Hacker News Reader

Comment by Zamiel_Snawley | Hacker News Reader

This reads like part of the smear campaign predicted by Matt in his interview with Michael Paulson.

Also note that the author doesn’t disclaim any financial stake in the company he used to work for, WP Engine, after his company was acquired. He merely claims that he isn’t a “fan of either party”, so we should value his opinion and trust that it is impartial.

As for myself, I’ve never used WordPress or any CMS, I’m a lowly embedded software engineer. If Matt, the progenitor and steward of one of the most successful open source products in the world, asserts that an entity in the ecosystem is a leech, I’m inclined to believe him.

View on HN

> asserts that an entity in the ecosystem is a leech

By that definition, TinyMCE should be able to disable all textareas in Wordpress, since the product has used it freely for years without contributing anything.

And Lodash should be able to disable TinyMCE.

And QUnit should be able to disable Lodash.

It's open source. Should every Linux user be -required- to contribute? I'd bet the OS quality would degrade if that were so.

I am left with the question: why, after 13 years of WP Engine doing the exact same thing, is Matt now willing to burn down the house?

I partially agree with you that this could be a slippery slope, but there is a difference here. TinyMCE is not burning through API and CDN resources of the dependencies it is using.

Matt mentioned it's costing them millions per year to provide them with automatic updates and other services they provide.

And he also mentioned that they can host these services on their own, since the code is GPL2. They don't do this because they don't want to pay these costs themselves.

Perfectly acceptable to make that claim, which would be a ToS violation. Why couch it as something else?

if WP Engine contributed to source, would they suddenly be allowed to rack up API and CDN bills?

Where's the pricing page? Where's the terms that say "once your customers use our service enough you have to pay"? Where's the option in WordPress to switch to another backend?

The converse of this is where’s the contract or terms that says WP has to keep providing API access for free? It’s open source software after all, almost all of which comes with some form of “no warranty or guarantees” of any kind. Certainly I’ve never seen one offering contractual access to any and all future updates or patches.

Nahhhh that's not how that works at all. Real users are now not getting security updates or features that they had expected before they invested in the WP ecosystem. There's literally no way for a user to pay for API access. Instead, the onus is on the company they're paying for servers from to pay tens of millions of dollars (with no rhyme or reason for that amount). There's no passive "well we never guaranteed this!" from WordPress, they're actively going out of their way to break installations.

This wasn't an issue of "it's abusive traffic"—and how could it be, being the code that Automattic wrote!—it's an issue of Matt Mullenweg throwing a temper tantrum and turning unsuspecting WordPress users into collateral damage. There's no way to operate these features without WordPress infrastructure (you might even argue that it's not feasible, as it's never been done before by someone other than Automattic!). WordPress isn't just "not providing updates", they're actively blocking these users for purely political reasons. The users have been turned into cannon fodder.

The problem with these sorts of discussions is both sides always want to have it both ways. When the complaint is they aren't doing something and that's against the spirit of the thing, the response is "show me the contract that says I have to do it". But when it comes to talking about how their opponent is being unfair, the words of the contract don't matter anymore. That's just not how things work, either the contract is all controlling, or the relative behaviors and non-contractual expectations matter.

Matt might well be throwing a temper tantrum, and almost certainly causing brand damage, and the result of the conflict might be actual harm to end users. BUT WP Engine doesn't get to hide behind the limits of their obligations under the open source licenses and then shift the blame they should rightfully be taking onto Matt because of his temper tantrum. Real users are not getting security updates or features they expected because the company / vendor they are buying their product from did not do due diligence to secure their supply chain. Matt could decide tomorrow to stop releasing new WP versions, or change the license (modulo CLA stuff). It's not like sudden, fundamental changes to the upstream licensing / sourcing hasn't been a constant source of headlines and conflicts for the last few years now. CentOS, Redis, HashiCorp, Akka, CockroachDB, and many more projects have fundamentally "altered the deal" and downstream customers relying on them have been caught in the crossfire. Heck, even the GPL2 vs GPL3 debate is an example of this. Are all the projects that switched to GPL3 for anti-TiVoization clauses guilty of throwing temper tantrums? Plenty of real world users were harmed by moves to GPL3, for example, Bash on macOS is stuck at 3.2 and users were forced to migrate to zsh over this move.

> There's no way to operate these features without WordPress infrastructure

Is WordPress not open source? What stops WPEngine from doing it themselves, they have the source. If its too hard, well that might explain then why their upstream vendor wants some compensation for the work. We (rightfully) criticize commercial companies for not putting resources into the huge numbers of open source projects and labor that underpins their very existence. Well this is another example of that. If an upstream source is so critical to your business that its loss would cripple you or your customers... maybe consider spending some money on securing and retaining access to that source.

> Real users are not getting security updates or features they expected because the company / vendor they are buying their product from did not do due diligence to secure their supply chain.

It's not WPE's supply chain, it's the end users' supply chain. There's no way they could have seen this coming. Targeting WPE was essentially arbitrary. Users are affected because WPE was cut off, not because they did anything wrong.

> BUT WP Engine doesn't get to hide behind the limits of their obligations under the open source licenses

I'm curious to know what you think they should have done, because other then just heap money on a literal direct competitor, I can't imagine what they could have done.

> Is WordPress not open source? What stops WPEngine from doing it themselves, they have the source.

How are they supposed to have a copy of all the updates if they're blocked? This is such a nonsense suggestion. Of course they could run the servers, but those are empty servers with no data.

> If an upstream source is so critical to your business that its loss would cripple you or your customers... maybe consider spending some money on securing and retaining access to that source.

You're only just defending Automattic's literally extortion tactics. Should I as a user be worried that Linode or Hetzner will be blocked next because they aren't paying a tithe to WordPress?

> I'm curious to know what you think they should have done, because other then just heap money on a literal direct competitor, I can't imagine what they could have done.

I suppose not pissing off their single and sole supplier of the product they're reselling to their customers might have been a smart move. If you buy your product from your competition, you probably need to stay on their good side. Maybe not re-selling a product when their continued access to the product was controlled by a competitor might also have been a good idea.

> Of course they could run the servers, but those are empty servers with no data.

Do they not have the source? Probably time to start hiring some developers and make their own patches for security issues in the product they're selling. No warranty express or implied is exactly that. They get the software, they get the source. Everything else is a bonus. Especially if the defense of their conduct is that there's no obligation for them to have done anything more than the license required of them.

> Should I as a user be worried that Linode or Hetzner will be blocked next because they aren't paying a tithe to WordPress?

Yes, you probably should be. Any time you're reliant on a single source of failure for a critical component of your business you should be worried about it. Sometimes you accept the risk and nothing happens. And sometimes you accept the risk and something does happen and you learn why redundancy is important.

I would think that having the update server hardcoded into the application might be an implicit expectation that you're going to use that update server instead of another one.

Possibly, but when the owner of that server comes around and starts playing hardball, you probably need to figure out real quick how to mollify them or get out from under them. And if you're going to just point to the software license and say "it doesn't say I have to do anything to give back to you", then you probably shouldn't be surprised when the owner of the software points right back at the license and says "it doesn't say I have to give you access to the hard coded URLS either"

Except, as far as I understand this (not being a WPE customer or a WP user, just an observer), MM isn't cutting off WPE, he's cutting off anyone that uses WPE to host WP sites. The whole situation stinks and innocent customers are being caught in the crossfire as a result. No one comes out of this looking good and the WP community as a whole takes a hit as a result.

> Matt mentioned it's costing them millions per year to provide them with automatic updates and other services they provide.

A single hosted plugin repository is a huge multiplier towards ecosystem growth, but WordPress always had the option of distributing the load by asking others to set up mirrors, and offering a selection of mirrors. Y'know, redundancy. They've never done so.

There's also no option in the WordPress core to easily point towards a different repository URL.

Maybe this whole debacle would lead to slightly more decentralisation of WordPress, which might be a good thing for the long-term health of the project and community.

There's discussions on this https://www.reddit.com/r/Wordpress/comments/1frd37p/its_time...

1. Provide proof of your claim that they don’t contribute, or a request for them to do so. I suspect Matt and his companies have contributed to many of their dependencies.

2. All those products have no marginal cost for users, WordPress.org does.

3. Just because bad behavior has been tolerated for a time doesn’t mean it must be tolerated forever.

> It's open source. Should every ... user be -required- to contribute?

No, not every user. Only entities that make millions of $$$ directly with that free software. They should be required to contribute!

Either donate directly or contribute hours proportional to your dependency on the project.

Also note that the author doesn’t disclaim any financial stake in the company he used to work for

It would hardly be shocking if he had some stock or whatever, given how prevalent that is for tech workers' comp.

However, if it were me, and I did have a financial stake in WPE, I would not/could not write either of these sentences from TFA under my personal view of honesty:

I really don’t have any reason to be a WP Engine cheerleader.

I can assure you it’s not me defending my old company just because I used to work for them. I’ve got literally no reason to do that.

If it were you and you did have a financial stake, would you make a post like this?

I doubt it, and it would be wrong to do so.

If he didn’t have a financial stake, he would have listed it in his myriad reasons to trust him.

It's worth noting that Matt Mullenweg invested in WP Engine's Series A.

I think the quotes you choose arguably are not even the strongest, because the author also said:

>I’ve watched from the sidelines as the company has implemented a bunch of scummy policies and shady sales tactics to squeeze money from their customers and make it harder to leave.

And

>On most days, if you wanted to have a conversation about how much WP Engine sucks, frankly, I’d be a happy participant.

The author goes to pretty great lengths to be transparent about his background and employment history.

More to the point, he lays out a ton of specifics about how Matt acted like a Grade A Asshat. If you have any issue with those specifics, you can and should state your objections.

But your comment here is just nebulous BS. Saying "This reads like part of the smear campaign predicted by Matt in his interview with Michael Paulson" sounds exactly to me like when Elizabeth Holmes gave her now infamous retort "first they think you're crazy, then they fight you, and then all of a sudden you change the world". Both are equally vacuous statements that don't address the specific criticisms put forth.

I will concede that my remark about a “smear campaign” is worthless or detrimental to the discussion.

1. The author claims dozens of other companies behave similarly and claims that Matt has not taken any action against them. However, the author makes no claim of what level of contribution to WordPress, cost to Wordpress.org, or any contractual agreements those companies may have with WordPress entities. Multiple companies do pay for trademark licenses. Scale is also an important factor here. Estimates are in the hundreds of millions of revenue for WP Engine. They are one of the largest companies in the ecosystem, of course they should be contributing more than smaller players.

2. The author claims that Matt attempted “extortion” and refused to give WP Engine more time to address his demands. It does seem true that Matt refused to give them more time. However, Matt claims this conversation has been going on for more than a year. A deadline seems appropriate if your counterparty keeps delaying.

3. The author claims that trademark confusion between WordPress and WP Engine is an unfounded concern, citing confusion Shopify and Spotify. This is ludicrous on its face, those companies serve completely different market needs, compared to the WP Engine literally offering the product produced by the trademark holder. The author claims that WordPress.com and WordPress.org is confusing the trademark, but doesn’t state whether WordPress.com has a license to use the trademark.

4. The author claims that Matt’s dissatisfaction with WP Engine’s contribution is unreasonable because there aren’t terms and conditions or a contract. This is missing the point entirely. The point is that good members of the community shouldn’t need to be forced to contribute. If they want to play by the letter of the law, Matt isn’t obligated to provide the free services that their business relies on, just as they aren’t obligated to give back. It cuts both ways, and if they won’t operate in good faith, it is self destructive to continue to enable them.

I’m out of energy to continue, so I’ll stop here.

>2. The author claims that Matt attempted “extortion” and refused to give WP Engine more time to address his demands. It does seem true that Matt refused to give them more time. However, Matt claims this conversation has been going on for more than a year. A deadline seems appropriate if your counterparty keeps delaying.

What would "seem appropriate" would be some form of terms and conditions, or contract, or legal authority that would warrant any of this business about imposing any deadlines or demands of any kind whatsoever, in the first instance. The time isn't Matts to give or not give to begin with.

>The point is that good members of the community shouldn’t need to be forced to contribute.

I think the author was at pains to emphasize through the beginning middle and end of the article that there was such a thing as a right way to make this case. And the problem is weaponizing certain levers at WordPress in ways that raise all kinds of conflict of interest issues, have the potential to cause all kinds of collateral damage, and undermining credibility and integrity of WordPress as a long-term project.

I agree that there is a right way to make this case, but we don’t know if it was already made behind closed doors.

The ultimatum Matt made in the texts highlighted by WP Engine appears short, but it seems unlikely this was the first time Matt brought up these issues.

Even assuming the best was done behind closed doors, isn't it reasonable to WP Engine customers to give them notice of at least a few weeks or months that "unless your host complies, you will lose access to WordPress.org updates"?

If Matt can pull the rug on one host's customers without notice, he can do it again. He has been on streams saying no other host is in the doghouse with Matt, but a week ago almost nobody knew WPE was on thin ice.

If Matt didn't do the reasonable thing to warn WPE customers, what other unreasonable things is he capable of doing in the future?

The "reprieve" of a new Oct 1 deadline is still far from reasonable in my opinion to the point that it is further infuriating that he is using it to virtue signal, though it is at least a tiny start of an implicit acknowledgement that he screwed up. But it's a matter of rebuilding trust in the ecosystem now, and I think Matt is still digging a hole, and this can't be fixed until he apologizes, and the governance of the WordPress.org update server is clarified (best case: out of Matt's hands), or somebody more neutral creates a competing update server, fracturing the ecosystem.

Reply on news.ycombinator.com