WordPress Planet

May 01, 2012

BuddyPress: BuddyPress at Newham Bridge Primary, UK

This post was written by Adam Heward, a member of the BuddyPress community and ICT Manager at Newham Bridge Primary School.

Facebook is an endemic problem for UK schools. Issues from outside of the classroom are being brought into school as a result of Facebook interactions and schools are powerless to do anything about it. I found out on my first day in my new job as ICT manager in a primary school in Middlesbrough, UK when I was asked “What can we do about Facebook?”

Our school had experienced everything from name calling to death threats, doctored pictures to stolen identities; all of this from users who were still at least 4 years short of Facebook’s (all too easy to avoid) minimum age requirement of 13 years old. We needed to steer our students away from Facebook and toward something the school could police, and make sure we catch the others before opening Facebook accounts.

That’s where BuddyPress came in.

BuddyPress enabled us to start our own school-oriented social network, where children can communicate with their classmates in a safe and monitored environment. Every child was given a username and password as well as training on how to use the platform. We encourage responsible use of the Internet through teaching our children how to be good e-citizens. Our social network is treated like the children’s school books where the children should produce their best work at all times. This is imposed to produce an environment of high quality writing (typing) which in turn breeds good writing habits both online and in the rest of their school work.

Our social network is hosted on the Internet rather than any internal school server and so it is easily accessible to the children at home which has further encouraged participation. The children have really enjoyed engaging with their classmates, and even their teachers, on the school social network; sharing brief conversations about both in school and out of school matters. Teachers are able to set tasks for whole class groups or give encouragement to individual learners. It’s a valuable tool to enhance communication between teaching staff, reminding colleagues of events, sharing resources for lessons, and taking care of administrative and social notices.

The basic functionality of BuddyPress can be further extended through the use of the ever expanding Plugins library. We use BuddyPress Docs where children can collaborate on a shared piece of work and teachers can make comments and suggestions to help the children to enhance it. We also have the CubePoints for BuddyPress plugin to encourage participation on our social network. Children are awarded points for logging in daily and posting comments and a chart showing to top users is displayed in the sidebar. Points can also be deducted for any issues both online and offline.

In addition to the masses of free plugins that are available, we have a paid subscription to WPMUDEV’s BuddyPress Calendar Plugin to help us to plan events in the school calendar such as Sports Day and Summer Fairs, or for individual groups such as fixtures for the school football team.

BuddyPress is the perfect fit for our school. The flexibility and extensibility of the WordPress platform, the continually updated plug-in environment, well documented support, and the fact it’s all free, leads me to the conclusion that it can be just as successful in all other schools as it has been with ours. Thank you for the opportunity to share our story!

by Paul Gibbs at May 01, 2012 09:05 PM under uses

WPTavern: Import/Export Options Now Available With Widget Logic

The latest release of one of my favorite plugins, Widget Logic, now has the option to import and export options. The options are saved to a text file which contains all of the conditional logic.

Widget Logic Export Import Options

Widget Logic Text File

Conditional Logic Saved Within A Text file

Despite using this particular plugin for a long time, it never really occurred to me how nice it would be to have such a feature. This really comes in handy for those times when you want to reformat your website and instead of remembering the conditional logic for each widget, you simply import the text file and the configuration is taken care of.

While I didn’t dedicate much time to it, there is an additional enhancement that comes with Version .52 of the plugin. You can now select when the logic code runs. Here is a screenshot that should help clarify what it does.

Oh, and if you get lost trying to find out where the new features are located, you’ll find them at the bottom of your Widget configuration page.

No related posts.

by Jeffro at May 01, 2012 07:15 PM under widgets

WPTavern: WooThemes Excels At Customer Service During Crisis

While WooThemes was experiencing a crisis that involved the loss of 6 months of data along with their main website going offline, they still managed to provide great customer service. During the entire ordeal, WooThemes kept customers and the public updated with what they knew and what they were doing to fix the problem via their status blog. Their status blog was updated multiple times a day. Many people commended the company on Twitter for doing such a great job and it’s definitely deserved.

I wish companies whether they be WordPress based or not would so something similar when a crisis hits. Customers want to know what happened, what’s currently happening, who’s doing what, etc. When a crisis hits and takes a website offline, people don’t want a canned response to a support ticket or email, they want information. Information keeps customers calm or at least, calmer then they would be without it. I personally hate that feeling I get when a company seems to shove me off and pretends as if nothing is wrong. As for information, inform the masses, not just a few. That way, everyone is on the same page. Use your company site as a means of controlling the conversation so people don’t have to guess what’s happening.

Related posts:

  1. WooThemes To Go Back To Their Roots
  2. Interview With Adii Of WooThemes
  3. WooThemes Releases Survey Results As An Infographic

by Jeffro at May 01, 2012 03:00 PM under woothemes

Weblog Tools Collection: WordPress Plugin Releases for 5/1

New plugins

Simple Google Connect is a framework and series of sub-systems that let you add any sort of Google based functionality you like to a WordPress blog.

WP Coming Soon adds a coming soon page with a countdown clock.

Updated plugins

Email Log allows you to log all emails that are sent through WordPress.

Keyring provides a very hookable, completely customizable framework for connecting your WordPress site to an external service.

Social Login for WordPress lets your users log in and comment via their accounts with popular ID providers such as Facebook, Google, Twitter, Yahoo, Live, and over 15 more.

by James at May 01, 2012 02:00 PM under WordPress

Alex King: RAMP v1.0.4 Released

We pushed out an update to RAMP today, our WordPress plugin that makes it easy for you to stage content for review in one environment, then push it to your production server once it’s ready to go.

As the version number indicates, this release is primarily to deliver a few bug fixes. Here is a quick overview of the significant changes:

  • improved compatibility with changes introduced in WordPress 3.3
  • properly handle entirely numeric category and tags names
  • improved support for hierarchical taxonomies
  • misc. cleanup of PHP notices (when the WordPress DEBUG setting is enabled)
  • minimum required WordPress version is now 3.3

For a little more detail about just what this product is all about, check out my original post announcing RAMP.

by Alex at May 01, 2012 12:19 AM under WordPress

April 30, 2012

Weblog Tools Collection: Do You Use a Comment Policy?

Comments are an important part of blogs. They help readers relate to articles by asking questions and building discussion and are even credited with creating some of the strongest online communities today. But, how do you keep everything clean and on topic? Do your users know what to expect? I’m not just talking about common sense and anti-spam practices, I’m talking about a policy or a code of conduct. Do you have one?

We have a comment policy here, and it’s as follows:

Comments will be accepted if they meet the following conditions:

  • The comment is not spam.
  • The comment is not left solely to drive traffic elsewhere. (Yes, this is spam.)
  • The comment is not widely off topic.
  • The comment is not obscene or profane.
  • The commenter has left a real name or proper screen name. (“Cheap Lawn Chairs” and “Joe @ MyCellPhoneTips.blah” are not real names).

We do use a broad list of moderation keywords, but if your comment is held for moderation and abides by our comment policy, it will be accepted shortly.

By submitting a comment here you agree to the above comment policy and grant this site a perpetual license to reproduce your words and name/web site in attribution.

You might notice that we’ve added a handy link to it above our comment form by just editing the theme’s comments template. It’s just about as easy as typing the desired text above the form fields. If you’d rather not get your hands dirty in the template, and you have a WordPress blog, try Comment License.

So, do you have a comment policy? If so, we’d love to hear what it is! If you don’t, what guidelines do you use to manage comments on your blog?

by James at April 30, 2012 02:00 PM under discussion

WPTavern: Critical Update For WooThemes Customers

As if WooThemes.com being attacked was not bad enough, there is also a critical security issue that’s been fixed in the latest release of the WooFramework. The issue dealt with the shortcode generator.

The latest version (and most likely many previous versions) of the WooThemes WooFramework has a bug that allows any website visitor to run and see the output of any shortcode. This gives unauthenticated visitors the same power to execute code on the server as regular publishers have. WordPress installations with unsecured shortcodes (such as [php] which allows raw PHP code to be run) are vulnerable to serious attacks if WooThemes are installed, even if they are not the selected theme for the site.

While the Gist author for that post took some heat for releasing the information the way that he did, others chimed in and stated the vulnerability should have never existed in the first place. According to Jason Gill who is a WooThemes paying customer and also the one who announced the vulnerability on the Gist website explained that he made every effort to try and contact WooThemes or at least, see if the patch was already in existence but was unsuccessful.

While at the time of writing this article WooThemes.com is offline, I advise you to check back often to update your themes as soon as possible.

Related posts:

  1. WooThemes Releases Survey Results As An Infographic
  2. WooThemes To Go Back To Their Roots
  3. Interview With Adii Of WooThemes

by Jeffro at April 30, 2012 01:00 PM under woothemes

April 29, 2012

Weblog Tools Collection: WordPress Theme Releases for 4/29

Chess is a vibrant, bright, high contrast theme that would suit sites dealing with games, chess, or sales.

silverOrchid offers a wide range of customization possibilities with theme options, and is extremely simple to get up and running.

Sunspot is a sharp theme with subtle grid lines and sun-splashed accents.

by James at April 29, 2012 04:15 PM under wordpress themes

April 28, 2012

Weblog Tools Collection: New Blog Dedicated to Theme Options Screens

Konstantin Kovshenin, an Automattic Code Wrangler, has launched Theme Options Gallery, a new blog dedicated to the best and worst WordPress theme options screens.

Each post features a screenshot of a theme options panel in action followed by a breakdown of what makes it either so great or so terrible. There are definitely some eye-opening observations here, especially when it comes to the themes that have so many options they might as well be their own blogging platform. If you know of a theme options panel that’s either amazing or terrifying, Konstantin has a handy submission form for you to share in the joy or madness.

by James at April 28, 2012 02:00 PM under theme options

April 27, 2012

Weblog Tools Collection: WordPress Plugin Releases for 4/27

New plugins

I Recommend This allows your visitors to simply recommend or like your posts instead of commenting.

WP Breaking News Mail allows you to send an email to your subscribers each time a post is published in one or more categories.

Updated plugins

Akismet filters out your comment and track-back spam for you, so you can focus on more important things.

Jetpack supercharges your self-hosted WordPress site with the awesome cloud power of WordPress.com.

Share Buttons by Lockerz / AddToAny helps people share, bookmark, and email your posts & pages using any service, such as Facebook, Twitter, Google, StumbleUpon, Digg and many more.

Sharexy is a powerful social sharing, bookmarking, and blog monetization tool.

Shortcoder is a plugin which allows users to create a custom “shortcodes” and store HTML, Javascript and other snippets in it.

Super RSS is a jQuery based RSS reader widget, which displays the RSS feeds in the widget in an attractive way.

Twitter Avatar Reloaded adds a new field to the comment form to get the user’s Twitter usrename and uses it to replace the Gravatar with their Twitter avatar when the comment is displayed.

by James at April 27, 2012 03:30 PM under WordPress

April 26, 2012

Matt: Richard Clarke on Stuxnet

Smithsonian Magazine has a great article on Richard Clarke, the former counterterrorism czar, discussing Who Was Behind the Stuxnet Attack.

by Matt at April 26, 2012 03:46 PM under Asides

Akismet: Akismet WordPress plugin 2.5.6

Version 2.5.6 of the Akismet plugin for WordPress is now available. This is a maintenance release that includes several bugfixes and improvements to performance and robustness:

  • Prevent retry scheduling problems on sites where wp_cron is misbehaving
  • Preload mshot previews
  • Modernize the widget code
  • Fix a bug where comments were not held for moderation during an error condition
  • Improve the UX and display when comments are temporarily held due to an error
  • Make the Check For Spam button force a retry when comments are held due to an error
  • Handle errors caused by an invalid key
  • Don’t retry comments that are too old
  • Improve error messages when verifying an API key

To upgrade, visit the Plugins tab of your wp-admin dashboard and follow the instructions. This version of the Akismet plugin requires WordPress 3.0 or higher. If you haven’t already upgraded an old copy of WordPress, now is a good time: the new plugin release will provide significantly more accurate results than the legacy plugin available for WordPress 2.x.

If you haven’t yet activated Akismet, you can sign up for an API key here. Personal blogs and sites can choose how much to pay, starting at $0.


by Alex at April 26, 2012 04:47 AM under releases

April 25, 2012

Matt: Automattic Growth

Liz Gannes writes for AllThingsD, Automattic Grows Up: The Company Behind WordPress.com Shares Revenue Numbers and Hires Execs. In addition to Stu joining as CFO and Paul as Consigliere/Automattlock, we’ve been on a hiring roll the past month or two with excellent folks joining at every level of the company, including two more Matts. If you’re passionate about Open Source and making the web a better place, like we are, there’s never been a better time to join. My favorite thing about logging in every morning is the people I work with. Friends say I work too much but it hardly feels like work at all. Update: Now in Techcrunch too.

by Matt at April 25, 2012 02:40 PM under Asides

Weblog Tools Collection: WordPress Theme Releases for 4/25

LaunchTime is a coming-soon page theme that you can use as a placeholder while waiting until your site is launched.

Silesia is a clean and elegant HTML5 theme.

SmartBiz is designed for corporate business websites and blogs.

Voyage is a peaceful, nautical theme that would suit personal blogs, sites about boating or sailing, or any other nautical related subject matter.

Zenon Lite is an all in one wordpress theme with 3 awesome fonts, slider, background image, and an easy to use theme options panel.

by James at April 25, 2012 02:00 PM under wordpress themes

April 24, 2012

Donncha: Wikipedia Irish Style

WordPress on Mickopedia via r/Ireland.

Related Posts

by Donncha O Caoimh at April 24, 2012 05:21 PM under Wikipedia

WPTavern: ManageWP To Soon Be Available As An iOS App

ManageWP, the service that makes it a breeze to manage multiple websites from one location has announced that they are currently developing an iOS application specifically for ManageWP. This move takes the ease of managing multiple websites to the next level. While the app is not yet available, there are a couple of screenshots of what the final product might look like.

The first screenshot shows a concept of what the dashboard might look like. I have not tested the app itself but it will be interesting to see if they manage to pack all of their sites functionality into the iPhone app while still maintaining ease of use.

ManageWP Dashboard Concept Image

What may be the most exciting part of this news is that the app will also be available to use on the iPad. With more screen real estate and the retina display on the newest version of the iPad, this combination should make for a great experience.
ManageWP iPad Concept

Pricing has yet to be determined and in some aspects, this could get tricky. While the app is no use to non ManageWP customers, will the company end up charging for the app for existing customers? Considering there are three different service plans, I could see them offering the app for free to those who are middle and top tier plan customers. I know that the folks from ManageWP monitor this website so if you have feedback on how they should go about this, please offer your feedback within the comments.

While there are alternatives to ManageWP, they are certainly experiencing healthy growth. Earlier this year, they hit the 100,000 managed websites milestone. They have also obtained 2,000 paying customers. Speaking of paying customers, I encourage you to read through the comments of a post I published about a week ago where a number of folks chimed in that while ManageWP is awesome, their prices are a bit too high to digest. Based on feedback I have observed, there are two camps. One that says ManageWP is worth every penny that they currently charge and one that says the prices are just too high.

If you believe their prices are too high, consider the following. They currently have a staff of 20 or so people with plans to add more. They are an international bunch and the company is growing rapidly. There is the infrastructure, hardware, etc that they have to pay for. In my opinion, they shouldn’t price themselves out of business. They should simply charge what they feel is right for the service.

Related posts:

  1. WordPress App – The Best Thing On Peter Brights iPhone
  2. Turning Your WordPress Powered Site Into An iPhone App
  3. WordPress iPhone App 2.7 Released

by Jeffro at April 24, 2012 01:00 PM under managewp

April 23, 2012

BuddyPress: One Million and Counting

One Million (and four)

One Million (and four)

Today, BuddyPress saw its one millionth download!

Many thanks to the thousands (and thousands!) of contributors, developers, site admins, and users who have made BuddyPress thrive. The ongoing popularity of BuddyPress is a direct result of the vibrant and growing BuddyPress community – we couldn’t have done it without you.

Here’s to the next million!

by Boone Gorges at April 23, 2012 04:28 PM under Community

Weblog Tools Collection: WordPress Plugin Releases for 4/23

New plugins

Donate Ribbon places a black “Donate” ribbon in the upper right corner of your blog with the option to set the link and link title.

Rickroll changes all of your embedded YouTube videos to Rick Astley’s “Never Gonna Give You Up.”

Updated plugins

Exploit Scanner searches the files on your website, and the posts and comments tables of your database for anything suspicious. It also examines your list of active plugins for unusual filenames.

HTML5 MP3 Player with Playlist allows you to easily use the HTML5 audio element to enable audio playback in most browsers, with playlists.

by James at April 23, 2012 02:00 PM under WordPress

April 21, 2012

BuddyPress: The Default Theme

BuddyPress is a collection of social networking components that are heavily dependent on the theme of your WordPress.org powered site. In order to view a member’s profile, a list of user groups, an activity stream, your friends, the active WordPress theme needs to have the proper templates to output those things. If the templates don’t exist, the page won’t display. Pretty simple, right?

Wrong.

There are two fundamental problems with this approach:

  1. Bolting BuddyPress into an existing theme is really difficult. It’s a rabbit hole of modifications just to get things usable, and another hole to make it actually look pretty and cohesive with the existing theme’s styling and layout.
  2. When the BuddyPress development team wants to update the Default Theme, we do so at the risk of breaking backwards compatibility with existing themes that expect for it to work a specific way.
    1. Third-party BuddyPress plugin authors feel this pain even more-so, as they’re dependent on parent themes, child themes, and their own functionality all aligning correctly.

The first problem is the most common, and also the most frustrating to most new users. “I already have the site I want, but I want this feature that BuddyPress can provide. How do I make them work together?” The answer to this question isn’t simple, and it’s a huge detriment to the new experience of setting up BuddyPress to have to lurk around the HTML and template files, and butcher your pretty theme to make things fit.

The second problem is more common to developers and designers, and also prevents the BuddyPress development team from exploring any amazing new ideas with the project at its core. When we want to build something new, or improve an existing feature that’s falling a bit behind the times, existing templates can’t evolve to match the functionality because it’s going to potentially break existing installations.

There’s a solution, and we think it’s pretty awesome.

In an undetermined future version of BuddyPress, we’re going to start bundling template parts along with features. These template parts are intended to be the canonical set of skeletal styling that BuddyPress provides out of the box. It has the benefit of being a turn-key installation for everyone, and allows us to push out updates more quickly and evolve the platform without worrying about how themes that are outside of our control might break. These templates will work with *any* existing standard WordPress theme without any modifications.

Sounds neat, eh?

Surprise! bbPress already works this way, and it’s not far off for BuddyPress to inherit this new functionality, too. The purpose of this particular post and announcement is really two-fold:

  1. We know that this is an issue for our users, and we don’t like being stuck in this rut either.
  2. We want to get the word out early about the change so anyone that needs to adapt has ample time to do so.

What does this really mean for me?

Very little, actually. :) If you’re using a derivative or a child theme of “bp-default” it will continue to work as it always has. If you’d rather check out what the bundled and white labeled styling looks like, you’ll be able to switch back and forth between the two seamlessly. The Default BuddyPress theme has had a good run, and we’re going to continue to include it and support it for the foreseeable future. What we want to do is shift our dependency from a theme we’re afraid to change, towards a set of templates that we love to improve.

We’ve created a forum topic specifically for this discussion about how theme compatibility will work, and to answer any questions and talk more about its future.

by John James Jacoby at April 21, 2012 11:09 PM under theme compatibility

Weblog Tools Collection: WordPress Theme Releases for 4/21

Express is a basic, simple theme that would be suitable for any blog or website.

Next Saturday is a bold and playful theme which adds a touch of childlike innocence to your blog.

Typhoon is a simple blue theme.

by James at April 21, 2012 02:00 PM under wordpress themes

April 20, 2012

Weblog Tools Collection: WordPress 3.3.2 and 3.4 Beta 3 Released

WordPress 3.3.2 and 3.4 Beta 3 have been released. This important security update plugs exploits in Plupload, SWFUpload, and SWFObject (three external libraries used by WordPress), as well as a few additional fixes.

WordPress 3.4 Beta 3 is still not ready for prime time, but provides almost 90 fixes since the second beta release. Please do take a few swings at it on a test installation, especially if you are a plugin or theme developer. If you find any bugs, please report them, and contact the support forums if you need any help.

If you’re currently running on the WordPress 3.3 branch, please update to 3.3.2 as soon as you can!

by James at April 20, 2012 06:19 PM under wordpress 3.4

Matt: Open Source Science

Nature Editorial: If you want reproducible science, the software needs to be open source. Amen.

by Matt at April 20, 2012 04:24 PM under Asides

Dev Blog: WordPress 3.3.2 (and WordPress 3.4 Beta 3)

WordPress 3.3.2 is available now and is a security update for all previous versions.

Three external libraries included in WordPress received security updates:

  • Plupload (version 1.5.4), which WordPress uses for uploading media.
  • SWFUpload, which WordPress previously used for uploading media, and may still be in use by plugins.
  • SWFObject, which WordPress previously used to embed Flash content, and may still be in use by plugins and themes.

Thanks to Neal Poole and Nathan Partlan for responsibly disclosing the bugs in Plupload and SWFUpload, and Szymon Gruszecki for a separate bug in SWFUpload.

WordPress 3.3.2 also addresses:

  • Limited privilege escalation where a site administrator could deactivate network-wide plugins when running a WordPress network under particular circumstances, disclosed by Jon Cave of our WordPress core security team, and Adam Backstrom.
  • Cross-site scripting vulnerability when making URLs clickable, by Jon Cave.
  • Cross-site scripting vulnerabilities in redirects after posting comments in older browsers, and when filtering URLs. Thanks to Mauro Gentile for responsibly disclosing these issues to the security team.

These issues were fixed by the WordPress core security team. Five other bugs were also fixed in version 3.3.2. Consult the change log for more details.

Download WordPress 3.3.2 or update now from the Dashboard → Updates menu in your site’s admin area.


WordPress 3.4 Beta 3 also available

Our development of WordPress 3.4 development continues. Today we are proud to release Beta 3 for testing. Nearly 90 changes have been made since Beta 2, released 9 days ago. (We are aiming for a beta every week.)

This is still beta software, so we don’t recommend that you use it on production sites. But if you’re a plugin developer, a theme developer, or a site administrator, you should be running this on your test environments and reporting any bugs you find. (See the known issues here.) If you’re a WordPress user who wants to open your presents early, take advantage of WordPress’s famous 5-minute install and spin up a secondary test site. Let us know what you think!

Version 3.4 Beta 3 includes all of the fixes included in version 3.3.2. Download WordPress 3.4 Beta 3 or use the WordPress Beta Tester plugin.

by Andrew Nacin at April 20, 2012 03:10 PM under Security

Weblog Tools Collection: Free WordPress Security Webinar

iThemes will be sponsoring a free webinar on WordPress security on April 25 at 1 PM CDT. The webinar will be given by Dre Armeda of Sucuri and will cover cleaning up your WordPress site and keeping it secure.

If you can’t make it, don’t worry. iThemes will be providing a recording later for viewing at your leisure.

by James at April 20, 2012 03:00 PM under webinar

April 19, 2012

Weblog Tools Collection: WordPress Plugin Releases for 4/19

New plugins

HTML5 MP3 Player with Playlist allows you to easily use the HTML5 audio element to enable audio playback in most browsers, with playlists.

Stop CISPA Ribbon places a black ribbon with the words “Stop CISPA” in the top right corner of your website, linking to the Stop CISPA website.

Updated plugins

BackWPup allows you to backup your WordPress database, files, and more.

FoxyPress is a custom plugin made to integrate FoxyCart e-commerce functionality into your WordPress website.

Share Buttons by Lockerz / AddToAny helps people share, bookmark, and email your posts & pages using any service, such as Facebook, Twitter, Google, StumbleUpon, Digg and many more.

Sharexy is a powerful social sharing, bookmarking, and blog monetization tool.

Store Locator allows you to efficiently display and manage your important stores, locations, or other points of interest on your website in a manner that’s easily searchable by visitors.

by James at April 19, 2012 02:00 PM under WordPress

April 18, 2012

WPTavern: Free Webinar On Locking Down WordPress

As part of their Make Waves series, iThemes will be conducting a free webinar with Dre Armeda of Sucuri.net to discuss how to lock down a WordPress installation. In this webinar, viewers will learn how to reduce their risk of being attacked by hackers and malware threats. The webinar takes placed on Wednesday, April 25th at 1 P.M. CDT. I’ve linked to Sucuri a number of times during the year because these guys know what they’re talking about when it comes to website security.

Related posts:

  1. WordPress Not The Direct Cause Of Mass Site Attacks

by Jeffro at April 18, 2012 06:30 PM under webinar

Weblog Tools Collection: WordPress Stats Overload Now in Graphic Form

We already know that WordPress powers about 19% of the web and 48 of the top 100 blogs, and now Joost de Valk has taken that a step further with this amazing infographic.

Some cool stats worth mentioning: WordPress powers 72.4 million websites as of March 2012 with half of those being on WordPress.com, an estimated 20 – 25% of new websites published in 2011 were built using WordPress, WordPress powers 22 of every 100 new domains created in the US, and WordPress corners 53.8% of the market when compared to other content management systems.

The infographic is definitely worth a quick look through, and perhaps even framing and hanging on a prominent wall in your main room.

by James at April 18, 2012 02:00 PM under stats

April 17, 2012

Alex King: Cart66 Vulnerability Follow-up

Cart66 released a new version this morning, addressing the vulnerability I posted about yesterday. A one-day turn-around to address a security issue is excellent (even if the stink from 9 months of inattention hasn’t fully dissipated yet). I’m disappointed I had to resort to a public warning to get action but glad that action was taken (and glad to see the Cart66 folks making the right general noises about the importance of security).

While I’m glad a new version is out to address the vulnerability, I think it was a mistake to release any information about the nature of the exploit today (the same day that the fix is available). I would have favored:

  1. Release the new version with the explanation that this fixes a security vulnerability and everyone should upgrade right away.
  2. Wait for a week to allow your customers time to upgrade.
  3. Then release the details of the exploit.

As a customer, I’m surprised I haven’t (as of this writing) received a notification warning me of the vulnerability and urging me to upgrade.1 I believe it’s the responsibility of a software provider to reach out to their customers to warn them about security issues before disclosing the details of them publicly.

Cart66 has already generally disclosed what the vulnerability is, but they didn’t go into much detail about how it could be exploited. The “black hat” folks will likely figure it out anyway, but I’m going to hold off sharing any details of it until next week. I think it is appropriate to outline how this can be exploited to help provide some context to Cart66 customers, but I don’t want to be the one making it more likely that people will exploit the vulnerability on their sites.


While I am generally willing to take the explanation of how this vulnerability was allowed to remain unaddressed for such a long time at face value, I also believe this shows a fundamental lack of emphasis on security throughout the Cart66 organization. Someone received my email, replied that this was already a known problem, then nothing happend. Who knows, perhaps the people involved with that response aren’t even with the company anymore, but I’m pretty darn sure that this wouldn’t happen in my shop. A security vulnerability is a “Drop everything, get it patched and get a new release out. NOW!” situation. I will take them at their word that they are working to address this internally, but I’m still not comfortable with what their response (or lack thereof) says about their culture.

If I were advising the Cart66 team, I would tell them they need to take additional steps to make it clear to their customers that they are taking security seriously. I would recommend hiring Mark Jaquith (or another reputable consultant or firm) to do a full security audit of their code and product architecture.

I would also create and publish a process by which developers can responsibly submit security concerns, patches, etc. This should be easy to find on the Cart66 website.

Lastly, I would establish the process by which security issues are communicated to customers (a mailing list, or similar). In the case of responsibly disclosed vulnerabilities, this should include giving customers reasonable time to upgrade before publishing any details of an exploit.

All software has bugs, and some of these bugs have security ramifications. How you deal with them (and how you work with your customers when they are found) is what builds or destroys your reputation.


  1. I did receive an email response to my ticket about the new release, but that didn’t go to all customers 

by Alex at April 17, 2012 05:33 PM under WordPress

WPTavern: The Biggest Challenge For WordPress?

WordPress’ biggest challenge over the next two years, and where we’re focusing core development, will be around evolving our dashboard to be faster and more accessible, especially on touch devices. Many of our founding assumptions about how, where, and why people publish are shifting, but the flexibility of WordPress as a platform and the tens of thousands of plugins and themes available are hard to match. We might not always be the platform people start with, but we want to be what the best graduate to.

Via WordPress And The Top 100

No related posts.

by Jeffro at April 17, 2012 05:00 PM under wordpress

Weblog Tools Collection: WordPress Theme Releases for 4/17

Fanwood is an all-purpose, responsive (mobile friendly) theme with 12 optional layouts, per post layouts, multiple drop down menus, 18 widget areas, and more.

Museum Core is a simple theme/framework with support for post formats, thumbnails, background, header, menus, and more.

Tartan is a very attractive, professional website or blog theme with a hint of a vintage look.

by James at April 17, 2012 02:15 PM under wordpress themes