Tag: governance

  • Rubicon

    Rubicon

    On Saturday October 12, 2024, a line was crossed in the WordPress open source project that I fear will have a lasting and irrevocable impact on open source as a whole.

    After locking out developers from rival hosting company WP Engine over a trademark dispute, project lead Matt Mullenweg announced the “Advanced Custom Fields” plugin had been forked and a new version titled “Secure Custom Fields” substituted into the supply chain to be automatically installed on every site running the plugin.

    As a result, some 2 million websites, through no action of their own, now potentially run a new plugin maintained by an unknown group of developers unfamiliar with its design and function, while the original developers desperately try to reach their customers to ensure they get the latest updates from the original plugin. For some website owners, the change will cause confusion: They installed “Advanced Custom Fields,” and now they find a new plugin called “Secure Custom Fields” in its place. For others, the change will manifest as a security alert, or a function change, or even a system error. And for most, the change will be invisible – a silent substitution of a trusted product for an untrusted one.

    In any other context, this would be considered a supply chain attack, and for many enterprise, institution, and government users of WordPress it will be read as such.

    In my opinion, this action sets an indefensible precedent for WordPress and open source:

    Expropriating an actively maintained plugin breaks any reasonable trust open source developers can have in distributing their plugins and themes through supply chain services like WordPress.org that are not under transparent and accountable management.

    Forcibly replacing a plugin on millions of websites is contrary to the reasonable expectations of users that the software they are using is provided and maintained by their creators or appointed successors.

    When one person can unilaterally block access to any developer, carbon copy their work, take over the software’s primary location and associated history (support forums, reviews, etc.), and then distribute the new version to existing users, no one can have a reasonable expectation that code posted to that service is safe.

    These actions are the very behaviours open source adherents so deeply despise in closed-source platforms: the claiming of other people’s content and work as their own. This is the richest kid in the neighbourhood saying he alone decides who gets to play in the sandbox, and if he takes your toy, it is your fault for not playing the way he likes. This is the community waking up to the real tragedy: They were never in a commons, they were on private land, and the owner has decided he no longer sees value in keeping up the pretence.

    In the oft cited (and too seldom read) book “The Cathedral and the Bazaar,” open source ideologue Eric S. Raymond uses the ill-fated Maginot Line as a metaphor to describe how traditional software development approaches are too rigid and static to adapt to the fast-moving and dynamic environment software operates in. Raymond proposes open source as a more adaptable and decentralized alternative. What Raymond did not predict was a new Maginot Line forming within open source, manifested as centralized control of the commons by project creators turned “Benevolent Dictators For Life”.

    Open source is at an inevitable crossroad: It won the battle for web supremacy, but lost the plot when it comes to who gets to extract financial value from the work. As a result of the resulting massive inequity, the supply of people willing and able to volunteer their time and work to open source software is dwindling, and open source projects have become dependent on corporate support – the exact thing Raymond and his ideological compatriot Stallman said open source would rid the world of.

    Meanwhile, open source project founders have built vast wealth and power on their creations. They extract massive amounts of capital from the volunteer labor of unpaid contributors, and invest some of it back into the project, often by populating central positions with paid staff that steer the direction of the project in ways that ensure continued corporate benefit for the founder and their friends.

    At the BDFL-level it appears conflict of interest is considered a virtue.

    The future of open source depends on what those with power choose to do with that power. Do they build an equitable system of governance where those who do the work are consulted about and compensated from the riches extracted from their work? Or do they submit to the allure of chokehold capitalism by crushing what is left of their communities with the iron fist of a dictator who no longer sees benevolence as a worthwhile investment.

    The Usurping of ACF may set in motion events beyond the control of the WordPress community and even the greater web community. Ignored by the owner of .org and .com and his ilk, there are wolves at the doors to the open web and they are itching to get in. Big Tech platforms and their lobbyists invest billions to convince lawmakers that the wild and open web is a threat to the safety of children and stability of society. They say only their walled gardens can be trusted, and lawmakers listen.

    Internal chaos in open source already has real-world impact outside the community: Mess with critical infrastructure, and you invite deep scrutiny. Both WordPress and ACF have become critical infrastructure, powering sites for enterprise level businesses, educational institutions, and government entities small and large. To lawmakers informed by Big Tech lobbyists the solution is obvious: Outside corporate control.

    For WordPress, what happens next is largely in the hands of a single man who is increasingly isolating himself and consolidating his power. His choice: Tighten the grip, or let governance in.

    Time will tell if the Rubicon has been crossed. I fear we are past the point of no return, but I have hope and faith in the open source community and in their mutual solidarity.

    And to me, hope is a catalyst. I know it can be for you too.

    Stay true to your values my friends, and build the world you want to live in.

  • The Case for WordPress Governance

    What role does WordPress play in the larger discussions about the web platform and the internet? What responsibilities does WordPress have to speak for the tens of millions of content creators, business owners, designers, developers, organizations, institutions, and governments who rely on this free open source software to share their thoughts, ideas, information, products, and services with the world? And how does WordPress responsibly take part in the external decision making processes which impact not only the application itself but every person who in any way interacts with WordPress?

    These questions, and others in the same vein, were the starting point of what would become the WordCamp US 2018 talk Moving the Web Forward with WordPress, and the WordPress Governance Project.

    Today, some 4 months later, I want to shed some light on why I think WordPress Governance is so important, and why to me it is less about uprooting existing leadership models and starting a revolution than taking stock of the position WordPress and its community finds itself in and accepting its new role as a driving force of the web.

    In this article I speak not as a representative of the WordPress Governance Project. These are my personal reflections on where we are and where I think we need to go next. Consider them part of a larger discourse, and an invitation for you to join that discourse.

    33% and growing

    A few months ago WordPress crossed a significant mile marker: According to W3Techs, WordPress now powers more than 33% of the 10,000,000 most popular sites of the web as ranked by Alexa. That’s ? of the web gathered under the banner of democratizing publishing through free open source software. Even if we question the methodology or validity of this particular number, the reality is clear to see: WordPress has a larger footprint on the web than any other content management system.

    33% is a testament to the millions of hours of free labor the WordPress community has invested in the application. It proves, beyond any doubt, that free open source software published under the GPL is not only a viable but a preferred option in the eyes of the end-user, the people who want to publish content on the web. In short, WordPress has been and remains an unprecedented success story. And that success is the result of a vision of the web defined by project co-founder Matt Mullenweg and supported by every contributor to the WordPress open source project: that web publishing should be available to all; that open source software published under the GPL is the best vehicle to make this happen; that the Four Freedoms must have precedence above all else.

    These ideals, combined with a strong belief in meritocracy and an ideological aversion to hierarchical management, have paved the path leading to today. Which begs an obvious question:

    If it works, if it got us this far, why change it now?

    My answer, “what got us here won’t get us there,” needs both context and more substance. In this article I’ll lay out my two main reasons for wanting governance in the WordPress open source project: Representation for the open web, and deliberately moving the web platform forward.

    Who speaks for the open web?

    Decisions are being made by politicians all over the world about the future of the internet, the web, and what types of services and contents can be published and used on them. These decisions are already having a direct impact on every person who interacts with WordPress, and there are more to come.

    As a person using the internet, and probably using WordPress in some way, two questions should be front of mind in all this:

    Who speaks for WordPress when these decisions are made? And what are they saying?

    Right now, the answer is nobody, and nothing. This is concerning, and may have significant consequences for the future of the web and the internet, even for those who never interface with WordPress.

    If you think I’m being overly dramatic look no further than the UK Home Secretary linking WordPress.com to the spread of terrorism and you realize politicians and lawmakers are in their seats of power, policy proposals in hand, and we have so far chosen to not help them craft those proposals into laws that protect rather than hurt the open web.

    To put a fine point on it, right now the future of the internet and the web is being decided by lawmakers with a poor understanding of how these technologies and the communities they foster work. These politicians make their decisions based on input from lobbyists, special interest groups, and industry bodies. While there are some organizations working to promote the interests of the open web, WordPress has been absent in these conversations.

    This is a deliberate choice of political non-intervention, and it’s an irresponsible one in my opinion.

    By not taking part in these conversations, by not claiming a seat at the tables of power, the WordPress open source project says “we power 33% of the web, but we do not promote the rights of the people who use our software.”

    But what policies would a representative from WordPress promote? Who would appoint that representative? And who would they represent? Every WordPress user? The contributors?

    All these questions have no clear answers today because the WordPress open source project has no governance structure to allow policies to be created, appointments to be made, or discussions of representation to even take place. Today, the sole representative and only person who can speak on behalf of WordPress with any authority is project lead Matt Mullenweg. When I asked him how we go about representing WordPress in these decision making bodies at WordCamp US in 2017, his answer was quite vaguely that someone should step up and lead. Which is, in part, how the WordPress Governance Project came about.

    Necessary conditions as a starting point

    I think one of the major sticking points in this whole conversation is how to define policies that can be legitimately said to represent every WordPress user. My proposal is to start by identifying the necessary conditions which must be in place for WordPress to be able to achieve its core philosophy.

    The core philosophy of the WordPress open source project is the “democratization of web publishing.” What exactly that means is not clearly defined, but the words themselves have meaning. “Democratize” in this context most likely means “make something accessible to everyone,” so “democratize publishing” means making publishing accessible to everyone.

    From this, we can stipulate some necessary conditions including:

    • Unrestricted access to the information on internet
    • Net neutrality
    • Accessibility
    • Privacy
    • Security

    These conditions, and others like them, can be turned into concrete policies representatives can bring to politicians and lawmakers around the world. That way, when a proposal for stricter regulation on link attribution, or the removal of net neutrality, or anti-encryption, or pro-privacy laws are proposed, the WordPress project can claim its seat at the table and present comprehensive and consistent policy opinions as the representative of every entity who chooses to use WordPress to publish content on the web.

    “These are the necessary conditions for 33% of the open web to flourish” is a strong statement, and one politicians will listen to.

    Silence is consent

    The current absence of WordPress in these conversations is seen as consent. When 33% of the web stays silent as laws are enacted, the lawmakers read that as 33% of the web approving of those laws being enacted. This silence is not a decision made by the WordPress community. It’s an ideological decision made by WordPress leadership on behalf of the community, and I question whether it is one the community agrees with.

    This is a conversation the WordPress community needs to have. To continue thriving on the web, the WordPress community needs to play a role in the decision making about the web. To do that, we need systems in place to propose and ratify principles and policies, elect or appoint representatives, and fund their work to promote the interests of WordPress site owners.

    Other communities including Drupal are hard at work trying to put together exactly this type of representation, but WordPress’ absence is a proverbial elephant in the room. If Drupal goes to the EU and says “we speak for our users,” cunning lawmakers and the corporate interest lobbyists who influence them will say “You represent maybe 3% of the web. 33% of the web is silent. Get back to us when they have something to say.”

    WordPress should be banding together with Drupal and other open web communities to create a body of influence representing the open web. To do so, WordPress needs the tools and mechanisms to create policy and enact it. That in turn requires governance.

    Interlude: Paving the Cowpaths

    Behind my childhood home on Nesodden right outside Oslo, Norway, there was a hidden path leading to a bigger path leading deep into the forest. As children my brothers, our friends, and I would take these path as soon as our homework was done and disappear for hours into the wilderness. Over time, what started as tracks of broken twigs and crushed vegetation became well-trodden dirt paths, and eventually the municipality came in to clear away boulders and lay down gravel turning what was a natural path between the trees into a maintained pedestrian road through the forest.

    We are a society of road builders, and the roads we build typically start off as paths laid down by animals and people exploring new ways of getting where they want to go. There’s a term for this: paving the cowpaths. We use it to describe the formalizing a de-facto practice, whether that be a path through the forest or a coding pattern for the web.

    A significant portion of the modern web standards we work with today were established by paving the cowpaths of the web. Standards bodies look at what established practices exist and what solutions people use consistently, and build new standards around them. Prime examples are how modern JavaScript (aka ES2015, ES6, ESNext, etc) has adopted many of the de-facto practices established by jQuery and similar libraries, and how modern CSS has adopted many of the de-facto practices established by preprocessors like Sass. Seeing cowpaths being formed on the web, the standards bodies get together to pave them, formalizing the practices and making them part of the web platform proper.

    What does this have to do with WordPress? To put it bluntly, at 33% and growing, WordPress is the cowpath. Or rather, wherever WordPress decides to go, it puts down a cowpath wider and more established than anything else on the web. That means wherever WordPress goes, others will follow, and standards bodies, browser manufacturers, and every other player in the ecosystem surrounding WordPress has to start paving the path laid down behind it.

    I propose this is a one reason why large multinational corporations, major hosting companies, and other commercial parties are investing heavily in developer resources and contribution to the WordPress open source project: Pushing WordPress in a particular direction means pushing the web in a particular direction. WordPress is becoming a vehicle driving the web forward. But where exactly that vehicle is going is not clear. And that’s a problem, not just for WordPress but for the web.

    Moving the Web Forward with WordPress

    A few months ago a friend reached out to me asking what my goal was for the WordPress Governance Project. I told him I want to move the web platform forward with WordPress. “WordPress could be a vehicle to push the web forward,” I said. “Imagine if WordPress collaborated with the various standards bodies governing the web to implement new features. We could quite literally deploy a proposed standard to +33% of the web over night thereby establishing it as a de-facto practice ready to be implemented across all browsers. It could mean an end to waiting for years for tools like flexbox, CSS grid, service workers, and modern JavaScript to become well established enough to get widespread support.”

    He shook his head and said “From where I stand, it’s the other way around. WordPress is conservative, regressive even. It’s not moving the web forward, it’s slowing it down.”

    I wish I could say he was wrong.

    From my perspective WordPress is cautious to the point of being conservative. And in some cases it is indeed regressive. There are many causes at play here, maybe most importantly WordPress’ policies of backwards compatibility, continued support for older browsers and server infrastructure, and reluctance to adopt progressive enhancement principles.

    There are good reasons for these policies and practices: WordPress powers 33% of the web, and its users are distributed across every continent and country on our planet. WordPress needs to work for all the people who use it, and that means providing solutions that work on old and outdated infrastructure, in poor connectivity environment, on pay-per-byte connections, on legacy devices, running outdated browsers.

    But these challenges are not unique to WordPress, and they do not need to be a grand piano dragging behind the vehicle of progress. What WordPress needs is a long-term strategy for upgrading the web while protecting every user. That requires a stated vision and goals. That requires the involvement of subject matter experts from within and outside the community. That requires the establishing of plans, assignments, roles, and delegation of tasks. In other words, we need to rethink how the WordPress open source project is structured, from the ground up.

    Leadership matters

    What got us here won’t get us there, because what got us here was a flat-structure management system based on meritocracy where each contributor works on what they find valuable, and the application evolves based on their contributions. This model is designed for small open source projects developed by the people who use it. WordPress is a mission-critical application built by a dedicated team of contributors for tens of millions of people, businesses, and organizations who never interface with the WordPress community. On this scale, leadership matters.

    What’s needed to move forward is a system where the community agrees on a direction, tasks are defined and delegated, and decision makers are assigned to ensure things are done and done correctly. This is how well-functioning organizations work, and it’s for a good reason: No single person can have complete oversight of an entire complex project. Without proper hierarchical leadership structures, management becomes non-existent and project success relies entirely on individual contributors. In a leadership vacuum, ad-hoc leadership structures naturally emerge introducing confusion and often conflict. The end result might be functioning software, but it is guaranteed to be wasted time for everyone involved. Leadership, and leadership structures matter.

    Many who read this will immediately object saying this is not how we’ve done it so far, it goes against the very essence of open source, it is not tenable, it means some people get to decide what other people (volunteers) work on, etc. These are fair arguments. In response I’ll say WordPress powers 33% of the web, and every decision made in WordPress affects tens of millions of people. Continuing to develop WordPress in an ad-hoc fashion is no longer responsible. Furthermore, it prevents us from being a true vehicle of progress for the web. And as Gutenberg has proven, it is also not how things are done today:

    The evolution of WordPress is not as ad-hoc as it appears. It is very much guided by the grand vision of Matt Mullenweg, and his vision is the reason for WordPress’ continued success. The ad-hoc nature of the evolution happens further down the decision tree, in the minutia of application development. That’s where chaos takes root, conflicts arise, and significant volunteer time and resources are wasted, all because there is no system in place for proper project management. There is no governance.

    When I told my friend about my vision for WordPress being used by standards bodies as a vehicle to move the web forward, his immediate response was it wouldn’t work because WordPress can’t be trusted: “Right now” he said, “anyone from WordPress can come to a meeting of a standards body and say they want to implement a new standard. But there’s no guarantee that will actually happen. We can’t trust WordPress to actually do what it says, because nobody speaks for WordPress. Even if a solution is built, there is no guarantee it gets implemented. The process of actually accepting something into core seems arbitrary at best. It’s like there’s a cabal of secret leaders in the project giving each feature a yay or nay. That’s not something we can work with.”

    The reality is WordPress does have a hierarchical management structure, and there are people in the project with powers to stake out a vision and delegate tasks. One of those people is Mullenweg. Other people include sub-project leads appointed by Mullenweg. Yet others are people with core contributor access. All of them are promoted to leadership positions through meritocracy. Yet, if you ask them if they are leaders in the project, many will say “no” and explain WordPress doesn’t have leadership; it just has contributors and the playing field is even. This is, and pardon my harsh words here, nonsense. And the refusal to admit there is hierarchical leadership in the project is a problem.

    Let me give you one general example: Over the years I’ve observed subject matter experts attempting to contribute to the project only to be overruled by contributors with higher meritocratic status. In several of these cases, the refusal to accept the contributions of the subject matter expert was due to a lack of understanding of the issue by the person turning the proposal down. Because of the lack of any type of transparent leadership structure within the project, there is no clear way for a contributor to raise this issue and get a fair resolution, so they shrug their shoulders and walk away.

    What WordPress needs to move forward is to have a conversation first about how to manage a large open source project responsibly, then how to introduce a long term vision and concrete plans for the future of the project and the web, and finally how to introduce more hierarchical management structures with checks, balances, and decision makers to ensure the contributions made by thousands of volunteers result in meaningful progress for the application and the web.

    These are conversations and decisions we need to make together as a community.

    Only with these structures in place can we start taking part in the larger conversation about how to move the web platform forward, and how to use WordPress in a meaningful way to do so.

    We can move the web forward with WordPress, but to do so we have to act like the leaders we want to be. If we don’t, WordPress could become a battleground for competing corporate interests who want to use WordPress to carve paths into the futures they envision.

    Build the future you want to live in

    People ask me why I started the WordPress Governance Project. My answer, as you’ve seen in this article, is it’s complicated.

    I believe WordPress can be a force of good on the web, but the way things are right now we can’t take on that role because we don’t have a clear way of governing ourselves.

    I’m not here to start a revolution, or a coup, or even stir things up. I’m here with a plea to the community to take a breath and think about how we got here, where we want to go, and what we need to do to get there.

    WordPress is important. For many it is mission-critical. We owe it not just to the people who use WordPress or to the web but to ourselves to take stock and create the necessary structures for WordPress to continue to thrive on an open, accessible, progressive web for years to come.

    WordPress needs governance. What that looks like, I am not sure. That’s why the WordPress Governance Project exists: to have the conversation; to explore possibilities; to work together and find solutions.

    Those are my thoughts. I’d love to hear yours.