I called my sister last night to tell her about a present I found for her in the market and she interrupted me to say she saw my name show up in Google News a few times and started reading some of the articles. Before the phone card ran out she read me some headlines and my stomach sank. This is my first vacation and I almost didn’t even bring my laptop. (Luckily I talked myself into bringing it to do pictures.) I haven’t been on the internet since Monday and I obviously have a lot to catch up on. It was almost midnight when I found out and there was no access anywhere, so I woke up at 4:30 AM this morning to catch the first water bus to the airport and found some overpriced wifi, and here I am.

I have close to a thousand emails and countless blog posts and comments to go through, but I’ll try to synthesize everything and respond ASAP, I think it’s important because some people seem to be spinning things quite maliciously. If you have a specific question please send me an email and I’ll do my best to respond personally or on the blog, even if you’ve already decided I’m the scum of the earth.

As has been reported many places, and sent to me in a dozen emails, Dreamhost have integrated support for installing and upgrading WordPress through their administration interface. For many this is not new, some systems like Fantastico have had support for auto-installing WP for a while now, but the interface was cluttered and WordPress was just one of several dozen miscellaneous scripts. What’s really interesting about this decision is their thought process, quoted from their newsletter:

Why didn’t we make it so you could just install Movable Type itself with one click instead? Somewhat because Movable Type is a commercial product, and they would require us to do some sort of weird registration for all our users with them in order to even install the free version. Also, WordPress doesn’t require “rebuilding” your blog every time you publish. Mostly though, installing WordPress was eleven times easier for us.

Tyler Brekko sent me screenshots from the entire installation process, including emails from the “Happy DreamHost WordPress Robot” and it’s kinda neat. They take advantage of a few structural decisions in WordPress and on wordpress.org to make the process very smooth. You can read a bit in their knowledge base. What surprised me the most was the sheer number of people who emailed me about this, DreamHost must have a ton of users. Here are some other posts around the web about this:

• DreamHost Excels
• @ Switch Case
• @ What Do I Know

Thanks to everyone who wrote in about this!

A few comments about some of the code changes in 1.3. Very nice to see people appreciating some of the hard work we’ve put into this iteration. In a perfect world we could stop the clock and rewrite large portions of the code from scratch, but that would take a long time and break a lot of things in the process. All programmers want to do this, it’s our weakness, but every time I get this urge I think of Netscape and how devastating their rewrite downtime was. We’re making some substantial changes but doing it gradually while introducing new features and responding to users needs.

For example, in 1.3 “the loop” is called very differently but it’s completely backward compatible with everyone’s 1.2 loop code. We deprecate things over time so any structural changes that need to be made come gradually for people upgrading, there’s nothing to drastic every time. This also saves a huge amount of time in support. (Regular users don’t want to have to redo their templates, hackers don’t want to relearn code they already knew.) Same for the new theme system we’re introducing, it adds a lot of flexibility, radically changing how the front end of WordPress operates (like plugins for templates and styles) but all the new stuff is completely optional. I’ve transitioned most of my custom code into a personal “theme” that makse upgrading a lot easier for me (which is good because I do it almost daily).

Next time you get the urge to rewrite from scratch think about the testing your code has gone through, all the edge cases that have already been addressed, the existing installed base, and how many new bugs you’ll introduce with the from-scratch code.

This is neat: Fernando Graphicos has taken Michael’s Kubrick and built a few other very well-excuted graphic designs on top of it. Take a look:

• Lack of Love
• Clean and Crisp
• Rotten Tarp
• Headspace

It’s great to see one labor of love inspiring another. I can’t wait to see what these talented people do when the theme system for 1.3 is released.

Can you link to this? How does it look in your aggregator? What’s it look like in your address bar? If you can’t get to this entry leave a comment on the previous one. Hat tip: Anne.

Through Carthik’s post A minor debate I came across this thread talking about comment feeds. The thread is a little funky and Carthik is obviously enthusiastic, but what stood out is Anil‘s comment “If there’s enough demand from users for it, we’ll include them in MT as part of the package.” Which prompts the question, how much demand from users for this was there in WordPress? Do we just bloat the willy-nilly with every idea that comes down the line? The answer is in two parts:

First, a great deal of thought and deliberation goes into every feature we include with WordPress, particularly the ones enabled by default. One guiding force of WordPress is that every release is faster than the one before that, and to do that you have to optimize ruthlessly and be very wary of any bloat in the code. So far we’ve been very successful with this: WordPress is at least 3 times faster than b2 was and we still have added features that other systems are just beginning to catch up with. With comment feeds there is the immediate benefit of people being able to subscribe to any thread on any WordPress site in the world, but there is a further benefit of bootstrapping a technology of which the benefits are just beginning to be fully realized. Feedster can index not just every post on a WordPress blog, but every comment as well. Aggregator developers may not have gone to the trouble of supporting <wfw:commentRSS> for just a few custom feeds, but now I can point fifteen thousand blogs using it to point to a countless number of comment feeds.

The market might not be demanding a feature yet, but if you just wait for the market to decide it wants something you’ll always be following and never leading.

Second, a great idea can come from a single user. Pure numbers are a factor when considering new feature suggestions, but most good ideas stand on their own merits. Innovation usually comes from the places you least expect it. If I remember correctly we had about a dozen or so people interested in comment feeds that I knew of, but it really could have been one. It was an idea that made a lot of sense within the stated goals of WordPress and didn’t cost anything to add. Alex got the code together and it was in the next release. It’s been improved a couple of times, and now you can add /feed/ to any permalink (or category page, etc) in WordPress and get the feed you want. Users that didn’t know they wanted comment feeds before are thanking us now. Eventually all modern blog software will support comment feeds, and WordPress will have moved on to something else new.

Under the Iron has an old interview with Scott Johnson that is a good read. Now scroll down to the comments. Dozens and dozens of spam comments. I see this over and over again on MT and s9y sites. What’s terrible is these pages are just as dangerous as dedicated spam blogs. Think about it: I shouldn’t even be linking to it now.

Alex told me the other day about a new type of comment spam he’s been seeing: comments that link to normal blog entries. Well known blogs like Mozillazine. As advanced as tools like MT Blacklist have become, they’re pretty useless in cases like this. Are you going to blacklist Dave Sifry? Molly.com used to have spam comments on her site all the time. Even though she spent a lot of time and effort dealing with them (a daily chore) they only need to be there long enough for Googlebot to index them for the harm to be done. I’m not dogging on MT here, it’s just that there are tens of thousands of MT blogs out there who don’t have any protection and the spammers are targetting them mercilessly. Domain blacklists don’t scale (spammers can have thousands of domains easily and hijack innocent domains) and centralized registration hasn’t shown to be effective except against people who don’t like centralized registration, a group that doesn’t include spammers.

People used to say that WordPress doesn’t get spam comments because it’s not popular enough. I don’t think this argument holds water anymore. It’s true that MT has three to four times as many blogs as WordPress, but Serendipity has an order of magnitude fewer blogs than WP and is highly targetted by spammers. I think WordPress has, through design and luck, done a lot of things right with regards to comment management in general. First we respond to the problem in the core code quickly. Moderation and blacklisting has been in the core for half a year now. All of the WordPress developers are bloggers as well so we’re pretty sensitive to new techniques in use by the spammers. When early versions of WordPress 1.0 advertised moderation was on spammers instantly adapted to that and started searching for blogs that didn’t have the phrases we used, so in the next nightly build for testers I had changed how that worked so it couldn’t be targeted anymore. Then in 1.2 we expanded the already successful moderation to allow powerful regular expressions and target not just the content but things like number of links in a post. Let’s say that somehow two hundred spam comments did get on your blog, which would never happen in the first place because we’ve had throttling for over a year now, you can easily delete hundreds of spam comments at once in under five clicks. We’re not sitting still either, version 1.3 will have emergent registration based on code originally written by Kitten so there is a type of automatic whitelisting going on that spammers can’t duplicate because it uses email addresses like a secret key and WordPress never reveals your email address. (So Dave and Mark, stop leaving fake ones!) The code will be flexible enough to adapt for GPG signing for the ultra-geeky in the audience.

Any of these things by themself wouldn’t be very effective, and each method I’ve listed has its flaws and weaknesses and I know them. Which brings us to what I think the real reason WordPress, despite its explosion of popularity, still doesn’t get the level of spam other tools do: it’s more trouble than it’s worth. WordPress, to spammers, is an unpredictable and moving target. We’re not resting on our laurels, we have another exciting feature-filled release coming just a few months after the landmark version 1.2. The WordPress moderation system can be be toggled to manual mode, which is 100% effective at catching spam, or triggered only when something is suspicious. We’re committed to keeping the cost high and the reward uncertain for spammers which means you don’t have to wake up every morning to filth on your weblog as well as in your inbox. You can focus on what draws us all to this medium, writing and genuine interaction. Here’s a quote from Molly from a comment she left on Keith’s site:

I wanted open comments. In my situation, MT, despite the wonderful Jay Allen personallyhelping me on an almost daily basis to deal with comment spam, I was a major target. My ISP refused to continue dealing with me because the server molly.com resided on was brought to its knees twice due to spam floods. I was spending up to two hours PER DAY to undo the spam much less post.

Since switching to WP, I’ve had exactly five emails sent to me automagically for moderation. 3 of them were spam, 2 were just enthusiastic posts with multiple links from a reader.

Either way, I had instantaneous access to accept or delete those posts.

That’s the sort of thing that is incredibly rewarding about working on WordPress. Knowing that your work makes it easy for someone else to do what they love is one of the greatest feelings in the world. No amount of money or recognition can ever match that.