Cheers to ten years, and here’s to a hundred more.

Love,
Matt

One of my favorite photographers, Neil Leifer, has a beautiful new WordPress.com-powered site. For the past few years I’ve had this photo in my office:

The story behind it is pretty interesting, taken from this interview with Larry Berman and Chris Maher:

Chris/Larry: It’s actually quite a different question to say what are your favorites verses what do you feel are your best photographs.

Neil: I know, and my best picture ever, in my opinion, is my Ali Cleveland Williams picture that I shot from overhead. I don’t usually hang my own photos, I collect other people’s pictures. But that picture’s been hanging in my living room as long as I can remember. I have a 40×40 print of it which is hung in a diamond shape with Williams at the top. That’s the guy that’s on the canvas on his back.

Chris/Larry: It’s remarkably abstract for a sports picture.

Neil: I think it’s the only picture in my career that there’s nothing I would do different with it. You look at pictures and think that you can always improve them no matter how successful the shoot is. Part of what motivates you to go on to the next shoot is every once in a while you get a picture, whether it’s the cover of the magazine or an inside spread, that’s as good as you think you could have made it. And then a week later you see a couple of things that you could improve slightly. A month later you might see a few more things. It doesn’t diminish the quality of that picture. It simply means that there’s always room for improvement.

Chris/Larry: You’re learning for the future?

Neil: Exactly. It’s sort of what motivates you to go on. If I were to do the Cleveland Williams Ali picture again, I would do it exactly the same. And more important is that no one will ever do it better because it can’t be done like that anymore. Today the ring is different and the fighters dress in multi colored outfits like wrestlers. Back then the champ wore white and the challenger wore black.  Today, when you look down at the ring from above, you see the Budweiser Beer logo in the center and around it is the network logo that’s televising the fight. Whether it’s Showtime or HBO, they have their logo two or three times on the canvas. The logo of promoter of the fight, Don King Presents, is also visible. That’s why that picture couldn’t be taken today. So not only did the picture work out better than any I’ve ever taken, but it’s one that’ll never be taken again.

Chris/Larry: Where are you in this picture?

Neil: I’m at 11:00 o’clock, as I remember it. I’m in a blue shirt leaning on the canvas with a camera in each hand.

It’s always an honor to have a great creator make their home on the web with WordPress.

Last week there was a serious flaw found in the code behind TimThumb, an image re-sizing library commonly used in premium themes.* Because the code is commonly embedded in themes it’s not easy to discretely update like it would be if the code were a plugin, and even when a theme is updated people are hesitant to update because they often customize theme code rather than making child themes, so if they were to overwrite their theme with a new version they’d lose their modifications. That, combined with the severity of the flaw, means that this is one of the more serious issues in the WordPress ecosystem in a while, even more than normal because it wasn’t in core.

It could have gone a lot of ways, but the incident brought out the best in the community. The core team sprang into action searching through the theme directory to inoculate any themes that contained the dangerous code. Community blogs quickly got the word out about the problem so people were aware of it. Mark Maunder, who originally discovered and broke down the problem, created a fork of the code called WordThumb that rewrote TimThumb from the ground up. Forking is not usually ideal because it fragments the market for users but Mark soon connected with Ben Gillbanks, long-time WordPress community member, and they’ve teamed forces to release TimThumb 2.0, a collaboration that exemplifies Open Source at its finest. An updated plugin should be in the directory shortly.

It also illustrated the original vision I had behind VaultPress. In addition to reporting early and emailing customers with vulnerable code, the following morning they had devised a way to go in and surgically correct vulnerable code on over seven hundred affected websites. This fixing-problems-while-you-sleep delighted users and is exactly the kind of problem I hoped VaultPress would solve for people and it underscores the core value of the service. If you’re not using VaultPress for your most important websites yet, you should.

* I originally had a long rant here, but here’s the 13-word version: I’ve seen no correlation between how much something costs and its code quality. This is getting better as more people become familiar with the coding standards of core, and PHP in general, but there is still a long way to go. If you want to avoid this in your own code, check out Theme Check and Log Deprecated Notices to start. If you’re looking for code to base your own theme on, it’s best to start with something like 2010 or 2011.

As noted on TNW and Adweek, yesterday we passed over 50,000,000 websites, blogs, portfolios, stores, pet projects, and of course cat websites powered by WordPress. I had the good fortune to celebrate this milestone with a few hundred WordPressers at WordCamp Montreal yesterday. (During my Town Hall I wasn’t aware we had passed the number until someone shouted from the audience.) It’s always fun to pass a big round number and over the weekend many libations were consumed with friends old and new, but ultimately the press has always been more concerned with those top-line numbers than we have in the WordPress community. More sites being created is a good benchmark for our adoption, but ultimately WordPress matters not for the blogs it creates but for the lives it affects. We have some huge opportunities this year, particularly around making our software more accessible to the next 50 or 500 million people who want to have a voice online, something I hope to talk more about at WordCamp San Francisco next month.

The New York Times has a pretty prominent article today called Blogs Wane as the Young Drift to Sites Like Twitter. The title was probably written by an editor, not the author, because as soon as the article gets past the two token teenagers who tumble and Facebook instead of blogging, the stats show all the major blogging services growing — even Blogger whose global “unique visitors rose 9 percent, to 323 million,” meaning it grew about 6 Foursquares last year alone. (In the same timeframe WordPress.com grew about 80 million uniques according to Quantcast.)

Blogging has legs — it’s been growing now for more than a decade, but it’s not a “new thing” anymore. Underneath the data in the article there’s an interesting super-trend that the Times misses: people of all ages are becoming more and more comfortable publishing online. If you’re reading this blog you probably know the thrill of posting and getting feedback is addictive, and once you have a taste of that it’s hard to go back. You rode a bike before you drove a car, and both opened up your horizons in a way you hadn’t imagined before. That’s why blogging just won’t quit no matter how many times it’s declared dead.

Blogging (with WordPress) is the natural evolution of the lighter publishing methods — at some point you’ll have more to say than fits in 140 characters, is too important to put in Facebook’s generic chrome, or you’ve matured to the point you want more flexibility and control around your words and ideas. (As The Daily What did in their recent switch from Tumblr to WordPress.) You don’t stop using the lighter method, you just complement it — different mediums afford different messages.

Read more: Scott Rosenberg on “Another misleading story”; Mark Evans “Why I Still Love Blogging.”

I don’t think “mega-blogging” is actually a thing, I just made it up to make the title sound more dramatic. But if mega-blogging were a thing, you would do it with WordPress. Micro-blogging is a thing, and a lot of people do it with Twitter.

TechCrunch drops in this fray with an article comparing the comScore numbers of WordPress.com and Twitter.com, which show an accelerating growth for WP.com and flattening for Twitter. I’ll talk about the data itself later, but first wanted to point out a point many overlook when trying to create a battle between the mediums.

New forms of social media, including micro-blogging, are complementary to blogging.

One of the many uses of Twitter is to link to and promote your blog posts. (And other people’s blog posts.) As we grow, so do they, and vice versa. I blog when I have something longer to say, like this. I tweet when it’s the lowest friction way to talk to my friends, or get distribution for something longer I did somewhere else.

It’s not really a “versus,” it’s an “and.”

Whether the Twitter team intended it or not, they’ve built a killer and highly addictive reader platform with dozens of interesting UIs on top of it.

Features like WP.me, post by email, Twitter publicize, RSS Cloud, P2, email subscriptions, and more stuff in the cooker is trying to tie these things together more because people who do one are highly likely to do another.

As for the accuracy of underlying comScore data I would say they probably are precise but not accurate, meaning that whatever flaws they have in collection now, for example for WP.com they don’t count the custom domains or RSS readers and for Twitter they don’t count API usage or desktop clients, they’re at least self-consistent in how they do things over time. Some months they show us flat our internal stats showed growth, and vice versa. Ultimately it’s not worth anyone outside of comScore arguing how they collect their data, it’s better just to use it as one reference point alongside Quantcast (my fav), Alexa, Google Trends, Nielsen…

How tweets get imported into a blog is still an open question for me. I’ve seen lots of ways people have attempted it but when a blog becomes an activity stream it becomes a weak version of all the things it aggregates, less than the sum of its parts, because of the loss of context.

Adam Tow got some great photos at WordCamp. Update: Here are mine. See also:

• This hilarious set with the WordCamp sign
• Duane Storey’s
• Randy Stewart’s
• Ben Metcalfe’s
• Andrew Mager
• Nick from CNP’s
• Jenn Vargas
• Dennis Goedegebuure’s
• Mark Ghosh’s
• Lorelle’s
• Chiropractic’s
• Byrne Reese’s (MT developer, a spy? :))
• Liz Danzico’s
• Chris Heuer’s
• Hugo Baeta’s
• Alan Levine’s
• Laura Iriarte’s
• Jeremy Person’s
• Niall Kennedy’s
• Douglas Bell’s
• Scott Beale’s
• Emily Chang’s
• The WordPress Tattoos 🙂
• Some funny ones from the WP Scavenger hunt

What about mine? Not quite yet.

Wincent Colaiuta has no problem throwing flames at WordPress, but doesn’t see fit to enable comments. (Apparently disabled to make Movable Type more secure.) His table-layout blog isn’t too notable but it got linked from Daring Fireball so a lot of people saw his article trying to draw the line between a routine point release and encouraging people to never use WordPress on the public internet. Here are a few points for thought in response:

• The SQL problem in 2.2 requires both registration to be enabled (off by default) and the blog to be upgraded to 2.2. It is a serious problem but I’ve heard of fewer than 5 exploits from the flaw. Even if you assume there are 100 blogs for every one we heard about, that’s still an incredibly small percentage of the millions of WordPresses out there, especially considering, as Wincent points out, the problem has been in the public for a while now.
• Getting people to upgrade web software is hard. We work as best we can with hosting companies, but a consideration is that it’s best to roll several security fixes into one release. It’s not responsible to do a release if we know of another problem, so sometimes there is a lag between an initial report and a final release, not to mention the testing required of a product used as much as WP.
• Wincent digs up the server crack that modified the files of 2.1.1 for a few days. Ignoring the fact that it was a server issue and had nothing to do with WordPress the software, we actually had NO reported exploits of the problem. (Though I’m sure there are at least a handful out there with problems, it wasn’t enough to hit our radar.) Despite that we took a hit and publicized the issue as much as we could to get the word out.
• Also about 2.1.1, the problem was found through someone proactively auditing the codebase.
• Finally Wincent says of WP “[a]nd if you insist on installing it, then you need to watch the trac like a hawk.” You would think complete transparency of the problems (it was on our bug tracker and mailing list) would be a good thing, especially considering the software Wincent uses doesn’t have a bug tracker, and the only way to submit a bug is through a contact form.

We can and do review new code for problems, and pick the vast majority up before any releases. I think the real issue though is not that WP has bugs which are sometimes security related, which all software not written by djb does, but that the mechanisms for updating complex web software are a pain. Right now the best experiences are probably with folks like Media Temple or Dreamhost that have pretty foolproof one-click upgrades and are quick with updates.

Making notification better and upgrading more painless for people not lucky enough to be on a host like that are problems with some very clever minds on them, and I’m confident that we’ll have good progress toward each in the next major release of WP.

Finally, I suppose we could act more like our proprietary competitors and try to downplay or hide security issues instead of trumpeting them loudly in our blog, but I think the benefit of having people well-informed outweighs the PR lumps we take for doing the right thing. I truly believe talking about these things in the open is the best way to address them.

In some ways it’s a good problem to have. When a product is popular, not only does it have more eyes from security professionals on it, but any problems garner a level of attention which is not quite warranted by the frequency of the general event, like Angelina Jolie having a baby. There are certainly things intrinsic to coding that can make software more or less secure, but all things being equal the software with the most eyes on it, which usually means Open Source, will be the most robust in the long term.