This Week in WordPress #262

[00:00:03] Nathan Wrigley: It's time for this week in WordPress episode number 262 entitled. Different. But different in a good way. It was recorded on Monday the 24th of July, 2023. My name's Nathan Wrigley and I'll be joined as always by some WordPress guests this week. It's Bob Don. It's Tim Nash and Zubair Siddique. It's a WordPress podcast. So you know what we're going to talk about. WordPress Gutenberg 16.2 has some new improvements, especially.

As regards pattern management and vertical text orientation. We talked for quite a long time. About real time collaboration. That's phase three of the Gutenberg project. Is it even going to be possible? Will we see this at any point soon? We also talk about. What we've enjoyed about WordPress over the last 20 years? What things stand out for us?

And guess what several of them are the same for all of the guests. Blue host has launched a new way to get your website up and running. It's got some AI juice behind it. So we talk about that. Smush is smushing even more. We also talk about a couple of updates to cadence and stackable, and then we get onto some security news. The all in one security plugin comes on the Tim's expert eye and he talks about why they might have done things slightly differently.

We also talk about the Oregon compliance guide. And passwordless authentication with pass keys. What even is that. It's all coming up next. On this week in WordPress.

This episode of the WP Builds podcast is brought to you by GoDaddy Pro, the home of managed WordPress hosting that includes free domain, SSL, and 24 7 support. Bundle that with The Hub by GoDaddy Pro to unlock more free benefits to manage multiple sites in one place, invoice clients, and get 30% off new purchases.

Find out more at go dot me forward slash WP Builds.

This is This Week in WordPress, episode number 262. And I am joined by three fine people so that we can natter about the week in WordPress. In no particular order. Let's start. I'm gonna get the pointing right this week in no particular order. Let's start with Zubair Siddiq How are you doing Zubair?

Nice to have you with us for the first time.

[00:02:43] Zubair Siddiq: Hi Nathan i'm doing good and it's an honor for me to be the part of this week in WordPress And I would love to listen you Nash and Bob Dunn, definitely. I'm looking forward for the whole

[00:02:56] Tim Nash: episode.

[00:02:57] Nathan Wrigley: I'm really pleased that you've joined us. Hopefully it's the first of many times.

Thank you for joining us. I'll just quickly read out your biographies so that people know a little bit about you. So Zubair Siddiq is the founder of the Oh My WordPress group. He's the organizer at Karachi WordPress meetup, and he's a community manager. Over at WP Experts as well. I have to ask, Sabir, what time of the day is it where you are right now?

[00:03:23] Zubair Siddiq: It's 6 p. m. here in Pakistan. I'm living in, I'm living in Karachi. Yeah, Pakistan, one of, Pakistan's biggest city. And it's 6 p. m., 6 p. m.

[00:03:35] Nathan Wrigley: here. Nice. At least we're not keeping you awake at stupid o'clock. I really appreciate you being on. Thank you so much. Also down there... Where is he? There he is. It's Tim Nash and this time around Tim's camera seems to be allowing him to move.

Last time Tim joined us every time we switched screens he just froze. It was actually quite funny. But this time I think he's got the iPhone going on there. How you doing Tim?

[00:04:01] Tim Nash: I'm doing all right. Thanks for having me back and I had a whole set of clothes to one side to do quick

[00:04:10] Nathan Wrigley: changes. You can still do that if you like. Tim is a WordPress security consultant. We'll be quizzing him later on his security credentials. There's quite a bit of security news thrown around this week. He has a background in development and systems administration. He has worked with WordPress for nearly two decades.

Yeah, that's pretty amazing. And he has founded one of the very first commercial WordPress plugins. Today, he provides security reviews, consulting and training. And as an active member of the UK WordPress community, Tim is also an international speaker who likes to scare slash enlighten people at conferences.

You can find out more at his website, easy URL, this one, Tim Nash. Dot co dot uk nice lovely to have you with us What's that plug in? What's the like nearly some of the earliest?

[00:05:03] Tim Nash: Back in 2007 and 7 2008 I Founded a plugin called your members, which was a membership plugin And we will get one of the first if not the first Truly commercial wordpress plugin.

Sadly we folded the it all down in about 2010 but actually 20 a bit later than 2010 2012, I think. But yeah, we were Ahead of our time. We were a proper company. We had offices and staff and yeah, we had a good run but we were doing stuff that Wasn't really, there wasn't any ecosystem around it to give you an idea.

When we went to the WordCamp Manchester, the very first WordCamp Manchester, we were booed because we were commercial developers. Those were the

[00:06:03] Nathan Wrigley: days. I how times have changed. We're going to be talking about the first 20 years of WordPress a little bit later, sharing some stories, hopefully from each of us, but yeah, Tim, nice one. Thank you so much for joining us. Really appreciate it. And. Over there. Can I get him? Yeah there's Bob. How are you doing, Bob?

[00:06:21] Bob Dunn: Yeah, I'm doing good. I'm hoping I'll stay here the entire

[00:06:24] Nathan Wrigley: 90 minutes. Yeah. Bob's having technical gremlins. It looks like his actual internet connection is just up. Down and up and down. So if Bob comes and goes and comes and goes, he's not actually trying to frustrate us. It's just, his internet is trying to frustrate him.

But Bob, Bob WP is producer, podcaster and community builder at Do The Woo. He also likes writing and sharing stuff more and more these days on bob wp.com actually, yeah, go and check that out. He's been working a lot on that, haven't you? Bobwp.blog via Tumblr and o porto cast.com.

Between times he talks about, oh dear, between these times he talks about feet, penguins, hair and other topics with my, with me on a podcast, which we won't name for the sake of decency because we'll get like some kind of strike. Yeah. It's called a S show and it's quite fun. It's like one of the highlights of my month when we do this, because me and Bob just thought that word.

Or about, or so it's quite fun. If you are joining us, I appreciate it. That's really great. Thank you so much. I've just a couple of bits of housekeeping. The first thing to do is to say, if you fancy sharing this episode and dragging some other people in. That would be lovely. That'd be so nice. Send them to this URL WP builds.

com forward slash live. If they go there, they'll probably want to comment but sorry, if they go there and they want to comment, they'll have to be logged into a Google account because it's YouTube comments that we stuck in over there. So WP builds. com forward slash live. If you are in our Facebook group or so, yo Tim, nice.

Just helping out there. You could rest your chin right on that little caption, couldn't you? Look. Ha. Just a little scratch off the edge. Ha. Anybody listening to this might have a clue what we're on about. If you're in our Facebook group, you need to go through one little extra step, which is this one.

And the little extra step is to allow us to see who you are. And that is to go to wave. video forward slash. Lives forward slash Facebook. And if you do that, then we can see who you are. But that's it. That's all the housekeeping bits. Let's see who's joining us today. First off, Courtney Robertson.

Hello, Courtney. She says, good day folks. We're now less than a month until WordCamp US. Good grief. That seems that was a long time ago. Anyway, thanks for joining us. Good afternoon, says Cameron from Rainy Brighton. It's not raining in Yorkshire, is it? No! No, we're in good shape. Good afternoon, says Petya from extremely hot, muggy and overcast Porto Ferraio.

I don't know how to say that, I'm sorry, but there. Hi Petya, how you doing? We'll mention her in a little while. Peter Ingersoll regularly brings us a weather update, and here it is. Connecticut is 23 degrees centigrade, 74 degrees fahrenheit, and rising after a gorgeous weekend. We're expecting heat, humidity, and sthom...

sthom... Can't say that word. She likes your hat, Courtney says. She's loving Bob's hat. Is that a new one, Bob? Did you have

[00:09:48] Bob Dunn: that? It's one of the newer ones. I got this one when we were in Athens, and then before we... So I bought a couple of hats in Paris. So this is one of those. So I think I bought about four hats while I was traveling

[00:10:02] Nathan Wrigley: around that time.

Very nice. Indeed. Cameron says it was raining there yesterday. Okay. And look, you've got somebody to join forces with because Jackson is from Brighton. Nice to have you with us, Jackson. Very cool. And I'm behind. Just last one. I'll pop that in from Equalize Digital is saying it's Monday morning.

It is. It's not actually. It's Monday afternoon for all of us. In fact, it's the evening for Zubair. But thank you for joining us Humber. Very nice. Cheers. Okay. Let's get on with some WordPressy stuff. Do forgive the self promotional stuff, but there's a couple of things I always want to do at the beginning of the show.

And this is one of them. First thing to say is this is our website. You can see we are sponsored by the delightful GoDaddy Pro. They keep the lights on. So please give them some of your support. In fact, we've got a URL. It's go. me forward slash WP builds that sort of logs, if you like, that you've come from us, but thank you to them.

If you fancy subscribing to our email newsletter, just fill out that form, one field, click go, and we'll send you two emails a week when we produce new bits of content. You can see right at the bottom, we're trying to push the page builder summit version six. We've done five of them so far and in September this year.

We've got the latest iteration. I'm just about to start making the speaker images cuz we know who they all are now. But if you are a company in the WordPress space and you would like to get in front of that audience, we're actually looking for some sponsors at the moment. This page, wp, sorry, it's page builder summit.com/sponsors will give you all of the low down on all of that.

So page builder summit.com. Forward slash sponsored. We'd love to get you, your company, whatever it is that you do. If you're in the WordPress space and you're interested, let us know. Also, we spoke to, spoke about Pecha, spoke to Pecha just a second ago. We're having another live UI UX show tomorrow. Where Pecha.

Takes apart some websites in the past. We've done any website, which came our way. Peach has changed the rules of engagement a little bit. What she's after now is nonprofit charity or passion projects. So the ones where you'd doing it for a philanthropic reason, or it's a pet project of your own.

This page, WP builds. com forward slash UI is a good place to go to let her have that information about what page you'd like to be looked at. Cause there's a little form there. Fill it out and you never know you might get yourself in the show, but we're doing that tomorrow 2 p. m. UK basically This time tomorrow, I'll be here, but those three people below me will all be Peacher.

So that'll feel weird to you, won't it? Next one and last one is that we're doing our... We've started a new series. It's all about static WordPress sites. And we've done one of them. We've got four in our new webinar series. They're all being done with this chap, Patrick Posner. There he is, and Patrick has a plugin called Simply Static, and it basically flattens your WordPress website.

You click a button, outcomes, HTML, CSS, possibly some JavaScript, flattened files, you chuck it over to somewhere GitHub or Netlify, and you can more or less have a website for free. It's pretty close to free. There's some restrictions, forms and search and all of that kind of stuff are a bit interesting, but we're getting onto that.

But if you fancy joining us, we're doing that again. On Wednesday, 3pm this time. So I've got three live shows. This one, tomorrow with Pecha, Wednesday with Patrick, and there is no more for me to go on about. So there we go. Thank you very much for putting up with me. So Pecha, thank you. She says we've got a slot free for tomorrow's show.

So yeah, go for it. WPbuilds. com forward slash UI and Daniel. Hello, Daniel. He's joining us from Tampa, Florida. Long time, been hiding out. Yeah. We've been here every week, Daniel. We've missed you. Thank you for coming back. All right, let's get stuck into the weed, shall we? Gutenberg 16. 2, Sarah Gooding writes, brings improvements to pattern management, introduces vertical text orientation.

I don't know if you had a chance to watch the video that Anne McCarthy and Rich Tabor did. They did a live presentation last week in which they outlined some of the new things coming in WordPress 6. 3. A lot of this is a bit of an overlap, but not all of it. But there's some really nice stuff, but some of it is perhaps a little bit confusing.

So for example, reusable blocks, we've probably just got used to that term. It always felt like a bit of a odd term to me, but now it's gotten rid of, they're now just called patterns and patterns which are usable in different places on the site are now called synced patterns. So you've got two types of patterns and synced patterns.

Think about global. Rows or something like that in a page builder. So that's changed. You've got different in the UI, like different places where things have been put. There's also this vertical text orientation, which can be applied to a blocks typography settings. Imagine that you're reading, a language, which instead of going left to right.

Or right to left goes up and down. I'm guessing. I think I could be wrong, but I think things like Chinese, sure. How widely available that is just yet, but also the footnotes block has been added and you can now sort of in the, in past iterations of that block, if you lost that. You had to start over.

Now, if you just bring the block in and drag it anywhere onto your page it'll take you from where you're left off. The command tool as per instructed by Tim Nash, last time he was on this podcast, he basically said it needs to be called the command palette is now called the command palette.

So congratulations, Tim, you you spoken, they listened yeah. And also, tucked into the bottom of this piece, here's something, look at this! It also appears the Gutenberg team is preparing for the eventual deprecation of TinyMCE. Now, TinyMCE, you might otherwise know as the, the classic editor.

So that little bit, just dropped in at the end, really does spell a potential... Moment in time where new WordPress, if you like Gutenberg and beyond gets gets a bit of a change. So lots and lots of stuff in there. So I'm just going to hand it over. Zuber, you've not been on the show before. So basically whenever you want to talk, you just start talking and it doesn't matter if you interrupt somebody because.

We're polite and we'll we'll be quiet. So anybody want to drop in tell me what you think about that

[00:17:04] Tim Nash: Wow stun silence. That's how much we love I think it's

absolutely wonderful how we can't have consistency for more than two minutes

[00:17:17] Nathan Wrigley: You mean in terms of the naming?

[00:17:19] Tim Nash: Yeah. I get it. I understand it's an in progress thing. And Wittenberg is constantly under development. There just seems to be so much renaming of things. And if I can't keep up with it, I have no idea how...

People doing the documentation are keeping up with it, and the answer, of course, is they're not.

[00:17:41] Nathan Wrigley: That's a good point, isn't it? Because every time something is renamed, presumably there is an awful lot of legacy and debt of find, search, replace that needs to be done across a myriad of articles. to fix it.

I hadn't even thought of that. That's a really good point. Yeah. Just

[00:17:56] Tim Nash: imagine how many tutorials have been written about reusable blocks.

[00:18:00] Nathan Wrigley: Yes. Yeah.

[00:18:03] Tim Nash: Patterns meant something completely different a couple of versions ago that were completely radically different. You're going to have these two things clashing and You can't avoid changing names of some stuff.

It happens an awful lot, doesn't it?

[00:18:19] Nathan Wrigley: Yeah, it's quite interesting. There's a comment in at the bottom of that article by a chap called steve I don't know who he is But he makes the point that every time he tries to explain to a pattern Sorry to a pat every time he tries to explain to a client what a pattern is they immediately start thinking about knitting and things like that.

So checkerboards and cross stitch And when he explains that in this case, it refers to reusable layouts, they ask, can we rename it to that instead?

Yeah, okay anything on that bob zubair Yeah,

[00:18:56] Zubair Siddiq: I think I really appreciate the idea of bringing the vertical orientation because we have the languages Rather than left to right and left to it is good to bring the japanese south korean, hong kong or the region that we have bringing those languages in and It will be easier for them to use.

Gutenberg and blocks in that and especially it is good for typography, you know designing point of view So it will be a good thing and second thing in most of the designing software We use term use the term like pattern for the reusable things these designers make the patterns for that they usually use this or recurring or things that they use is for the Regular things, they put the name pattern for it.

I guess it's a good name. I I agree with that, Tim is saying something that the pattern or your usable blocks, we need furthermore documentation and establishment of the names before rather than going steps for this. These moves are good. For the WordPress builders and bringing the vertical orientation will be good in a long

[00:20:14] Nathan Wrigley: term.

It says on the post, actually, Zubair, speaking about the vertical orientation, it seems like it's a fairly like the beginnings of such a thing, because it says at this time, the feature is only available when the theme author opts in it, it opts in for support of that in the theme, but I suppose that in the future that will become.

Much more widely adopted. Yeah, thank you for your commentary there. Bob, anything to add before we move on?

[00:20:42] Bob Dunn: No, really, maybe we should just we could have where everybody could rename it to their custom name. And then underneath it could say, AKA. The name that everybody uses, and then we can all name little things.

And then, but then the other name would always

[00:20:59] Nathan Wrigley: be there. Actually, it's quite interesting. I have a, I have an app which I use to do things like invoicing and things like that, and it allows me the ability to completely modify the interface. So I can change the word invoice, for example, to financials, and it really doesn't matter.

I can make it my own. I guess that could be totally plausible, but goodness knows where, how would you ever, find it? No, my ideas. It looks like you want to say something, Tim. Sorry, am

[00:21:29] Tim Nash: I interrupting? I'm just thinking that we should actually have votes on all of this and we can just call it, we'd end up with Blocky McBlockface.

Yes! And Patton Ook, pat

[00:21:38] Nathan Wrigley: Patton, blocky Ook block face. Did you guys did either of you pick up on this story? It was really interesting. Ages ago. The UK commissioned a large, I think like a big yacht or something. It was for the queen at the time. No, it was a,

[00:21:56] Tim Nash: It was a research vessel. to the...

I

[00:21:59] Nathan Wrigley: apologize.

It was a research vessel commissioned and paid for by taxpayers money. And so in order to try and have this ethos of, where we're doing things with the whole of the UK, they decided to put out to public vote what the, what this new vessel should be called. And the winner was Boaty McBoatface.

But it wasn't allowed, even though it was the winner. They decided it was too stupid. I just thought it was brilliant.

[00:22:31] Tim Nash: It does live on though. There's a submarine on that. But I think the best one was David Attenborough. But actually on the vessel, there's a submarine called Boaty McBoatface.

Yeah,

[00:22:44] Nathan Wrigley: I'm glad you brought that up. I love that story. Cameron is saying it blows my mind that we're getting vertical text before we get a list block allowing lettered labels. Do you know, Cameron, I didn't even notice that. I always use either bullet points or the numbers. I'd never spotted. That letters were not an option.

You've brought that to my attention. Thank you. And Amber's saying, I'm still wondering when the table block will support row headers. That's been a GitHish issue for years now. And then there it is. Blocky McBlockface. Cameron. Has voted. There you go. Yeah, so I guess the moral of this story is on this show, each and every week is that you can't have everything.

Some things you can have, some things you can't. Okay. And Peter's reaching out to say, is there a more British comment than that, Tim? Thank you. I'll take that as a compliment, Peter. I Okie dokie now this is going to be difficult for me to explain, largely because I don't really understand it.

So what we're going to do here is we're going to rely on clever people, aka Tim in this case, to try and explain it for us. And this is... This is really interesting. Riyad Benguela posted a piece on the 13th of July. So it's a, it's a certainly older than a week, but not that old called real time collaboration architecture and in this piece, if you are like me and you don't really understand it, but you are prepared to put in the time to read it and then reread it.

And in my case, read it again, like eight more times, you do get an idea. Of what is going on and how they're trying to tackle collaboration Tenanted collaboration, if you like, think Google docs, because that's the endeavor of this phase of the Gutenberg project phase three, let's have collaborative editing.

So me, Bob Zuber and Tim could all be editing the same document at the same time without locking each other out. Now. Clearly, that needs quite a lot of re architecting because WordPress at the minute is just one person edits, saves, hops away, another person drops in, and so in order to try and explain that, they've got some nice diagrams in there, which really help me, and you can imagine, if I was to show you both of these drawings, and you had to pick which is the new one and which is the current one, I reckon you're going to quickly work out that's current because it's dead easy.

It's all going in one direction, backwards and forwards, left and right. And now we've got this one, which is start over here, go up a bit, then go up, left, down, and then finally, in other words, it's going to be more difficult. But at least they've got an idea of how they want to do this. The technical details are all in there.

You can see from my highlights, I've tried to understand it, but this is the sort of spec that they're putting out there saying, let's get some ideas back from developers. Let's see if anybody's got any thoughts about this. And. Certainly everybody that I've spoken to, who I think has got credentials to have authority in this sphere, says this is going to be really challenging to pull off.

Largely because not everybody has a... A robust host, shall we say. You might have very affordable hosting, a few dollars a month, and it's just about coping with WordPress as it is. You introduce this layer where it's synchronously doing all these different things, you can read it in the post, and it's going to be really difficult to keep that whole stack going.

So I'm going to start with you, Tim. If you had to give it a percentage score of happening in the next few years, what would your what would your percentage score be, dare I ask? That's putting you on the spot.

[00:26:40] Tim Nash: I think I gave Gutenberg about a 10%, the first phase of 10% chance of succeeding and they forced, managed to force that through, although the initial implementation we all potentially regretted it.

But where it is today is much better, but I'm very tempted to make this, my prediction even lower this time. This is really hard. There's a reason that you don't get collaborative systems built willy nilly. Google Docs is amazing. Google Docs has had lots of money spent on the infrastructure, the backend systems, and a huge development team that keeps this going.

Other software that tries real time collaboration you often find. doesn't do this very well. And that's the level that we're going to be seeing here. The ways to communicate between peers, so that's all, if all four of us were editing the document, we act as peers and we have to have separate instances and communicate our changes, not just to the central server, but to each other.

How you do that, you could use something like WebSockets, but that requires specialist hosting. This proposal is talking about using potentially web rtc which most of that work's done in the client So most that's done in the browser, but not all of it. So it still needs to communicate to the back end somehow How do we build that and one of the suggestions is that you build a centralized point on the wordpress.

org infrastructure Now every single WordPress site on the planet, to be able to edit a post, needs to have a connection to WordPress. org. That is a huge infrastructure undertaking for them in the first place, but it's just going to break. Not every website, WordPress website, is online. Quite a lot sit behind firewalls.

In infrastructure, people don't necessarily want data going across to a random. org servers. It's going to be very messy. It's going to break. Just imagine the testing that's going to have to go on. And if we force this through, it will be like WordPress 5 all over again, but worse. Because at least you could turn off the classic editor and you could turn, you could, people could ignore it.

This is going to be a lot harder to ignore because it's going to be taking over so many components and so much things could Potentially break along the way so how Ignoring how we implement it how you even roll it out. I have no idea how you test this I have no idea. So this is such a huge undertaking that the only way I feel I can see it working Is that if one hosting company put it on their infrastructure and ran it for a while and then said this is success And then never deployed it to anywhere else we could put it on wordpress.

com And then leave it there and I think that's what's going to happen. I think that it will get it Running on a perfect hosting setup That's designed for it, and then it will slowly but surely die down and disappear because I cannot see how we deploy this to 40% of the internet.

[00:30:12] Nathan Wrigley: Yeah. I'm going to work.

Yeah. Okay. So that's a really. I don't suppose anybody would disagree with the idea that it's a really nice thing to have. Nobody hates that you can do concurrent editing in Google Docs. It's just such a fabulous feature. But like Tim just described, the technical difficulties of this are really difficult.

I need, I'll link to this piece in the show notes. By the way, I should say it's called Real Time Collaboration Architecture. It's on make. wordpress. It was published on the 13th of July. So you can Google that if you like. And it does lay out all of the pieces Tim just said, and it is really complicated because at the moment you basically load up a post, you click save and stuff is sent in one direction, get saved.

And then if somebody goes and looks at it another time, it comes back in the other direction. This is, if you've got six people trying to edit a document, who's got the. Canonical source of truth. How do they communicate that a change just happened to the other five people? And where is the original blob stored?

And how do you know that you're accessing the original blob of data and that the amendments that you've, that have been made over there have been saved correctly? It's really complicated. So Tim, that's a really interesting perspective. Are you, Tim, just back to you quickly, are you imagining then that this will Potentially be like a an add on service in the end where you might pay your hosting company an additional X dollars a month to have concurrent editing.

[00:31:39] Tim Nash: Potentially right? I can only see that happening with certain hosting companies and I genuinely think that this is going to be one of those projects that It's going to have to be built by taken on by a team who is going to push it through And at the end of it, they're going to have something brilliant But then can't put it anywhere.

I expect the technical demos to be fantastic. I expect the that all the testing that they do internally to be amazing. And then I expect it never to be pushed out. And I feel that's such a waste because there is a lot of potential in here. The positive things are that they are looking at it now. And already starting to think about these things.

And at least we're starting in a position of going back. We need to think peer to peer, right? We need to think about talking to us for, and keeping it as separate from the WordPress instance, almost as possible. That's a positive thing, because if we can manage that in the browser and not have to worry about hosting so much, there's a chance of it working and.

I I feel this is going to become somebody's vanity project and I think that's going to probably be WordPress. com's vanity project because they're just the only people I can think of who have enough skin in the game and the infrastructure, large enough infrastructure, they can push all of these features into now, whether this accidentally.

Merges into something say jetpack. I can see that happening that the Effectively the signaling server is it's not on WordPress. org side, but it's on WordPress. com and it shifts over there But obviously that will cause humongous drama if that happens But that the schism and the drama would be immense But I almost wish that they'd gone that route to start with

[00:33:28] Nathan Wrigley: We would have years of content on this show, just on that one story alone, just every week, over and over again.

Bob, anything on this? I know it's all very technical, I don't really understand, I don't know if you did. Yeah

Tim

[00:33:43] Bob Dunn: has pretty much, I think, said it, ideally it sounds like a wonderful thing. And, maybe there'd be some facet of it that might happen. But technically it sounds like...

Like the podcast we don't want to mention, so it's pretty much that's, that makes a lot of sense. And I think he explained it very well.

[00:34:11] Nathan Wrigley: Yeah. Zubair, anything to add to that story?

[00:34:15] Zubair Siddiq: I think Tim has explained everything really well and you are very right, it could be a potential for the wordpress.

com. Yeah, I can totally understand this. And thank you, Tim, for the very detailed explanation to the, synchronize that thing. Thank you.

[00:34:34] Nathan Wrigley: It's going to is really like I say, it's fairly tinfoil hat stuff. They introduced this thing called Yjs. I presume I'm saying that correctly. She's a sync engine, which they're looking at at the moment. And also the other different things that Tim mentioned, web RCC and web sockets and what have you.

It looks like it's the first foray into all this. So if you've got any. Got any skin in the game? I guess hosting companies are probably pricking their ears up at the minute thinking maybe there's a little add on service we can add into our package here, but thanks for all the comments that are coming in.

A few of them are related to the previous piece. So let's start there with Daniel. He can't help but feel that WordPress is taking the Apple route of whole of building things into the system rather than leaving them to plugins that always handle that already handle the capabilities right now. Very well.

Multi Colab. Is so far ahead in this capability. Elliot Sowersby just down the road from me in Brid, just saying hello. Hi there, Elliot. Daniel again, similar thing happened with Turbo Admin being replaced by the comma by command palette. That's Ross Wintle's fabulous extension stroke plugin. I keep Going on about this.

It's so good. You haven't checked it out. Go to turbine out, just Google turbo admin WordPress. Cause I can't remember if it's. com or. io or something like that, but it's brilliant. Go and check it out. Max. Hi, Max. For me, the most exciting news in Gutenberg is partially synced patterns confirmed by Matthias and the upcoming new admin interface, the admin interface.

It does look very cool. We'll probably have more on that when there's actually some some, we did a bit on it last week. Put it that way. Is it called partially synced patterns? I just thought they were now called patterns. I thought partially synced patterns maps were just patterns and synced patterns were the other ones, was everything else.

But I could be wrong. Courtney, I'm considering how proactive we must be for accessibility to implement this. Are you talking about collaboration? I guess you are. Oh no, the command palette has just been introduced. Implemented code packages that won't work with screen readers. Sorry, that didn't make it on.

There was too much text there. We need to access, we need to assess accessibility as a forethought, not an afterthought. And Amber is agreeing with that sentiment. Could Colab Features, says Nigel Rogers be an option that is off by default? Interesting. Also, could it be a prerequisite minimum server resource?

Maybe checks php. info before activating. It's off unless it's honorable. And then even then you get to toggle it on if you like it. It's fascinating this, but we are going in all sorts of different directions suddenly, aren't we? We've got all these options in WordPress which mean you've got things or you don't have things, and you have to go and pay extra things elsewhere.

Collaborative editing like Google Docs feels like such a waste of time. I feel that's bad. Probably what Tim felt like saying, but didn't say in 14 years working with WP. I have never thought that I wanted that. There are bigger priorities to improve the project. Yeah. Amber on that point, I collaborate on Google docs because it's a collaborative document.

I was struggling the other day to think, when would I use that on a WordPress website? And the answer was, not too often. Honestly, I can count on four fingers and a thumb, the amount of times this year I've contacted somebody and said, I'm locked out. And even then it wasn't that hard for them to go, Oh, I'll just go out.

So yeah, I get your point. Cameron shares the same concerns. He doesn't see a way that it can be implemented on a way which doesn't kill a 2 a month site. Very few sites have Google style infrastructure is true. And yeah, partially sync patterns. We'll come back to that one later. Thank you, Max. All right, let's move on.

That was interesting. There was lots to say about that. Let's move on to the next story. Which is this. This is, okay, so this is a story about Bluehost, but I feel this conversation could be about any host at all, but Bluehost happened to be the one that got the news piece at the moment. Bluehost have launched this thing called Wondersuite.

With AI powered site builder with an AI powered site building guide. So first thing to say, I haven't used it. So I don't know how to go through the process, but the intention here is that you sign up for Bluehost. Because they now own a whole bunch of things like they own all the Yith products and they also own Yoast, they've thrown those into the WordPress website that you'll get.

But not only that, they're going to be. at you a bunch of content related how do you want your site related kind of questions at the beginning and then things like what are your social channels that you're using and then what kind of content do you want to be put into your site and then it builds the site out for you.

So there's a little bit, I don't know how much AI is in this, or if it's just, it's sucking in templates. I'm not entirely sure. It feels like you can say AI for templates, but we'll, yeah, anyway. This is something that Bluehost are offering. It's called Wondersuite, like I said. You can go and check that out for yourself.

It's now launched. The article that highlights this is Sarah Gooding's one on WP Tavern. But really, more broadly, it was a conversation about whether this is a useful thing. In the wordpress space because I know for me I just want a vanilla wordpress site and then I start chucking things on top of it But if wordpress is going to be going after the square spacey wix crowd This seems like a bit of a no brainer if I was giving my mother A website building tool, I would seriously be looking at something like this because you don't have to have the technical chops to get something minutes after you've started.

So that's the conversation really, what do we think about these kind of tools? And I'll share the screen, take that off, and anybody that wants to go for it, hop in. I think

[00:40:49] Bob Dunn: that I don't know, it's, I mean everybody's been saying. We got to make WordPress competitive. We got to make WordPress easy. If that's going to happen, the hosts are seeing it, they're going to, they're going to come up with these ideas. It doesn't really matter what I think, in reality.

It's yeah, I think it's inevitable. That's, onboarding.

experiences. However, they incorporate AI, which is obviously not going away. I'm not saying it's good or bad because, there's going to be an audience for it. And there's going to be probably an audience that says, Hey, this is the greatest thing since Nathan's podcast or something. I don't know what they'll

[00:41:42] Nathan Wrigley: say, but, two people.

Me and also me. Yeah. That's,

[00:41:48] Bob Dunn: It's a limited crowd, but

no, it's really, it's. It is what it is. And I think it's interesting. That, yeah, there's people that just want, I'm even looking at what I'm doing with my site. I'm not doing this, but I want it to just be set up a certain way where I can just create content and not have to worry about everything else because I don't have time to worry about everything else.

They used to have more time to, so I don't know. There's an audience. I'm

[00:42:22] Nathan Wrigley: sure. Yeah, you feel that they, this must cost quite a bit of money. I would have thought to put together for a start, but also I wonder if they've got data, which says that there's a growing need for this support tickets, or they've got metrics about the kind of customers that they're onboarding and whether or not it's going to save them time in paying content writers to create content for how to make a WordPress website, how to install a theme.

They don't have to do that anymore. You just go through the wizard. Once you're out the wizard, you won't need to ask any more questions. It'll all be fine. Tim's nodding. What do you reckon, Tim? Do you like this kind of product or does it not work for you?

[00:43:03] Tim Nash: Having worked at a hosting company and especially if you're doing managed WordPress hosting, that covers a huge spectrum from very technical people.

Through to mom and pop shops and people who I really think that managed WordPress hosting means you want to build them a website and I this build you a website and you know what I'd love it if I could actually just go build me a website and it builds me the thing I want. Will this do that? But I like the idea that it could in potential Yeah, you feel it is going to ultimately be mr.

Clippy, we're gonna have it's gonna ask you Do you want to build a website? Yes, and then it produces something but that's not a website That's just and you're you know, it's going to be running off to chat gbt to generate me some content and you know that some people will leave that filler text on there and we will end up with a vast amount of new websites with Text generated by AI, with design patterns generated by AI, and they'll all look and sound the same.

And won't we be happy?

[00:44:14] Nathan Wrigley: It'll be a niche for those of us actually making content. I hope there's some kind of flag for that in the search engines. I really truly do hope that for the likes of Bob and I who like producing audio content, I do hope that there is some kind of... Flag which Google invoke which says we know that Bob's real because he was doing it long before Those AIs came around and the same for me because it does feel like that deluge We've got your

[00:44:43] Tim Nash: voices.

We don't need you two anymore. We can just, we've got enough of your voices. We can send it off to the AI and it will come back and give us perfect deep faked versions of both of you.

[00:44:56] Nathan Wrigley: Yeah. I I have a piece of AI technology. It's called it's an app it's called Descript and you feed it.

When I started using the app about three years ago, you had to give it 10 hours. Of content for it to mimic your voice. Now, three sentences is all they need. So their AI model can go from not knowing what a human sounds like to more or less getting you correct in basically three sentences. I think it's about 15 seconds basically.

And so I ran it, tried it, and actually the model, the 15 second model is better than the three year old 10 hour model. So that time is coming. But yeah, Zivert, sorry, we've excluded you from this one. Do you like onboarding systems like this? We've got Andrew Palmer in the comments saying he thinks it's the future.

Oh, no, that's the wrong comment. Where did he say? There we go. He thinks it's the way forward. Kudos to Bluehost, is what he's saying. That's been a long time coming. BoldGrid has had a site building wizard for years.

[00:46:07] Zubair Siddiq: It is great to see the Andrew message here. He's also running an AI kind of product, as varta. AI. So he's quite relevant to that things. That launches by blue host. Technically tim and bob is right that It will create a similar kind of websites, you know when you are Bringing the ai content and pictures so it will give the monotonous to the site development but if I see as a business point of view that all these brands like blue host and yoast and Yi all comes under the umbrella of New Fold Digital.

And when they have acquired this, they have, they are launching the new products, which is the calibration and merger and amalgamation of, they have certain child brands like Blue Host y, and host. So the, this is a great wonder. So for them, Basically if you we have an audience as well for the WordPress users, those who like to do things like the AI do the things for them.

So they are targeting those type of audience. It's a futuristic thing, and I guess they are spot on for their own innovation and the way they are going in it.

[00:47:20] Nathan Wrigley: Yeah. Yeah. Thank you. This is fascinating is a comment here from Amber Hines, which is just really interesting. How much clients sometimes care about their website.

She says, I regularly encounter WordPress sites for large organizations that have published lorem ipsum posts that were never replaced. So change. So changing chat GPT tech sounds like an improvement. Wow. That's I actually speaking of AI, I decided I would throw some audio at chat GPT to see if it could sum up a podcast episode that I did.

So I threw 30 minute chat that I did with somebody and told it that there's one person, Nathan, and there's another person. I actually can't remember who it was, but the guest. And. I told it to do a several things. First of all, sum up what the podcast was about. And it did that brilliantly, like utterly brilliantly.

And then I asked it to write some show notes to go on my website and it did that. Terribly really badly. So for some tasks, I think they figured out what that means, what it means to get AI to do a certain subset of these tasks, but clearly the show notes piece, not so much, but I think the time's coming.

I'm, I think I'm probably on Andrew's side here. I think the time's coming where these tools will become so good. It's so relevant that it's almost like silly not to use it at the beginning to at least get you off to a flying start. We'll have to see

[00:48:59] Bob Dunn: Nathan, I was just going to say that I did that with my, I had a two, three paragraph description.

And I went in and asked for a narrative of the podcast from this. Two, three paragraph and it came back like a 12 paragraph and it sounded like some fricking TV commercial. It was saying how, the amazing so and so has bringing his insights into the global minds of. Intellects worldwide.

It was like, Whoa, where do you write all height? Yeah. Yeah. So there was some real interesting stuff.

[00:49:37] Nathan Wrigley: Yeah, it was interesting. Cause that's the kind of voice I got back. It just kept talking in this like superlative language about how everything was great. And so that's not my style anyway.

So maybe there's a way of, maybe there's a way of tweaking the prompt to make that less, but the summary. Of everything that was said was just breathtakingly good. It gave me, I put the audio in and I think with, so that was half an hour of audio, which clearly would take me 30 minutes to listen to, or a little bit less if I played it faster, and then I'd have to think about it, honestly, from the time I uploaded to the time I got the data back was about eight seconds.

So it's somehow captured the audio. And somehow I don't know if it was capturing it on the fly as it was uploading. Anyway, it was utterly brilliant andrew says though it won't be able will it capture the sarcasm and wit? I don't know what to say andrew. I don't know what you're talking about. i've never used sarcasm in my life He said it's somewhat sarcastic what's this one from max?

Hope that the just released components in quickly Never used quickly, Max. So I'm not really sure about that is part of the show. Pretty amazing stuff. It won't be part of the show, Max, but if you want to send me a link, feel free to do that because I have not I haven't got anything on them today. All right, let's go on to the next piece though.

So this is inspired of nothing really. So it's contextually nothing, but it was really interesting because I did a podcast episode with a really nice chap called Aaron Ryman when I was in. Athens a few months ago now, and the whole premise of the podcast was based upon a talk that he did when he was there.

And his talk was about the first 20 years of WordPress. So I know what Aaron said, Aaron talked about what his highlights were in the first 20 years of WordPress. So we're not gazing into the future. That's not allowed, right? You're not allowed, but I am interested to know if each of you had one. Or two little bits that were your favorites from the last 20 years of WordPress.

Now I know that I've sprung that on you, I'm sorry. But I'm just wondering if you've got anything which just pops into your head as some favorite bit. Now it could be some bit of code that enabled you to do something. It could be an event that you attended. Whatever you like. But last 20 years, favorite bits of WordPress.

I'll, shall I go first? Because I've, I've had a bit of a time to think about it. I think for me custom fields would be my, probably my favorite thing that enabled me to move away from the platforms that I was using at the time that I was getting a bit fed up with. So things like Drupal and what have you enabled me to come to WordPress.

And then when plugins like advanced custom fields bolted into that and made it possible for me to do it in a GUI way without having to go into, all the code, that was really nice. I really enjoyed that. And for me, although I can't name a specific event, it was finding that there were actual people.

Out there who were using wordpress who were quite nice aka the wordpress community because I was probably using wordpress for a couple of years maybe Before I even knew that anybody was meeting up online I'm, sorry in person and then I attended my first wordpress event and I thought actually these are These people are quite a lot like me.

I don't feel quite so weird when I'm with these people. There's my two. Let's go, Tim, you first. Best bit.

[00:53:26] Tim Nash: Do you know what? I think I'm going to be very broad and say, actually, actions and filters, because it's such a simple concept. But that's allowed the entire plugin ecosystem and themes ecosystem to exist and it was quite a radical idea if you compared it to other things, if you compared it to we're talking about a time where people were Sliced things like Magento, for example, you were putting patches into the core code where you were given, where plugins were delivered as patch files.

Same with something like PHP BB. And while Drupal had its modules. They weren't anything like how wordpress could do it wordpress just blew your mind when it came to extensibility so I think action filters is my sort of like code one and then i'm going to go with community as well but so when we started wordpress north because in the uk we had WordPress South aka WordPress London and WordPress North, which was everybody else and the first time we going up to our broadcasting house in Leeds and Not being sure that we were going to have anybody turning up and we had eight very nervous very confused people at that first meeting and I'd driven for an hour and I didn't live near Leeds at the time, I'd driven for about an hour and a half to this place.

And it was mainly memorable for me because I'd parked my little smart car at the time in a car park that I didn't realize I couldn't get out of. But it was fine because there was the pedestrian sidewalk pavement there, so I just drove around the barrier. And I randomly gave a... Now a very good friend, but a friend, someone who had never met before, I gave them a lift back to Sheffield, which is like an hour away.

And then we drove for another hour until we got back home. It's

[00:55:33] Nathan Wrigley: fascinating, isn't it? That whole community thing. I know that we drone on about it. But honestly do teachers, do mechanics, do they like go to events and just hang out? Do they do that kind of thing? Cause I think it's amazing that we do.

People that are just combined in some way by this interest in this software, whether you're a marketer, SEO, coder, designer, whatever it may be. It's peculiar that we do it. Not peculiar bad, but peculiar, probably not typical. And I love it. Stories about breaking out of car parks. Hey, that's great. Let's go to you Zubair.

Have you got any. One or two things that you love about WordPress from the last 20 years?

[00:56:18] Tim Nash: Oh,

[00:56:19] Zubair Siddiq: Nathan, I started using the, one of my friend introduces me to WordPress in 2000, somewhere in 2009, 2010. Oh, you're a veteran. And I used to build some literature blogs. On WordPress. So I must say definitely the motto of the 20 years WordPress and it's itself among of my inspiration is from blocks to blocks.

I guess that is the transformation that I have witnessed myself.

[00:56:46] Tim Nash: So I

[00:56:46] Zubair Siddiq: can say it's a huge transformation. The WordPress that I use is in 2010, then now the WordPress that I am using in 2023. So from blogs to blocks, one of the inspiration and definitely, WordPress community. I think no open source, I can surely claim that no open source CMS has the community like the WordPress has.

They are vocal about accessibility, diversity, and, what cams superb things, and superb connectivity. Isn't

[00:57:22] Nathan Wrigley: it weird that the three of us have said... Like one thing, and then we've all said the same thing. That's, let's see if Bob can .

[00:57:31] Bob Dunn: It's I wanna make up something just for, it's different, , I like, I always the the the underline, no I, yeah, no, technically, Nothing's really, it's, I think it was back, but 2006, 2007, I was able to build my first. using WordPress for my own business, which was not a WordPress business. And that was amazing in itself that I could do that. Cause I was terrible at HTML and all that.

And so no feature except the blogging feature is probably what, got me involved with it and with community. I spent 17 years in the world of marketing design outside of WordPress. So I've been to a lot of conferences. And I remember the first time I went to meetups in, I don't know, 2009 or so.

And then WordCamp 2010, it was like, Whoa, this is. Really different. Compared to what I've been used to and it was a good different and probably with the community. It was just the connections, everything that everyone's talked about, but the one thing I remember is when, and I think it was WordCamp Europe that first started and then U.

S. and now Asia is when the flagship started coming out, the flagship WordCamps, which was like, okay. Now we're moving into that next phase here where we're bringing together a larger community and for that part of it and for events that was a, that was a memorable part for me just because I compared it to the conferences I'd gone to in the past, which was still very different, but it's yeah, it's, 17 years, I'm just Sometimes it's a blur, it feels like

[00:59:30] Nathan Wrigley: that's all I've ever done.

So I don't know. Oh, isn't that fascinating how that whole community thing just keeps coming around. It really is amazing because I think It has helped me make a lot of friends, a lot of lifelong friends that I really do cherish. And I didn't expect those to be the case. In fact, if you reround the clock, like 25 years, I probably had no expectation that I'd have friends outside of where I lived, really.

Because that was the sphere of where you could influence. And fast forward now, Zubair's on the, more or less, the other side of the world. Bob's on, on, the other side of the continent, Tim's down the road. It's amazing. Absolutely miraculous. And yeah, so community for the win.

And that was actually oddly, although that was the long the last point that we made on that podcast episode, it was the longest one. So I think that the guy that did it Aaron probably shared your thoughts. Here's Andrew's thought, Andrew Palmer, page builders. Is his favorite thing in the last 20 years.

That's great. Yeah. I think nobody can question what that did to WordPress. In fact, really, I think if you look at the data over the last, I don't know, six, seven, eight years, the upward. Spike really seems to be very much bound to page builders. As I'm sure, Cameron, my favorite thing in core would be custom post types although the database structure makes me cry.

Yeah, it's good. And it's bad all at the same time. You're getting a nod from Elliot. He says plus one for hooks and filters with many claps. And I think you're winning this race here, Tim, because hooks and filters, oh, and community nailed it. So he's agreeing with you. I did pick the

[01:01:22] Tim Nash: broadest thing in tech insight.

How wordpress works. Oh, i'll just pick the fundamental thing that makes it wordpress.

[01:01:29] Nathan Wrigley: Yeah, that's right. That's right It doesn't matter. It was a bit of fun But anyway, if you want to go and check that article out, please do it was a podcast episode and it was episode 84 On the WP Tavern website with Aaron Ryman, so yeah, go check that out.

So I don't really know I don't really know the technology behind, I've said that a couple of times today, I don't really know the technology behind how this works, but one thing that I do know is that if you are going to make your site quicker, More sustainable, I guess we could throw into the mix and also probably a little bit cheaper to run using up less storage.

There's a whole load of other reasons. Then squishing your images, smushing your images, we might say to coin a phrase is an important thing. Now for me, this tool has been around for almost forever. It's WPMU devs. Smosh tool, but just a heads up that they've got a new bit of that product which they are calling ultra smosh.

And guess what it does? It ultra smoshes your images. How cool is that? They had a previous like ultra smosh. or something like that. This they're claiming that this is up to five times more data that they've managed to suck away. than previously. The story, the article here that takes longer to create these smushed images because I guess the algorithm has to do a little bit more work, I'm not entirely sure, but they're claiming five times a reduction in the amount of data stored there, so that's cool.

Have any of you guys got anything to say about that? If not, I was just going to move on quickly, it was just me just raising it as a thing. Okay. In which case I'll just move on and do another couple of things, which are similar in vain. It's me really just promoting some things that I've seen around the web this week.

Kathy Zant, who's often on the show. So it's nice to give her a hat tip. She made a live presentation this week. All about building forms with blocks and cadence blocks 3. 1 beta. They've got this much more advanced cadence. Blocks form builder. So you can essentially build fairly complicated blocks and Kathy.

Shows you how to do that's over on the iThemes training website. Again, links in the show notes tomorrow. And finally on the product side of things stackable. Benjamin Intel's been on this show and the page builder summit actually. They've got a new tabs block. So if you're using their suite blocks, this is quite nice.

It enables you to, as you'd expect, add tabs. But not what, not necessarily in the way that you'd expect them. That's fairly typical. I'm showing on the screen. Tabs left, that's fairly normal. I'm showing on the screen tabs at the top, fairly normal. But I thought this was an interesting implementation of it.

So the tab here is on a pricing table, and I never really thought of that as a tab. It's nice to build that functionality in. I always thought about that as a, I don't know, a specific block for making pricing tables or a plugin or something like that. But anyway, so there you go. There's three little updates that have happened around the web to date.

Again, I'll just quickly throw it open if you've got anything, I won't move on. If you haven't, I'll just go on to the next one. Okay. Perfect. It's Tim up again. Tim, in his bio, I think you heard, he's a security dude and he likes to scare people when he goes to WordPress events. Yeah. Having said all of that about community, Tim.

And I freak everybody out when you get there. So this piece, it's not brand new but I thought it would be nice to raise it because I know that Tim has probably got something to say about this. This is the news that the all in one security plugin has patched a sensitive data exposure vulnerability in version 5.

2. The bottom line of this piece, although we'll get into the weeds, go and update it. If you're not on that version or newer, update it. But Tim, because you're cleverer than me, I'm gonna just hand it over to you and you can explain what the heck was going on here and why did it matter.

[01:05:42] Tim Nash: Okay All in One Security Plugin is a plugin that does a bunch of security stuff and including in that it does some sort of logging and has an audit log, which is stored in the database.

And or Zoom, it can be also stored elsewhere, but it's stored primarily in the database. And one of the things it did up until very recently was in some scenarios, accidentally put users clear text passwords. into the database. Now, this is bad because when we pass words, we like to keep them nicely hashed and they shouldn't ever come, be stored, except hashed and therefore somewhat protected.

If they're in clear text, anybody who can access the database Can retrieve those passwords and therefore gain access to not just that user's account But one assumes that most people reuse passwords and so we'll take one look at those passwords and the first thing you do is go off and look at their gmail account and Go and log into that instead because it will be the same password because people are people And from all the training we tried to give you the world the vast majority of people use the same password everywhere This is probably quite bad, but that's not what makes this story particularly interesting.

People make mistakes all the time. There was something like the WordFence last week published 67 WordPress plugin vulnerabilities. People screw up all the time, and I've made similar mistakes and fixed them, and they are not the first people to have accidentally dumped sensitive data into a log.

They're a security plugin.

[01:07:34] Nathan Wrigley: Is that a wrinkle?

[01:07:36] Tim Nash: Their response was terrible. If you get a report that says, Hey, you're leaking security sensitive data. Your response should be, regardless of what you are, what you build, should be, Oh, that show that Bob and Nathan do. We we'll fix that and promptly go and fix it.

Then you go out and say whoops, whoopsie doodie. We did this. We're so thankful for whoever reported it, for telling us. Here's the steps we're going to take to never do it again. What you don't do is say, and I'm going to just go into the article itself I can't find it now, but there was basically a reference where it's, no, it's just in the database.

So it's perfectly safe because only admins can access it.

[01:08:31] Nathan Wrigley: So tell us why that's wrong, because I guess on some level, depending on how you look at it, there's something to be said there.

[01:08:41] Tim Nash: If we took that at face value and assume that only lovely admin people could ever access that thing, We wouldn't need to hash passwords in the first place, right?

The thing is We have to assume that anything in the database can be accessed. There are 67 wordpress plugins last week which had vulnerabilities in them I imagine a percentage a relatively high percentage of those had something called an sql injection, which is basically where you can Manipulate an sql query to return data that you weren't expecting So it doesn't really matter if I have admin privileges.

If the data's in the database and I have another plugin that's vulnerable, you've now given me a chain, which I can access that data. The database is not a safe place. We don't store secrets in the database without either a significant amount of hashing, which is I what we do for passwords, because we don't need to get them over back.

We only ever need to compare and for data that we do need to retrieve and have to return, and we encrypt. But we don't leave it in plain text. And a security plugin should know that and more importantly going out and basically bitching at your People who are reporting this and saying things like it's hyperbole and it's all this It just rubs wrongly and gives you a really bad place to be standing and looking, you don't look like the good guys in this scenario.

And they came out and they do not look like the good guys and you just, they're going okay, this is a good company. This is a UK company that have a relatively up until this point, good reputation in terms of support. And now that's tarnishing the rest of their brand. So it goes beyond this one plugin now you're there going well if they don't manage that very well How many installs does updraft have?

Do I want to be do what happens when there's an issue in updraft? Are they going to behave in exactly the same way? Is it going to take them several weeks to fix it? And that's perhaps unfair perhaps that team would be so much better But it doesn't matter because if you've got a security plugin you're putting yourself on a pedestal and it sucks because yeah People are going to take pop shots at you, but you put yourself on a pedestal and you have to say i'm sorry And fix things when you're told you've got problems

[01:11:21] Nathan Wrigley: Yeah One of the wrinkles in this story was the length of time, wasn't it?

It was the amount of time that it took between the first reporting of it and the amount of time that it took to be fixed. And there was some commentary in here. I can't remember what it was, but there was some thing from the developers, which said. Why it had taken so long. And I believe it was because there was lots of backwards and forwards with the testing of it.

I can't really remember. But anyway, so the article there is all in one security plugin patches sensor sensitive data exposure vulnerability in version 5. 2 0. I've got a few podcast episodes about a subject. Very similar to this, but related to other plugins as well. I've got three podcasts more or less in a row about this from the developer's side of the plugins in question, but also from the security researcher's side.

So that'll be on the podcast fairly soon. I'm making sure that I've recorded all three episodes before I release any of them so that not one of them can listen to the other one first, so we'll see. We'll see if that all works out. Maybe it'll be stale news by then, but. Judd Wrigley. I know. I was trying to be really fair.

But Zubair and Bob, if you've got anything to say on that, please go for it now. We're running out of time, so we'll have to be fairly pithy.

Bob,

[01:12:48] Tim Nash: anything?

[01:12:49] Zubair Siddiq: I guess vulnerability and security saying anything in front of Nash. It's been like. Showing the torch to the sun.

[01:13:00] Nathan Wrigley: Yeah. Sometimes it's best to leave it to the professionals. That's right. Okay. Let's see if we got any comments on that. Why on earth did AIO all in one I guess

I don't see any reason a plugin would need them to be honest with you, Nigel. I don't have an answer to that. But okay. You've raised another interesting point. Thank you for that. And Andrew Palmer said they could have said, oops. It's a minor issue and we'll get it fixed in the next update. Okay, you're getting the full on fingers pointing at that comment from Tim there.

I guess one of the things that, what, that plugin developers are learning is that there is now a WordPress news cycle. That is a thing, right? Go back five years and probably something like this, a couple of people might have heard about it, might have got into some publication that a few people read.

But now with things like the Tavern, which has really done a great job in hoovering up the WordPress news over the years, you've got Jeff and then Justin and now Sarah holding the torch. They're they've got a massive audience. And so if something's written on there, it quickly becomes.

Anyway, yeah, there's just another thought. Okie dokie. We've got a piece about affiliates. I think we'll probably miss this out. I just want to raise this one next, I think. This is This is the good old state of Oregon. I don't know anything about the state of Oregon, so it might be neither good nor old.

I don't know. But the state of Oregon this comes from the Termageddon website and there is something called the SB619 Compliance Guide. And the reason this has reached my doorstep is because I subscribe to a bunch of WordPress content and Termageddon came out with this piece this week. And I just thought it was curious because it does feel...

And I suspect there's a couple of people in the comments here who will actually know a lot more about it than I do. It does feel as if Oregon have decided to be a bit more, how should we say this, a bit more EU in their approach to data and what's allowed to be held. So quick bullet points. You don't need to worry about this if you are not in any way dealing with the state of Oregon and its people, there's number one.

But also if you're not controlling the personal data of 100, 000 or more residents of Oregon, this legislation apparently has no teeth. You also, the processors or controllers also need to be holding the data of 25, 000 residents. But I don't quite know how those two things are different. But if you are holding that data, then these people are allowed to.

Get a lot from you. So if there's a data breach, you have to report it properly. If they want data back from you, you have to return it to them. If they want their data deleting, you have to delete it for them. All of this kind of stuff. This feels very much like the stuff that we've been talking about in Europe for.

Years and years and this has some teeth it looks like because If you are in violation of this seven and a half thousand dollars per violation and per violation means per website visitor Whose privacy rights were infringed upon. So you can imagine this quickly for a big ish website in this, where all of those caveats were met.

Suddenly you're into the half a million, million possibly. I guess it ramps up fairly quickly. But I just thought it was curious because I don't really remember a story coming out of the U. S. and forgive me if I'm wrong, I don't remember a story coming out of the U. S. where it felt like this had a lot of overlap.

With the kind of European approach to data and the right to be forgotten and all of that kind of stuff. So again, I'll throw it out there. If you've got anything to say about this, feel free. If not, I will just quickly move on.

[01:17:06] Bob Dunn: I'm just wondering the people that have nine, 99, 999 Oregon residents on their list, what they're doing right now, where you can't even.

Select Oregon as a state in the form.

[01:17:20] Nathan Wrigley: I am. If I was the owner of that website, I am taking out every form on my website, which can, it can consume data about new people. Yeah, that's interesting. Some kind of arbitrary length. Thank you. Thanks. Oh dear. We were

[01:17:33] Tim Nash: hacked. And now everybody, for all they did was change one database field.

They seem to Oregon.

[01:17:47] Nathan Wrigley: I love that piece, but thank you to term again. I think it was sorry, I apologize. Who wrote that piece? So I'll link to it in the show notes, right? Okay. I don't even get what this is, but I know that I have to get it. Can somebody please explain pass keys to me? So I know that passwords and usernames is broken going forwards.

We can't keep doing this. People who are using a password manager, that's helpful because you can put in stupidly long passwords, but you've got this single point of failure. Just read the last pass story from last year. But I still, I don't get what a passkey is. Again, sorry, Tim. It's like you're on the shelf for this episode, aren't you?

What the heck is a passkey and how does it work?

[01:18:38] Tim Nash: So a passkey is simply a different factor that is from a password. You have passkeys, you just don't realize it. Now, traditionally a passkey would be a physical device that you could plug in. And I was hoping that I was going to say, and here's mine. It's just lying around on my table, but it's not.

Yeah, a YubiKey. It's a really good example as a basket, but so is the biometrics on your phone So is the thumb fingerprint reader? so is the facial recognition on as you if you've got a camera and you're getting a If you're on a Windows machine, you can log in without By the webcam in your face. All of these are extra factors Historically, what we did was use these as multi factor.

So we would say, you have to have a password, and then you have something that you own. Something that you own and manage. Now, pass keys are an alternative way where we say, actually, what you remember is not working. So we're just going to go with making you have many factors. That you have to use and that by giving you different options We're gonna we can just as long as you have multiple different ways of proving your way in that's fine We can dump the password one because that's the one that is the most insecure of the lot in theory

[01:20:02] Nathan Wrigley: So I've set up right a few weeks ago Gmail or Google Right?

Google's, my Google account prompted me, do you want to set up passkeys? And I thought, yes, I'm a good boy. I will do the latest, most secure thing. So I did something and then I got distracted. And now every time I log into my Google account, it says, do you want to use your passkey? And I click yes. And it asked me to do things like scan QR codes with the phone that I've synced with it.

And I'm like, I don't remember doing that. Where the heck are these things? That's the bit that I'm lost

[01:20:39] Tim Nash: in. A good, so in that scenario I would try, probably what would happen is if you took your phone that you have, that you've got there and you open it up and you scan the QR code, it will take, it will ask you to go to a link.

You click on the link and that will loop through and it will look through whatever authentication System is being used on your phone if it's an android phone Then that links in with google system and google can go. Oh That phone is registered and attached to this account and therefore you can process through so

[01:21:10] Nathan Wrigley: right just to be clear It's not that there's something on this phone Like specifically on this phone that's on no other phone Or is there or is it just at some point in the

[01:21:21] Tim Nash: past it knows that phone has been attached to the account Got it.

And therefore that phone is your factor. So what they're then doing is asking you to prove the existence that the phone is in your hand in some way.

[01:21:35] Nathan Wrigley: Got it. I'm such a luddite. What the heck am I doing on this show? It just, this seems so, so self evident now. But honestly? I don't have does that mean I just open up any barcode scanner because I have the barcode scanner app or the google Photos app or whatever.

Yeah,

[01:21:52] Tim Nash: I mean I imagine if you use google lens or whatever One that's probably a more seamless experience I'm not inside the android app Ecosystem anymore, so I can't really attest to how it works. But apple has an almost exactly the same mechanism where you can go through their process and all of a sudden it will your phone will start buzzing and it will say Oh, do you want to approve this?

If you're using password manager like bitwarden That will allow you to authenticate on a separate device. So yeah, these things are slowly happening where we're going away from this idea that you are, have to remember this thing. And we're going more to, hey, we've got enough points to prove, to build a case to prove that this person is the right person and put them forward.

Okay.

[01:22:45] Nathan Wrigley: Got it. Next time I'm with you in like a WordCamp Europe bowl, but I'm going to use your face as my passkey. And every time I need to log into anything, I'm going to phone you up on zoom or something. Can you just stare into this for a minute?

Yeah, thank you. That's actually explained it for me. I think I get it. I think the bit that I'm not getting is that there isn't an associated Google app. I'm expecting there to be something that when I try to log into Google, Something pops up on my phone like it did do in the past, which says, is this you?

Yes I'm expecting that step to be proactive on the phone side, but it's not, I can just scan it with any old QR scan. I have understood. Thank you. Great. Thank you. Oh, hello, Ben. We were talking about a stackable just a moment ago, Ben, you missed it, but it looks like you've got a typhoon heading over the Philippines.

Go and get some shelter. Ben. I hope that everything's all right. That sounds awful. Yeah. Google Authenticator. Oh I'm using that at the moment for two fa so yeah. Thank you. Bert, anything on that? Or should we move on? Oh, I should have said, the reason I mentioned it is cuz if you've got a GitHub account, you can do it over there.

That was the whole point of mentioning that. Where are we at now? Bob, this is your piece. What's going on with WordCamp us? Not much. Just, I just

[01:24:16] Bob Dunn: thought since it's what tomorrow that it happens. Yeah. Tomorrow.

[01:24:19] Nathan Wrigley: Oh, is this the final round?

[01:24:21] Bob Dunn: Yeah, this is the final round for all those people that have been freaking out.

Oh, set their alarm, and

[01:24:28] Nathan Wrigley: go and buy a ticket. That's really interesting. Cause I actually was, I've just recently given I'm, I bought a ticket cause I was hoping to go and I gave it to somebody just the other day. And it sounded from everything that I was hearing that there was no such final round.

They'd all gone, but there it is. So they start tomorrow, 25th. Don't know what time looks like 12 p. m. Eastern. So that'll be the last little batch I don't know how many are left, but if you are looking to go to that event You've got a very short space of time to find them. Have we got time for this?

We've only got three minutes left. Looks like we've left them. I was

[01:25:07] Bob Dunn: gonna say, you put up one heck of an article for three minutes, ah

[01:25:10] Nathan Wrigley: we can't, can we do this in three minutes or do we wait for this for another week? Aww. Should we do it quickly? Are you alright if we overrun for a few minutes, everybody?

Bob? Yeah, you're not. I can do a little bit. Okay, let's let's just quickly tackle this one then. Sarah Gooding, WordPress contributors demand transparency and objective guidelines for listings on recommended hostings page. There is a recommended hosting page if you didn't know. And up until recently, there were, I believe, Three hosting companies, one of which was sites ground company that I'm sure many of you have heard of, and that a, that company has been removed.

The reason that makes this the reason that there's a story around this is because it would appear that there isn't really much. insight into how something gets on that page, but also why they get taken off the page. So transparency, is the right word there. So will new things be coming onto the page?

We don't know. Will things be coming off the page? Why was this removed? We don't know. And I think it was Tim that posted this one. I missed this piece. Tim, I think you've got thoughts.

[01:26:23] Tim Nash: I'm going to stand up for every small host or every host that's ever existed. That page is presumably gold dust.

Once you're on that page, you as a company are probably set for life. While I appreciate AIG and others are huge corporate entities, that page has helped promote them and push them into the places they are today. That page is controlled by one person. I think it's fair to say Matt has made it very clear that he controls that page.

He alone makes the decisions. He also owns a hosting company, who is a direct competitor to everybody who would want to go on that page. Even in the best world in the world, He cannot say he is not biased, and he cannot say that he is not influenced. And why he I understand why he set himself up to do this.

It's because he didn't want anybody else to have to deal with how much hell it would be to organize and manage that page. But, consequently, we are in a state where one person is controlling a humongous amount of influence, and he's come along and said, I'm going to make some changes. And everybody's gone, okay can we start with change number one, which is building a team that will pick this, that ideally have no outside influences, don't work for hosting companies, don't work for competitors etc.

And the response was not, what a great idea. The response was, I might change one of the questions on the questionnaire.

[01:28:05] Nathan Wrigley: Ah, got it. Okay, so here we go. Let's read ReviewSignal, which I think is a company which every, let's say every year, I could be wrong about that, produce quite a lot of metrics about different WordPress hosting companies.

A guy called Kevin... O R C. I do apologize if I've butchered your name. He makes some commentary here and this is probably the bit that you're talking about. Getting listed on that page is likely worth millions of dollars to any company in terms of business generated. I think the process and criteria should be transparent and clear from the beginning.

I also think who is involved with evaluating should be known beforehand as well. At least give companies and consumers the information. They deserve to evaluate and participate in the outcome. Yes, that's the story. I'll hand it over to Zubir and Bob, if they've got anything about this.

[01:28:59] Bob Dunn: I just think, yeah, it's a hot mess, it's like it, and I don't know how long it's been there.

I, it seems like it's been there as long as I can almost remember and whatever the initial. Reasons for starting it, leaving it up there and leaving it gathering gold dust, like you said, was maybe the mistake. And now we're at a point where I honestly don't think, I think it's going to be damned if you do, damned if you don't type thing.

It's, there's going to be somebody somewhere that. or several somebody somewhere that no matter what we do, they're not going to be happy. And Tim said, there's a lot. I'm amazed I get contacted by these hosting companies and they keep cropping up a lot of these little hosting companies.

And you draw a line at some point and you know what, it's just, it's crazy. It's a, it's, it almost. It gives me nightmares to think of a page for recommending hosts. I never even wrote posts like that when I would do tutorials, just because it was like, who do I put on here? Cause everybody, yeah it's I just can't figure it out.

I don't have any good answers for it, and I'm hoping between everybody that's wanting to do something that, something can be figured out or, I don't know. It's

[01:30:32] Nathan Wrigley: like I said I just typed into google. co. uk. I typed in the phrase, which I suspect is a very commonly typed in phrase.

And I can't say whether you'd get the same results. I'm in an incognito window, by the way. So there's no. There's no account bias here typed in WordPress hosting and the number one search right at the top there is the page in question WordPress hosting. So now I guess until the last few weeks or so, this would have said Bluehost, Dreamhost and SiteGround.

So now we're missing the SiteGround one, but we don't know. Who's going to be on there next. And obviously if the process is the question, isn't it, whether or not there should be some kind of oversight there and how that's done. But certainly if Google are sending, if you're typing in a phrase like that, I would imagine there's a very large amount of traffic.

Going in that direction. Peter Ingersoll's got a comment like all of us, I think of several hosting companies that are great hosts contribute and contribute more and are more engaged in the WordPress community, nevermind all those that just, it looks like this system doesn't post if you go over a certain word limit, nevermind those that are just good WP hosts and Courtney says, I'll give a plug for folks to get involved in make.

WP hosting team in deedly doodly. I think very

[01:31:56] Tim Nash: quickly on Courtney's point, there, that it's really important to say that there is a make WordPress hosting team. They have no control over that page whatsoever. And in fact, I've been planning on doing their own page separately. Because it's, that's how much of a hot mess it is.

And it's a really frustrating moment because we, there is this team that can take part, but they're not yeah, that page should just be deleted. It should have been deleted 10 years ago. Andrew Palmer,

[01:32:30] Nathan Wrigley: I don't know, says there's a new paragraph asking people if they'd like to get listed. Oh yeah, right at the bottom, be listed on this page.

We'll be looking at this several times a year, so keep an eye out. I don't know if this paragraph is new, so I probably won't read it.

[01:32:44] Tim Nash: It's been there through. For years, and yeah, I remember filling in the form being part of a group that was filling in the form, so no, it's not new.

[01:32:54] Nathan Wrigley: There's a list on that paragraph about things that you must do, or not do rather, but there isn't a, there's no sort of here's the process that you'll have to go through or anything.

So anyway, there we go. That's it. We've run out of time. I do apologize. We've overrun slightly. I am so sorry about that. I'd just like to say thank you to Zubair for joining us for the first time. Thank you so much. I hope you come back. And also thanks to Tim Nash and to Bob. I'm pointing the wrong way.

Bob's over there. Oh, I don't know where Bob is. He's over there somewhere. There, there's Bob. Now it's the Zubair. I don't know if you know about this. We have to. We have to every we have to do this slightly humiliating wave of the hands. Everybody does this thing So if we could all just raise our hands, I wonder if we can get bob to raise his hands No, I think bob's frozen.

I think oh, no, there he goes. There he goes. We got him Thank you so much. I appreciate you To do that somewhat humiliating thing, but thank you for you three For joining us. Thank you to all of the people who made comments. There was quite a lot today. I really appreciate that. And we'll knock it on the head.

Just to say this platform, by the way, when we go away, it it sends a little video. So you three, if you want to stick around for 10 or so seconds, will there be a little, not video, it's like a holding slide, but I'll see you in 10 seconds, see you guys, see the rest of you next week.