Slashdot Mirror
WordPress 2.3 Does Not Spy On Users [UPDATED]
Marilyn Miller writes "Popular open-source blogging engine WordPress has been upgraded to 2.3 — with some unexpected nasties in the mix. As of version 2.3, WordPress now periodically (every 12 hours) sends personally identifying information (blog name & URI) to the mothership, along with an alarming amount of information including $_SERVER dumps, a list of installed plugins, and your current PHP/MySQL settings. Most unfortunately, it does not provide any way of disabling this functionality, and WordPress does not have any privacy policy protecting this information. In a thread about the issue, lead developer Matt Mullenweg defends his actions and staunchly refuses to add an opt-in interface, telling users to 'fork WordPress' if they aren't willing to put up with this behavior." Update: 09/25 17:52 GMT by KD : This article is misleading enough to be called "just wrong." Matt Mullenweg writes: "As mentioned in our release announcement, the update notification sends your blog URL, plugins, and version info when it checks api.wordpress.org for new and compatible updates. It does not include $_SERVER dumps, or any settings beyond version numbers (for checking compatibility), or your blog name, or your credit card number. We do provide a way of disabling this feature; in fact I link to one of the plugins in the release announcement and in my original response to Morty's thread."
He can go fork himself.
Crow isn't very nutritious.
Cue OpenWordPress project appearing in Sourceforge in 5... 4... 3...
...But people are busy checking their posts from the "Sony DRM" thread last month to make sure they don't look like hypocrites.
PrivatePress
The world is made by those who show up for the job.
one way to disable it is to go into the code and remove the offending portion. couldn't be that hard to do. and once somebody does it and posts instructions, it gets even simpler. no reason to fork the project.
and wordpress isn't that complicated that this is something that no one but the most hard core will do. tons of wordpress users regularly go in and tweak it for their own uses. i haven't moved to this new versions with my site yet - i always wait a bit for things to shake out, and stuff like this is why. when i do upgrade, i'll just fix my install.
It's hard to believe that's how Micronians are made. Why don't we see it right now by having you both kiss one another?
So what does it send, according to the FA:
The blog's URL
A list of all plugins and versions
A list of the $_SERVER env variables
How is this information not necessary for a robust autoupdating/autonotifying infrastructure? Since the plugns are the source of so many vulnerabilities, you need to know their versions etc.
Since so much incompatibility may be caused by funky $_SERVER variables, you need to know their contents.
And the blog URL tells you who it is.
Windows Update has to send far MORE intrusive information.
Test your net with Netalyzr
Well if anyone is looking for an alternate upgrade path, I 'upgraded' my blog from Wordpress 2.2 to Pyblosxom and am really enjoying using it:
- its really light and fast
- I can edit posts in a text editor rather than a web based interface
- its in Python and very easy to customise
- theming far simpler, just rip your HTML template into a header and footer, rather than having to make 12 files with Wordpress.
Plug over... Move along...
My little Linux and tech blog
Why can't they download a file with a list of "all updates" and check locally?
Read the thread. This isn't a developer admitting to spying on users. This is debate over a new feature written to help you keep from getting your blog haxored. They are collecting server and plugin data to help you to keep your software up to date.
Matt Mullenweg is being very reasonable and reasoned in dealing with a small but vocal groups paranoia. In the same breath that he mentioned forking Wordpress, he also mentioned that another option is using a plugin that disables this behavior.
The submitter should be ashamed.
If the developer decides to insert malware, or other forms of code not acceptable to you, the GPL gives you the freedom to modify it to suit your own needs. If that means you have to fork the project, so be it - that's within your rights under the GPL.
OTOH, the idea of using FOSS (good!) as a venue for spyware (bad!) is enough to make a guy's head explode...
As to what the summary refers to, where Matt suggests a person fork Wordpress:
Again, he gives the solution to the original poster's complaint (Moritz 'Morty' Strube). If this Moritz is really concerned, he can fork and remove the new code that transmits this information - or if he isn't too concerned, just install the plugins matt suggested.
This is making something out of nothing. Definitely nothing to see here, please move along.
Maybe I missed it, but it struck me that the developer's response was very civil, and well thought out. From the slashdot article you'd think he'd told the whole community to "fork off"?
So - did I miss something, or did everyone else not RTFA?
For those wondering what the big deal is, I expect a lot of the reaction is fueled by memories of Mullenweg being caught google cloaking in 2005. Once someone loses your trust, you don't really want to share any data with them.
Not true. There are two plugins that explicitly disable this functionality:
disable WordPress version check and disable plugin version check, both of which were mentioned by Matt in the thread above.
I wish I had a kryptonite cross, because then you could keep Dracula and Superman away.
And not only is it a troll, it's tinfoil haberdashery and skating _really close_ to Libel.
Actually RTFA Matt's reasoning gives the opposite impression of the summary. Fork the submitter and Kdawson for greenlighting this.
--
BMO
Anyway, i googled and found this link:
http://www.mitchelaneous.com/2007/09/19/9-wordpress-alternatives/
Now, my question is - how secure are they for you, sethawoolley? Which one would you choose?