Hacker News Reader

Comment by mvkel | Hacker News Reader

> asserts that an entity in the ecosystem is a leech

By that definition, TinyMCE should be able to disable all textareas in Wordpress, since the product has used it freely for years without contributing anything.

And Lodash should be able to disable TinyMCE.

And QUnit should be able to disable Lodash.

It's open source. Should every Linux user be -required- to contribute? I'd bet the OS quality would degrade if that were so.

I am left with the question: why, after 13 years of WP Engine doing the exact same thing, is Matt now willing to burn down the house?

View on HN

I partially agree with you that this could be a slippery slope, but there is a difference here. TinyMCE is not burning through API and CDN resources of the dependencies it is using.

Matt mentioned it's costing them millions per year to provide them with automatic updates and other services they provide.

And he also mentioned that they can host these services on their own, since the code is GPL2. They don't do this because they don't want to pay these costs themselves.

Perfectly acceptable to make that claim, which would be a ToS violation. Why couch it as something else?

if WP Engine contributed to source, would they suddenly be allowed to rack up API and CDN bills?

Where's the pricing page? Where's the terms that say "once your customers use our service enough you have to pay"? Where's the option in WordPress to switch to another backend?

The converse of this is where’s the contract or terms that says WP has to keep providing API access for free? It’s open source software after all, almost all of which comes with some form of “no warranty or guarantees” of any kind. Certainly I’ve never seen one offering contractual access to any and all future updates or patches.

Nahhhh that's not how that works at all. Real users are now not getting security updates or features that they had expected before they invested in the WP ecosystem. There's literally no way for a user to pay for API access. Instead, the onus is on the company they're paying for servers from to pay tens of millions of dollars (with no rhyme or reason for that amount). There's no passive "well we never guaranteed this!" from WordPress, they're actively going out of their way to break installations.

This wasn't an issue of "it's abusive traffic"—and how could it be, being the code that Automattic wrote!—it's an issue of Matt Mullenweg throwing a temper tantrum and turning unsuspecting WordPress users into collateral damage. There's no way to operate these features without WordPress infrastructure (you might even argue that it's not feasible, as it's never been done before by someone other than Automattic!). WordPress isn't just "not providing updates", they're actively blocking these users for purely political reasons. The users have been turned into cannon fodder.

The problem with these sorts of discussions is both sides always want to have it both ways. When the complaint is they aren't doing something and that's against the spirit of the thing, the response is "show me the contract that says I have to do it". But when it comes to talking about how their opponent is being unfair, the words of the contract don't matter anymore. That's just not how things work, either the contract is all controlling, or the relative behaviors and non-contractual expectations matter.

Matt might well be throwing a temper tantrum, and almost certainly causing brand damage, and the result of the conflict might be actual harm to end users. BUT WP Engine doesn't get to hide behind the limits of their obligations under the open source licenses and then shift the blame they should rightfully be taking onto Matt because of his temper tantrum. Real users are not getting security updates or features they expected because the company / vendor they are buying their product from did not do due diligence to secure their supply chain. Matt could decide tomorrow to stop releasing new WP versions, or change the license (modulo CLA stuff). It's not like sudden, fundamental changes to the upstream licensing / sourcing hasn't been a constant source of headlines and conflicts for the last few years now. CentOS, Redis, HashiCorp, Akka, CockroachDB, and many more projects have fundamentally "altered the deal" and downstream customers relying on them have been caught in the crossfire. Heck, even the GPL2 vs GPL3 debate is an example of this. Are all the projects that switched to GPL3 for anti-TiVoization clauses guilty of throwing temper tantrums? Plenty of real world users were harmed by moves to GPL3, for example, Bash on macOS is stuck at 3.2 and users were forced to migrate to zsh over this move.

> There's no way to operate these features without WordPress infrastructure

Is WordPress not open source? What stops WPEngine from doing it themselves, they have the source. If its too hard, well that might explain then why their upstream vendor wants some compensation for the work. We (rightfully) criticize commercial companies for not putting resources into the huge numbers of open source projects and labor that underpins their very existence. Well this is another example of that. If an upstream source is so critical to your business that its loss would cripple you or your customers... maybe consider spending some money on securing and retaining access to that source.

> Real users are not getting security updates or features they expected because the company / vendor they are buying their product from did not do due diligence to secure their supply chain.

It's not WPE's supply chain, it's the end users' supply chain. There's no way they could have seen this coming. Targeting WPE was essentially arbitrary. Users are affected because WPE was cut off, not because they did anything wrong.

> BUT WP Engine doesn't get to hide behind the limits of their obligations under the open source licenses

I'm curious to know what you think they should have done, because other then just heap money on a literal direct competitor, I can't imagine what they could have done.

> Is WordPress not open source? What stops WPEngine from doing it themselves, they have the source.

How are they supposed to have a copy of all the updates if they're blocked? This is such a nonsense suggestion. Of course they could run the servers, but those are empty servers with no data.

> If an upstream source is so critical to your business that its loss would cripple you or your customers... maybe consider spending some money on securing and retaining access to that source.

You're only just defending Automattic's literally extortion tactics. Should I as a user be worried that Linode or Hetzner will be blocked next because they aren't paying a tithe to WordPress?

> I'm curious to know what you think they should have done, because other then just heap money on a literal direct competitor, I can't imagine what they could have done.

I suppose not pissing off their single and sole supplier of the product they're reselling to their customers might have been a smart move. If you buy your product from your competition, you probably need to stay on their good side. Maybe not re-selling a product when their continued access to the product was controlled by a competitor might also have been a good idea.

> Of course they could run the servers, but those are empty servers with no data.

Do they not have the source? Probably time to start hiring some developers and make their own patches for security issues in the product they're selling. No warranty express or implied is exactly that. They get the software, they get the source. Everything else is a bonus. Especially if the defense of their conduct is that there's no obligation for them to have done anything more than the license required of them.

> Should I as a user be worried that Linode or Hetzner will be blocked next because they aren't paying a tithe to WordPress?

Yes, you probably should be. Any time you're reliant on a single source of failure for a critical component of your business you should be worried about it. Sometimes you accept the risk and nothing happens. And sometimes you accept the risk and something does happen and you learn why redundancy is important.

I would think that having the update server hardcoded into the application might be an implicit expectation that you're going to use that update server instead of another one.

Possibly, but when the owner of that server comes around and starts playing hardball, you probably need to figure out real quick how to mollify them or get out from under them. And if you're going to just point to the software license and say "it doesn't say I have to do anything to give back to you", then you probably shouldn't be surprised when the owner of the software points right back at the license and says "it doesn't say I have to give you access to the hard coded URLS either"

Except, as far as I understand this (not being a WPE customer or a WP user, just an observer), MM isn't cutting off WPE, he's cutting off anyone that uses WPE to host WP sites. The whole situation stinks and innocent customers are being caught in the crossfire as a result. No one comes out of this looking good and the WP community as a whole takes a hit as a result.

> Matt mentioned it's costing them millions per year to provide them with automatic updates and other services they provide.

A single hosted plugin repository is a huge multiplier towards ecosystem growth, but WordPress always had the option of distributing the load by asking others to set up mirrors, and offering a selection of mirrors. Y'know, redundancy. They've never done so.

There's also no option in the WordPress core to easily point towards a different repository URL.

Maybe this whole debacle would lead to slightly more decentralisation of WordPress, which might be a good thing for the long-term health of the project and community.

There's discussions on this https://www.reddit.com/r/Wordpress/comments/1frd37p/its_time...

1. Provide proof of your claim that they don’t contribute, or a request for them to do so. I suspect Matt and his companies have contributed to many of their dependencies.

2. All those products have no marginal cost for users, WordPress.org does.

3. Just because bad behavior has been tolerated for a time doesn’t mean it must be tolerated forever.

> It's open source. Should every ... user be -required- to contribute?

No, not every user. Only entities that make millions of $$$ directly with that free software. They should be required to contribute!

Either donate directly or contribute hours proportional to your dependency on the project.

Reply on news.ycombinator.com