I don’t normally do negative posts about another person or company, but I feel this needs to get out there.  A few hours ago I received an email from MediaTemple, where I host several of my clients.  It was an automated message informing me that:

This is an automated notice informing you that our system has reset your Server Administrator FTP/SSH password due to suspicious activity observed on your (gs) Grid-Service. Our systems have taken measures to protect your service from any possible future exploits.

Since Media Temple doesn’t offer customers any FTP/SSH server logs for me to check, I called them to discuss.  The initial tech support representative and his manager were polite and helpful, explaining that an enormous amount of login attempts had been going on through many accounts, with a number of them being successful.  Many sites on many Media Temple accounts had been attacked and contained injected links in the footer:

<!– [6eb602d48b8b7f42aba0ce0c31ebe3f5 --><!-- 9190819521 --><noscript><ul><li><a href="http://rg8rhg34h34h.cc/c">.</a></li></ul></noscript><!-- 6eb602d48b8b7f42aba0ce0c31ebe3f5] –>

I asked how in the world did hackers magically guess so many FTP/SSH passwords.  At first I was told that these were old passwords (I wasn’t explained the significance of why old passwords should be vulnerable).  Then I was told that the login data was stored in plain text in a database that had been compromised.  My jaw dropped.  In my entire life, I’ve never heard of a company storing passwords in plain text.  This is bad enough, but then the database where these passwords were stored was somehow accessible to someone on the outside.

They weren’t able to give me any really good answer, other than that the issue was being worked on to revamp security on the servers, and that new account level security measures (like not emailing passwords to new customers) would be implemented.  I asked when they became aware of this issue, and was told within the past day.  Oddly enough, Kyle Brady at the Inquisitr and Ross Dally at Tinyenormous seemed to be aware of this long before earlier today.

I asked if Media Temple would be making a public announcement detailing the issues which led to the hacks, and what is being/has been done to correct them.  I was told to expect such an announcement.  So wait and see?

No related posts.

I don’t have some crazy linkbait title bashing some plugin, developer, or Automattic employee/executive, but you’re here so I guess you still found the post somehow.

Lately, there has been a lot of talk about a variety of issues related to the commercialization and GPLness of plugins, themes, and Automattic.  Some of these discussions have been overlapping and conflicting.  Most of them are crap, and it’s getting harder and harder to weed through all the crap to find the legitimate stuff.

It’s been made clear before, but I’ll say it one last time, if you develop a plugin or theme for WordPress and plan on hosting it at wordpress.org, giving it away, selling it, or distributing it to the public in any fashion it must be GPL.  If you don’t like this, then go develop for something else.  When I started developing for WordPress, I did so with the knowledge that someone could take the fruits of my hard work, and redistribute it as their own.  This is seen by some as a crutch, a roadblock to making money with GPL software development.  Some people have decided that the GPL is some sort of burden (whether by design, flaws, or implementation) to making money.  Tell that to Red Hat, Sun Microsystems, our own Automattic, or the countless thousands of people and companies making their living from WordPress in some way (including fully compliant plugin and theme development).

For one thing, if you’re developing plugins because you think you’ll get rich off the donations, then stop right now before you waste your time.  Aside from the fact that we do it for other reasons that you’ll never understand, your average wp.org plugin just isn’t going to provide you with donations on a level that will afford you early retirement.  Open source software development is about the community being able to bring together collective and individual efforts to create applications that best serve everyone. It’s not about getting software free of charge, even though that often can be a great side effect.

I sometimes wonder if some of the GPL misconceptions we see in the WordPress community are largely due to people having their first exposure to “free and open source” software with WordPress.  They see this great free software with lots of free community supporting, plugins, and themes, and perhaps think that everything has to be free, or that everything touched by GPL software has to be free (in either sense of the word).

Let’s look at Akismet.  You can download the Akismet plugin, which of course is free of charge, but also the GPL kind of free.  This plugin interfaces with a proprietary Akismet service.  The Akismet service doesn’t have GPL freedoms, that doesn’t even apply here.  Whether or not the Akismet plugin costs money has absolutely nothing to do with it being GPL, and whether or not the Akismet service it interacts with costs money has nothing to do with the plugin being GPL.  Another example would be any one of the many Google-related plugins.  There are plugins to interact with Google Maps, Google Analytics, Youtube, Google Translate, Google search, etc.  These plugins are all GPL (free as in liberty).  They interact with a service that is not.  We don’t have access to the source code of Google, and have no liberties with it, other than being able to use their API.  Whether or not Google charges for any of these services is irrelavent.  The code that the GPL applies to is the plugin itself.  The fact that it happens to interface with something that may or may not be commercial, and may or may not be GPL doesn’t affect the GPLness of the plugin itself.

Making money with WordPress Themes and Plugins

There have been some recent movements to help plugin developers either be better compensated for their work, or to develop a solid business model.

There has been talk a while back, and again recently, about Automattic creating a commercial themes repository for the community theme developers to use.  Now people have been talking about a commercial plugin repository, which could possibly be similar to the iPhone App store.  While I wouldn’t be opposed to this happening, I won’t lose any sleep at night if it doesn’t.  I keep seeing all these posts and comments lately that Automattic or Matt needs to define a list of business models.  Although I suppose it would be great to have someone tell me how to make tons of money, it really isn’t their responsibility to hold the hand of someone trying to figure out how.  They’ve made it clear that they pretty much don’t care (and fully support) whatever business model you dream up, just as long as you comply with the GPL.

Another topic being discussed lately is the fact that donations to plugins are fairly meager. Again, I have to point out, that if you’re concerned about how you’re going to make money with the plugin you uploaded to the repository, you’re missing the point of creating that plugin.  As someone who develops several popular WordPress plugins, I can testify that you aren’t likely to make a living from the donations.  Do I enjoy receiving and appreciate donations of any size?  Of course I do.  Do I require it or look down on someone just because they don’t donate?  Absolutely not.  I have no problems with receiving little or no donations from most people for my contributions, that’s not why I do it.  If I never get another donation I would still continue to work on developing my public and private plugins and love doing it!

Some people wonder about a plugin developer who’s had part or all of the functionality of their plugin intergrated into the core of WordPress.  I suppose I can see why someone could be upset if they just lost what was their primary means of income, but again, this is missing the point of the GPL.  (I need to point out that certain functionality of a plugin winding up in the core doesn’t mean that the specific code they used is the same as the code to achieve that functionality in the core, but that’s a topic for another day.)  The point of the GPL isn’t to enable someone to have access to free (of charge) software, or to be able to take someone elses’ software and put their own name on it.  Are the developers of SimplePie or TinyMCE upset that WordPress uses their software in the core?  I doubt it, especially since SimplePie themselves makes a WordPress plugin.  The whole point is that we can all benefit.  It may not be much consolation to tell you that you should be honored that the functionality of your plugin was so great and so desired that it made it’s way into the core, but that’s what it’s all about.

Related posts:

1. You know you’re a WordPress addict if…
2. All in One SEO Pack increased support for WordPress as a CMS

Check out the new Foreman Field football stadium facility at Old Dominion University.  The ODU stadium is still a construction zone.  The game day building in the Southern Endzone is new.  In the next several years both stands will be replaced as they  are the original stands from the early 1900s.  ODU last played there 60 years ago!

In other news, be sure to check out our new WordPress Support Forum!

Related posts:

1. Marshall @ Virginia Tech 2009

The new version of All in One SEO Pack now has increased support for using WordPress as a Content Management System.  There are also various bug fixes and security updates.  Make sure you stay up to date with the ONLY All in One SEO Pack.

Related posts:

1. All in One SEO Pack – Pro Version update
2. Cory Miller loves his All in One SEO Pack shirt!
3. Raleigh WordPress May Meetup

I checked my mail today and found a relatively large, padded envelope. I opened it to find a signed copy of the latest album, Crazy Water, from Stan Crawford.

Stan Crawford is a singer/songwriter from Mineral Wells, a small town in the heart of Texas. After graduating from Texas A&M, Stan went on to discover sharing his love of music with others. Somehow he is still able to find the time to volunteer teaching children to play music when between tours.

Best of all, his site is powered by WordPress.

Click to hear Crazy Water

No related posts.

I’ve never been much into typography but as a habitual photoshop user, I’m burdened with some number of thousands of fonts on my computer. I recently came to the profound realization that it is silly for there not to be a font of my own handwriting.

Click for full size chicken scratch

When I was in elementary school, I was one of only a few kids who had a computer at home (Commodore 64 anyone?) so some of my teachers wouldn’t let me type my book reports. They had to be handwritten, so that it would be fair to all the other kids. I sure would have liked this back then.

Related posts:

1. It’s official… I have converted.