Matt Mullenweg, the 23-year-old who is the founding developer of the open source blogging software WordPress, woke up in March to find that disaster had struck. “A cracker gained user-level access to one of the servers that powers WordPress.org,” he later explained on his blog. “They modified two files to include code that would allow for remote PHP execution.”
What was alarming was that thousands of people were downloading the code, believing it to be the latest – and so the most secure – when in fact it was making their sites vulnerable to attack.
But instead of downplaying the incident, Mullenweg told the world. “It was painful to publicise, but we got a huge amount of coverage and got the word out that there was a dangerous version of WordPress. Even though there were probably only 10,000 or 15,000 people affected, we ended up getting half a million downloads [of the update]. So everyone was updating. Which was good, actually.”
WordPress began in January 2003 when Mullenweg began a project to create new weblog software by adapting what he was currently using, an open source product called b2/cafelog.
A question of conscience
In 2004, Mullenweg – who was born on Houston, Texas – left his college course to work for the tech media company CNET in San Francisco, where he now lives. A year later he left CNET to found his own company, Automattic, which runs hosted blogging services on WordPress.com and a spam detection service called Akismet. Basic accounts are free, with money made from premium services and advertising.
WordPress now lies behind a fair chunk of the world’s 100m-odd blogs. In September 2006, WordPress.com hosted 350,000 blogs; today it has 1.5m, and is among the top 20 busiest sites in the US. “The only other site that’s as big as this and on an open source basis is Wikipedia. Everyone else runs proprietary code,” Mullenweg says.
The open source aspect is important. “For me, open source is a moral thing. Software should be free; it’s our philosophy as a company,“ he says. There is one exception: Akismet, his spam detection service, does not reveal its code. It addresses the problem of automated posting of comments with advertising links on blogs. “With Akismet there was an interesting dilemma,“ Mullenweg says. “Is it for the good of the world Akismet being secret and being more effective against spammers, versus it being open and less effective? It seemed more people would be helped by blocking spam. “
He considers paid links deceptive – and feels strongly about it because of his own experience. “A few years ago an advertiser approached me and said, ‘I want to put these articles on your site,’ and I agreed. It was WordPress.org. That lasted about a month, and became a huge controversy in the blogosphere. I took it out the next day.
“It helped me think. Before, I thought spam came in my inbox. I never thought about it in terms of the broader web, that people buying these links with the intention of changing the search engine results are spamming the world. That was part of the inspiration for Akismet – my Catholic guilt for making such a screw-up.“
Link vendors have also targeted WordPress “themes“ – add-ons users can download to customise their site. “People would hire a bunch of people in India, crank out 10 or 20 themes, and put links in them that they would sell. Then people would download them. The theme would sometimes come with good links, sometimes with bad links, sometimes with actual malware. The theme directory at the time had just under 5,000 themes. We ended up deleting 3,000 of those.“
The purpose of paid links may not be obvious to a blogger, but Mullenweg advises caution. “I think it’s dangerous. Much of the lifeblood of blogs is search engines – more than half the traffic for most blogs. If that dries up, people will realise that the $100 a month they were getting from this mortgage advertiser wasn’t worth losing half their visitors.“
Problems also exist beyond paid-for “speech“ – specifically, over free speech. As a blog platform, WordPress enables people to speak their mind. Turkey blocked the entire site on a judge’s orders, though Mullenweg expects sense to prevail.
“We had a bigger problem in China. It set the moral compass for the company. About a quarter of our traffic was coming from China. Overnight it disappeared. For a young company, that’s a big deal – it was a million pages a day. We found our if we were willing to forbid certain words, track people and give up their information if asked, we could be turned back on.
“It was tough. We decided that being there under those circumstances isn’t worth it – we’d rather not be there.“ Does that mean WordPress is still blocked in China? “Yes, still blocked two years later.“
Open source software is nothing new, but Mullenweg sees a change taking place. “In the past open source has been focused on developers. Within the last few years we’ve had a rise to prominence of consumer open source applications. That’s a new set of challenges. If you’re building something for a server, there’s usually a defined output which is right or wrong. In consumer applications there are different ways, which aren’t necessarily better or worse, so people have strong opinions.“
The consequence for WordPress is an avalanche of feature requests. Mullenweg advocates a minimalist approach to software quality, and believes that many software products have too many options included to satisfy divergent opinions.
“Lots of software, especially open source software, goes the option route because it makes everyone happy. But it creates terrible software. I think WordPress as it is now has too many options. So in making decisions, I piss people off. Sometimes they take it personally, and that’s a difficult thing. But if we continue to be a successful product and to grow, I feel we’re making the right decisions.
“There are two main methodologies of open source development. There’s the Apache model, which is design by committee – great for things like web servers. Then you have the benevolent dictator model. That’s what Ubuntu is doing, with Mark Shuttleworth. Ubuntu is doing amazing things, and I think it’s going to change the face of the desktop. That’s also WordPress, and ultimately that’s what’s going to work for consumer applications.“