I had the pleasure of presenting at WordCamp Seattle this weekend. Big thanks to Josh, Bean, Calvin, Dan, and the rest of the volunteers, sponsors, and attendees that made it a great event. I presented a talk based on an earlier blog post about the steps in launching a new blog, specifically SocialPhotoTalk.com. Here are the slides from my presentation. The talk was recorded; once that video is available I’ll link it here as well.
Dear WordPress users: The sky is not falling. Yes, there’s a worm in the wild that is attacking older versions of WordPress. This is not a new scenario. It’s what malicious software crackers do: they write code that exploits vulnerabilities. It happens to operating systems, it happens to web browsers, and yes, it happens to blog software.
The solution to avoid being attacked is to keep WordPress up to date. With current versions of WordPress, that’s literally a two-click process. If that’s too difficult, then you need to either use the hosted WordPress.com system (where Automattic will keep the entire infrastructure up to date), or hire a system administrator to spend a few minutes to keep your software in shape.
Matt Mullenweg gives his perspective of how to keep WordPress secure.
Yes, it sucks if your blog gets attacked. It wasn’t your fault. But much like the car owner who leaves doors unlocked and is then burglarized, there are things to do to protect oneself and minimize the risk. The best protection against a WordPress security issue is to keep one’s blog up to date.
As most of you probably know, I’m a big fan of WordPress, what with being the lead organizer for WordCamp Portland and having founded the Portland WordPress User Group and all. That said, Posterous has been making a lot of waves lately with Steve Rubel now using it for all of his publishing and even Chris Brogan giving it a shot. I decided to use Posterous to blog our recent roadtrip, publishing text and photos from the road.
The big differentiator between Posterous and a traditional blog platform like WordPress is that all content is published via email. Sending text to Posterous creates a text post. Including a photo or video attachment results in those being shown on the post. If multiple photos are attached, a gallery is created. Posterous’ other notable feature is that it can then notify other social networks of your content. Photos can be sent to Flickr or Facebook. Links to the Posterous post can be published to Twitter or a Facebook news feed. Videos can be sent to YouTube, Vimeo, or the like.
My overall impression was that post-by-email was a great solution for moblogging from a smartphone, but the limitations of the service mean that I wouldn’t consider it for any sort of permanent blog/web presence. The look/feel can’t be customized, and my of the “nice to haves” of a full blog platform (Gravatar, OpenID support, threaded comments, etc.) are missing. I know that Posterous is under development and I’d expect to see these type of features in the future, but for now I don’t think it can be seen as anything more than a plumbing system to mass-publish content across the web.
As such a plumbing system, it works great. I had no problems using their email interface to specify if I wanted my content to go everywhere (in my case Posterous, Flickr, Twitter, Facebook) or just to a subset of the services. One gotcha that I ran into was that because I have my Facebook feed setup to import from Flickr, when I posted a photo to both Flickr and Facebook it showed up twice on Facebook. This isn’t a fault of Posterous at all, but rather me needing to be more granular in my cross posting. The one Posterous-to-Facebook annoyance that is a limitation is that when posts are made with photos on Posterous, the photos get put into a Facebook album and the blog post gets pushed to the Facebook news feed, but there’s no connection.
Overall Posterous worked great for pushing a variety of content to a variety of places. The rather spartan web interface, lack of customization, and lack of extensibility limits its usefulness for a more traditional blog or website presence. A lot of Posterous’ functionality could be duplicated via WordPress plugins. For a simple publishing mechanism, Posterous is great, but for a full-featured blog platform, WordPress remains king.
Disclaimer: I’m not a lawyer. I don’t even play one on the internet. All of this post is speculation by a blogger.
WordPress, everyone’s favorite blogging platform, is released under the GNU GPL, an open source software license. The GPL is notable in that it not only requires that source code be made available, but that it stipulates that anyone may modify and redistribute that source code as long as the derivative works are also licensed under the GPL.
Is a theme integrated into WordPress closely enough that it’s required to be licensed under the GPL? This morning, Matt Mullenweg (creator of WordPress) posted a piece stating the “official” view that WordPress themes must be GPL.
How does this play with the premium (read: $$$) themes which are available for WordPress? I’m a big fan of Thesis (so much of a fan that I offer up that affiliate link), but a GPL-ed theme would wipe out the basic revenue model of “pay to use the theme.” There would still be opportunity for payment for services such as the excellent Thesis support forums, but the basic pay-to-use notion would be gone, since the code would be freely available from any number of sources.
I decided to pop the question of Thesis’ future to Chris Pearson (@pearsonified), the man behind DIYthemes which is the company that releases Thesis:
ahockley: Curious to see how this affects some premium themes, namely Thesis: http://bit.ly/txqE0 @pearsonified
pearsonified: @ahockley It won’t affect Thesis at all.
ahockley: @pearsonified Thanks for the reply… but… Thesis isn’t GPL, is it?
pearsonified: No
ahockley: @pearsonified So if Automattic says themes need to be GPL, and Thesis isn’t GPL, how does this not affect Thesis? Connect the dots for me
pearsonified: @ahockley Automattic says that, but they cannot and will not enforce it. Therefore, DIYthemes will continue to operate as normal.
Interesting way of handling the situation… sounds like Pearson isn’t planning to change his operation unless forced, and he’s confident that Automattic won’t press the issue.
Photo by stopnlook, used under Creative Commons licensing
