I hope that one positive outcome of this whole debacle will be people realising that the Wordpress Foundation board is apparently three Matt Mullenwegs in a trenchcoat: https://www.pluginvulnerabilities.com/2024/09/24/who-is-on-t... (I exaggerate, slightly.)
This is clearly not what an independent foundation with the interests of the open source project in mind looks like.
If this mess creates pressure to put more separation between the Foundation and Automattic, I think that can only be a good thing.
I’m the president of an internet nonprofit (miraheze.org) and we have five active directors with an annual budget of ~$10k. We have elections for community appointed directors as well. This stuff is not hard.
By comparison, the WordPress Foundation is just embarrassing. One of the biggest OSS projects in the world operating as a vanity project for Matt instead of being a stakeholder group, or doing much of anything.
I've been trying to wrap my head around why this feels so wrong. If the project had been run like this from the beginning, in an opinionated way that prioritizes what the few creators of the project think are important, then that's one thing. But it seems like Wordpress has generally been the stable, boring, slow-moving project that isn't run like a personal fiefdom, and Mullenweg is trying to force it from the one model to the other. I haven't used Wordpress in years, and this drama makes me never want to use it again.
Initially, I was taking the side of WP.org and Automattic; however, I changed my mind completely once they took over the “Advanced Custom Fields” plugin, and replaced it with another plugin that broke people's websites. So Matt weaponized the WP package repository, and stole the users of a well-maintained package, making WP site admins work over the weekend to fix the breakage.
This isn't opinionated, this is theft.
If the project had been run like this since the beginning, it wouldn't be where it is today. Automattic is a rich company partially due to the community around WordPress, and the trust that community has had in the governance of the project.
> replaced it with another plugin that broke people's websites
What makes you think it broke someone’s website? AFAIK they just patched the security issue that wp engine team couldn’t patch because they were locked out from pushing to repo?
Firstly, the security patch was already published by the ACF team, and that wasn't the code that was pushed. This was a package takeover, slug, reviews, users, everything:
People woke up to their website being updated to “Secure Custom Fields”, an alternative (or a fork) that's not fully compatible. Here's one such report from HN:
It reminds me of Reddit cracking down on 3rd party apps or Twitter changing that policy and a whole lot more once Musk took over. The problem isn't necessarily the actions or policies in a vacuum. There are legitimate benefits to these approaches. The problem is it feels like these communities were built up around certain practices and there was no reason to expect those practices to change. So when there is a big change that only happens after a platform has already reached near monopoly status, it feels like a bait and switch to users because many people would have never signed up for a platform with those policies in the first place.
> Mullenweg is trying to force it from the one model to the other
There are proper ways to do that, changing the license in a next version for example is how I think it should have been done in the first place. I've said it before here but this has all the markings of being extremely petty and Mullenweg not happy with their own licensing model.
> There are proper ways to do that, changing the license in a next version
All the projects doing that will soon discover that they were popular mostly because of the Open-Source licensing. Once that changes, the popularity, and goodwill go down, for the simple reason that trust gets breached and forks happen. Open-Source is essentially about the freedom to fork, and that's precisely what happens when governance fails.
Some of them will backtrack on that decision, but it will be too late; like ElasticSearch recently changing again to AGPL, except now the question is why would people choose it over the more trustworthy, open and secure OpenSearch.
There's nothing wrong with building proprietary software, but there is something wrong with pulling a bait-and-switch, betraying your community that invested in your product because of its Open-Source nature.
Matt surely knows that, and also, changing the license of WordPress is probably not possible due to them not having the full copyright. WordPress is not really theirs, despite all their contributions. Which is why this will not end well for Automattic.
Can Matt do that though? I don't _think_ WordPress has a copyright assignment agreement for contributors? So neither Matt nor Automattic nor wordpress.org nor The WordPress Foundation can choose to re-license future versions of the GPL2 or newer codebase without agreement from _all_ the contributors who retain the copyright in their part of the code.
There is no chance the license changes. Matt has been a very, very vocal supporter of GPL.
This self-described war he’s going on is all about commercial trademarks, and other hosting companies having more commercial success than Automattic in the ecosystem while contributing fewer developers and less money to the project.
Now, he’s taken it to a very extreme extent, and I fully disagree with his approach, but the core issues (for him) have nothing to do with GPL and how the WP project is governed. Those has even the same for decades, and he’s not trying to change them.
He’s just being very self-destructed because it turns out the community has no interest in some kind of “war” that gets long term contributors locked out of the ecosystem. He was expecting more people to be on his side, and frankly now seems to be lashing out (by blocking people) when that didn’t happen
None of that means he’s trying to change the governance model or license.
In 2021 Automattic, the company that effectively owns Wordpress, has a valuation of $7.5 billion in 2021, and revenue of $750M in 2024. It's big money.
I'm probably wrong here, but my tinfoil hat take is that Matt has seen how well Taylor Otwell is doing with Laravel and he wants a piece of that cake. Granted they're doing pretty good with wordpress.com hosting, but they'd have so much more money if they licenced plugins and features the way Laravel does.
On the off-chance that Matt is doing the irresponsible thing here and still getting involved in social media discussions on this topic:
People don't like being involved in drama, and as we saw with the Freenode debacle, when it starts up, the usual first reaction is to try to chart a path that lets them avoid the drama as much as possible. But when you demand that those people take sides, and pursue a scorched earth policy against those who don't take your side... the side that's going to be picked isn't your side. There's just too much risk to taking your side.
Which is kind of a weird thing, as people sure do love to sit back with their popcorn and watch the drama. There's entire TV networks dedicated to banality just like this.
Oh yeah, this is a fantastic thing to sit back and munch popcorn to. It's when the people involved are demanding that you stop munching the popcorn and start throwing knives at someone that the fun stops.
Yep, I’m browsing this topic with popcorn right now, with no skin in the game. It’s great fun!
Sorry if this is your livelihood, folks, but I can’t do anything to actually help. So I’ll just enjoy the fireworks and try to apply any lessons learned to other OSS communities.
@WPEngine - fork Wordpress, rebrand yourself and the code. Setup a plugin / update hub like Wordpress.org and provide a pathway for your customers and devs to migrate. I recognize this is non-trivial. Ending an abusive relationship usually is.
They profit off Wordpress' brand for free. Maintaining a fork and building a new brand will be expensive. As much as I despise Matt's antics, there's not much to gain for WPEngine by forking it.
The best scenario for all parties is to burry the hatch and for Matt to step down.
What the hell are you on about? Wordpress is GPL. Are all Linux distro profiting off Linus’ brand?
There is a very simple thing you can do if you don’t want people to do this: use a different license. You cannot eat your cake and keep having it.
> Maintaining a fork and building a new brand will be expensive.
Publishing free software is a decision. You cannot come years later to say “no, actually you need to pay”, or “yeah, it’s free but not like that”.
The whole “WPE does not contribute” point is completely disingenuous and I cannot believe that people are still uttering it in good faith.
> The best scenario for all parties is to burry the hatch and for Matt to step down.
The best scenario is Wordpress going up in flames, Matt being utterly ridiculed for his dishonest behaviour and the whole thing serving as a cautionary tale.
> What the hell are you on about? Wordpress is GPL. Are all Linux distro profiting off Linus’ brand?
> There is a very simple thing you can do if you don’t want people to do this: use a different license. You cannot eat your cake and keep having it.
Not taking sides here, but the GPL did not include a trademark grant the last time I checked. In fact, treating copyright and trademark rights separately is a fairly well-established strategy in the open source world (e.g.Firefox and Ubuntu).
OK, replace "WPEngine" with AWS/GCE/Azure/every-other-server-host. Thery all sell customer's services that rely on linux kernel (and gnu utilities). I don't see Torvalds or Stallman getting high and trying to extort them...
My mother has a WordPress site talking about hedgehogs and at this point it seems like it's only a matter of time before Matt's vendetta shows up in her site footer.
There’s a ‘sport’ where contestants see who can kick a rolled up hedgehog over the most garden fences. Maybe that one? Or it was a Sean Lock joke. I forget.
One positive outcome of this entire dispute is I picked up an old project where I wrote my own cms. It's been fun stepping through the code, and I'm tempted to take it further under a permissive license.
Been randomly thinking about it since this whole thing started, and beyond the drama it's clear that whether legal or not, Matt intends to use the trademark as a weapon to serve his purposes.
If you just look at the timeline and even that response to DHH it feels to me that he has much resentment against others using the software and him not being able to be the largest beneficiary of it. The examples to Shopify being a billion dollar whatever and unable to capture, to applying for the recent trademarks around "Wordpress Managed" and such show me that's how he views it in the end. You are using "Wordpress" software, so he should of course get a cut of that.
So many companies in the ecosystem have "WP" or "Wordpress Managed/Wordpress Hosting" as their tagline and have been for over the past decade. WPEngine is just the biggest target and the first in line. I have no soft spot for PE, but both can be bad in this case. I feel like Automattic is willing to burn the community to the ground or fracture it as long as they get their cut or become the the biggest player.
Yeah the DHH post is an example or projection… Automattic is hosting a lot of WordPress sites but not making anywhere near as much money as the WP Engines and Go Daddy’s of the ecosystem. (And yet automattic contributes the most to the project.) So it’s definitely a point of frustration to the business.
> I’ll just remind everyone at the start that this is a respectful debate, and DHH and I tried to get on a call but couldn’t because we were both traveling.
> DHH claims to be an expert on open source, but his toxic personality and inability to scale ...
Yep, real respectful.
I don't even understand the point of the post, other than to shit on the other guy. It doesn't advance any debate or raise any questions.
The post as it is now sounds really decent and a step in the right direction. Let's not air all the dirty laundry happening here, it looks like Matt is trying to do the "right" thing here.
Here is the current iteration of that post from Matt:
"I’ve taken this post down. I’ve been attacked so much the past few days; the most vicious, personal, hateful words poisoned my brain, and the original version of this post was mean. I am so sorry. I shouldn’t let this stuff get to me, but it clearly did, and I took it out on DHH, who, while I disagree with him on several points, isn’t the actual villain in this story: it’s WP Engine and Silver Lake."
he can link to his original post and put the clarification alongside if that's the case. i can change my mind if his actions show he's trying to do "right", but that takes time. for me, it's very important to know that he was even capable of writing the original post.
Nice detailed article. However, in these two places it doesn't seem clear that it was just the Slack account that was deactivated. Here:
> Javier Casares shared that his account was deactivated after he asked a series of questions in a Slack thread started by Colin Stewart.
And here, referring to Terence Eden:
> He later reported on Mastodon that his account was deactivated.
Another thing – with that headline, I was hoping for some more info on how it impacts community like how many migrated away from WordPress or even a change in market share. However I'm not sure where that's available on a daily or weekly basis.
I mean. It’s too early to say. If we’re talking raw traffic — the high profile enterprise sites have long term contracts. And it’s VERY hard to migrate hosting providers, let alone entire CMSes. So it will take a long period of enterprises not wanting to buy into WordPress for the traffic to die down.
Beyond that, which sides would move? Those owned by people who were invested in WordPress. Honestly, that’s probably not a super massive share of the websites. The random small businesses and individual people might not ever hear about this drama. It would take a while for new projects to stop getting built with WordPress.
So we won’t see that impact over the course of a couple weeks. Maybe several years.
But the community is way more about contributing to the core project (there are many hundreds of contributors in each release). With plenty of high profile ones leaving, it’s gonna be a blow to the project if good people don’t or can’t step up.
This has gone on for far too long... while I don't use a paid/managed WP on my personal blog, I'm seriously considering dumping WP entirely and writing my own CMS for my personal blog.
I can't do that, given that I run an e-shop with a card payment system etc. on Wordpress/WooCommerce. The ecosystem of plugins is just too damn useful.
Feels like WooCommerce should buy WPEngine and sell blackjack and h…
WooCommerce should become the steward, fork Wordpress, simplify it, and Wordpress should be their freemium offering. Wordpress is a funnel to WooCommerce.
WordPress's core dev team has had a longstanding aversion to including "unnecessary" features in the core to avoid bloat, with the idea that plugins can take care of any gaps in functionality.
It sounds like a reasonable philosophy until you see just how many basic CMS features it's missing and subsequently how many sites are running 20+ poorly-coded plugins that spam the dashboard notifications and have numerous PHP vulnerabilities.
I’m trying to get a better picture of this. Can someone tell me what percentage of code contributions are paid for by Matt/automattic? If it’s like 99% then I’m a little more sympathetic, I’m reminded of the centos/redhat thing. Either way, peace :)
I mean, it’s a lot. Certainly the majority of regular contributors. Probably 80-100ish full time employees working solely on WordPress OSS projects. (Some in community roles, executive director, tech leads, devs, designers, etc.) There are certainly other regular contributors (Yoast sponsors a couple people to work full time), and lots of volunteers. But without question, Automattic spends a lot of developer time on WP.
And in other parts of the business, there is a strong desire to “fix it in core,” so if WordPress.com wants easier site building for customers, well hey, send devs to help build full site editing in WordPress.
I have the impression that many long time contibutors walked away. Since the addition of the Gutenberg editor, I mostly see Automattic employees.
I wouldn't dare to say that other companies don't want to contribute, I do wonder what was and is going on. Outside Gutenberg, there is hardly any change in WordPess.
A thoughtful article that I'd say is recommended reading for people who have only a peripheral interest in WordPress as such but would like to know what's going on, aerial view.
"That is deeply unfortunate, because the questions about sustainability of open-source projects, and who profits from them versus who produces them, are in need of addressing. Instead of having that conversation, Mullenweg has put questions about governance, centralized software distribution, and software supply chains at the forefront."
Oh, I wish, because the discussion about, centralized software distribution, and software supply chains will have to be had and it cannot be separated from the open-source profits discussion.[1]
In my opinion some take aways from this should be:
1. As users we should do better avoiding unilateral dependencies. Specifically, every central repository we are using for free is a risk. Be it wordpress.org, npm or crates.io.[2]
2. As open-source author, decide if your project is a charity or not. Expect people to be angry, when you change your mind, even if the law is on your side.
3. Defend your trademarks vigorously from day one. Being lenient in the hope of free brand awareness will bite you.
[1] I am a bit disappointed that LWN, which I hold in high regard, recognized this, but still decided to ride the drama train. LWN I am used to better things from you.
[2] Java's convention of using domains in package names was ugly, inconvenient and did not solve the problem completely (see the issues around javax and sun packages), but it gave us a far better chance to avoid a dangerous dependency.
EDIT: I am tempted to add a fourth point, even if it is not 100% applicable to the case:
4. Don't expect people to understand open source licensing. Neither the authors who decided on a license in the first place, nor corporate lawyers - especially corporate lawyers.
> 3. Defend your trademarks vigorously from day one. Being lenient in the hope of free brand awareness will bite you.
As far as I see, he did defend his trademark - he just had some very reasonable rules under which you could use it (like saying that you're hosting WordPress).
He then walked back on those rules to attack WPEngine for his personal vendetta.
Why do we care so much about Wordpress? Wordpress has always been a swamp, why are we now all suddenly pretending like it’s this glamorous thing Matt is destroying? How did we get here? It has never been a user friendly or sensible way to host a god damn website…
Because it’s one of the most prolific OSS projects on the web, and hosts more than 40% of websites (and that number was growing until a year or two ago)? It was pretty sensible when it was created compared to other CMSes of the day! So “never sensible” is probably an exaggeration, if even massive, massive sites like nasa.gov are using it.
But putting its merits to the side, people firstly love drama and love sharing their opinions about contentious situations. And secondly, hopefully there are lessons to be learned for other OSS projects and other founders about how NOT to handle this kind of situation.
It's one of the few services I actively refuse to host because of security issues. You either run a Wordpress hosting company or buy a managed instance from one.
I honestly have been starting to wonder if this open source business model (a for-profit company whose business model centers around being the owners and maintainers of open source projects) is the best way to fund the development of open source.
I think a vast majority of software should be open source, but I also don’t think these sorts of businesses are the best way to achieve that goal. There just ends up being too much conflict between the need to run a business and the needs of the open source project and community. They can end up downright hostile, as in this case.
I personally think the best funding model is companies who have a software need that is outside their core business to pay for their employees to work on the open source software, either full time or as part of their duties. It aligns the development of the software with the needs of the people using the software.
If a company wants more of their own needs to be addressed in the development, they can contribute more developer time to work on those things.
You are also free to fund the development effort yourself as an individual by contributing, if you want to drive development in a certain way you think is best.
That's at the heart of this discussion. There are two legal entities at play here: automatic, a for profit company, and the WordPress Foundation, a non-profit. It's believed that the latter carries independent governance over the open source project. As it turns out: that's likely not the case, and there's a potential conflict of interests.
That doesn't imply it's a bad model. Drupal is governed in a similar fashion, with safeguards in it's governance model to avoid this.
Dries Buytaert also considers the maker/taker issue, but does so from a place of, seemingly, healthy conversation.
I think the big issue is that, ultimately, a lot rides a lot rides on the character and the acumen of the foundational maintainer / creator of a FOSS project. As well as how they succeed in creating a particular perception about themselves. Sadly, the "mad king" moniker in the lwn article is kinda apt in WordPress' case after these last week's.
As for funding, I do believe companies leveraging FOSS have a moral obligation to contribute back, but that it's not the world we live in. Unless there are tangible incentives to do so, it's hardly possible to enforce this. As per Dries: promotion and visibility as a "trusted" party through the project's channels is probably the most concrete form of leverage a FOSS project has.
I mean that problem does exist as a whole, but in this specific case this has nothing to do with some scrappy open source project not being able fund itself. Automattic is a 7.5 billion dollar company with ~800 million in rev lol.
The "giving back" angle is just smokescreen for wanting to charge more rent IMO.
Rumors are that another round of voluntary layoffs are coming to Automattic today. I am optimistic for the future of WordPress because it looks less and less likely to involve Matt. Matt has created the ideal conditions for a fork to succeed: WordPress (the software) is a fixture of the internet, it is never going away no matter how much Matt sabotages it but Matt's control over it is not a foregone conclusion given all Matt really controls is the brand. The name and leadership may change, but WordPress will live on.
I have been thinking about the alignment offer that Automattic has offered its employees. It’s hard for me to imagine any scenario at any company where I would not take the money and go. Six months of salary is a lot of money for just simply walking away.
To be completely honest, after seeing everything that has transpired, I would be worried that the offer is just a lie, a way to out the detractors. I’m wondering if that’s the reason less than 10% accepted the first offer.
If you're a PHP developer with expertise in WordPress Automattic is pretty much your version of FAANG - I can totally understand why people wouldn't want to trade even six months salary for never being able to work there again.
The 8% of the company left. IMHO it's not uncommon than the 8% of any company is willing to leave at any time because of any reason. They got a payoff so they anticipated their move. Some of them could have been even on Matt's side, some not.
Matt even dunked on DHH that only 8% left automattic, while 30% left badecamp back when they banned politics. Nevermind the fact that DHHs offer was without a timelimit, allowing people to figure out their options. Also the job markets couldn't be more different.
However, I do think a fair amount of automattic employees do not want to leave since their benefits seem actually really nice. Not many companies provide constant pay regardless of your cost of living, so I commend them for that. It could be impossible to find an equivalent job for non US employees, so 6 months pay for leaving in this market is hardly worth it, unless like you said you had plans to do it anyway.
I doubt Automattic is going to tank any time soon. I’d still bet at least a few employees are pondering certain money in hand today vs being the last one to turn off the lights on the way out. If you thought Matt’s decisions and behavior were disastrous, maybe it’d be better to leave now and get one of the other good jobs while they’re still available.
No Roman general ever decimated his legion twice. Matt should go on vacation and beg Dries Buytaert to clean up his mess because he's the only guy talking sense. https://dri.es/solving-the-maker-taker-problem
This is an interesting case of Dear Leader going haywire even outside of a real power context. No armies and billions of dollars involved.
It indicates that building a community not prone to self-destructive conflicts over bruised egos is a hard task even if its individual members are smart people.
Politics seems to be harder than tech to pull off right.
> It indicates that building a community not prone to self-destructive conflicts over bruised egos is a hard task even if its individual members are smart people.
My prior is that if anything, self-destructive conflicts over bruised egos are more likely if the individual members are smart people. At least for certain values of "smart".
One of the most recent losses to the WordPress community is bluesix, a former r/Wordpress mod, and arguably one of the most altruistic members of the community:
Worth noting that this was entirely the fault of the /r/wordpress users though, not Matt. The users threw wild accusations and conspiracy theories at the moderators and apparently threats in PM. The level of madness in the sub really reached embarrassing levels.
The mods never behaved as if they were on "matts payroll" or anything of the like. They had a pinned megathread at the top of the front page, they opened up the sub in the past few days to allow any posts even outside megathreads. They also redirected for a period all posts to r/wpdrama, giving free promotion to that sub.
Whether you agree with the megathread-only policy or not, they never behaved as if they were doing anything but trying to keep the sub clean and not totally overridden by Matt controversy posts which is normal on Reddit.
> Mullenweg had also asked Automattic employees to pick a side, shortly after banning WP Engine from WordPress.org. He wrote on October 3 that Automattic had extended an ""Alignment Offer"" to its employees. The company provided a buyout package of $30,000 or six months of salary (whichever was higher) to employees who wanted to leave because they disagreed with Mullenweg's actions. Employees who accepted the buyout were immediately terminated and are not eligible for rehire. According to the post, 159 people — 8.4% of the company — accepted the offer.
Hot take: it should be illegal to do these "agree with me or take a silver parachute" deals. This is the CEO blatantly forcing their political views on their workers and purging anyone who has a different opinion and wants to speak it.
And yes, just for completeness sake (and because he's tangentially involved in the Matt drama), that includes DHH's "no politics" rule at 37signals, which (if my fuzzy memory is correct) was also enforced by a similar "agree or parachute" deal. Yes, "no politics" is political, it's stopping the music after claiming a seat in musical chairs.
The offer is setup as a dichotomy but at least in countries with reasonable workplace laws (which perhaps the US isn't) it's a false dichotomy.
There's nothing stopping an employee from simply continuing to disagree with the company direction and also not accepting the offer. In this case, employment goes along as usual and you can continue to disagree with the direction. With proper workplace laws, a company couldn't fire you in this instance, even if you vocally disagree with what is happening.
When an unreasonable choice is attempted to be forced onto you, sometimes the best approach is to ignore it and continue on as usual.
Yup, "my environment is not political" just means "I'm in a comfortable enough situation that most current issues don't affect me and can ignore that they affect others". I don't think it should be illegal. But it sure describes a person.
IMO this is different from discriminating based on political opinions because it's the employee who decides whether they want to leave. Similarly, if you build a company and are very vocal on Twitter supporting a presidental candidate, you will probably mostly attract people who support the same — but again, it's the choice of the employee. Very different from asking candidates about who they voted for and then tossing resumés based on that.
It's asymmetric, but laws should generally be in favor of the employees, because the employers already have most of the power on their side.
This is clearly not what an independent foundation with the interests of the open source project in mind looks like.
If this mess creates pressure to put more separation between the Foundation and Automattic, I think that can only be a good thing.
reply