And how much weight does the community carry?

This week we’ve seen a lot of discussion around the Active Install Growth Chart in the WordPress Repository. Mark Zahra has rallied the community to push back and find answers. He has an open meta Trac ticket you can follow and comment on to see where this goes, but it does beg the question: how open is our open-source community when decisions can be made unilaterally without warning and without community input?

This isn’t the first time the community has dealt with changes (remember when Gutenberg was introduced?), and it certainly won’t be the last time (history in any community bears witness to this), but when should the community be involved, how much involvement should there be, and how and when do you notify the community at large?

Decision-by-committee is difficult enough, and decision-by-community is called an election. Surely there must be a way that we can gather information, keep the community informed, and move forward in a mutually-beneficial way. I don’t claim to have solutions, but I, along with many of you, will be watching to see how this goes.

Racism and Allyship

Racism and Allyship continue to be a conversation in the WordPress community. Allie Nimmons recently hosted a two-hour webinar on How to Be a Better Ally. Feedback on the event was all positive, mostly due to the non-lecture way that Allie presents on the topic, and also the workshop approach to challenging the attendees to think about their current beliefs and how they consider themselves allies, how they think they can do better, and how we can all challenge ourselves to think about our place in the community to one another. I consider myself an ally, and I look for ways that I can improve continually, and this workshop helped me move forward in that even more. If you weren’t able to attend, you can still purchase the event and watch it online. I urge you to do it.

WordPress Business News Roundup for the Week of October 3

Active Install Charts Removed from Plugin Repo

In reaction to as-yet-unpublicized details about the abuse of active install data in the WordPress.org plugin repository, the charts displaying that data have been removed from plugin pages in a move expected to be temporary. Important (and familiar) questions are emerging as this story unfolds. While we wish many things had gone differently, the questions that will help the most and move plugin businesses forward have to do with the things they (and anyone in the WordPress community) are always free to do. Most of all, “What are winning growth strategies for plugin owners that aren't dependent or overly focused on single measures of success — whether they use the .org repo or not?” READ →

• Cory Miller: What Can We Do Better to Support Our Plugin Developers?
• Daniel Schutzsmith: Diversifying Revenue, the 50% Coding / 50% Marketing Lifecycle, Active Install Clawback, and Turbo Admin

Trust and Distrust: Microaggressions, Active Install Growth Data for Plugins, and Open Source Security — Post Status Excerpt (No. 70)

In our weekly chat for Post Status Excerpt, Nyasha Green and I take on three big, unavoidable issues in the WordPress community — touching briefly on one that looks like an iceberg dead ahead that no one is paying attention to. All of these issues deal with trust — how it can be harmed and the difficulty (and necessity) of repairing it: 1) racism and microaggressions, 2) the sudden removal and uncertain fate of the active install growth chart in the WordPress.org plugin repository, and 3) open source and security. Briefly discussed: emerging US federal policy that aims to secure open-source software. Zero-trust architecture might work well for networked machines, but human relationships and communities need trust. (Full Transcript) LISTEN →

Going from Agency to Products: The Story of Barn2 — Post Status Draft 125

Katie and Andy Keith started out as a WordPress agency almost a decade ago and then tried to break into WordPress products, first with themes and then plugins. Challenges arose with reliable project management on the agency side while they tried to establish a foothold in the WordPress plugin market after a first attempt with themes. The WooCommerce Extensions Store is where their business took off. With niche extensions that had no competition, they ranked very quickly. Other ideas for plugins solved problems in custom development projects for clients. Eventually, the Keiths developed a formula for evaluating new plugin ideas. Learn from their challenges and successes — there are a lot of interesting details that only come from experience. Hosted by Cory Miller. (Full Transcript) LISTEN →

Open Source Communities: You May Not Be Interested in CISA, But CISA is Very Interested in You

United States national security interests are poised to become more invested in and engaged with open-source projects classified as public infrastructure. From Log4j to the Securing Open Source Software Act, how did it all come together in 2022, and what may lie ahead? READ →

• When the Free Rider is Government — Chinmayi Sharma argues our digital infrastructure is built on open source, and it cannot provide adequate security so governments should help out.
• Open Source Software Security Summit 2: 10 areas of focus to improve OSS security
• A proposed amendment to HR 4521, the America COMPETES Act of 2022, would authorize the creation of a set of Critical Technology Security Centers inside the Department of Homeland Security through CISA, including one focused specifically on open-source security.
• The Senate Homeland Security and Governmental Affairs Committee held a hearing on Log4Shell and open-source security in February. GovTech did a nice summary of the event, but there are many details in the speakers' prepared statements worth reading or viewing. (Speakers include David Nalley, Apache Software Foundation • Brad Arkin, Cisco Systems • Jen Miller-Osborn, Palo Alto Networks • Trey Herr, The Atlantic Council) The Q&A; is worth a listen. WATCH →

The recent discussions around the Active Installs data being removed from the WordPress Repo prompted a couple of questions I think we need to answer as a bigger WP community and particularly our members at Post Status.

As someone who lived in the WordPress product space for 10+ years and had free and paid plugins (found this from 2010), I resonate with the issues and concerns being brought up particularly by plugin developers.

In the spirit of Mark Zahra's “let's work together, not against each other,” what I want to do here is continue a constructive conversation and help us all make progress together — for the good of WordPress, plugin developers, and users.

My intention is asked in the spirit of Mark Zahra's sentiment of “let's work together, not against each other” and is simple:

To give voice to those awesome people and the countless others building WordPress plugins around the world, to help frame the conversation to be clear and constructive, in order to help us all move forward.

So to our WordPress plugin developers ….

What worries, concerns, problems, obstacles, challenges do you have creating, building, maintaining WP plugins?

What are 1-3 initiatives would you prioritize that would create a better, more sustainable environment for you in WP?

As always, keep it about the work, never personal. Talk about and share your experiences, not blame.

In this episode of Post Status Excerpt, Dan and Ny take on three issues in the WordPress community that can threaten or impair trust while also revealing how foundational trust is, especially in open source.

First, they talk about Ny's article at MasterWP, “Enough with this woke stuff: and other racist speech you can unlearn,” which explains microaggressions and received a significant number of macroaggressions in reply — but also far more positive support from the community.

Next, “How do we rebuild trust when it's harmed?” is a question that leads into the biggest WordPress story of the week — Matt Mullenweg's apparent decision to shut down access to active install data at the WordPress.org plugin repo due to an unspecified security breach and/or privacy concern. The way communication has happened — or hasn't happened — about this decision is clearly damaging trust in the WordPress community, particularly among business owners with a product in the plugin repository. Ny points out how this all looks to a newcomer to the WordPress community — again, trust takes a beating. But while we lack clarity about the po. ssible return of install data in some form, Dan suggests asking why this data is trusted and valued by many plugin owners. What business decisions can it helpfully inform? Are there alternative and possibly better sources of data about a plugin's users?

Finally, Dan briefly talks about the emergence of draft legislation in the US Senate: the Securing Open Source Software Act. It seems likely that in the near future, US security agencies will be getting people, dollars, and new organizations involved in assessing risk in open-source software. Are WordPress auto-updates critical supply chain infrastructure? When should individual freedoms be exchanged for collective security? When do we need to know what our machines and software are doing? When don't we? Zero-trust architecture might work well for networked machines, but human relationships and communities need trust.

Trust can be betrayed in so many ways or failed even with the best of intentions.

Dan Knauss

Mentioned in the show:

• Nyasha Green, Enough with this woke stuff: and other racist speech you can unlearn (MasterWP)
• Mark Zahra, A sudden change leaves WordPress plugin devs in the dark (MasterWP)
• Dan Knauss, Active Install Charts Removed from Plugin Repo (Post Status)
• Dan Knauss, Open Source Communities: You May Not Be Interested in CISA, But CISA is Very Interested in You (Post Status)
• Cory Doctorow, Our technology is haunted by demons controlled by transhuman life-forms

Credits

• Nyasha Green, Editorial Director at MasterWP (Twitter)
• Dan Knauss, Editor for Post Status (Twitter)
• Olivia Bisset, Web Producer intern for Post Status (Twitter)

Every week Post Status Excerpt will bring you a conversation about important news and issues in the WordPress community and business ecosystem.

You can listen to past episodes of The Excerpt, browse all our podcasts, and don’t forget to subscribe on Spotify, Amazon Music, Google Podcasts, iTunes, Castro, YouTube, Stitcher, Player.fm, Pocket Casts, Simplecast, or by RSS.

Transcript

Dan Knauss: [00:00:00] Good morning Ny.

Nyasha Green: Good morning, Dan. How are you?

Dan Knauss: Okay. I think! We've got quite a few things cover here, but I think today, the first — the first is probably a topic all onto itself. Something you could spend a lot of time on!

I feel like I'm in the role of like bringing, bringing someone to the family Thanksgiving dinner and having to explain like… Oh yeah, Uncle—

They said that.

Nyasha Green: Oh yeah, So , I wrote an article at Master WP about microaggressions. Mm-hmm. . And you know, usually when I do my social commentary, I do tie it to tech. And I mean, the reason I wrote it was tie it to tech issue, Twilio and claims of reverse racism and hiring and [00:01:00] things like that. And affirm of action and.

What I saw the conversation around this tech conversation was that, you know, a lot of microaggressions, which I talk about is like, you know, unconscious bias and basically racism. Um, so I was like, you know what, this seems like something that the community really needs to learn about and hear about. So, took my wonderful African American studies degree in research background, , and um, you know, did a good article on microaggressions.

Mm-hmm. , which led to more microaggressions. That let this hate mail led to me taking a little break from Twitter. But, um, I guess that's addressing the elephant in the room. But I mean, I look at it as something as I still don't regret writing it. I don't regret what led up to writing it because we have a good number of people in the community who are very informed and they are very.

You know, resp receptive to information like this. I got a [00:02:00] lot of support. I got more support than hate. Okay? So I want to do, I do wanna acknowledge that, but there are quite a few people in the community who actually, you know, they need this information and they ignore it. But you know, that's not going to stop me.

And although I'm taking a break from Twitter, you know, it's because, you know, I have a lot of other things going on. Um, yeah. So I'm perfectly fine and I can't wait to get back on Twitter cuz I'm really gonna argue. Yeah. I'm ready to argue with people. , I'm just kidding. But I, no, I do miss Twitter. It's.

It's nice connecting with people of the community. Yeah. Be in a meaningful way. And like I said, there were lots of people who were like, you know, I really needed to hear this. Like, this actually changed my perspective. I think I might buy a book, one of the books you recommended, Things like that. So, Oh good.

If I can help one person, like that's all, that's all I need. I don't need a, A group.

Dan Knauss: I think it was really good article. I, I haven't heard all of the, the stuff that you covered and you did have a, a bibliography at the end, so Yeah. Mm-hmm. , people [00:03:00] wanna read, click through and, and, and get into some more. Um, I thought it was pretty generous and even handed things.

It's interesting people. Triggered about it because you were pretty clear that microaggressions are, are things almost anyone can do to anybody else for any number of of reasons. Um, but, um, I don't know. I'm, I'm always, I'm surprised, not surprised at the kind of reactions that you, you get, um, when you touch these, these subjects.

I know it's, it seems pretty much that women. are the, the targets of, of that when, when there's equity and inclusion and justice type subjects that come up. Um, and that kind of bothers me. We talked about that a bit before. Mm-hmm. , the kind of, what I wouldn't say it even approaches hate mail and we get the kind of angry I'm leaving, [00:04:00] I'm unsubscribing it, you know, you shouldn't talk about this stuff.

It's always anonymous. Um, that comes to me. The, the stuff I've seen, um, that post status gets, Um, I, I think your experience is quite a bit different and that kind of concerns me that, um, people getting, I think a, a pretty, even, even handed and calm, even like calmer than , a very tolerant response to. Some tough issues where there's, there's definitely kind of abusive things going on out out there.

Um, the reaction is more of the same a as you said, directed very personally from people who are using their work accounts to do it. And they're not hiding their identity at all with you. I don't know what they're afraid of. They don't do that with, with us, but it [00:05:00] kind of, That doesn't speak to anything good if they feel confident.

Um, just cutting loose on, on you, on, on women who write, um, something that they don't want to hear. And it is, it is exclusively men as far as I've ever heard.

Nyasha Green: Yeah. Um, As, as you said, as we talked about people, as you saw on Twitter, people are writing from their Twitter accounts with their WordPress information in it.

Yeah. They're sending it from their business address that. Their business, their business, email addresses that have their addresses and phone numbers and stuff. Mm-hmm. , that's what's, uh, . It's interesting to me because even if you, I, it's a disrespect thing, honestly. Let me, let me go back. They do it because it's, they know like, I can say this to you with my chest, and there's no repercussions.

Or they think, they think that, right. And, um, it's a disrespect issue. It's always amusing to me. Going back a little further to what you said, you were like, you wrote it very like, you know, without emotion. Objectively, I've, I've seen a [00:06:00] lot of people say that. A lot of people said this to me. Mm-hmm. , they were like, this was written like a research paper.

Yeah. Because, you know, one, it was. Two. The biggest thing that I want people to know is that I don't have the luxury of being able to be emotional in writings like this. When I write about my race and my gender or things that I have experienced, and the moment I show any sign of emotion, I'm the wrong person.

It doesn't matter what the other party did to me, right? Because there's this big, uh, I don't know what you would call it. It's this big theory with people discount your experiences and they say it's because you're emotional. It's because you're looking to be a victim like you in, like, I enjoy stuff like this.

I don't enjoy racism or racist people. I prefer to pretend they don't exist. That if I could do that, that's what I would do. But, um, I just couldn't show emotion. And it's been a while since I've written like that. Um, I've been able to show emotion for a while, but I knew with this I couldn't. And you see with that, we still got hate mail

So, uh, I got told I was being a victim of, I was like, Of what? [00:07:00] No response. I was like, What am I a victim of? I'm like, I'm, this is, I have. Micro aggress against people. I've used ables language, you know, not knowing I've said things, um, toward people that I didn't know was harmful. And it was important to me to unlearn that I don't care if I didn't do it on purpose.

And I'm like, Doesn't everyone feel like this? No, they just rather not be told that they're doing anything bad at all, ever, even if it's unintentional and even if it hurts people, but you know, that's them. But for everybody else who wants to learn, I'm always here .

Dan Knauss: Yeah, it's, uh, definitely worth checking out if, um, if you haven't seen it enough with this woke stuff and other racist speech you can unlearn, which I think is very inviting.

Um, uh, and yeah, that, uh, it, it can be unlearned that's a, a positive. Um, yeah, I've seen mail come in about that, complaining that we don't want to hear anymore [00:08:00] of this. Change your thinking, change your mind. Woke stuff. Too bad. Yeah, too bad. Uh, everyone who has that kind of reaction is just a voting for doubling down on, on bigotry or the idea that they have nothing to learn.

Um, and yeah, I know, I think that's a pretty honest and good generous starting point that we're. There's, there's not really any way through life and relationships without stepping on people's toes, and sometimes intentional, sometimes unintentional. And if you don't learn from that, you're, you know, that's, uh, at some point it's not ignorance anymore, it's intentional damage you're doing.

Um, but I'm, I'm glad you wrote it and I hope more, more people. Engage with it, read [00:09:00] it and think about, think about it. Um, I, I think, uh, it's a tough one. Cause you, you also tackled the myth of meritocracy, which will die hard in, in tech. Um, , you know, I, everyone's a victim who hasn't earned their way up or, you know, proven their worth or, or mm-hmm achieved something that I consider, you know, notorious. Yeah, that's, there's a lot, there's a lot more going on in here than I imagine people think who just dismiss it at the title. So that's, uh, it's definitely worth, worth going through. And honestly, it's not in my time. I, I don't think this is something we've talked about a lot.

I don't think it's come up, um, a ton in, in just let's talk about. Kind of, um mm-hmm. conversations. [00:10:00] Yeah. In reaction to bad events. Un unfortunately in problem individuals and, uh, conflicts that come up. So it's, it's worth, it's worth having that conversation as a running one. And I hope the, um, diversity inclusion, um, equity approach to.

To the, to not just events, but um, to, um, to help people, um, look at each other and relate in general will. We'll make that more of just, this is, this is just normal, right? . There's, there's a lot of different cultures and perspectives and age groups represented in a large, large community like WordPress and having an open door and open conversation on it.

It's good. Um, anything else you wanted to [00:11:00] get into? About that. I know there's, there's so many big things looming behind it, but yeah, you need some time to rest, recover, and.

Nyasha Green: Um, not many big things for me. Um, I just want people to, I, I was worried people were thinking, um, especially the first few days I was off Twitter that I was like somewhere crying. I'm not,

Dan Knauss: Oh geez, , no.

Nyasha Green: This man could not ever in a million years make me cry, baby. But , um, it has encouraged me to keep talking.

Like, if, if the reception was a little more tame, , I definitely probably would've said, You know what? Okay. People heard and they understood. The pushback has made me want to talk about it even more. Mm-hmm. , So I'm, I'm cooking up some things and we had Ally, uh, Neon's workshop on how to be an ally, which, um mm-hmm.

talked a lot about microaggressions and a lot of things we were experiencing cuz Ally's been through the re, through the wrong. Is that the expression? Thank you.

Dan Knauss: Through the [00:12:00] ringer.

Nyasha Green: Through the ringer. Especially when you talk about, you know, racism in Europe and, you know, Yeah. You can't even talk about racism in Europe according to Twitter.

So, um, and I'm going to talk about it. So, and I'm going to Word camp. I, I don't care if no one has Christmas, I'm going to work Europe next year. But, um, Yeah, we're, we're gonna keep talking about it. I, I hope to see more workshops. I may do one I don't know yet. Um, I'm gonna keep, I'm gonna keep talking about it.

If, like I said, if I'm only reaching one person out of all the people that this goes out to, that's fine. Yeah. ?

Dan Knauss: Yeah. Good. No, um. I, I, I think, uh, anyone who thinks that you were off Twitter for any of those reasons is just out of , out of touch. No. Yeah. Pin pinned your flow foot to the floor with a steak knife.

Got bigger. wasn't a steak knife, but was a Japanese, a big

Nyasha Green: shift [00:13:00] knife.

Dan Knauss: The sword.

Nyasha Green: It was a Santo chef knife. It was very sharp. I sharpen it every week. It was an, it was a beast. Let's, let's embellish this story. Oh. And then, Yeah. I don't, I know.

Dan Knauss: Jump me. I told you I don't, I don't want to talk about sharp needles, knives every, you know.

Oh man, we won't, We've been through that. I've been upset when that happened. I was like, Oh, oh, oh,

Nyasha Green: oh. But I just wanted it to be known. It was not a state knife I could have handled.

Dan Knauss: No, it was huge. A state knife. Yeah. Yeah. It was. Uh, well, I, I hope that that recovery. Goes really well and admire your, your spirit, but it, it is good to get off.

It is good to get off of the social media and I'm glad for the supports you've got and the team that is always seems to be a hundred percent behind you and is good with disagreement and, and some amount of, of [00:14:00] tussle and stuff. And, and that's. That's probably a good move in a good way to move into the, the bigger, the bigger topic in most people's minds for this week.

But, um, yeah. Um, I, I really think the macro microaggression and how people teach, uh, how, how they treat each other. . Um, it's just a huge thing on onto itself and it really affects, it impacts trust and I think that's the theme, the theme here. And it's, it's always one in open source and in communities and in relationships.

How, how healthy is our level of trust? Um, For each other. And this, uh, this active install growth chart issue going away has certainly touched a lot of people's nerves and confidence or, or trust for, um, their relationship with.org and how things work there. [00:15:00] Have, have you, uh, what are, what are your, what are your thoughts on that?

It's, I guess nothing's really changed in a week as far as I can tell this morning.

Nyasha Green: That's a spicy topic. I don't know. I don't wanna say the wrong thing. I'm just kidding. You know? Nah. Um, , no. Um, that was a very interesting topic. Um, I have not jumped a lot into plugin developing. Plugin development. I've wanted to, that's something I have on my to-do list for the future.

Um, there's so many different aspects of WordPress I want to kind of jump into cuz it's very interesting. I don't, and I'm, I'm being honest, like I don't really know how to feel because I've seen both sides of it. Um, you sent me some good information. We had a very good article. Um, I don't wanna Bri pronounce his name.

Dan Knauss: Mark Zara. Mark. He's a great guy. He's, um,

Nyasha Green: he is, he is awesome. Um, he had a article by him. Oh, go ahead.

Dan Knauss: Oh yeah, he, he brought [00:16:00] it to everyone's attention first, I believe. Um, yeah, so for those. Have been under rock or, or new to all this , I think it was late Thursday night, um, a week ago. Um, uh, uh, someone who works for, for Audrey Capital, um mm-hmm.

So you would assume like directly. Responding to, to something Matt had re requested, took down the, uh, re reverted the changes in an old track ticket that in 2017, introduced the active install charts that are in the advanced section on plugins, um, in the WordPress DO org plugin repository. So, Plugin owners and really everyone can go in there and see a somewhat obscured, rough estimate of, um, how many sites appear to have your plugin installed on it at the, within the last 24 hours and.[00:17:00]

And then over time, how that needle moves. Is it, is it going up or down? And, and if there's a, a growth or decline trend, what's that line averaging out to? So that's been there for a while and, and people really, a lot of people have really relied onto it. And that just went away with a ticket that just said it's insufficiently obfuscated data.

So clearly there's, there's sort of an implication and then further things, there's definitely a security issue. The attempt to put out, to make some data public and not all of. Um, completely exact and comprehensive and available to everyone. That wasn't the attention, but some, some entity, um, with the capacity or more.

I know a lot, there's a lot of services and people who scrape that, who pull that data in some way. Um, To get a fix on the market, on to offer it as a service to look at other, [00:18:00] your plugins, your competitors, how things are going. Um, that was just pulled and there's co, the, the primary code involved, um, is not public, is not out in the open, and it's what would be receiving the, the pings from all the sites and interpreting them.

As, Okay, does this count as a live site? If so, score one and then making that available through some kind of API where you can pull, um, pull out your current active installs. That too, that's the part that apparently has a security privacy issue and needs attention and, um, that has not been formally, officially.

Clearly publicly stated, there's a discussion in meta slack, uh, mechan and WordPress slack, where this, you know, if you wanna read through, read between the lines and [00:19:00] people unofficially, but who I think are, uh, uh, totally trustworthy and, and know enough about what's going on. You can figure out what's happened.

And that's the article I put together. Uh, trying to take that as at face value. Um, that appears to be what's gone on. And you see the, the reaction if you were a plugin owner. In the,

Nyasha Green: I wanna pause on something you said. You said, Well, if you know that these people are reliable, the right people are telling you the right things.

What if you're a newbie like me right to this and you don't know these people not saying they're not true. Exactly. I don't, You know, I, I.

Dan Knauss: My thought, Who is Triple J? Why should we trust him?

Nyasha Green: No, I wouldn't say that. I'm just like, I'm going off what you're saying. You're like, Well, these are the right people.

And I'm like, Well, you know that. How would I know that? You know? Yeah. That's me not playing devil's advocate. Cause I think that's stupid, but I, that's me just like waiting in, like I, I don't really [00:20:00] personally know these people. I, I get. , I get the side, I get both sides. Again, because one, I, I looked at it when I was deciding on plugins that I didn't really have a lot of information a on because, you know, the more people that seemed to be using it mm-hmm.

the more reliable it seemed. And so, I mean, I definitely get that as a consumer. I'm definitely like, Okay, I'm gonna do a little bit more research and, you know, I'm lazy. So, you know, that's on me, that's on them, that's on me. But I, I get where plugin owners are panicking over that. Like, it's, it's their money, it's their business.

Like I, I get that. And then like, it does not seem to be a lot of clarity on it. Like especially when it went down, like it just went down like, ugh, you know, we need to fix this. Mm-hmm. . And it was kind of like, that's it. And it. , Right? What can we get an explanation? And it's like they have to dig, dig, dig.

And I'm, I know speculation is bad in general, especially when you don't have all the facts. Um, so I know there's been a lot of speculation on what's really going on and why it was really taken down, you know, outside of the few statements we got. But [00:21:00] do you blame them? Can you blame them? Like, if you're in the dark, all you can do is guess, I guess.

Dan Knauss: Yeah. And that's not helpful from the, from the, um, from a normal corporate communications or community management standpoint. Mm-hmm. not having, not having an internal PR arm, not having some means of, of communicating to stakeholders in ways that calm things and, and spread correct information. Um, is it just.

Who does that? So I think a lot, a lot of people feel disrespected, but this isn't a new thing. Um, they should know that it's, it's that way. It's been that way for a while and I would assume it's wanted to be that way. Um, but if, if you were expecting or wanting something a little more standard, that is not, not the [00:22:00] case.

And it does lead to people getting wound up. Speculating wildly and, and, uh, with distrust, uh, is spreading a good deal with distrust. And I think that's, that's what people are going to do every time.

Nyasha Green: I mean, and I'm, I'm with you on that. It's been this way for a long time, so people are pretty much, um, You know, a lot of people pretty much expect it.

So they're like, Well, you know, these things happen. That's one way to look at it, but I would like to quote the Great American Television Show The Wire. Oh yeah. And say the thing about the old days. Is they The old days, ,

Dan Knauss: Was that bunk who said that? I think

Nyasha Green: he did. Yeah. It wasn't, Yeah. So, um, This is the thing, like, again, me just looking at this from my perspective as a newer person, if I'm, if I don't know to expect these things, how can I expect them?

Right? Like, that's a lot, a lot of things happen in community, even outside of this, where it's like, well, that's how things have been done. And it's like mm-hmm. . [00:23:00] Yep. What am I supposed to do? , Like, I, I, Okay. Like I have to, There's no onboarding to how things are done. We've talked about,

Dan Knauss: That's a big issue.

This is your onboarding.

Nyasha Green: Yeah. So it's like, Trial by baptism. Trial by fire. Yeah, that's what I mean. But you know, and I know some people, some people who are still having these conversations, they've been in the community and they're used to this, but I mean, it could be, they could be tired of it. They could want change.

But I, I do agree with you saying like it's, it's gonna spread a lot of disinformation. No, you didn't say disinformation. It's gonna spread a lot of disagreement and we really don't need that. At all. You know what hashtag WP Drama. Um, but I mean, people also need answers. It's like I don't have a clear answer for what they should do because when I'm confused and I feel like I'm in the dark and nobody's giving me answers, I'm definitely going to complain.

And sometimes when you complain, it turns into hashtag WP Drama .

Dan Knauss: Oh yeah. That's almost inevitable. And so seeing it both ways, [00:24:00] Um, it, it shouldn't be Mark coming into Post Slack and in Twitter and saying, Hey, did anyone notice this ticket that just kind of crept in there and late Thursday night and, Hey, look, this chart's gone.

Um, that's. At once, kind of highly irregular. But then again, is it, is it really to me for this, for this family?

Nyasha Green: To this family, I guess not like I'm the, I'm the, the, the daughter-in-law, I guess I'm married into this family. Yeah. I'm at Thanksgiving. Like, Huh, ?

Dan Knauss: No, I feel like, yeah. Well, sorry you married into the mob.

Um, . I apologize for uncle over here. . Um, well, yeah, I, I think trying, I always try to see things multiple ways and, and look for what's the most. [00:25:00] Most productive way forward that will align the most people in a understand productive way And what can be learned here? Um, I, I'm willing to, because John James Jacoby stepped in and is a real long timer and is on the Medi and the ME team's a bunch of.

Good people. Mm-hmm. who, um, were not apparently in the decision making about this, but have some degree of knowledge and oversight or independent, um, takes on. On the non-public code in question and have made it, and I see no reason to, to distrust any of that. So what, what has come out short of it? Not a press release, not something on even the taverns not, you know, being, being quite critical and not not getting any special, um, quotes from.

Inside explaining this, um, what we've got is what's come out on the, on the [00:26:00] ticket and it, they're saying it's a security issue that the either privacy, security, the, the way the data, um, was being pulled and used was over line that they were. Not willing to tolerate going on, and they want to change how that data access works.

And I also trust them that it's gonna come back at some point. But what's muddied the waters is Matt has, um, disregarded the um, The desire for the, the, the crowd that calling for like a full explanation and, and just kind of leading it going forward with the discussion of, well, what is this data that you want?

Um, what would, what helps the most? Um, and trying to kind of move things i I, in this direction of competition, how do we promote cooperative competition, Cooper competition, Um,

Nyasha Green: ooh, let's make that [00:27:00] a word. .

Dan Knauss: So it's a tough pivot to not to say, Hey, don't, let's not give you any kind of, we can't give you any full, There's not even official statement saying, We can't officially disclose what's going on here, but we're trying to remedy it in the meantime.

Um, There's a couple of paths, how this could come back and how it could look, what's your feedback and input on that. Um, that's kind of what's being attempted, but the room temperature isn't really conducive to the most, um, helpful feedbacks, but just for me, just in watching, I'm, I'm, I haven't seen a lot of people explain why that one number is so important the way they think it.

Um, and it makes me think like if you're that fixed on this thing, that could come and go, that wasn't there before. And none of the really big businesses are, [00:28:00] um, they're, they're not living and dying by this, and I'm not sure anyone really is, you know, eggs all in one basket. Like really, Um, this is a, a wake up call I would think that if, if that's how you're running your business or you, you think it works that way, maybe you need some other.

Other ways to analyze your success or, or, um, decline in with your customers.

Nyasha Green: Okay. I, I can't agree with you there, , but can I cannot, can't, cannot. I cannot.

Dan Knauss: Oh. Oh, really? What do you, what what, I mean, what about it?

Nyasha Green: Like you said, that's, that's all fine and dandy for the bigger corporations, but for the smaller person, it's like, Whatever, Figure it out.

Find another method. Oh, well I, again, you said this is how it's been done, but it's like, how many times can you do that to people? Honestly, [00:29:00]

Dan Knauss: I, Yeah, I think that's a separate thing, right? If you kind of put that aside, this isn't a great way to, this isn't a great way to handle a community. Um, it's not a great way to handle business community.

Um, It is what it is. It's happening. We put that aside. That's happening. Why do, why do you, you know, even if this hadn't happened, why is that? People saying that they go to that chart multiple times every. It only updates every 24 hours. And like the, the, it's general, it's kind of shotgun analysis. So I would say like maybe a week's worth of data would give you, it's just kind of a thumbs up, thumbs down on what, on install activity.

And that's, that's for your free plugin. So if you're trying to make, um, if you're, your revenue stream is coming elsewhere from a premium product or, or something else, um, this is just people who are trying you out or using. The free [00:30:00] version and it's, it's just a general pool of, um, not, um, Well actually you can, you couldn't, um, you may, it may include, I guess it would include both, but once you have paying customers, I would pay attention to them.

You have direct, you have a bit more direct, um, access to them and focus groups. There's a lot of things you could, you could do to, um, to get better. Data on how your, your product's being used and there's other ways to distribute.

Nyasha Green: You don't think that would be a lot on smaller business owners, people, you know?

Dan Knauss: Sure. It's a lot. Um, and I, it's always kind of surprised me though, how, um, how. There's, there's just, Well, you know, everyone wants an easy, an easy way forward, But does that really, does that really substitute for, um, real business intelligence, for real customer [00:31:00] feedback from real contact and relationships?

Um, the people I've seen who seem to effectively build a, um, a small plug-in business who in intentionally are, you know, they're not trying to build. Thing at scale. They're, they're trying to do a company of one. Um, they promote it from the beginning on their, on their own channels. They know more or less who they're talking to.

They're soliciting feedback. Maybe they have the, the code on GitHub, um, or wherever it is. They're engaged with a lot of people using it. I just, I don't see why a single measure as vague as that one is. Such, such an obsessed over, um, detail. I mean, I, I understand, I hear what people are saying about it. I get that mm-hmm.

but it, when you actually literally analyze it as like, is, does that make good business sense? I haven't, I haven't seen that. [00:32:00] The only, the only good one is, and I think it's, it's kind of a painful scene, but, um, Matt said about this, the same thing people. See it as a thumbs up if they see it going up, it's a motivation to keep working.

It's like, okay, that's valid. Like that. That's good feedback to give. Um, but what, there are all these other reasons people talk about why this is a, an important business metric to them. And I just, I think almost all of those are highly, highly questionable or at least, you know, you could probably get better information Another.

And the

Nyasha Green: independent, like, so I, I've never ran a plug-in business. I don't know if you have, you have a lot more experience than me. So, I mean, well we aren't we just speculating on what they can do. Like, you know, I, I trust Mark, Mark said that was one of the only tools they had, so it's going to make it a lot more difficult.

I mean, like, I think that's worthy of them [00:33:00] complaining. I think if that was their only tool, like I, I don't know. I can't, I can't like jump in and say, Well they can do this, they could do that. They could go do this cuz I don't know.

Dan Knauss: Well, but it's their, It's their only tool. Cause they've allowed that.

They've allowed that relationship to exist.

Nyasha Green: So it was the easiest. And they like just kind of, I. It's, it's the easiest tool. So they kind of, it was easier for them to latch onto that instead of doing like alternate things, which they can do now. Is that what you saying? If it's,

Dan Knauss: yeah, if it's really true that, that you put your, your business in the hands of a freemium type of product and the free versions in the repo, and this is the only measure you have of, of your potential market size.

That's choices you made. I, I . I mean, there are a lot of other, And you went in someone's house and, and this was here once and, and some years ago it wasn't there. And, um, I, I understand why that, that feels like a, a breach of trust. [00:34:00] But no one ever had a contractor understanding. To the other one, to anything different that this is, that they have a right to this.

Um, I,

Nyasha Green: uh, I think the analogy is, you know, you went into someone's house and they said, Hey, it's an open. And you can use this thing right here. And they're like, Okay. And they use it for years and then they walk into the house one day and it's gone. And the person's like, Well, it's gone. Oh, well tell me why you needed it.

Dan Knauss: Well, it wasn't quite that, It was more like someone, someone's been coming in the back door in the kitchen and they took the beer cooler.

Nyasha Green: Yeah. Someone else has been like sneaking in and doing bad stuff and now everybody, we can't pay forward.

Dan Knauss: We gotta go to the, Yeah, we gotta shut this down and, and go and address this.

And,

Nyasha Green: but there was no communication on that. I found out about the, the communication is cut that through somebody.

Dan Knauss: There's, there's two levels. If you look at it, there's a, there's a much higher level thing here with how much bigger entities are using this data. Mm-hmm. and potentially abusing it, and the need to get everyone on the same page, and [00:35:00] everyone has the same data and even has the ability to hide it.

If you don't want your business exposed or your dad exposed that maybe that you can, you can put a privacy control on it. Mm-hmm. , but the, the rank and file the small. Smaller business entities that are upset because they've really been relying on this. Um, totally understand that. But it, it does raise questions of why you have that level of dependency and does this number really do all that for you?

Is your business truly going to, to tank or suffer in some way with without this and could having it taken away, whether are your options, do you. Are there any kind of creative ways forward then? Um, I, I would think that there, there are, having watched that space enough and how different businesses operate partly in using the repo, not using it, um, and how they do their marketing, how they do their relationship with their [00:36:00] customers.

Um, I, I think it. It's something that matters a lot to people, like you're saying, who are, who are small and maybe don't have the capacity, um, or it's a part-time thing or a side part project. Mm-hmm. , and they're leaning heavily on this rather than other things that maybe they don't have time to be doing.

But it raises questions about what's ineffective, um, business model, what, what's good data and how do you get it? And, I think that there's, from above, there's a bit of an attempt to push that question on that part of the business community. And I don't know if that's an effective way to do it, but it doesn't seem

It's not nice, it doesn't build trust. Uh, but I don't know, I don't know given enough, uh, pain points maybe. I don't know. We'll see where. Where it goes and the people caught in between on it, I, I feel for them. But, um mm-hmm. , [00:37:00] I don't have any, any reason to, to distrust those who have tried to be mediators and I, I think they're, I'm glad they're, they're there putting, putting in their 2 cents.

Nyasha Green: I feel bad that they've had to be mediators. This is a, a lot to push on someone. It is, but I am interested to see where this goes. And I'm glad people are talking about it. I, I, I know communication is a bit as of a doozy sometimes, but I'm glad people are talking about it. Um, I'm, I think we need to revisit it.

Listen, visit this cuz what if it just blows over?

Dan Knauss: I don't think it'll blow over. I, I think it's, I don't, I don't either. It's like a watershed,

Nyasha Green: I don't think at all. . Yeah. But I'm interested to see where it goes. ,

Dan Knauss: but it, there is, there is some sense of, um, a desire to redefine that part of the ecosystem, that culture there.

Yeah. Definitely not wanting a [00:38:00] leaderboard of winners and losers or top 10 or something like that, but have some kind of helpful metric that motivates people that, um, is useful to them and isn't something that can be gamed and that someone higher up isn't pulling out and trying to figure out how can we game these stats or.

Aggregate enough of this to, I don't know, build an even bigger secondary market for plugins, like a Zillow of plugin and that number is over your head as your business value and, and you wanna flip, you know, you wanna sell. Like this is, things have been moving in that kind of direction. I, yeah, call it financial, a financialized market.

And I don't, I don't think that's really in most people's interests when, you know, it's like, When the housing market isn't people's houses anymore and or their homes or community or neighborhood, it's just, what's the number on this here today and what can I get for it if I were to sell it? Give me a number.[00:39:00]

You know, there was a bit, there's been a bit of a movement in that direction. I question the, the health of that, but it's really a question of pH kinda economic. Culture, open source culture philosophy. What kind of market ecosystem do you want to have? And I think from above they're being pretty clear that they want something more cooperative down there, which is tough for people to swallow because on a higher level, these are, they're the corporate entities that are playing full bore, um, corporate capitalism, you know, on a, on a higher level.

Mm-hmm. , um, where. No one's suggesting co-opetition between hosting entities. Entities I love, but maybe they should, you know, I mean, in a way, um, it is, it is throughout open source. I mean, there has to be some level.

Nyasha Green: I'll suggest that on Twitter. Yeah. You'll be breaking with me. I, I think

Dan Knauss: I'm really like the cons really in, in [00:40:00] favor of that.

I think I'm not a, I'm not a unrestricted market person and I, I don't think the idea of a commons. works with that. You do need limits and at least a culture with some kind of consensus on, hey, we don't overly extract this here and there. And, but that's right. That's, that's not a conversation you can have in normal corporate America.

Um, Oh no, But it isn't, it is an open source thing and, um, how do we help each other grow? While in the midst of some degree of competition, um, that's a really worthy discussion. And uh, it's unfortunate. I think that the trust issues are high and the confusion and eventually misinformation may be high and we can't have that appropriate conversation.

I hope we can, but mm-hmm. . [00:41:00] Yeah. Well enough said about that one. I'm not gonna speculate where it's gonna go, but it's been a weekend. It's been a season,

Nyasha Green: Yeah. Oh,

Dan Knauss: The um, the last thing I was gonna ta I don't think we'll really tackle it too much. No one's looking, no one's looking at this. Have you? Um, I haven't found a single person. I'm, I'm start. Poke around and mm-hmm. more technical sources. And I'd really love for feedback from, from anyone who has, um, closer familiarity with government policy that's emerging around security.

Um, there's a, there's finally, this stuff goes back a few years, but there's a senate bill, um, that's very specifically targeting open source and security and how we can, how things can be changed. [00:42:00] to, I think ultimately is, you know, it's about mitigating risk that, um, the US federal government, really any go, any government's always concerned with risk.

They're highly invested in open source. Um, and it's not open source in particular, Most people will point out software across the board. Um, how can this be exploited and hacked has gotten into the public eye and into. , the, uh, the eye of people in, um, in government whose job is to focus on things like supply chain, security, that, you know, things that are considered public infrastructure, um, in a national interest that we need to secure and can't just have people hacking through, exploiting, you know, whatever they think is going on.

But , there have been plenty of examples and there always will. Will be some. [00:43:00] So we just, we haven't really seen that, um, that come down before and I think we will soon. So have you, have you seen anyone talking?

Nyasha Green: Not really. Um, it seems like something Rob would tackle, um, top Yeah, I think you'd be interested, but, um, I'm, My input is as someone who has worked for the state and federal government in a tech capacity, I don't have a lot of faith in this.

Right? Can I say that?

Dan Knauss: Why? Get in trouble? I don't think you'd be,

Nyasha Green: Will they come snatch my microphone? Yeah. bust through my window in the back.

Dan Knauss: Um, you aren't gonna quote the giver, are you?

Nyasha Green: Oh, I got other quotes, but I, One per episode. It's all get, um, Oh God.

Dan Knauss: I'm from the government and I'm here to help.

Nyasha Green: Please. No. Um. I, [00:44:00] I understand. Okay. The big, uh, the big hacks that have been going on, like the, having the Uber , um, you know, there are a lot of con security concerns out there. I get it. But I don't see, I guess I just don't know enough about this bill to see what they're going to do to help. I just feel like it's more government regulation.

I feel like I found very, I feel like I found very. Pro Capitalism this episode. Hmm. I'm thinking

Dan Knauss: on the one hand. Yeah, but on on the other. Yeah.

Nyasha Green: Ah, stop me when you see, when you hear stuff. I'm just kidding. I'm kidding. Um, dang. I do now I have to, I have to sit with my thoughts now. Um, no. I get the security issues, but I really don't see what they're gonna do to help, is basically what I,

Dan Knauss: Well, it is, I think everyone does have a common problem.

It's mostly. D updates. . Mm-hmm. , The, and how they get. Um, so if you have unup updated, the, the largest problem, you have a really, really big [00:45:00] attack surface. Like the log four j log four shell thing was under the auspices of Apache Project. Uh, it wasn't that something wasn't unmaintained and, but there was, um, uh, a, a security vulnerability that was discovered that had been around a long time.

Just no one had noticed it. And then you needed to patch it quickly and, and distribute. All around something that's very widely used, and that is the, the tricky spot. How do you get mm-hmm. , you can't. So in terms of, of WordPress, there's all these really old installs out there. Mm-hmm. , Um, and some are so old, I, you can't push an update too.

Mm-hmm. , you'd have to have anyway. Forced updates have become more of a, a less controversial thing. There was a day, oh probably. Not too long ago, year or two, um, when it was, it was controversial for, uh, again, a decision [00:46:00] made by through unknown processes and deciders to we're just gonna push a forced update on an insecure plugin or some core thing, um, that's emerged and, and that can be done just pushed down.

And I think that's just becoming more of, of the norm for security. Reasons and how that, there hasn't been a really discussion of that, how that fits in the ethics of open source. Um, if I choose to use this software, can you push changes to it against my, um, consent or without my consent and change my client's sites and stuff like that.

Um, yeah, I think we've kind of moved into a place where, It's kind of like getting a vaccination, like, like, Oh Lord, please, you wanna opt out? You wanna opt out to this? Um, there's a real problem, um, to doing that, but it, I mean, I, that too. I, I, These are, these are [00:47:00] two sides to the openness and, and freedom and rights, Individual rights versus collective.

Um,

Nyasha Green: I will not be hopping into the vaccine debate. You know, I'll debate anything that is scary to me. , I'll still debate it, but people are scary when we talk about vaccines. I get scared. Um, but I, I think that to me, where it goes to me in my mind is for security updates. We don't talk enough about, about how computer illiterate, I guess is how you would.

Mm. A lot of society is getting, especially when you think about the younger generations who are dependent on their phones and tablets and they don't really know how to use computers anymore. Sure. It's like, um, you have older people who, you know, have struggled with that, and now we have a younger generation and then it's like us in the middle.

So I think, I think that's going to be an issue because we're forcing people to. It's update and they don't know, You know, they know one version they [00:48:00] can't learn, or not that they cannot learn newer versions, but there is not a lot of adequate education out there to learn newer things. And I'm not just talking about WordPress kind that's in my mind, but that goes through a whole host of other software.

I just, I think we need more literacy before we do stuff like that. I mean, I'm not opposed to it at all. Um, I.

Dan Knauss: It would certainly help for trust again, like, um, if you, I think more and more people are just expecting and, and vaguely, maybe they don't even understand that their devices are being updated all the time.

Yeah, I monitored all the time.

Nyasha Green: Definitely. Don't they? Definitely. Don't you remember when they said 5G was like causing covid? Did you hear that?

Dan Knauss: Um, that okay.

Nyasha Green: Conspiracy theory. That was one. Yeah. Yeah. And I was like, What? And like it was, people were send me stuff, they were like, You're in tech. Is this true?

And I'm like, What? And I'm like, Why would you even begin to believe [00:49:00] this? Where is the correlation? It's like people really don't. Anything . And it's like, you know, I'm not calling people stupid or ignorant. Please, if you're listening and you sent me a covid conspiracy theory, I am not attacking you. Um, I, it's just that people are, there's too much lack of information.

I feel like that's the theme of this, uh, of this episode. If you don't give people enough information and literacy, they'll speculate. They'll create their own narratives and then they'll spread them. Right? And then we have all this what? And then we'll hear stuff when we say what. Yeah. What I do that like 16 times a day, so Right.

It's, they, they have so much more to do than just force updates, but I don't have the faith that they will do that. That's me.

Dan Knauss: Well, there, there's a lot, there's a lot that can be done in, in testing and and security practices to make more secure product, but there's always gonna be stuff that just needs a hot fix.

It needs enough to push to it. Dependencies that aren't even within the project, but that we use and that some other project [00:50:00] uses. Everyone's got to be able to, um, verify what they're using, what version it is, maintenance status, and how do you, how do you quickly update a lot of stuff across the network.

I think that's all good, but yeah. What, what you're saying with a highly, with something, um, as ubiquitous as WordPress or. Apps on your phone. Um, people aren't, it's better if you can get them educated enough to trust that, okay, this is how this is done and mm-hmm people are trying to keep this secure and here are the risks and so on.

And, um, maybe there's some kind of catchall consent. If you know you're using this, this is what's gonna happen. It would be great if, as a community, talked more about those things too, and then mm-hmm. , um, informed people of, of what to expect about security with client work. It's totally, [00:51:00] absolutely necessary to, to explain about the importance of updates, maintenance, and security issues, and, and that being a constant ongoing process.

But when, when people don't understand and then something happens, you get what? The demonn haunted world. I keep thinking of this essay that that's a Carl Sagan book. And Corey doctor wrote a great essay a few years back when, when Volkswagen was uh, uh, gaming their catalytic converters or what, whatever that was when they, whoever hooked the hook, the cars up for testing to emission standards.

Um, it. The computer would realize, ah, we're being tested, so let's cheat. And we go into cheat mode and give a different output than, um, when you're on the road, you want more power delivered to the user and it's actually over emission standards. They got caught for that, but it was a sophisticated software [00:52:00] thing.

BMW did this to, uh, I wanna pronounce these in German way, Ba a. I, I don't know how many did this, but I was talking to a friend of a friend musician who bought one of their sprinter vans. He's really, uh, fancy bmw, um, vans, and they got, they had to do a recall on all their, Their catalytic converters, um, because they had a cheat system in it too, I think.

And they had agreed to some, you know, there was a, there was litigation and they just agreed to replace it all. Not that they had done anything wrong or something like that. And, and he was in the states, he's Canadian, bought this thing in, in Canada and it was in the States and the computer on the car, and his van started saying, You have 10 more starts.

You gotta get this to a dealer, Do the recall, have the part swapped out, and if you don't and, and you need to do that in 10 more starts, you start, you stop and start 10 times this thing's not gonna, it's [00:53:00] gonna be towed, you know, It will not, your, your vehicle will no longer function. Um, so it's like ransomware built into thereby the, the manufacturer of your vehicle.

Um, huge. Shift from . I don't think you knew that that was even possible. They left the thing running.

Nyasha Green: Well, , that reminds me. I do. Because that reminds me of the, the, I don't know if I've never had it, but I've known people who've had these type of cars. If you don't make a payment on your car, you miss a payment, they cut.

They really just lock your car and then you can't crank your car up. Yeah, you can't use your car. You've never heard of that?

Dan Knauss: Like they do remotely through the card. They do it remotely disabled.

Nyasha Green: I'm, I'm, I thought that happened to many people. Like I've had people go to pump gas and then they can't crank their car up and they'll say, Oh, you owe it's money.

Dan Knauss: My car is older than my oldest kid. I have a 1997 crv. Like the early years were, were really good. I have a Honda [00:54:00] guy, um, who um, yeah, like, yeah, I'm an old tech person, , so you couldn't Yeah,

Nyasha Green: that's, but that's like, that was kind of old. That's like, I learned of that when I was like a teenager and that was like, oh my.

I am about to turn 32. I was around 15. That was, I'm doing math 17 years ago, .

Dan Knauss: So yeah, I think that's, I stuff should be built to last some things and maintain. Oh yeah, definitely. And I don't like the idea of. Of being surveilled and controlled remotely. Oh, yeah. Um, and that's, um, that's the world we're moving into.

Mm-hmm. and to some extent there, you know, well there's real abuse and ethics issues and uh, personal autonomy. And I don't think that kind of car system is at all what anyone in open source wants or, or just coming. But there's always a trade off to, uh, with security, how do we, how do we protect. [00:55:00] Ourselves, Um, the most people efficiently.

And it's, it's by overriding, you know, anyone who might individually say, Wait a minute, I wanna evaluate this update code before, you know, most people are just gonna sit on an unup updated thing and mm-hmm not know what's going on. And that's, um, ultimately you have authorities saying that's just not okay cuz it's a security risk to.

Much more, much more significant higher level interest than, you know, Bob Smith with his whatever software he is running. Mm. Well, I think that's a, that's just a fascinating, ethical, intellectual thing, and I, I hope, I hope that we can find a few people to kind of dig more into that as, as that goes along.

But, um, yeah, trust. Everything's about trust.

Nyasha Green: You [00:56:00] made me think about trust falls. Trust. Trust falls when someone like stands on a chair and you all hold hands. Oh, that,

Dan Knauss: Yeah. I've never done that. Uh, no. I didn't

Nyasha Green: want, I was scared. Yeah. I didn't trust, I did not trust those people. But, but no, you're right.

Trust is, is that today's word? That's a big word for Elmo. .

Dan Knauss: Yeah. Just cause people are being, just cuz people are being nice and communicating well with you doesn't, you know, you assume good intentions, but I mean, trust can be betrayed in so many ways or failed, um, even with the best of intentions. And I think how we recover from it, there's no ideal state, you know, no human group is gonna have pure trust unless they're completely in denial, like a cult or something about how everything is awesome.

There's always damage. In and histories of, of um, reasons not to trust each other in any long relationship. [00:57:00] And you kind of have to find a way to be resilient through that and recover from it and reassure each other. Yeah, we're aligned. We want the same things, pretty much. Um, I'm not, I, you know, and I've got your back and that's what we need.

It's hard to come by.

Nyasha Green: I agree. Trust in communication.

WordPress Design & Development Around the Web for the Week of October 3

Diversifying Revenue Streams as a Solo Devpreneur

Web Developer, Entrepreneur, Organizer, and The Man in the Arena Carl Alexander has shared his journey creating Ymir, writing a book, freelancing, and how much he actually makes from all that to live each month. TL:DR; Not as much as you’d think. This kind of transparency into the entrepreneurship side of WordPress can be so valuable and helpful for everyone to see. I suspect many of us can relate to this, especially in the WordPress space where our abilities as developers, designers, and builders are often taken for granted or undervalued. Carl’s answer is creating a Github sponsored page, which is a great way to show appreciation for a developer's work, especially the free plugins that they maintain. Aurooba Ahmed has made a list of developers you can sponsor as well.

The 50% Coding 50% Marketing Lifecycle

We see it all the time: some application or website comes out with half the features of a similar idea you’ve been toiling away on for months, maybe years, but they get all the traction because they market the heck out of their brand. Chances are they also probably hired a small marketing team or agency to help them, and for many of us, we don’t have that luxury. Enter the 50:50 concept from Jon Yongfook of Bannerbear. It sounds like it would be complicated but it’s really simple.

Oh Look, Somebody Took Something Away and Didn’t Communicate About It Well, That Tracs

This week’s #WPDrama has surrounded the abrupt removal of the install growth charts for security reasons on WordPress.org and the Trac ticket created in response to that from Post Status member Mark Zahra which highlighted the frustration felt across the plugin community. I cannot stress enough that all of these frustrations could have been avoided by good communication with the community right after the removal. Instead, everyone was left to piece together different conversations on Twitter and Make WordPress Slack to understand what might be the future for getting similar or even better analytics into the Plugin Directory. As of this writing, there still is no response from the team that removed this feature or what a process might look like for future analytics improvements. Again, an open-source project the size of WordPress should have a team just to help write a synopsis of major changes so anyone can understand the why, when, where, and what’s next.

This Week at WordPress.org (October 3, 2022)

News

• WordPress 6.1 Beta 3 Now Available
• WP Briefing: Episode 40: All Things Testing with Special Guests Anne McCarthy and Brian Alexander

---

Related News:

• ECMAScript Proposals

Thanks for reading our WP dot .org roundup! Each week we are highlighting the news and discussions coming from the good folks making WordPress possible. If you or your company create products or services that use WordPress, you need to be engaged with them and their work. Be sure to share this resource with your product and project managers.

Are you interested in giving back and contributing your time and skills to WordPress.org? Start Here ›

Get our weekly WordPress community news digest — Post Status' Week in Review — covering the WP/Woo news plus significant writing and podcasts. It's also available in our newsletter.

Katie and Andy Keith started out as a WordPress agency almost a decade ago and then tried to break into WordPress products, first with themes and then plugins. Challenges arose with reliable project management on the agency side while they tried to establish a foothold in the WordPress plugin market after a first attempt with themes. The WooCommerce Extensions Store is where their business took off. With niche extensions that had no competition, they ranked very quickly. Other ideas for plugins solved problems in custom development projects for clients. Eventually, the Keiths developed a formula for evaluating new plugin ideas. Learn from their challenges and successes — there are a lot of interesting details that only come from experience.

Mentioned in the show:

• Barn2 Plugins
• WooCommerce Marketplace

You can follow them on Twitter:

• Katie Keith (Twitter)
• Cory Miller (Twitter)
• Post Status (Twitter)

The Post Status Draft podcast is geared toward WordPress professionals, with interviews, news, and deep analysis.

Browse our archives, and don’t forget to subscribe via iTunes, Google Podcasts, YouTube, Stitcher, Simplecast, or RSS.

Transcript

Cory Miller: [00:00:00] So, hey everybody. I'm talking to one of our great post status members, Katie. Keith. I got to meet her in person a couple weeks ago at work camp US in San Diego, and got a little bit about her story there and she's got so many compelling things to part of her story that's gonna be valuable to our audience and our membership.

Um, particularly how do you go from client service and agency? To successful plug-in business, particularly, you're gonna hear all those stories about, um, Katie and her work and her team's work at Barn two. But Katie, thank you for, um, coming on, uh, post draft today and being willing to share your story.

Yeah. Thank you for having me. Okay, so tell us a little bit about yourself. You're the co-founder of Barn Two, but I want to give you an opportunity to just kinda say a little bit about yourself.

Katie Keith: Um, yeah, so I'm Katie. Um, kind of one of the two directors at Barn, two plugins. I run [00:01:00] the company with my husband Andy.

Um, we're English, but last year we moved to, uh, New Yorker, Spain, um, because of the flexibility you get with this industry, which is amazing. Um, So that's kind of what's new with me at the moment and new country to live in. And we have a kind of a team around the world. So, um, we were able to work from anywhere.

That's

Cory Miller: awesome. Um, and we could talk about New York all the time cause I remember you mentioned that and I love that, uh, story. But I'm gonna stay the topic here today. Well, so tell us about, Okay. Currently today, um, Your business is primarily around plugins, but WooCommerce plugins, and I wanna get to that, but I wanna talk about the story of the beginning.

Um, mm-hmm. , you, you and your husband started in 2009, but could you tell us the story about how you started in web design and development and WordPress and all that?

Katie Keith: Yeah, sure. So, um, Most of the [00:02:00] time when in, when we were in our twenties, we had normal jobs, um, both in the public sector in England, and we would always talk about we wanting to run a business together and we never did it for ages and ages and, um, just kept taking our salaries and not doing it.

And then eventually, um, Andy in particular was, um, quite fed up with his job and so we thought, Right, we're gonna take the plunge and do something. And we couldn't afford for us both to do it. So he quit his job and I kept my job and we started freelancing together, basically building websites. Uh, we thought that was a fairly easy thing to get into because, um, you can attract quite small clients and work your way.

So, um, he's a software developer and did the technical stuff and I have a marketing and project management background, so I managed the clients and did their SEO and content and everything. So it worked quite well as, um, something we could do together. So we started freelancing, um, fairly quickly. We [00:03:00] discovered WordPress as being the best way to build a website.

So all our projects were built on WordPress. Um, it wasn't something the clients were asking for, that was just our decision. And then after about a year, I thought, Well, what if I actually advertised this as WordPress specialists? So this was in late 2010. So I ran a Google AdWords campaign focusing on keywords like WordPress experts and things like that, and it was amazing.

We. I think I spent 3000, uh, probably pounds, and we got within couple of weeks, more than 10,000 pounds worth of work out of it. I realized it's not that easy now because there's a lot of WordPress specialists, but back then there was a gap that we kind of fell on, and so the agency grew from there.

Cory Miller: Okay, so then you're, and then you were able to come full time at some point, of course.

And, uh, what, what happened? So you, you found WordPress, you started to build this, and how did the next [00:04:00] couple of months, years or whatever until, um, the plugins go, what were you, you were just, you were building websites and all the things around it. Did it get, did it broaden out to anything specialization wise, or?

How did that grow? Grow from there?

Katie Keith: Yeah, we specialized in doing more bespoke, uh, client projects in WordPress because we'd found this gap that there was at the time. And we recruited a team of freelancers, um, from websites like Upwork, which wasn't called Upwork then, and people per hour and found good people and, you know, we thoroughly vet them and things.

And so we managed to build a freelance team. We didn't have any employees or anything. Everybody was just freelance. And that way we could increase capacity. We were really pleased at first that we were running our own business. We quit our jobs, and that was really great. And then we started to think, actually, it's still kind of not the perfect lifestyle because clients work, [00:05:00] as I'm sure all your listeners know, can be quite demanding.

They want things done straight away. They have problems with their website, which you have to sort out immediately and you don't really get any time. So we have that in the back of our minds that what is the ultimate sort of lifestyle type business where we can be successful and have that flexibility.

And being in the WordPress industry, we could see that WordPress products and the growth of that. And, um, at the time you could see how well people were doing with themes, particularly, um, on theme forest. So in about 2013 we spent like literally a year building a theme, which we were gonna spend on sell on theme forest, and it was rejected, so that was disappointing.

Um, we spent so long building this product that in the time we were doing so that market changed and it became very competitive with the big themes like Avada and Jupiter coming out, uh, which were huge [00:06:00] pieces of software, uh, with tons and tons of features, which we. Possibly do, um, ourselves. So we kind of gave up on that idea for a while.

Um, and then in, but in 2016, we thought, let's go down the plugin route because plugins can be small and very niche, or do I have to say niche, um, . Um, and so we launched our first plugin, um, and um, it went from there.

Cory Miller: Okay, so let's back up just a second. So, started themes, what was the, was the desire there to kind of diversify income, explore this?

Did you have, you obviously had some time to be able to, like your, your agency work is going well and start to, Okay. Hey, how, how did the product and the themes, uh, idea kind of get started and, and what were your thoughts around that? Like,

Katie Keith: We found the capacity to develop it, um, through the freelance team so that [00:07:00] they didn't do the theme.

Um, they did the client projects and that freed up Andy as the technical director to work on the side projects. So because we had people that we could outsource the technical side of projects, Two, he was able to do that. And then I was able to take over the marketing when things were launched. And so that was, um, if it was just him doing all the client projects, that would've been very difficult because he, you get dragged onto those.

Of course, whenever something urgent happens or he, you need some money, then you'd end up doing the work yourself. So through the, um, freelance team, that was helpful.

Cory Miller: I feel like I hear a lot of stories where it's, you get up to kind of cruising that altitude and you're able to have just a little bit more time and space to go, Huh?

What else would we like to do? Um, you mentioned lifestyle in a second ago, but what was the spark that goes, Okay, maybe if this is true, we had one more time in space where [00:08:00] Andy, for instance, in this scenario, Do that more. What was the spark that led to that? That initial theme product? The

Katie Keith: spark was that we reached a ceiling in the growth that we were realistically able to achieve.

If we had taken on a lot more risk and full-time staff and gone down a much more traditional company model, then we could have continued to grow. But basically the limit we faced was project management. So we found good people that could do design websites and plugins for us, for our clients more specifically.

Um, but whenever we tried to find project managers, it didn't work. And I spent a long time training some freelance project managers and they just didn't have the WordPress experience, the relationship with the clients as I did in. Managing myself. Um, so, and the clients were less happy. Um, and one time [00:09:00] in 2015, um, it, our daughter was just about to start school.

And as you will know, that holidays get very expensive when your child's at school. So before that, we decided to take a month off. And we hired a motor home and drove around France for a month, and that meant we had to take a step back from work. And I got one of my project managers to handle everything, and it was a disaster.

The clients were unhappy, projects failed. It just didn't work. And it became clear that that was the ceiling I had to manage all the project. Um, I obviously didn't have the skills to recruit and train project managers. I know some people are good at that, but I wasn't. And, um, so we couldn't grow any further because I couldn't manage any additional projects.

And so then we started thinking, how can we grow, uh, products?

Cory Miller: I see. I, I love how you described it as ceiling, cuz I can totally see that, you know, you get to a point where, kind of a fourth in road too of what do you, [00:10:00] what do you wanna do? And we feel like we're right here. So that's, that's, that's inspiring too.

Um, okay, so we had the same product and that didn't go well. We, you sp said you spent about a year doing that. Um, and then we get over to plugins. I think you said two. 16. But I, I hear from a lot of, um, agencies that have transitioned or offer products that often they start as, uh, client work and you go, Oh, it's a discovery of there's a need here.

So how did the plugins and I wanna talk about, and actually talk about what the plugins are, but how did that, uh, spark get started there too with the plugin?

Katie Keith: Um, well, we launched two plugins very early on. One of them we got the idea from the WooCommerce Ideas forum, where you can publicly see where the gaps in the market are.

So we just went through the list by the number of votes and found the idea that was, had the most votes. That was realistic for us to develop. So, um, that was our first [00:11:00] plugin, which was called WooCommerce, Password Protected Categories. So it was very simple. It loads of people wanted it, there was nothing at the time that did it.

And it just lets you password protected category for your store. Like if you wanna create a, a hidden area in your shop for members or wholesalers or. So we launched that and our other initial plugin, we got the idea from a client. So this client, uh, hired us to create a searchable table for his blog. So he had hundreds of blog posts about this spiritual leader that he followed, and they wrote all these things about his teachings and things, and there was this massive blog and he wanted a much more searchable, filterable, indexable way.

Than a normal WordPress blog where you just have the posts in reverse chronological order. That wasn't how he wanted it to be. And so we built this j query table plugin for the client, which he obviously paid us for. And then [00:12:00] independently we built it into a sellable plugin. So we, uh, added a lot more features.

We added settings, pages, the kind of things that you wouldn't realistically do on a client level project. So we put a lot more into. But the original idea came from this client. Um, we actually released that as a free plugin, which is still available on webpress.org now. It's called Post Table with Search and Sort.

And that's basically the, um, bells and whistles version of what we did for the client. Um, but then once we'd released the free plugin, we started to get feature requests. As you do when you put something out there. So people started asking for two key things. One was the ability to create a searchable table of custom post types.

So that might be documents or members or articles, videos, audio, all these sorts of custom post types. Um, And the other was specifically W commerce products. So later in 2016 we built our [00:13:00] post table pro plugin, which lists custom post types in a searchable table and our product table plugin W Commerce product table, which takes your W Commerce products and puts them in like a.

Table, which is basically a one page order form. So that works really well because you've got your variations and your quantity boxes and add to cart buttons all on this one page order form. So it's, even though it looks the same as the original table of blog posts. So it's actually a totally different purpose because it's an eCommerce order form.

Um, but the idea all came from that one client. And both of those projects have always been, those plugins have always been amongst our most successful. And WooCommerce product tables sold something like 1.2 million worth over its lifetime. And it is our biggest, um, lifetime selling plugin.

Cory Miller: Oh, that's excellent.

And I, I never asked revenue numbers, but thank you for sharing that, cuz I think that's, uh, inspired people to see how [00:14:00] you've come and how it, you know, evolved as a framework for how they can do that in their own world. Um, the back to, so I, I love that kind of little mini story of how that post search table, I've gotta look this up by the way.

Um, cuz I think we might need to post that, um, from, From that product came on our client. I hear that a lot and you gave such an amazing, um, example of how something can. Birth out of client work WooCommerce marketplace. You said the other one came from an idea on the Mark WooCommerce ideas place, but did, how did you get to WooCommerce?

Were you doing WooCommerce type projects for clients or did you say, did you just see that this thing called WooCommerce was coming, this big, big thing, or how did. Has it lead you to the marketplace to find that idea?

Katie Keith: We just knew that we commerce was big and we had also heard or felt, I don't remember that.

Um, people are more inclined to buy premium [00:15:00] products, premium plugins, when that will make them money. Which makes sense, doesn't it? Mm-hmm. . So, uh, we particularly wanted to sell plugins for e for eCommerce because they would be easier to go premium.

Cory Miller: Yeah, I, So for my time at Ithe, um, we built, mostly, we ended up building, we meandered in the path to plugins and then we kind of found our niche was utility plugins.

And I always said, um, Hey, we're saving people money, time, and things like that. That's the stuff you think about, like insurance. I go, I gotta have insurance. Um, but it's not sexy. What sexy is making. You know, and, uh, we never got to this part of the making money part. We felt like we were helping people by extension make money and build their business.

But it's, it's so neat to hear you all saw, okay, this is something that people, if you help make them money, it's a really good thing. Cuz I said, Hey, nobody grabs about the bill of something that, like if you have your [00:16:00] PPC campaign or whatever going and it's convert. . Nobody complains much about that Bill, but you complain.

I complain about our, our house insurance bill. You know, we gotta re up our house insurance bill because I don't think about like, well I don't want a fire to burn the house. I want to take care of itself. But on the other side to make money part is, is always felt easier to make that self. Cuz you're not a cost item per se.

You're more like, No, this is essential to helping us keep making the money.

Katie Keith: Okay. And not just for the initial sale either, but for ongoing renewals because obviously most plugin companies now sell annually. And if the customer sees that value coming in from the product, they're more likely to keep paying as well.

And we do quite a lot of analysis of our pricing to see what, um, is the best balance between sales. A cost per product and, and the W commerce versions always will justify a higher price than a general WordPress plugin. So, W Commerce Product Table and [00:17:00] Post Table Pro are good examples. Post Table Pro has never been able to justify the same price tag as product table because people are displaying information in a useful way rather than selling something.

Cory Miller: Okay, so were, Was there a point. After these two plugins start to have success and maybe others that you do, where you said we're, we're gonna, we're gonna thin down client work and we're gonna focus on, um, our, just our product and our plugins side of the business. And how did that, Yeah, how did you get to that decision?

Katie Keith: It happened surprisingly quickly. So we launched our first paid plugin in early March, 2016. And by August we were making decisions, Let's stop taking on new clients. So we'll follow through on existing projects, ex if existing clients want a new website, we'll do it. So we kind of slowed it down gradually.

So by then the plugins were probably making, I dunno, [00:18:00] $5,000 a month or something, which was less than the client business, but enough to live on. Um, so we could feel fairly confident. And we also had the safety net of a large number of clients that we were hosting and maintaining their websites. So we kind felt that we could take that risk and not be, keep taking up our time building new client projects surprisingly quickly.

Cory Miller: So I'm sure looking back, it feels like a magical time. It was for me when you go, Okay, this thing that we did, Is working and there's another opportunity here to, uh, you mentioned lifestyle in, in the beginning here is, and, and that's what motivated me too, is always to have this, Oh, this is working. Where could it lead?

And it feels, it feels magical to me, but how, how does that, reflecting back in 2016, those six months or so, from. Wow, this could actually be a thing. Oh, this is, oh, we should make these [00:19:00] decisions to do this. Reflecting back, how does that whole time period, uh, feel and how do you think about it?

Katie Keith: Well, the first sale was amazing cuz we just, so we used our existing website, which was@thetimebantu.co uk.

We eventually went to bantu.com but that took years. Um, so we had quite good SEO from the client business, so we didn't want us. Start again with a new domain or anything. So we put up a, a plugin section on our agency website. So we were advertising web design services and plugins on, you know, different menu tabs, basically, um, added some blog posts.

And because our first plugin, we commerce password protected categories was unique in the market, uh, there was no competition and we ranked very quickly. Which was amazing. And so, um, it actually was literally a few days before the first sale came and we were like, What? We saw this email, new plugin sale.

That's not one of our [00:20:00] tests. That's a real person. Oh my God. And we didn't even know it would ever sell. Um, so the first sale was really interesting because that's the first kind of evidence that people might actually find our website that way and buy things on it.

Cory Miller: That's awesome. Okay, let's fast forward a little bit to today.

What do you, what do you offer and what are you doing with Barn two? Let's see, what if I'm doing my math? Six plus years later, almost six years later, you're kind of coming up, You're already past your anniversary of that big decision. Now what? What are you doing at Barn two? Um,

Katie Keith: so kind of more of the same really.

So we've taken what worked and kept doing it. Um, we now have 19 premium plugins, plus maybe four or five free ones. And we have a team of about 14 people, um, who are all, um, working independently around the world. Um, [00:21:00] so from their, their. Uh, so we've got like a support team and a development team and a marketing team, which is amazing.

Um, but ultimately we are just trying to kind of replicate what we started and scale it up cuz it works.

Cory Miller: Yeah, it, it for sure did. Congratulations on your success and what you built so far today. Um, it's uh, I think a lot of people dream, Oh, I'd like where Katie is now. That's where I want to be. And how do you get there?

And I think you've shared so many key parts to the story. Definitely resonate with me, um, about building product, business. And I go back to what you. Find what works, keep doing it and if it stops working, find something else that's working and doing that. Um, I know we talked about some of the original ideas that came from Woo Marketplace looking in, seeing, seeing an opportunity there, and the other side was clients.

Any other thoughts about how, how you go about, or how someone else could go about finding the opportunities for [00:22:00] products as they're building their.

Katie Keith: Just keep it in mind really, the information, the insights are probably there. If you are in the WordPress industry, you're doing projects, you're building websites for people.

I would be surprised if you weren't coming across gaps in the market. And, um, if you do a bit of research, you can find out if other people are looking for the same thing that your client has found that doesn't exist. Maybe you've recently done some custom code and customization for, I dunno, the events calendar or something that what, there wasn't a feature built in.

And so you've written something bespoke that might be a plug-in idea for an extension you could sell. Um, there's tons of things like that in all the major plugins, um, like eCommerce. Easy digital downloads, gravity forms and so on. There's all these gaps. So if you are using these tools and customizing them, there's then to have a think about whether that's a product idea,

Cory Miller: it, it's part of your experience, part of your expertise, and seems [00:23:00] like a good place to start for me.

Um, when we started, I think we started with themes. And, uh, eventually we got into plugins because it was, it was definitely part of conversations I was having, uh, seeing that there was this opportunity with plugins, but it came out of a need for us in those, Just listening to customers, like you're saying, is just.

What are the things that people are bumping into that are problems that probably are valuable if you can solve those problems, Like your, um, your custom posts searched and organized plugin came out of that one person with this massive site. And then did you start asking like, what were the questions you started asking for me with, for instance, back, but when that, that was not my idea.

It came from our team and I go, Oh, a backup. Click in. My first question was, everybody needs a backup of their web WordPress website that came out of our own pain. Um, but where were some of those questions you started asking as you determine like, this [00:24:00] is feasible for us to take time, resources, energy, You know, I, we'll talk about like getting things off the ground to, from a marketing side.

I know, um, too, because I want to tap into that experience you have and expertise. But, um, what were some of those questions you asked when you're like, How do I. How do I determine, make this decision? This is worth some time.

Katie Keith: Well, to be honest, we did had a lot of randomness and luck and instincts. We weren't brilliant at establishing that data.

Um, we've worked a lot with ellipses to reduce randomness. Um, you know, the marketing company for WordPress, uh, product companies, sis, and, um, because we. Checking that it didn't exist. So we were checking, there was a gap, but we weren't establishing the, the demand. Sometimes we would just do it because it was new and have a go.

Um, so that, yeah, we probably [00:25:00] wasted some resources there. Uh, and um, so that has been an ongoing challenge and not something we've always been brilliant at, but the data is there and if you hire an SEO company or something, you can find out about search volumes or, or just go on Google Trends yourself and see.

Cory Miller: I love your authenticity though to say that because that's so reflective of my own experience and I think of many others. We don't just look into it crystal long. Go. There it is. Sure. Maybe that that's out there. I have this great idea. I think it would work, but there's probably so much backstory to it.

The story I tell often, and so much of this is experiments and over time I tried to make my experiments, uh, cost less and less and less because I made some very expensive. Experiment, failures, you know? Yeah. But I just love your genuineness of saying like, it, we didn't have it all together and neither did we, by the way.

Um, when you're starting and you start to hone that process, like that laboratory process, [00:26:00] I read a book called Little Bets and I back in the day and I go, Oh, I shouldn't just go. Um, see an opportunity. Let's run for it. Maybe there's some nuance there. Uh, one of the mistakes that we made that I often say when people ask me about my failures, particularly in product, I say, uh, I call it, I think it's exchange.

Back in this day, we were seeing the WooCommerce market really grow and explode and, um, it seemed very complex to me, and our opportunities started at, or the, the thought started. There should be a simpler way to do e-commerce for the person actually running the site, putting their products on the site.

And so we started, I think, exchange with that kind of premise, but we didn't do a lot more thought past that. And it ended up costing us probably 400,000, $500,000 fixed cost. Not to, not to mention opportunity costs. So I use that as my thing. It's like, okay, why did I. Why did that fail? Where did we go [00:27:00] wrong?

But I'd say that like there's so many failures that get to like, you know, get to, Oh, this is it. But I just keep anchoring back to your client's story when they birth out of either your experiences, like you said, or a client that see and like, Oh, could other people use this? How much do they value those things?

And I sometimes probably get thought, get paralyzed in that over analysis. But there is some here of. Those basic questions of like, is this something that we think could go and going from hunch to actually, let's put it out there and test it. Do you have any thoughts around that too? Um,

Katie Keith: yeah. I've never been a big risk taker and I like small risks, um, that aren't like gonna break the bank if they're not successful.

Uh, so. The, you know, where we haven't established the market first, it wasn't a huge amount of development time to get the product out there, for example. Um, we now have a formula which [00:28:00] we use to evaluate new plugin ideas, which looks at factors such as, uh, search volume. Other searches for that, um, concept going up or down, competitiveness, um, difficulty to develop that kind of thing.

So we've got this, this whole spreadsheets that we plug new ideas into with some data, so that helps. But yeah, I, I've always been scared of themes because I perceive them as being really huge and a big risk to develop. But you were very brave starting with

Cory Miller: themes. It was much more complex in two thou. I mean, I'm sorry.

Much more simple in 2008, by the way, than it is today. Um, for for sure.

Katie Keith: Yeah. Yeah. Cause it was about 2013 that it changed, which is when we were trying to build a theme and suddenly these multipurpose themes flooded the market, didn't they?

Cory Miller: Yes, absolutely. And, and that's the other part I think you even mentioned in there is competition is seeing what other people are doing out there in the space.

When we did backup Buddy, there wasn't really [00:29:00] anything that, what we felt was a holistic backup plugin to do backups, migrations, restoring of websites. And so, but, but again, it was early enough where there wasn't a lot. Now, today, totally different story. If we're going, we want do a backup plugin, well, There's, look at the landscape.

It's pretty competitive. The other side, and I love your input on this too, is that so many people, as we the theme market, got so competitive. And people would say, Do you think you could build start, Someone could build, Not even me, just someone could build a theme company. And early on in my, uh, naiveness, I said, um, I don't think so.

I think it'd be really, really tough. Well then probably right as, as I say that companies like Beaver Builder come out and I'm. Wow. Even the competitive, what I viewed as a competitive market, they saw a way to innovate that changed the game. Now they would say, I think [00:30:00] it's a plugin versus a theme, but I, But to me, they had a different perspective and they looked at some of what I was buried in complexity and go.

No, there's this, and then, then this whole page builder market starts. Um, and so that's always interesting too, is just when I, I, I always say never because when I have said, I don't think so, someone ever else goes but here, and it's so cool with the innovation that you can do in market. And

Katie Keith: that's an interesting example cuz I think a lot of the, uh, Beaver Builder diehards are developers and people that are quite, uh, into WordPress.

And, and I know that's not their whole market, but I think they go more in that direction in terms of their fan base. So they kind of found a bit of a gap as well from say the visual composer types who are very much not that group at.

Cory Miller: Um, well, okay, so let's, we've talked about kind of getting plugin, evaluating it and all the story that goes a part of that where [00:31:00] Barn two is today.

Um, the other compelling question that we talked about before, uh, before we had this, we started recording, was the whole marketing of plugins. Um, and. Particularly, I know this was something that you started with, with the agency back in the day, was your emphasis on marketing too, but how do you think about marketing plugins?

Okay, we've gotten past decision, we're building it, we've got it ready to go. And then just that big, broad question of how do you market plugins?

Katie Keith: Well because I'm not a big risk taker, I try to keep it small, but fi cuz with WordPress, in particularly with commerce, small, is a huge market because even the tiniest things there are loads of people searching for.

So if I was going to launch, An events plugin or a membership plugin, I don't think I would be that successful, to be honest. Uh, because it's so competitive. How are you going to rank for WordPress membership plugin? Never gonna happen, or you'd have to be very, very good. But [00:32:00] to rank for something really specific that doesn't exist in the market is actually quite easy, particularly if you already.

Say an agency website that you can start selling your products on and blogging on about your products and that you've got some domain authority built up. So my advice, um, if, if you've not got a huge budget and massive marketing skills is to go for the niches and find something specific that you have got a reasonable chance of success.

Cory Miller: As you're looking back to, do you think there were, where were the catalyst moments when. You know, you're, you're starting to get a flow in of customers that's kind of growing. Um, and like, oh, this point here, when this happened, things started to take off from marketing or customer, you know, incoming customers or things like that, that you think made the difference that you think about quite a bit today in terms of the marketing and growth of [00:33:00] the products that you offer.

Katie Keith: Um, it's funny cuz what we do now is kind of the same things that we always did, which is finding content opportunities that fill a gap that isn't already catered for and a bit of ads and things like that. So it was just about really getting, there wasn't really a catalyst moment because we did that from day one based on experience of marketing the agency business, it's more.

Reducing the randomness as I talked about earlier, and fine tuning that process so that you can predict the chance of success more before you start throwing things out.

Cory Miller: Yeah, I, The first month, that first eight months of item I tell people a lot is that I was doing support cuz I was the only person and um, oh yes, but I cannot take that experience back.

I would never want to because I learned so much about the who I thought. For, for the tenure, I [00:34:00] was, uh, part of Mythe. I always thought I'm our, I'm our base user. I'm not very technical. I'm technical enough. I can take a plugin, I can use it, um, but I'm not gonna get into PHP or anything like that. And that helped us maintain our cut or who we were and what we did.

But that first eight months was so interesting, just like when I've talked to our agency owners at post status. Um, you, you said this from the beginning, I just kind of assumed, if you like, from the agency mindset, um, you'd start. And then you'd hire a full-time person. That's a wrong assumption. I've, I've heard over and over you started with contractors or freelancers that helped you with your capacity of the work, and I've heard that so many times.

That was a nuance because I haven't been an agency owner that I learned, but those eight months that I themes, I realized. Um, a couple insights that now in reflection, you know, a long time past, it drove all of our key values because I was getting to understand the actual customers. They were freelancers, [00:35:00] solar printers out there, just kind of doing Lance web, WordPress web design on the side.

And eventually it would birth into something like you all did too. Um, and. Just knowing that helped me. And then just seeing the customer. We had a forum at the time. Everybody's asking about CSS customization. We would do a theme with the right sidebar. Now remember, don't make, this is 2008. So like they'd, we'd release a theme with the right sidebar and they'd say, Well, they wanted on the left, and we'd help 'em with the css.

And it was this thing of just noticing and observing what people were actually asking for and putting the head their headset. Headset on and saying, Okay, I wanted to be able to have this flexibility that helped us figure out what next products and what next features we would do because we kept really close to the customer.

Yeah. Are there things that in your experience, you've seen too or kind of, It doesn't have to be that, but I was trying to give an example to say, I know some of those [00:36:00] things were critical to our success, staying close to the customer, but there are other things that Jesus go, This happened, we learned from.

We're gonna do that over and over and over. Yeah.

Katie Keith: Um, there's a few things to unpick there. We've definitely listened to the customers, not just our initial clients. So I did the support myself for much longer than I should have done until it basically just became unmanageable because it was so many tickets.

And, but that gave, as you said, that gave me. Such a unique insight into our products and how people are using them so that then I could use that to inform new product decisions, new features, that kind of thing. But even now, we have a support team, which I think is six people as of a couple of weeks ago.

Um, we have a very comprehensive feature request list for each product where they put things on every days and that we, you know, We got formula again to say, uh, the demand and the difficulty and the impacts and stuff like that, and how [00:37:00] many people are waiting so that I can go in there and see what people are asking for.

Uh, and we have quite a loose interpretation of what makes a feature request. They may not be explicitly asking for something, but if that would meet their need, then we put it on the list, if that makes sense. Um, so we try to be quite, um, open. That so we've got more feedback, um, recorded. So that really helps because you get that insight to, as you say, reduce randomness and know what to build that will work.

Um, so for example, tons of our eCommerce product table customers were asking for quick view buttons in their table and they were asking for us to add that to their plugin, which makes sense. Can you add quick view? And we thought, hang. Quick view is not just for product table, that is for any store. You don't have to be using the product table layout to want quick V buttons in order to, uh, view more information and add to the cart without [00:38:00] visiting the separate product pages.

So we built a WooCommerce Quick View plugin, which again is still available today, uh, and integrated it with product Table. So when we buy Product Table now, you can either buy it on its own or there's like a bundle with Quick View, which quite a lot of customers go for. Um, and you can buy Quick View as a standalone.

So you would kind of look at what the customers are asking for and then make business decisions around that. Uh, but the other side of what you were saying was about building a team and, um, hiring staff straight away. And because I've always been a bit risk averse, I've waited until we're making money, um, until committing, um, particularly big commitments like staff.

And rather than freelancers. But it's interesting seeing more and more at the moment WordPress companies with the more of the startup model where they're seeking funding and so on. Cause that's something I've got no experience of personally and I've, we just [00:39:00] bootstrapped it, done the work ourselves until we can afford to hire people.

Um, and that's worked for us. So I watch with interest people with a different model because it's like bringing. Big business into WordPress. And you see that more and more the last couple of years, don't you?

Cory Miller: Oh yeah. And, and that was one of the primary drivers for us selling. Um, And being, being acquired is that there is a lot of money, big money coming, coming, continually coming into the space.

Um, okay. So Katie, I, we've talked about this past, thank you so much for just sharing that cause I think that's so inspiring and helpful for others trying to do. Even just the agency part, you know, And then get to a, what you said, the ceiling and going, Okay, what's next? What do we do? And oh, there's, there's these things that come out and, uh, then the present we're born to is now, but what is exciting about you and Barn to in the future?

What's getting you revved up about what you're doing, where you're going and [00:40:00] want to share with others about barn? Um,

Katie Keith: I think kind of keeping going and, uh, it's working, um, doing more, We are getting more ambitious with the sorts of plugins that we will release now. Our SEOs better and we know what works.

Um, I still don't think I'd have the confidence to do something really generic like a membership plugin. Um, but we are trying to have a ban to version of all of the Major W. So, for example, last month we launched a filter plugin. Um, actually there isn't a major version of that. There's a, There wasn't, Yeah, that's a bad example because there wasn't a major, major competitor.

But, um, that was quite a, it was our most complex plugin that we'd built. So, um, we were ambitious in that. Sense. And, uh, in the next week or so, we're going to launch a, uh, product option plugin. And there is a very strong, um, official version of product add-ons and we, but we've looked at what the gaps are and um, in what ways that plugin is not [00:41:00] like, and, uh, fix that in our own.

So that's exciting to see how that does, um, and just keep, um, doing what we're doing. All right.

Cory Miller: Well Katie, can you tell the, tell, tell listeners where we can find more about you and also Barn two in your work?

Katie Keith: Um, well the best place is our website, barn two.com. Um, and you can also find us, um, on Twitter at Barn two plugins.

Cory Miller: Excellent. And, and also I'm post out a slack. Um, but I don't want people bombarding you, but I know you're so generous with your expertise and your success story and everything like that. Katie, thank you so much, uh, for coming along and sharing your story. We need more like this, more willing to kind of share the story as inspiration, and you've been so generous and kind to share.

These parts that others can look at and go, Gosh, I need to think about this part that you shared. So thank you for sharing your story and thank you for your time today. And I'll see you in post at Slack.

Katie Keith: Yeah. Well, [00:42:00] thanks a lot.

Back in 2016, the White House officially promoted open source software in the federal government and beyond. The Office of Management and Budget (OMB) issued memorandum M-16-21 then, which required that all federal agencies open all new custom code for reuse by all other agencies and release 20% or more of any new custom code as free and open source.

Things have changed, but not the importance of open source software in government and critical infrastructure.

It is risk tolerance, which is never high in government, that has diminished greatly.

At the same time, open source software is increasingly associated with risk, if only because it has become so successful. It's a huge attack surface in the middle of a seemingly permanent and escalating cyberwar, a cold war that never ended, or what is more commonly seen now as fifth-generation warfare.

It's logical for government to step in to try to reduce that risk. Since the Apache Log4j/Log4shell vulnerability (Base CVSS score of 10) became public in December 2021, those big wheels have started to turn.

“There was a pretty big government response”

A critical vulnerability in the widely used Java logging tool (Log4j, specifically a Log4j 2 dependency, Log4shell) turned out to have been exploitable for about a decade, giving potential attackers “easy access to internal networks,” according to The Guardian. (It even touched WordPress, through Openverse, but was quickly handled as Chloe Bringmann later reported.)

Often described as the most serious vulnerability in a decade (if not all time), the US government response it motivated was recently summarized in The Washington Post. The Cybersecurity and Infrastructure Security Agency (CISA) led that response and will be leading new initiatives regarding open source in the near future.

Initially, “CISA briefed industry leaders, issued an emergency order for federal agencies to patch the issue and jointly published an alert with the FBI, National Security Agency and governments around the world.”

After that, all attention turned to future risk mitigation.

Like CISA in the US, the Canadian Centre for Cyber Security already distributes a vague and clumsy “WordPress security advisory” from time to time. Expect it to improve — there's a lot of money and jobs for it in the federal pipeline.

Who shows up when decisions are being made?

In January this year, the Federal Trade Commission (FTC) warned companies to remediate the Log4shell flaw or face potential legal action. And the White House brought in leaders from major tech companies to discuss what might be done about widely used and under-maintained open source software. Only three organizations represented open source at that meeting, including the Open Source Security Foundation, a project of the Linux Foundation.

WordPress was not publicly represented in these proceedings or any that have followed. In January, Lesley Sim and others in the WordPress community asked, “Who represents our open source commons?” And the question keeps coming up.

Tech Security Experts and Foreign Policy Interests Converge on Software Supply Chains

The Senate Homeland Security and Governmental Affairs Committee held a hearing on Log4Shell and open source security in February. The speakers involved, the discussion that took place, and subsequent legislative development indicate federal funding and involvement in open source is coming. It's just a matter of when and how much. GovTech did a nice summary of the event, but there are some things on the speakers' prepared statements worth singling out. The Q&A; is also worth watching.

David Nalley, Apache Software Foundation

David Nalley, President of the Apache Software Foundation, was the first to speak. The words “non-profit,” “charity,” and “contributors” figured early and prominently in Nalley's brief statement. (Later “free riders” came up in the Q&A.;) He emphasized a need for government investment in software supply chain security and the problem of getting updates out to vulnerable systems.

Brad Arkin, Cisco Systems

Brad Arkin, Senior Vice President, Chief Security and Trust Officer for Cisco Systems, also emphasized the need to be able to see the maintenance status of all software in use and make rapid upgrades — without overly focusing on Log4shell or regarding open source as being especially risky. Architecting systems with the “necessary separation inside” them to limit any damage and “providing transparency about
software components … through a software bill of materials (SBOM)” capped off his recommendations.

A “software bill of materials” (SBOM) has emerged as a key building block in software security and software supply chain risk management. An SBOM is a nested inventory, a list of ingredients that make up software components.  The SBOM work has advanced since 2018 as a collaborative community effort, driven by National Telecommunications and Information Administration’s (NTIA) multistakeholder process. 

CISA <https://www.cisa.gov/sbom>

Jen Miller-Osborn, Palo Alto Networks

Jen Miller-Osborn, Deputy Director of Threat Intelligence at Palo Alto Networks, went into greater technical detail with similar recommendations for containment, SBOMS, zero trust network architecture, etc. One item of note to software engineering teams stressed the value of Development Security Operations (DevSecOps):

Impressive work is already being done in this arena, but the community would be
well-served by increasing adoption of existing development tools to control access to open source components. These tools can scan all of the open source packages for both integrity and security before they are approved and allowed for engineering teams to use in products. Our recently released State of Cloud Security Report 2022, which surveyed over 3,000 IT professionals, found that organizations with tightly integrated DevSecOps principles were more than seven times likely to have strong or very strong security posture. They were also more than nine times more likely to have low levels of security friction.

<https://www.hsgac.senate.gov/imo/media/doc/Testimony-Miller-Osborn-2022-02-08.pdf>

Trey Herr, The Atlantic Council

Dr. Trey Herr, Director of the Cyber Statecraft Initiative at the Atlantic Council, was the last to speak. An academic and lobbyist, he was the only member of the panel not from the tech industry. Notably, the Atlantic Council promotes Atlanticism and has historic ties to NATO as an advocate for NATO interests. Dr. Herr took a slightly more alarmist view of open source as especially risk-prone. In his very goal-oriented, politically savvy statements, he called for DHS through CISA to fund and directly involve itself in the open source community:

This office should further encourage collaboration among the United States and allies in supporting the security of open source projects identified as critical by the office and act as a community liaison/security evangelist for the open-source community across the federal government.

<https://www.hsgac.senate.gov/imo/media/doc/Testimony-Herr-2022-02-08.pdf>

Further, “Open-source security should be part of mainstream supply chain security policymaking, and this office would be charged with supporting those efforts while acting as the single point of contact for external stakeholders.”

Deep Pockets Ready to Spend

Herr also pointed to:

…a proposed amendment to HR 4521, the America COMPETES Act of 2022, that would authorize the creation of a set of Critical Technology Security Centers inside of DHS [through CISA], including one focused specifically on open-source security.

<https://www.hsgac.senate.gov/imo/media/doc/Testimony-Herr-2022-02-08.pdf>

He then urged the Senators present to support this legislation “when it reaches the Senate, with the understanding that a substantial portion of moneys appropriated for these centers, on the order of $20 to $30 million a year, is dedicated to this open-source mission.”

In subsequent years, Herr predicted hundreds of millions would be spent on open source security by the federal government — all with the goal of:

…focusing on secure developer tools and “foundational” infrastructure for the open-source ecosystem, to incentivize rebuilding codebases in memory-safe languages, to support audits and volunteer labor to identify and patch vulnerabilities, and to support efforts to drive security talent into this space and towards the most impactful libraries and packages in open source.

In May, a second Open Source Software Security Summit was held in Washington, DC when “the Linux Foundation and OpenSSF gathered a cross-section of open source developer and commercial ecosystem representatives along with leaders and experts from key U.S. federal agencies.” Their goal was to build a mobilization plan — “a consensus on high-impact actions to take to improve the resiliency and security of open source software.” They came up with 10 areas of focus to improve OSS security and called for immediate funding from the tech industry in the ballpark of USD 150 million.

The Securing Open Source Software Act

In late September, Senators Gary Peters (D-Mich.) and Republican Rob Portman (R-Ohio) introduced legislation that directs CISA to:

• “Hire open-source experts.”
• “Publish a framework on open-source code risk” within a year and then regularly “perform an assessment of open-source code components that federal agencies commonly use.”
• Study, within two years, whether their risk assessment framework “could be used in critical infrastructure outside the government and potentially work with one or more critical infrastructure sectors to voluntarily test the idea.”

The Washington Post noted, “Other agencies would have roles as well, such as the Office of Management and Budget publishing guidance to federal chief information officers on the secure use of open-source software.”

Open Source Software as Public Infrastructure

Trey Herr was very positive about the Peters-Portman Act, saying:

“This important legislation will, for the first time ever, codify open source software as public infrastructure. If signed into law, it would serve as a historic step for wider federal support for the health and security of open source software.

While it may not be possible to rush through Congress before it's out of session this year, it seems very likely the Act will drive greater self-regulation in open source — and bring in new government requirements to comply with. Parallel developments are happening in Europe where investment in open source as a public good has advocates arguing it leads to nearly a hundredfold return. Opportunities will surely emerge from new sources of funding and jobs for open source, but national and regional geopolitics may complicate the nature of contribution within truly global and international projects.

On September 29, changesets 12097 and 12098 were committed to the Meta Trac repository for wordpress.org by Scott Reilly (Audrey Capital). These changes remove the Active Install Growth chart from the plugin repository's “Advanced” section on individual plugins. The only explanation given by Scott is “insufficient data obfuscation.”

These changes are simply a reversion of the code that Alex Shiels (Automattic) added to create the section with active install data back in 2017. Alex's ticket for improvements to the “Advanced” view (#3106) includes other additions to public plugin data that were never implemented due to concerns over the potential for them to be “gamed.”

Plugin Owners Respond

On September 30, Mark Zahra opened Trac ticket #6511 “Bring back the active install growth chart” to express its importance to plugin owners and to request improvements rather than deletion. Discussions were already taking place in Make WordPress #meta, on Twitter, and in Post Status #business, where Mark shared his ticket. At Post Status, a discussion was already happening about the challenges of entering the plugin repo and succeeding there since Vito Peleg had just launched Atarim's freemium Visual Collaboration plugin at wordpress.org.

Abuse Comes to Light But Details Aren't Clear Yet

For some time now, it's been a common and reasonable assumption in the WordPress business community that some of the bigger plugin owners have very accurate data on their plugins' usage as well as their competitors — enough to create a “leaderboard” to assess the effectiveness of sales campaigns or to see a buying opportunity in others' declining install figures.

Abuse of the active install growth chart has been an issue in the past. Barış Ünver's article, The Decline of Speed Booster Pack, touches on an incident where several hundred plugins had their install stats artificially inflated, mostly to mask the perpetrator.

Abuse seems to be an issue again but of a different type.

Josepha Haden Chomphosy joined the #meta discussion and said Marius Jensen was approximately correct in guessing “the active install growth could be (was being?) used to determine near exact numbers, making the intended obfuscation pointless.”

The data shared is always a bit obfuscated so that it’s harder to “game the system” — the same reason we don’t have running leaderboards for contributions.

Josepha haden Chomphosy <https://wordpress.slack.com/archives/C02QB8GMM/p1664559896577109>

Security or Privacy? Or Security and Privacy

In reply to Mark's ticket, John James Jacoby affirmed there had been, in Michael Nelson's words, a “closed-door security or privacy decision taken by a larger group.” The active install growth charts were not pulled on a whim by a single individual.

Sponsored by Awesome Motive, John is a full-time contributor to the Core, Documentation, and Meta teams. He says he independently reviewed the code generating the data for the active install chart which he noted “is outside of the Meta repository” with other “code responsible for keeping WordPress.org running.” None of this code is “publicly available,” but he “independently identified precisely why these charts were removed the way that they were,” and he “would not have made any different decisions had [he] been in on the decision-making process.”

John added he doesn't “have any doubts that [improvement and not removal] is the long-term goal” for the active install growth chart. Further, he added that fast, private action was called for and “is not intended to hurt your community of users.” Instead, the intention is to “[exclude] many people to protect them from some people.”

Later, in #Meta, John specified two future options for the return of Active Install data:

Private by default, and optionally made public by plugin authors on a per-plugin basis.

A GUI could be invented to allow plugin authors to add usernames with access to the stats, similar to how it works for the support forums.

Why Active Install Data Matters

Active installs are the only way plugin owners can estimate the number of sites that are using their free plugin — and assess growth or decline over time. As Joost de Valk noted on Mark's ticket, “The trends in this data are super important for plugin developers, as seen by the many many people that have responded to this in [WordPress] Slack.”

By monitoring many plugins across the repo, market trends can be assessed as well. Doing this work manually for even a single plugin is quite a chore. Iain Poulson, who is now at WP Engine, automated and improved on that process for Plugin Rank, which is now an Awesome Motive product. wpMetric offers a similar analysis. So does WPDesk's Active Installs.

For some time now, it's been a common and reasonable assumption in the WordPress business community that some of the bigger plugin owners have very accurate data on their (and their competitors') plugins' usage — enough to create a “leaderboard” to assess the effectiveness of sales campaigns or see a buying opportunity in others' declining install figures. Josepha and John are clearly opposed to that happening, certainly in a public way.

Healthy Co-opetition Is Not a Leaderboard

Reflecting on some early BuddyPress history, John shared how that project's “original primary concern” had been:

…revealing active install charts & graphs for all plugins & themes may not actually be healthy for the entire community, because it is impossible to resist using that single number to speculate about things those numbers may or may not imply – quality, security, performance, earnings, success, etc… and when that scales to inevitably comparing data across multiple plugins & themes, is any of that actually healthy, positive, or a real goal?

John also addressed Joost's sharpest criticism that “Automattic has an unfair competitive advantage because they have access to more accurate stats,” while everyone else is now fully in the dark. (Joost made this claim on several channels, and it's a continuing thread in #meta.)

I will go one step farther and say, that if a goal with any data is to be fair to each other with it, that includes a responsibility to serve up the same data with the same interface to everyone, and to prevent people from accessing it in any way that is unintended or unfair.

…which is essentially what has happened, here.

JJJ <https://meta.trac.wordpress.org/ticket/6511#comment:5>

Open to all — for all who want to be open — seems to be the way the issue will be resolved, probably to a near consensus.

But will enough data be available to satisfy those who feel like “Second-Class Third-Party Developers,” as Iain Poulson put it in his WP Trends newsletter this morning?

The deepest issues will likely remain divisive — perceived competitive advantages, the definition of healthy competition in an open source ecosystem, and who gets to referee these things.

Josepha emphasized that “suggestions are welcome for how to get some data for you all while doing our best to stick with a ‘co-opetition‘ mindset.”

Reply on Mark's ticket if you have helpful contributions to make toward that goal.

Happy Friday!

We're finding it increasingly tough to get all the best WordPress news and info into a reasonably-sized email, but we're doing it by making lots of cuts.

In the newsletter, you'll see links to the full weekly digests for the Business, Tech, Career, and Community sections we're focusing on now. Plus we've added a new ongoing section focused on WordPress project and contributor news from core and all the teams.

You can read all of this week's newsletter here. 

And if you want everything without the cuts, head over to poststatus.com/the-week/.

Get some rest and recharge this weekend! (I hope to.) See you next week! 

–Cory Miller

Walt Kania explains why you should craft your origin story over at the Freelancery. Walt has good advice, and most of it applies far beyond freelancing. I've only seen about three truly helpful books about freelancing on the web, and they were all free — once. Walt's is the best, hands-down, for any kind of professional contractor practicing a craft. That's how he approaches copywriting, and so should you — whatever you do. Way Smarter Freelancing: Your Real-World, Hands-On, Field Guide is available for only USD 9.95. READ →

Jussi Pakkanen has some pointed questions for developers to ask a prospective employer during a job interview. Two good ones: Does this or any related team have a person who actively rejects proposals to improve the code base? Explicitly list out all the people in the organization who are needed to authorize a small change, like a typo in a log message. MORE →

Sadly, these “5 Secrets to Getting Hired After 50” from the AARP are mostly about getting past age discrimination, especially the advice to “polish your appearance.” But, “According to some research, once hiring managers were able to interview applicants face-to-face, they were 40 percent less likely to hire older workers than they were to hire a younger applicant with the same skills.” MORE →

Supposedly IBM used to have an a**hole test to see how job candidates behaved in a group that was given an impossible task. Mean, and maybe unfair but also a worthwhile thought experiment or even a fun team-building exercise when no one is being evaluated by HR. How do you think you would behave? MORE →

The Misanthropic Developer casts a cold eye at job listings that mention a “Fast Paced Environment.” Why isn’t this a selling point? “It’s often (correctly) interpreted as code for ‘overworked and understaffed.'” MORE →

Quick Links

• September 28 is WordPress Translation Day! Learn all about it and how you can help at the Weglot blog. MORE →
• Tips on Writing for Engineers from the life learnings of Heinrich Hartmann.
• From GitLab: Preventing burnout: A manager's toolkit.