#21 – Chris Coyier Talks About Why He Sold CSS-Tricks

On the podcast today we have Chris Coyier.

Chris has been a user and educator in the WordPress and web development space for many years. He’s an author, podcaster, developer, but is perhaps best known for his website CSS-Tricks.

CSS-Tricks has been a valuable source of information about CSS for over 15 years. Updated multiple times a week, the site has articles about every aspect of styling your website. It’s gone through several iterations over those years, not just in how it looks, but in the manner in which it is managed and maintained. If you’re searching for any CSS related content, it’s quite likely that CSS-Tricks will be one of the top results.

A few weeks ago Chris decided it was time for CSS-Tricks to find a new home and it’s now owned and operated by Digital Ocean, a popular cloud computing service provider.

This podcast is all about the journey that Chris has had running CSS-Tricks.

We go right back to the start and talk about what his motivations were for starting, and then continuing to run the site. Were there any low points where he lost his motivation to keep it going? How has the site changed over the years? Why did he finally decide to sell the site, and how he landed upon Digital Ocean as the new custodian?

It’s been a remarkable journey, and you’ll hear that there were many twists and turns along the way.

Useful links.

CSS-Tricks

Chris’ personal website

Digging into WordPress

Codepen

Transcript

[00:00:00] Nathan Wrigley: Welcome to the Jukebox podcast from WP Tavern. My name is Nathan Wrigley. Jukebox is a podcast which is dedicated to all things, WordPress, the people, the events, the plugins, the blocks, the themes, and in this case CSS. If you’d like to subscribe to the podcast, you can do that by searching for WP Tavern in your podcast, player of choice, or by going to WP tavern dot com forward slash feed forward slash podcast. And you can also copy that URL into most podcast players. If you have a topic that you’d like us to feature on the podcast, I’m very keen to hear from you and hopefully get you, or your idea featured on the show. Head over to WP tavern dot com forward slash contact forward slash jukebox, and use the contact form there.

So on the podcast today, we have Chris Coyier. Chris has been a user and educator in the WordPress and web development space for many years. He’s an author, podcaster, developer, but it’s perhaps best known for his website. CSS-Tricks. CSS-Tricks has been a valuable source of information about CSS for over 15 years.

Updated multiple times a week, the site has articles about every aspect of styling your website. It’s gone through several iterations over those years, not just in the way it looks, but in the manner in which it’s managed and maintained. A few weeks ago, Chris decided that it was time for CSS-Tricks to find a new home, and it’s now owned and operated by Digital Ocean, a popular cloud computing service provider.

This podcast is all about the journey that Chris has had running CSS-Tricks. We go right back to the start, and talk about what his motivations were for starting, and then continuing to run the site. Were there any low points where he lost his motivation to keep it going? How has the site changed over the years? And why did he finally decide to sell the site and how he landed upon Digital Ocean as the new custodian? It’s been a remarkable journey, and you’ll hear that there were many twists and turns along the way.

If you’re interested in finding out more, you can find all the links in the show notes by heading over to WP tavern dot com forward slash podcast, where you’ll find all the other episodes.

And so without further delay, I bring you Chris Coyier.

I am joined on the podcast today by Chris Coyier. Hello Chris.

[00:03:05] Chris Coyier: Hello Nathan, pleasure to be here. Thanks for having me.

[00:03:08] Nathan Wrigley: Yeah, thank you for joining us on the Tavern Jukebox podcast today. We’re here to talk about a project which has been going on, it really feels like as long as I’ve been into the internet, and that is CSS-Tricks. I am pretty certain that if you are in any way connected with web design, development, WordPress, whatever, you will have come across CSS-Tricks, and the podcast has come about because of a choice that you made.

I was going to say last week, but I bet it goes back way further than that, to sell CSS-Tricks. And Chris, can we get into that a little bit later? First of all, can I just ask you some generic questions? I hate to be boring, but it would be good for anybody that hasn’t heard of you, small though that audience would be, tell us about you. What’s your background with WordPress and technology? Just give us your backstory basically.

[00:03:57] Chris Coyier: Oh, sure. To kind of focus it I suppose on CSS-Tricks a bit. It was started in 2007, so it is kind of old, I think there is something of a generation of front-end specific developers that where, I was coming up in this industry at the same time that they were. And you know, I’ve been a very consistent blogger, I guess, throughout that time, you know, I would probably write a blog post today for those 15 years practically. Most of them landing on CSS-Tricks.com. It’s a WordPress website. It’s always been a WordPress website. I’ve tried to run it as a pretty like stock WordPress site. Just go with the flow of what WordPress does. I only mentioned that because this is a WordPress specific website.

So I feel like WordPress people might like to know some specifics about the WordPress nature of it. Even as far as, Gutenberg and the block editor and all that, trying to get on board as soon as possible and embrace that a bit. So it’s kind of a middle-aged website in a way that when I started it, I didn’t feel like I am riding the wave, the early wave of blogging or anything like that. Not at all. I feel like I was, at the time, I might’ve felt late to it.

[00:05:05] Nathan Wrigley: Did you begin because you had a burning desire to blog or was it a burning desire to blog about CSS? What was the purpose?

[00:05:14] Chris Coyier: I think it was both of those things. Well, just because there was some desire that writing and publishing, somewhere deep in me was a good idea, or that I got a kick out of it in some way. The idea that the words that I write can be published so quickly and so easily, and that anybody in the world can read it and react to it. And I can just be part of this global community. I think that’s cool. I still think that’s very cool.

[00:05:40] Nathan Wrigley: How did you land on CSS as the thing? Were you in employment at the time where that was a concept that you were learning or really getting into? Was it a hobby?

[00:05:48] Chris Coyier: I mean the short answer is that I was into the web, but I wasn’t getting exposure to it at school, as much as I wanted to. We didn’t really learn HTML and CSS web stuff at school. And I was like, why not? This is weird. You know, this is clearly happening, but it was just too early for a state university to have latched on early enough to it.

So I was kind of learning on the side and getting kicked out of wow, I can, I can actually make websites. And I graduate college and that hobby persists, what I really want is this point, I’m like, I wish this was my job. Because clearly it’s some people’s jobs.

Why can’t it be my job? And I’m looking for jobs, I can’t get one. I try and try and just couldn’t be hired as a web. I think I was probably focused on being a web designer mostly because my degree from university ended up being in art and graphic design, and focusing on ceramics really, and I knew I couldn’t hack it as a ceramic artist, but I was interested in the aesthetics, mostly, and the communication aspects of the web.

So I’m trying to get a job as a web designer and I’m like, I know I’m not very good, but I still want to work in it. But I relegated myself to like, I’m not good enough yet. So, let me just work on getting better at it while I do something else. And that’s something else was working in the printing industry. I worked for years and years in digital prepress it was called, which is essentially taking documents from designers and getting them ready to run on physical printing presses.

I worked in the printing industry for a long time. That’s the industry that my mom is in. And she kind of helped me find jobs in that arena. Which was nice, it was fine. At least it was working on computers, and my whole life just learning computer stuff was always of interest to me. It’s not like I was masterful at it, but I feel like I took to the job of digital prepress, which was manipulating these documents.

Being clever with design stuff and solving the issues that designers had and getting their documents to press. You’d be surprised at the kind of the garbage shape that design documents come in. They’re almost never really quite ready to be printed. They’re full of mistakes and bad assumptions and things.

Anyway, even while I’m doing that, and I end up working some really weird shifts, like some graveyard shift, 6:00 PM to 6:00 AM stuff because these printing shops run 24 hours a day to get the jobs done and they need somebody in prepress on staff all night long. And it was the less busy of the shifts to, you know, there’s nobody in the office.

So if there was nothing to do, I’d be poking around at building websites. And then I go home and work on websites. It was such a fun hobby to me that I’d enjoyed the spirit of making anything online. So fun.

[00:08:26] Nathan Wrigley: So there was no intention at the beginning for this to be anything more than a hobby, a labor of love. It was just tinkering and playing.

[00:08:33] Chris Coyier: Well, there was a bit, there was actually because, I’ll always remember this blog that was about earning income or at least side income from blogging specifically. It was Darren Rose’s pro blogger.com or.net or something. And he had a couple of blogs that he made money on the side. And then he would blog about that blog. It was very meta.

I think he had some like camera review website or something. He was a photographer and he would write about reviews of cameras and equipment and stuff and put affiliate links on it. And it was probably before the days of sponsored content so much, but it was the days of where display ads were good money.

He clearly made good money off just blogging. Off just the idea of, I can create content and I can monetize it. And I did have that in me somewhere. I was like, maybe this isn’t my job, but I would love to make some side income. Who wouldn’t, you know? Side income’s awesome. Even if it’s beer money fine.

So I would start various blogs with the idea of, all I gotta do is, stick with this, make content, put ads on it, get beer money, be happy, you know, as a little idea. And I had loads of different ideas of this. One of them was, you know, making websites about Adobe products, in the spirit of providing help.

And I had this friend who has working phone support for Adobe, but third party. Adobe hires some third-party company to do their phone support, or they did at the time. And he would know, he had his finger on the pulse of what people call in about, and be like, let’s turn that into a blog post.

It’s like dang near every phone call. Might as well leverage that in an SEO kind of fashion and be like, what does this error code mean? Or how do I turn my PDF into a EPS or who knows what. So we’d blog those and then, hopefully get some SEO value on it, and put Google Adsense on it and get some beer money. And that we did, it just that it wasn’t very passionate.

I didn’t care that much about solving people’s PDF problems, in retrospect, you know. At the time I’m like, I don’t even know how much you need to care. If it made money, hand over fist, maybe I could have gained the passion for it. I don’t know. But one of the blogs I started was a, at this point, I’d built probably dozens of websites, all garbage, but Hey, I built them. And I built it with WordPress notably because I don’t know how I picked it, I just did. It seemed like the right choice at the time for spinning up a website fairly quickly. And as far as I know, WordPress was always kind of a CSS, even the very early days of WordPress, all the themes were CSS. You know, even though it was very early web, I think that embraced that early spirit of CSS.

[00:11:10] Nathan Wrigley: So it was a case of throwing spaghetti against the wall of various different topics. And CSS was the one that landed and stuck.

[00:11:16] Chris Coyier: Yeah, it was the least successful of them, but it was the most fun one to write. And then that success changed as I, as the other ones dropped off. I focused on this one. Mostly because it was just fun. And I think fun has a way of sticking, it’s the stickiest spaghetti as it were. And then little early success started to happen, you know. Like I get an email from, at the time, one of the big businesses, at least in this little niche industry I was in was PSD to HTML. And that was just a generic term, meaning all y’all know Photoshop, but very few people know HTML and CSS. So just send them your Photoshop file and they’ll send you back a website.

And it ended up being this kind of commoditized industry where there’s not just one, but lots of companies doing this, and charging really, like a hundred bucks, they would do that for. And I was always like, weirdly, not fundamentally opposed to it, but I was like the kind of people I’m talking to on this website, aren’t the kind of people that would use that service because they’re trying to do it themselves.

But at the same time, I think there was probably people that were trying to do it themselves, but then would give up and be like, oh, this is too complicated. I’ll just pay somebody a hundred bucks and get it. So I think those companies must have saw that in my audience and wanted to pay me money to put display ads on the website for them.

And one of them was quite literally called PSD to HTML. And it was so unofficial, I was just like, oh, I dunno, PayPal me a hundred bucks or something. And I put the little ad on there, and then I would notch up the price over time. Once in a while they would want to go bigger, you know, can you make the ad bigger? Sure. How about 250 bucks then, you know? And then I hand managed that for a long time. We had Treehouse became a sponsor for many years, and that was also very much just a handshake agreement and PayPal transfers. And I would hand craft the ads that I would put on the site, but the, eventually that fell away to more like traditional self service. Send us the asset. And I became a partner with this company called buy sell ads, who was our advertising partner all the way until I sold the website. They’re a great company that handles the sales and placement of ads on websites.

[00:13:33] Nathan Wrigley: Over time, it’s become something which was a hobby, which you didn’t anticipate becoming successful it because of the content became successful. And you stumbled into ways of monetizing it and justifying it in terms of the hours that you were spending on.

[00:13:48] Chris Coyier: Exactly. that’s a good way to say it.

[00:13:50] Nathan Wrigley: I do like that it wasn’t intentional. It was just, it just occurred over time and it may have done, and it may not have done. Rewind history 15 years and maybe that spaghetti didn’t stick and something else would’ve done.

[00:14:03] Chris Coyier: Yeah. I mean, I don’t know that it was entirely chance and I mean, it was a, that was a big part of it, but it was evolved to rank content that worked. And learned from that. And I evolved business model wise to double down on the things that were working and get rid of the things that weren’t working. It definitely was like labor and trying to understand the business and changing the business to make sure that it worked.

[00:14:30] Nathan Wrigley: Did it become more intentional over time? So as you began 15 years ago and it was what it was. And then five years later it was something slightly different. There was a financial benefit to keeping it going. And five years later after that, it was even more so. Did you modify it to become a business? Did you take on staff and guest writers so that your audience was satisfied?

[00:14:50] Chris Coyier: Yeah. there was some kind of moments where those things happened. For one thing, the first employee I ever hired, I think was Sarah Cope. The idea was we wanted to sell t-shirts and swag and stuff. So maybe I would just print a bunch of stuff. And then when somebody ordered it, we’d ship it out. We’d have a kind of a permanent swag business. But there wasn’t really companies around at the time that would just manage that all for you. Like there probably is now. So Sarah just did it. I had all this stuff printed, it went to her house. She lived in Ohio. She had a whole room of her house that got kind of taken over by swag.

And she would just, every day or every other day or whatever, run to the post office and mail out the orders that came in and all that. So that kind of cracked the nut on having an employee. And then she would help with more site stuff over time and then got too busy for it or swags started to diminish and sales and stuff, you know, things change over time.

I forget what was the end of it, but eventually she stopped working for CSS-Tricks and then other people would come on. You know, I had Jeff Graham was with me for so many years all the way up until the end at CSS-Tricks. And now he’s even going to go over to Digital Ocean and help continue working on the site there. He came on as like an editor and a writer, but then, you know, fell into more editing and more like site management and dealing with sponsors and just dealing with authors and just doing a ton of stuff on the site. That was kind of a moment when Jeff helped take over on some of that stuff. Partially naturally, just cause I, I felt too busy and I needed the help. These things are little moments in time where the site shifted and changed. Like, there was a whole, a whole period of time where I was trying to get staff writers.

I wanted to have a staff, like a magazine would. Of writers and that kind of worked for a little while, and then kind of stopped working for whatever reason. I can’t really remember. And we kind of fell back into a, just a one-off writer spirit, which was, the model that we ended with. I’m sure if I kept running the site for years to come, that that model would shift again over time. I’m not sure.

That model was pretty nice. Write in with your pitch, we work with you on your pitch. We publish the article, we pay for it. That’s what CSS-Tricks is today. And I think is the plan of how Digital Ocean is going to run it as well, because vibes pretty well with their content model.

[00:17:07] Nathan Wrigley: We’ll come to that in a minute. I’m just going to stay on the personal side of things, if that’s all right. We’ll split the next few minutes up into upsides and downsides. So you’ve got this project, CSS-Tricks, it’s taken off, you got money coming in and there’s bound to be upsides and bound to be downsides.

So let’s just explore those. Let’s get the downsides out of the way shall we? What are some of the things that looking back over the last 15 years, you recall as moments of headaches, heartaches, things that you wish you’d done differently or things that you wish, perhaps you’d never done at all?

[00:17:37] Chris Coyier: That’s tricky. There’s really not that many. I didn’t take as many risks running this site as other people and specifically entrepreneurs have. I’m really betting the farm on this and, if something goes wrong, I could be risking my house and home on it. I pretty much always have had other jobs as I did this. So my worry level was always lowish on what happens at CSS-Tricks. I always had in the back of my mind, like, man, if this thing gets burned to the ground, oh, well, there’s always something else I can do. But there’d be a little moments, at one time we published a sponsored post from some company that we really shouldn’t have.

It was like a company that sold SSL certificates, but that was actually kind of slimy about doing it. And that kind of like embarrassing moment where you get called out on it and you’re like, ooh. Or we publish something that, an article that didn’t take accessibility in mind nearly as well as it should have. Not just ignored it, but straight up bad accessibility practices in it and getting called out for that and having that be embarrassing, not great. Having people disagree with other advertisers or something. Those are moments that don’t feel good, but really aren’t that bad.

[00:18:48] Nathan Wrigley: No. Did you ever find it to be? I don’t know, maybe the words treadmill are suitable here. Was it ever, ever moments where you thought, oh, really? I’ve got to write an article for CSS-Tricks because I haven’t done one for a week or so. Did you ever feel it to be a grind or a noose around your neck?

[00:19:04] Chris Coyier: Sometimes the sponsorship related stuff felt like that. Honestly, it kind of did at the end. There was moments where you’d wake up and be like, oh my gosh, I totally forgot about this. It’s got to go out today. I got to wrangle the content for it. I got to basically look up with this company does because it made it this far, so it, it’s probably not abhorrent. It was agreed upon earlier, but I haven’t really researched what they do entirely yet. And it has to be my words. So it’s going to be a really quick turnaround and like, there’s some stress to that, that I didn’t really like. You know, what’s never stressful for me was writing about web stuff. If it’s just write a blog post about some link that I’ve saved, that I really, I saved on purpose cause I’m into it, and want to share it. I always liked that. I still like that. That’s not stressful to me.

What’s stressful is the stuff that you’re like. The only reason I run ads is to keep the site going because there’s people that need to be paid. This is a business that I’ve chosen to run. The agreement has already been made. Part of that agreement is that this content is going to run at this date at this time. And I do other things as well. You know, I have a podcast of my own and I have a much, much bigger project in Codepen that I’m a boss of, I’m a co-founder of, and I have responsibility for that needs the attention.

So if I’m off writing a blog post, that’s attention of mine that’s not being spent on Codepen and that’s something I wanted to change.

[00:20:29] Nathan Wrigley: Maybe a feeling of being spread too thin, but nothing too bad.

[00:20:33] Chris Coyier: Nothing too bad, that’s, that’s exactly right. I still, you know, I’m still waiting for that relief in a way. As you and I are talking, we’re less than a month off of the sale there’s still like, so much work to do that I haven’t felt any particular, the treadmill hasn’t stopped yet.

[00:20:49] Nathan Wrigley: Maybe we should have organized this podcast six months from now, and maybe you’d have felt the full weight of the relief.

[00:20:55] Chris Coyier: I’m enjoying the fact though that I get to be out on podcasts like this and talk about it though. So I appreciate that because, it’s nice to know that it’s at least a little bit of news In this industry.

[00:21:05] Nathan Wrigley: In my book, it’s a big piece of news. Let’s do the positives. Let’s do the upsides. So you’ve got a very successful website. You’ve affected a lot of people. You’ve helped a lot of people. You’ve probably met a lot of people. But there may be some unexpected consequences as well. So again, the same sort of question, but in reverse, if you look back over the last 15 years, what are the things that you’re really pleased about, that came about because of CSS-Tricks?

[00:21:32] Chris Coyier: Well, there’s so many. I was always pleased publishing an article and hearing people’s reactions to it. I think that’s part of the motivation and why it never became so painful or it never felt like a treadmill to write actual content, because it’s so satisfying. Even the early days, all the way through it, to write something and have people say like, oh yeah, I see what you mean there, that’s interesting.

Or have it actually influenced the article, or the industry in some way, you know, that you write some code that people use on their website and then they tell you about it or that they got some job because of something that they learned from CSS-Tricks or something. So satisfying, so satisfying, you know. And to kind of help people’s career in that way.

Sometimes they write for CSS-Tricks and that’s a seminal moment in their life and good things open for them. That was true for me too, though in that that CSS-Tricks was the thing that opened the door for me in other ways, like my first job. I had one job as a web designer that I kind of fell back wards into that was, it was great. It was, it was good to be hired finally to do web design work. And I was very happy to have that job, but it didn’t quite feel like a tech job. It wasn’t a startup. I was kind of the only web guy there not a newbie somewhere where everybody else knew more about building websites than I did, which is kind of what I wanted. And if I didn’t have CSS-Tricks, I’m not sure I would have been able to break into the industry in a way.

So CSS-Tricks exists. I used it in the early days, such a fan of this website, Wufoo. Which is a form builder thing. Yeah. Really great days for me. I was able to gush about it to some degree on CSS-Tricks, which doesn’t go unnoticed, if anybody was gushing about Codepen, I would, I would know about it, but blog posts have that kind of power.

I end up getting a job at Wufoo, which was my real break into the industry of tech. It was great for me cause I made more money and it gave CSS-Tricks more clout and it helped Wufoo too I’m sure, and really was just a virtuous cycle that started by virtue of that. And then I got to experience what acquisitions were like because Wufoo got purchased by Survey Monkey, which is a huge deal in my life.

Even though I had no ownership of Wufoo, I still got to like, take the ride with everybody else who did. And we all moved out to California because that’s where Survey Monkey was based. And that was just such a big transformative moment and lots of change, but really all positive in the end.

[00:23:57] Nathan Wrigley: Yeah, it’s amazing how much you can anchor back to CSS-Tricks. Just the fact that you’ve moved across country and perhaps the seed of that was a blog that you started many years before. That’s pretty remarkable.

[00:24:08] Chris Coyier: Speaking was a part of it too. It hasn’t been a huge part of my career monetarily, cause I think that it would be difficult to make your job, speaking at conferences. I don’t know if the pay is quite there in this industry. But, it can be part of a whole, that if you speak at conferences, then more people read your blog and you’re able to write a book and sell the book and all those things kind of feed into each other.

And CSS-Tricks definitely opened the door for me speaking at conferences, which I used to do a lot of. So that was a very positive thing. You know, that’s what I, and that’s what I got.

[00:24:40] Nathan Wrigley: It’s opened many doors by the sounds of it. Yeah. remarkable. So, more recently the news broke that you’d decided to sell it. Let’s just take that into two parts. The first part is why did you sell it? If you’re prepared to discuss that? And the second part is how. How do you even sell a blog? Maybe there’s a company which organized that kind of thing for you, or maybe you just stumbled into somebody and it just got done on the back of a placemat or something like that.

I don’t know. So let’s go first with why and then we’ll do the, how. Why did you decide to sell it?

[00:25:11] Chris Coyier: It’s all kind of mixed together because I didn’t set out to do it. I didn’t even shop it around really. I mean, maybe I should have or something, but I, it’s not really my style I guess. They came knocking, and I understood why. I was like, okay. Right away, it made sense to me why they would want it. I don’t think there’s a lot of suitors out there.

If I was making a list of companies that would have any desire to own CSS-Tricks. I don’t think the list is that long. I don’t mean to sell myself short, maybe it is. It doesn’t seem like blogs are a hotly traded commodity these days, you know. You don’t see a lot of blog acquisitions in a way. Especially one that’s so personal.

I think a lot of people attach CSS-Tricks to me, even though there’s so many guest writers that I’m kind of the face behind the site for better or worse. So why would you want to buy this thing that already has this face, you know? But in the case of Digital Ocean, they have long since doubled down on content marketing anyway. They would advertise on CSS-Tricks.

So they knew the potential of, surely they had analytics numbers of how successful that can be and probably were running internal numbers. That’s like, wow, what if we could do a lot more of that only, you know, we own the site so that the competition of who’s being shown advertising wise on the site falls away and it’s only us.

Content wise, I knew this, but I didn’t know to the degree of which this was true until this was further along, is that they have tons of content on their site that’s much more backend focused. I’m less backend focused as a person. So I just wasn’t as aware of it, I guess, but people that do lots of backend work, find their way to information on Digital Ocean’s site a lot.

It has just loads of good information that’s well regarded in the industry. To compliment that with buying more content that, hopefully is well-regarded content on the front end side, maybe fills a gap for them, especially knowing how important front end development is getting in the world of web development period.

I think there is a shift towards there just being a lot more front end developers because that skillset of knowing Javascript, and how much like easier hosting and stuff is getting and what a shift to JAMstack and stuff. I know that’s, a weird subject in WordPress land, but there’s a lot of that going on industry-wide.

I’m sure everyone can see that and being like, well, we should be catering, advertising, talking to front end developers as much as we are backend developers, because they’re starting to be the decision makers to, on even things like hosting. Which is what Digital Ocean is there like a cloud provider of services.

So they should be on front end developers radars as much as backend developers. And so I got it. You know, I was like, I understand why you would want this. And they’ve had some, they’re public now. So they have some money to spend and some money they, you know, so, so I was like, oh, I get that too. You know, maybe this really is a match made in heaven. And so knowing that, they could run the site, they could do it with more people than we have. You know, like I said, I’m trying to spend all my time on Codepen. So like, I haven’t sat down to say, okay, we got Jeff, we got Robin at the site. Maybe I should, like what’s a business plan for 2022, 2023 here?

Should we hire five more people and make a play at X, Y, and Z? Should we, what should we do? You know what? I would do, nothing. I would just be like, nah, let’s just keep doing what we’re doing. I don’t have the time to, to think about this. I don’t have time to staff up and, yada yada.

So when they’re like, we can put our whole community team behind this. I’m giving it to a site that I know why they want it. I have provable evidence that they do a good job with content. We can run the site with less advertising in general on it, which has always appeals to me as somebody who’s redesigned the site 19 times, the idea of redesigning the site without as much having to, to incorporate advertising into every corner of it possible seemed appealing to me. Like we could run the site a little cleaner that way and have all these people behind it and breathe new life into it.

And then of course there’s the money which I cannot talk about and don’t want to talk about, but, obviously that’s a part of decision-making duh, right. And having that be like, yeah, okay. That seems fair to me. Right on. I’ll get some of my time back, the site goes to a good place, that’s going to take care of it. It’s not even being redirected or anything. It just stays right where it is. So if you were an author who’s written for CSS-Tricks, it’s irrelevant to you.

Your, your byline stays right there. URL stays right there. If anything, your website is just being taken care of, or your article is just being taken care of by more people with even higher incentive than I had to take care of it and presented in a cleaner way, that’s just seems like a big old win-win. When I got to thinking about it and talking with my family about it, I’m like, it’s time for this change.

[00:29:58] Nathan Wrigley: Yeah. In the WordPress space, there’s been lots of acquisitions recently.

[00:30:02] Chris Coyier: Oh, yeah, what’s up with that.

[00:30:04] Nathan Wrigley: The thing, which always is released in the press release, which comes out the same day as everything is finally tied up and make public always makes the point that nothing is going to change. You know, it’s going to stay exactly the same.

Did you have any sort of red lines, any things that you said, please may we keep this bit as it is right now? Or are you just handing it over and saying, okay, it’s yours. You do what you wish.

[00:30:27] Chris Coyier: They told me early on that they were going to not, they were going to leave the site where it is. So that was part of my decision making. Now I can’t enforce that. There’s nothing in the, in any legal agreement that says that they can never change anything. I mean, it’s their site now they can do whatever they want for it, but it’s held true already, you know.

They’re just running it as it is there. And I think that’s, that’s a smart decision for now, I think because it’s complicated enough site, you might as well get to know it pretty intimately before you start making changes anyway. But I’ve seen it held true before though. I mean, when I went through that Wufoo Survey Monkey transition, you can go to Wufoo.com right now and they left it alone.

If anything, they just made it a little better over time. It hasn’t seen like intensive new development or anything, but it’s still a pretty darn nice website to make a web form on. So I lived through experiences where that stuff is no lie.

[00:31:17] Nathan Wrigley: Yeah. The only change that’s visible to me is they’ve put a fairly minimal logo next to the logo. If you know what I mean. It says powered by Digital Ocean.

[00:31:24] Chris Coyier: I mean, I did that.

[00:31:25] Nathan Wrigley: Oh, you did that. Okay. Yeah. But aside from that, it does seem to be exactly the same great content in exactly the same display. Just a complete aside from me, I have to commend your design. 19 ways that you’ve designed the site over many years. Every one of them breathtakingly good, so bravo for all of that.

[00:31:44] Chris Coyier: Yeah.

[00:31:45] Nathan Wrigley: Yeah, you’re welcome. It’s all tied up. The deal is done. You’ve mentioned a couple of times that you are going to concentrate on the project, which I think it’s fair to say is the one which provides for your family more than any other, Codepen. Have I got that right? Or are you, are you looking to branch out and use up that time that was on CSS-Tricks with something new or are you totally doubling down on Codepen?

[00:32:08] Chris Coyier: You know, if I had time that I really wanted to spend doing a side project thing, I would, I’d rather just stare at the ceiling at this point. I could use some, I use a little break. But now that time’s going to go to Codepen. Codepen, needs, we are in the middle of big, I mean, I guess changes is the right way to do it, but we have some big ideas for what Codepen could be, and we’ve had these ideas for a long time.

[00:32:31] Nathan Wrigley: Can I just stop you there actually. And can you just tell us what Codepen is? I know what it is, but maybe there’s a collection of people that will really benefit from using it. So yeah, just, yeah. Tell us what it is.

[00:32:41] Chris Coyier: Yeah. You know, and it started off as a thing for CSS-Tricks anyway. I mean, the stories are interwoven in a way. So Codepen is like a code editor in the browser. So pen is like the term we have for a thing that you create on Codepen, and it’s a social network in that you sign up for it, you have an account, do you have a profile on it?

It’s free to do so. Uh, and then there’s pro features. So it’s, uh, it’s a SaaS product, but freemium, you know, like you can sign up for pro and you get extra stuff. But the point of it is, you know, I follow you, you follow me, you’re making work, I’m making work and we can like each other’s work and talk about it and all that.

And those work are those pens and pens are HTML, CSS and JavaScript. It’s entirely focused on the front end side of the web. And people use it to like build little demos. They’re like, look at this, look at this thing that I’ve made. And sometimes it’s art. Sometimes it’s a reduced test case for a problem they’re having. Sometimes it’s a little example of something they’re going to send to a client. Sometimes it’s just an exploration of a cool idea they want to get out of their head. Sometimes they’re learning some new technology that they’ve never played with before. So why not do it on Codepen, because it’s so quick and easy to get started?

Sometimes people learning do it because it has this built in ability, basically when you stop typing into one of the editors, the code editors on Codepen, there’s a preview right next to it that instantly updates. So there’s that mental connection between the code that you’re writing in the output for it? Which of course you can wire up locally as well, but on Codepen, it’s just a website. So you click a button and you’re in that environment immediately. You don’t have to install anything. You can come back to it later and it’s still waiting there for you. You don’t have to save it to your file system and worry about losing it. You can search for it. I know I’ve just spit out a lot of words there, but the core of it is it’s easy to use code editor, right in the browser that has social features attached to it.

[00:34:38] Nathan Wrigley: So you’re going to be doubling down on work there. And presumably you’ve got a little bit of extra time to do that. What’s on the roadmap.

[00:34:44] Chris Coyier: Yeah. I mean, I can’t tell you everything in the whole roadmap, but some of it is fairly obvious in the stuff we’ve talked about already is that we want you to be able to do more on Codepen, but without losing the simplicity, that’s already there. There’s just the world of web development is ever-changing, which is just like a very obvious thing to say, but there’s always new libraries and new processors and new ways to approach building websites.

And we kind of want to embrace that change and build and change and morph our online editor experience to be just more ready forever change. You know, ready for whatever comes along the industry and gets ready for it and just make a much better online editor experience to the point where you’re like, this is so good, I want to use it. That you use Codepen because the editor experience is just so good, and integrates with everything that you need it to be integrated with and can build whatever you want to build with it, but still keeps that like simplicity keeps that catching people earlier in their careers.

That’s the one thing Codepen does well is we catch people early in their coding careers as they’re just starting to learn. I want to keep them, as they level up and learn more.

[00:35:54] Nathan Wrigley: Well, it’s linked from almost everywhere, isn’t it? If you’re learning something off a third-party website, you more or less guarantee that there’s a Codepen link on that somewhere, sort of demonstrating, okay, this bit of code will output this, okay, go and check on Codepen. It’s just used absolutely everywhere. It’s a sublimely good product.

[00:36:11] Chris Coyier: For me as I’m running Codepen, all I see is the things that it can’t do, you know, or the things that I wish that I could do. And so I want to, want to fix those, fix those gaps and get even more people. And then the business model, there’s some advertising on it like CSS-Tricks because there’s a lot of eyeballs on Codepen and it’s money worth making if you can. But I’d prefer to run it without that, if I could.

I’m sure that’s not good news to our, you know, our advertising partners or whatever, but sorry about that. I’d rather Just have the product be so good that that’s the way. It’s already 75% there. But the idea being that if you’re pro you know, you get all these extra things, you get the ability to make things private and you get the ability to collaborate with people in real time, and you get the ability to upload assets that will be your host for your assets if we want. And there’s all these things that you get for being pro.

I want to make those even bigger and better and bolder and have there be much more reasons for you to go and stay pro on Codepen. I think there’s just a lot of opportunity there. And, but this is a big thing.

Like CSS-Tricks I feel like I could run alone if I had to. You know what I mean, cause it’s just a blog, right? I know WordPress pretty well. I can write. That’s fine. Codepen I cannot. Codepen and I, there’s no way I can run alone. This is a very collaborative effort that takes lots of different skill sets to pull off. And it’s just, it’s the biggest thing I’ve ever done. And if we pull off everything that we’re trying to pull off, it will be the biggest thing I ever do.

[00:37:37] Nathan Wrigley: Just to wrangle it back to WordPress quickly toward the end. You’ve been with WordPress for a long time. You said every iteration of the website has been on WordPress. There’s been a lot of WordPress content. Obviously everything to do with CSS is helping every WordPress website. And I seem to recall purchasing digging into WordPress, your book Jeff Starr right back in the day, when I think he was still on version one. Are we going to see you hanging around the WordPress space at any point, or is that, is that a book which is closing?

[00:38:05] Chris Coyier: I’m very sure you will. I mean that would be like, absolutely no promises here, but wouldn’t that be neat. If you could build a WordPress site on Codepen? It’s not like we’re barking up that tree immediately, but like, that’s the kind of thing I have my eye on, you know, like, wouldn’t that be cool if CodePen was so advanced, you could build a WordPress site on it? Anyway, don’t read too much into that. But if I was going to build a new website tomorrow, and it was content focused in any way. I would just immediately pick WordPress to do it. I have ideas all the time. I was just driving around this morning and thought of some things that I think would be cool to build and do in WordPress. And I’m like, well, I absolutely don’t have time for that now, but I’m going to build that someday gosh, darn it.

[00:38:45] Nathan Wrigley: Well, it would be very nice to have Chris Coyier in our community for decades to come. Chris, for all of the hard work that you’ve done over the years, making everybody’s life easier to learn CSS, we thank you really, really has helped a lot of people, me included in that list. So firstly, thanks for that.

And secondly, thank you for coming on the podcast today. I really appreciate it. Just before we go. What are in the future, the best places to find you? That’s probably different to how it was six weeks ago.

[00:39:12] Chris Coyier: Well, not really, cause I you know, I’m a big proponent of having a, uh, a personal website. So mine is chriscoyier.net, a WordPress site of course. I did redesign it. It was on my list to do post-acquisition cause I was like, well, you know, I need to not have one of the first sentences say that I own and run CSS-Tricks on it. So I could have easily updated that sentence, but it’s also kind of my style to, just blah, I’m going to redesign it in an hour.

[00:39:38] Nathan Wrigley: I like it, by the way, it’s very, very bold and beautiful.

[00:39:42] Chris Coyier: That was about an hour’s worth of work this morning. Cause you know, the bones of a WordPress site, that’s this simple anyway, there’s no, it’s just a very simple header, a very simple footer and then just a couple of custom post types in there for the different types. There’s very little to this and I’ve done it so many times that really I’m not even exaggerating, it really was probably just a couple hours worth of work to knock out a little design like that and kind of update the text for what I want to that to say.

But all that said, it’s really my home base because rather than give you my Twitter or something, I’d rather give you my personal website, get the RSS feed. You know, you do want to follow me on Twitter, that’s all linked up from my personal website. Again, chriscoyier.net.

[00:40:20] Nathan Wrigley: Chris Coyier. Thank you so much for coming on the podcast today. I really appreciate it.

[00:40:24] Chris Coyier: My pleasure Nathan. Thank you.

How Promotions Ruin Dev Careers w/ Shopify’s Dir. of Engineering James Stanier

In so many professions, the reward for exceptional work is a promotion to management. Unfortunately, for developers whose programming gets them singled out for promotion, the skills to manage a team have nothing to do with the work that got them recognized in the first place.

James Stanier, Director of Engineering at Shopify, understands the pitfalls of being promoted from an IC to an engineering manager, and began writing as a way to think through the mistakes he himself was making. 

361: Forks in a New Tab

If you Command (Mac) or Control (PC) click the Fork button, it will open the newly forked Pen in a new tab in your browser. That’s new behavior. Before, it would open the fork in the same tab, no matter how you click. That was unfortunate, as Cassie called out:

Why didn’t it work like this before? Well, that’s what Shaw and I get into in this podcast. It’s a smidge complicated. The root of it is that that Fork button isn’t a hyperlink. It’s a button handled by JavaScript because of the nature of how it works (a fork might have data that only the client knows about: unsaved code changes). But Shaw found a way to make it work anyway, by essentially passing the metaKey information through all the forking process until that moment we had an opportunity to open that new tab.

Time Jumps

  • 00:32 What was the request?
  • 03:37 Being careful with target="_blank"
  • 05:14 The whole forking process
  • 07:16 A form for example
  • 08:41 How forks work on a pen
  • 10:47 How did you pass the data?
  • 13:41 It’s behaving like a link
  • 15:29 Sponsor: Notion
  • 17:18 A few issues
  • 20:14 People forking instead of saving

Sponsor: Notion

Notion is an incredible organizational tool. Individuals can get a ton out of it, but I find the most benefit in making it a home base for teams. It can replace so many separate tools (documents, meeting notes, todos, kanbans, calendars, etc) that it really becomes the hub of doing work, and everything stays far more organized than disparate tools ever could.

The post 361: Forks in a New Tab appeared first on CodePen Blog.

#20 – Oliver Sild on the State of WordPress Security

On the podcast today we have Oliver Sild.

Oliver has been working in the WordPress space for many years, and specifically with WordPress security, as one of the founders of Patchstack, formerly called WebARX.

Patchstack is a product which is designed to help you identify plugin vulnerabilities in your WordPress sites.

Over the past couple of years Patchstack has released an annual report about the state of WordPress security. The report for 2021 has just been released, and the podcast today is concerned with what they found out.

We talk about why they produce this report, and who the intended audience is. What are the main takeaways in terms of the overall security of WordPress Core, plugins and themes.

We then get into more specific details of what types of vulnerabilities and attacks seem to be prevalent in the WordPress space. Are there any trends which are useful to think about, and how WordPress security is managed by the community as a whole; are budgets and time typically allocated for prevention and restoration of websites?

Towards the end we talk about how some people have pushed back on the usefulness of the report. They’ve questioned the motivations of security companies to write such reports and the use of the language which they contain. Do they paint more of a negative picture in order to drive sales of their commercial solutions?

Useful links.

State of WordPress Security in 2021 Report

Patchstack website

Is WordPress security getting better or worse?

Rebuttal: How Patchstack is improving WordPress security

Oliver’s Twitter

Transcript

[00:00:00] Nathan Wrigley: Welcome to the Jukebox podcast from WP Tavern. My name is Nathan Wrigley. Jukebox is a podcast which is dedicated to all things WordPress. The people, the events, the plugins, the blocks, the themes, and in this case, the security of WordPress. If you’d like to subscribe to the podcast, you can do that by searching for WP Tavern in your podcast player of choice, or by going to WP Tavern dot com forward slash feed forward slash podcast. And you can copy that URL into most podcast players.

If you have a topic that you’d like us to feature on the podcast, I’m very keen to hear from you and hopefully get you or your idea on the show. Head over to WP Tavern dot com forward slash contact forward slash jukebox, and use the contact form there.

So on the podcast today, we have Oliver Sild. Oliver has been working in the WordPress space for many years, and specifically with WordPress security, as one of the founders of Patchstack, formerly called WebARX. Patchstack is a product which is designed to help you identify plugin vulnerabilities in your WordPress sites.

Over the past couple of years, Patchstack has released an annual report about the state of WordPress security. The report for 2021 has just been released, and the podcast today is concerned with what they found out. We talk about why they produce this report. Who the intended audience is. What are the main takeaways in terms of the overall security of WordPress Core plugins and themes?

We then get into more specific details about what types of vulnerabilities and attacks seem to be prevalent in the WordPress space. Are there any trends which are useful to think about, and how WordPress security is managed by the community as a whole. Are budgets and time typically allocated for prevention and restoration of websites.

Towards the end we talk about how some people have pushed back on the usefulness of the report. They’ve questioned the motivations of security companies to write such reports and the use of language which they contain. Do they paint a more negative picture in order to drive sales of their commercial solutions?

If you’re interested in finding out more, you can find all the links and the show notes by heading over to. WP Tavern dot com forward slash podcast, where you’ll find all of the other episodes. And so without further delay, I bring you all Oliver Sild.

I am joined on the podcast today by Oliver Sild. Hello Oliver.

[00:03:16] Oliver Sild: Hello Nathan, how are you?

[00:03:17] Nathan Wrigley: I’m very well, thank you for joining us today. Oliver Sild will no doubt be able to introduce himself, but I’ll just do a very quick job. Oliver is, I believe, one of the founders, if not the founder of Patchstack, formerly WebARX, which is a security solution for WordPress websites amongst other things.

So my first question to you all about, just give us a little bit of background, certainly more than I just provided. Tell us about your history with WordPress and how you came to be involved with WordPress.

[00:03:47] Oliver Sild: Yeah. So in 20, 20 13, 20 14, around that time I was actually running a web development company we were mostly back then building websites in Joomla and then I remember just at one point, the demand on the market changed pretty much everyone wanted to WordPress site. So that kind of naturally moved us from Joomla to WordPress, and because our company was, we were calling our services like a secure web development. So what we wanted to do is that if we are building you something we’ll also make sure that the security side of that is covered as well. So we already had some level of internal tools built which were helping us to track what kind of software we were using on our different kind of customer’s websites. And that eventually, well, by now has turned into what Patchstack is.

Okay.

[00:04:40] Nathan Wrigley: Thank you very much, indeed. So security is your thing. And very recently there was a piece on the WP Tavern website, which I will link to a little bit later, which was highlighting the fact that you had released one of your annual reports.

I believe we’re on possibly the second iteration now. It’s called the state of WordPress security. And in this case it was 2021. So it’s a look back over the last year in WordPress security. And we’ll go into that. And that really is the point of the podcast today. We’re just going to appraise all of the different bits and pieces that you highlighted there because I’m imagining that most people listening to this podcast are deeply into WordPress. And this is obviously a seriously important side of any WordPress website, keeping it updated and secure.

And then towards the end of the podcast, we’ll go into a little bit of an exchange that happened over on a website where somebody called into question the language that you’re using over here, but, okay, so first thing I’m going to suggest then is that if you’re listening to this, you may like to go to Patchstack dot com forward slash white paper forward slash the state of WordPress security in 2021. All of those words are separated by hyphens. And you’re going to find the article that we’re talking about.

It’s broken up into lots of different sections. But first question is why are you making the efforts to write this report? And we know that you have a WordPress security company. That is your job. That’s what you do, but why go to the lengths of illustrating what’s going on in the WordPress space so that people like me, the general public can consume it? It must require quite a lot of resources and effort.

[00:06:14] Oliver Sild: Indeed yeah. I think we put that report together for three months. So it’s quite in depth by the way. If you want to quickly open up the white paper, you can just go to Patchstack dot com, we have with the banner on our front page that’s actually linking to that, but that’s a side note.

We actually did that first, last year. So we last year released one about the previous year and we started doing that on the point where as a company, we decided to switch into a very specific focus on security vulnerabilities found in the software that is built for and around the WordPress ecosystem, which is the WordPress Core, the plugins and themes and the wordpress.org repository.

But also the WordPress plugins and themes that are built as a premium ones that are not in the WordPress repository or the ones that are actually built or like being provided, some other marketplaces like Envato and so on. And by doing that, we switch the, like we have a SaaS product that is providing, we have a free version of a SaaS product where you can like, just connect like 99 websites, for example, and have a central overview if any of the plugins on any of your websites is becoming vulnerable. And at the same time, we started, looking into those different kinds of popular plugins and if they are vulnerable or not, then for years we’ve been providing code review and security auditing services for plugins.

By doing that over the time, what we’ve collected together is like a quite big database, so security issues around the WordPress ecosystem. So if you go to Patchstack dot com slash database, you actually see a full-blown list of all of the security vulnerabilities that are in the plugins, themes, WordPress Core, and so on.

And last year, what we did is that we figured, we understood already by doing surveys and so on that actually plugin vulnerabilities and theme vulnerabilities, and like anything that you are running on your website that becomes vulnerable, is pretty much the number one security threat to the website. And then we started a thing that we call it today Patchstack Alliance, where we just decided to start building a community of ethical hackers, who then submit vulnerabilities that they find in any WordPress plugins in the ecosystem to us. We make sure that we help the plugin developer to fix those issues. And then we actually pay to those ethical hackers for the contribution that they make to the WordPress security.

And that’s on the other hand, generates a lot of data for us. So a lot of data about new vulnerabilities. A lot of data about, what is actually happening in that ecosystem. And we just decided to pull all that information and data that we have collected over this time and make it into a kind of annual report or a white paper.

[00:09:09] Nathan Wrigley: Yeah. It’s really definitely worth having a look at, because it portrays, obviously now that you’re in the second iteration of this, you’re able to compare the way that things were last year. And in many ways, this is a comparison piece based upon last year. And so we often hear the phrases, such and such a thing is up such and such a thing as down, you’re looking for trends basically.

The main gist is three sections. As you described, we’re talking about WordPress Core, WordPress themes and finally WordPress plugins. There’s obviously a little bit of nuance in there. Do you want to illustrate for us what you’ve found to be the big highlight bullet items, if you’d like for those three areas.

So should we start with Core? Let’s discuss what it is that you found over the last year in terms of the security or otherwise of WordPress Core. To paraphrase, it seems pretty good.

[00:10:02] Oliver Sild: Yeah. Like WordPress has quite mature software development cycle. WordPress the core, also has the bug bounty program.

They have the bounty program on hacker one. And who doesn’t know what backcountry program is? It’s basically, like you say to hackers, come hack my software. If you find something report it directly to me so I can fix it, then they will pay to you. So this is the approach that is being, is becoming very popular.

That’s the same thing, what we do to plugins, but WordPress has its for it’s own core. So they do that, which is nice because that is actually getting much more security attention on the WordPress Core. And at the same time we see less major security vulnerabilities being discovered in the Core itself. And something that we also saw this year, which was a little bit different was the dependency confusion attacks, where there was like a high risk of being maybe like a custom plugin being updated from the wrong source. I think the Core had an interesting year, but what we see is in general that the Core has a matured development kind of processes and cycle in place. So it’s getting better each year.

[00:11:14] Nathan Wrigley: I think in the year 2017, I believe it was, the bug bounty program began with hacker one and it would appear, it seems to have worked because over the years after that, there’s been a fairly precipitous drop in the amount of concern with WordPress Core. In fact of the four security updates that were released in 2021. And again, we’re talking about Core it would appear that only one of them had a critical vulnerability, which wasn’t actually concerning something that was Core. It was an insecure component. It was PHP mailer library if I remember rightly.

So that points to the idea that anybody these days is saying that WordPress itself is an insecure platform, which I’m sure we’ve all encountered when we’ve been building client websites and so on, people have this fear that WordPress itself is pretty insecure and your document seems to imply exactly the opposite. It’s very robust and very secure.

[00:12:13] Oliver Sild: Yeah, and if you read our white paper, we actually say that, we are saying that WordPress has done a very good job at that. WordPress is getting more and more security attention, obviously, as it’s running, soon, almost like the half of web, basically.

It makes sense that it gets more attention. More attention means more stuff is being found, more stuff being found means more stuff is fixed. And this is a good thing. And in terms of like the whole mature way of how there’s regular security updates and regular updates for the core itself. It shows that the core is doing really well.

[00:12:51] Nathan Wrigley: Do you want to illustrate for those people who perhaps aren’t familiar, one of the headline paragraphs that you’ve got right near the top is, the dependency confusion attacks. Now this may be something that people are very familiar with. I suspect maybe not. Do you just want to outline what those are and why you’ve illustrated it in the report this year?

[00:13:09] Oliver Sild: Yeah, we call it the fear of dependency confusion attacks, because we didn’t really see any dependency confusion attacks specifically. Like I was mentioning before, there was a risk where if you have a custom plugin that is not on the wordpress.org repo. And if you are adding a new plugin to the repo with the same slug that this custom plugin was using, then you could pretty much overwrite the custom plugin on the websites that it was running at.

So this was like, a risk where if there is like a plugin made by someone, maybe installed on like very high profile websites. This plugin is not known to the WP dot org, or it is not on the WordPress dot org repo, but someone made a plugin for, with the same slug and it went past it. And then the auto-update mechanism in the WordPress Core would basically update this plugin, now, which was a core, which was a custom plugin into the plugin that is now in the WordPress repository.

So basically replacing someone else’s plugin with a plugin made by another author. The content can be checked by the wordpress.org, like what actually this new plugin would do. But at the same time, of course a bit of a fear, I think a lot of people were afraid that this is going to affect everyone, but it was more of a theoretical thing that was a risk, but we didn’t really see any of such effects happening.

[00:14:37] Nathan Wrigley: Yeah in software, in general, nothing to do with WordPress, this kind of supply chain attack is potentially a real problem, isn’t it? Because if you can somehow become the official canonical source of the software, even though you are not the official canonical source of the software, you could in theory, get to many, many places very, very quickly.

And and it’s nice to see that you’ve not really found too much evidence of that over the last year. So WordPress core itself, I think it’s fair to say, you feel is in very good shape. The problem is really for WordPress and I’m sure this is something that many people can relate to if they’ve been using the software for any length of time, we’re going to get into themes and plugins. This is where I guess the problems begin to arise. Let’s tackle them in turn. Let’s go for themes first. What were the broad sweeping outlines that you that you discovered in your exploration of themes this year?

[00:15:32] Oliver Sild: I think this has been happening over the time, but basically what we see is that the line between themes and plugins is getting blurrier and blurrier Themes now use a lot of PHP code for, site builders are also, people considered as themes in a way, but then at the same time they actually a plugin. Yeah, so the line is getting blurrier and more PHP code is being introduced into the functionality of the themes, which basically brings the same kind of threats to the themes that we have with plugins, where there can be a kind of vulnerable PHP code that can be a trick doing something that was not meant to.

And what you saw is that there are vulnerabilities within themes that are as critical as you could expect from the plugins. It isn’t from this report, but I think a good example is. It was just recently with Freemius library, which was used by a lot of themes. And this is like exactly the supply chain issue where, there’s thousands of websites that are using one theme, and if this one theme becomes vulnerable, then all these thousands of websites are vulnerable. But now we’re also seeing where there’s thousands of themes on these themes use a library, and if this library gets vulnerable, then all these thousands of themes become vulnerable. And all those, I don’t know, hundreds of thousands of websites that use these thousands of themes become vulnerable as well. So this, you can see how this is coming, like from top to the bottom and eventually affecting a lot of websites. So as an example, I think two or three weeks ago when the Freemius thing happened, I think we, I believe we added 1,800 different vulnerabilities or vulnerable components to the Patchstack database in a single day.

So next year is going to be definitely more, we have more data that’s definitely from this year about theme vulnerabilities than we have from the past year.

[00:17:35] Nathan Wrigley: There were a fair number of what you might describe as critical vulnerabilities. There’s a list that you’ve described, depending on how interested you are in security.

The names of these things may be of interest or otherwise, but things like unauthenticated, arbitrary file upload and option deletion, that would appear to have been found at least in your case, 10 times in 10 different themes. Unauthenticated upload vulnerability, leading to remote code execution, which you’ve found in one theme.

Arbitrary file upload vulnerability, 42 themes were affected. So it’s fairly widespread. And I guess if any of those themes are incredibly popular, that can quickly get out of hand.

[00:18:16] Oliver Sild: Absolutely. If a single plugin that has, especially those unauthenticated vulnerabilities are the scariest ones because they require no access to the website, like any permissions to your websites and someone could basically, the malicious hacker could potentially upload file to your site without gaining access to the website. So this kind of vulnerabilities are very scary as they can be abused automatically and on scale. So indeed, like if a single plugin would have a hundred thousand installations and it would have just one, this one vulnerability, especially for unauthenticated one, then what we are seeing is that hackers very quickly build custom tools to start finding all the websites on the internet that use that theme and then start exploiting them automatically to inject backdoors or redirect traffic from the website, change the search engine results for your website. So if you watch, if you look at the website everything seems to be okay. But if you Google your website, for example, then it would give completely different results and redirect your site to somewhere else.

[00:19:24] Nathan Wrigley: So, is the trend in terms of themes, is your experience that there was more concern over the last year than there was in the previous 12 months? Or is it essentially the same quantity of vulnerabilities?

[00:19:39] Oliver Sild: I guess the trend is the fact that the vulnerabilities are just becoming a little bit more critical. I wouldn’t say that there is a big trend in terms of that there is like a massive increase in the vulnerabilities in themes, but I think the fact that so much more functionality is being shipped with the themes in terms of the PHP code in general than they are just more and more prone to being introduced or introducing that kind of critical vulnerabilities into the code.

[00:20:07] Nathan Wrigley: Yeah. Okay. Thank you. Let’s move on to WordPress plugins and this, as one might expect, has possibly greater numbers attached to it. There’s more plugins out there, and I would imagine that most websites have got one, possibly two themes, whereas they might have 15, 18 20, whatever the average number now is plugins. So there’s probably a bit of a larger target painted on plugins back than there is on themes back. Give us the overarching findings in terms of WordPress plugins for 2021.

[00:20:40] Oliver Sild: Yeah. Plugins are the ones that we’ve been focusing the most on. And these are the ones that our Alliance members or like the community of the ethical hackers that are reporting new vulnerabilities to us. Majority of the vulnerabilities that are being reported to us are about the plugins. If we’re looking about the total number of new vulnerabilities that we’ve added to the database of vulnerabilities that effect the WordPress Core, plugins and themes, then there has been quite heavy increase in if we compare it to the last year.

But that means that is actually very good news because that means that these are vulnerabilities that the developer has been able to get fixed because these vulnerabilities didn’t appear this year. These vulnerabilities probably in many cases at least they were sitting in those plugins for quite some time already. What just happened, why there is an increase in new identified vulnerabilities is just the fact that there’s more people looking at those, and reporting them to the developers.

[00:21:49] Nathan Wrigley: There was a couple of plugins, and I guess this is the difference with plugins is that really the sky is the limit in terms of the numbers of installs. I don’t know what the largest install base of any particular theme is, but I’m guessing it is nowhere near the install base of the largest WordPress plugins. And so there was a couple that you mentioned in one case, one of the plugins that had a critical vulnerability this year was over 3 million website installs.

And then there was another one with over a million. The seriousness of that is pretty obvious I’m sure. The quantity of people that are affected. You seem to be saying that in terms of the conscientiousness of the developers, you seem to be fairly happy with that, in that a lot of vulnerabilities got patched fairly quickly and disclosed in the appropriate way.

However, we’ve still got this legacy of older plugins. In fact, you mentioned nine that have been removed from the repository, completely gone from the repository and yet have vulnerabilities, which essentially are going to stick around for ever.

[00:22:56] Oliver Sild: Yeah, these are the most scariest ones. Like in, in most cases what we see is that developers, once a security report is being delivered to them, they look into it and they release a patch. So they fix it in most cases, the vulnerability doesn’t become publicly disclosed before that happens. Like, we also have our own disclosure policy where we just don’t like, we let the developer know about the vulnerability that was reported to us about, his, or her plugin, but at the same time, we keep it.

We don’t publish that before we make sure that the developer had enough time to fix that. And also after that, that they have time to let their own users know that there is a security update and they should basically, update the sites as fast as possible. Just to make sure that we don’t cause any unwanted damage where this information might get in front of the wrong person.

And we, what we wanted to do this year is we counted all the critical vulnerabilities and by critical, we mean the ones that are actually being, are actually the vulnerabilities that have the characteristics that hackers would want to automate exploitation attempts. So that means that it’s usually unauthenticated vulnerability, that basically you can either inject something to the website, add a back door or something, and you can fully automate that. And there was, yeah, like I think we counted, I think it was 35 different plugins that had that kind of vulnerabilities in last year. The scary part was that many of them didn’t really receive a fix at all.

So these are plugins where the developer was either, had abandoned the plugin, was not active anymore. So in that sense, if you were running this plugin for example, if you were part of those plugins that didn’t ever receive a patch for this critical vulnerability. In your WordPress website, you would just see that everything is up to date.

You would never see that there is an issue with this plugin unless you are being notified by like some security product or something that would say that, Hey, there is a vulnerability in this plugin. So this is a bit scary.

[00:25:09] Nathan Wrigley: Yeah. This, I think we should dwell on this actually, because it seems like this is a real failing, or at least an area of possible improvement in the future. So let’s just reiterate what we’ve just said. So we’ve got a plugin, which has discontinued support. There are no ongoing updates for whatever reason, this plugin, which is in the repository is stalled. Nobody’s going to update it in the future.

Now, at some point in the future, a vulnerability is discovered in it. It could be severe, it could be minor. It doesn’t really matter, but the point being that any WordPress user would never be alerted to the fact that something here is awry and something needs updating, because the only mechanism we’ve got in the WordPress admin area is to see when things need updating.

And so we update them. And if there’s no update, the assumption would be everything must be fine. How on earth do we overcome this problem in the future? Do you have any thoughts on a process that we could adopt or some direction of travel that we might move in to make this go away?

[00:26:15] Oliver Sild: Oh yeah, it requires a lot of awareness building around the ecosystem in general. We need to talk even more about the security in the WordPress ecosystem. We need to make sure that developers are also the ones that are not afraid to talk about security, because over the years, what we’ve seen is a lot of developers, like the plugin developers, specifically have been worried about like even dealing with security issues because they don’t want to be highlighted as, oh, this plugin had the vulnerability.

So they see this as a negative kind of attention. In fact, for me, for example, completely from the opposite side see it as a very good sign that this developer actually takes attention on security. But that’s obviously because, from my end, I just see that there are so many vulnerabilities in different plugins.

And the fact that there’s just increasing numbers of them now being reported from the last year, in our white paper, for example, that just the fact that more of them are being identified and being reacted on. It’s not the fact that there’s now, more of them, but they are at the same time what they see constantly is that the developers don’t need to be afraid of the security issues in a sense where they try to avoid those issues. And I think there should be even more and more open discussion about, hey, let’s together make the security in the plugins and in the software better.

And I guess in terms of the core, I guess at one point core would need to have some level of security incorporated to basically give an insight on the plugins that are being used on the websites. For that specific reason, for example, because there’s been so much people saying, even from people that worked in the wordpress.org, we’ve seen people saying that, yeah, basically you just need to enable auto updates and you would be fine.

But it’s not true. It’s just not true because in many cases like that, you can have auto updates enabled, but this there’s no update, if there is no update for the plugin, basically you don’t even know about issue. So I guess, yeah, this is definitely something that needs attention over the years. We are doing our best, like our product is actually literally covering that area of letting the users know if there’s a vulnerability, even if this plugin is being removed from the repo, or even if this plugin didn’t even receive a patch. So we are letting our customer know about that. Then we are also providing a patch to protect against the attacks against these plugins. But at the same time, yeah, I think this is clearly a issue that needs more and more attention.

[00:28:58] Nathan Wrigley: Yeah, it would be nice to come up with some kind of system which didn’t break things, which enabled, I don’t know, perhaps these particular plugins to be disabled. In some way removed, but then that of course has all sorts of implications in terms of the ownership of the site and whether you actually want people to have the capacity to be able to remove things from your website. People flock to WordPress because you get to own everything. It’s yours, and you can modify it as you like. And the idea that some plugin could be removed, disabled without your say so, is one that I’m sure the community would definitely want to have a long and deep conversation about. But interesting. You found nine that had these problems this year and there seemingly is no way of automating that problem to go away, as yet.

Okay, so we’ve dealt with core, we’ve dealt with themes and plugins and what I’ve just described as orphaned plugins. Let’s just talk about the broad bits and pieces that your report highlighted this year. Some of it is good. Some of it is less good, but the first sort of headline pieces that you’ve definitely found that there was a rise in vulnerabilities found compared to 2022. On the face of it that sounds like a bad thing, but you’re saying that there were many more in the previous year than in the year prior to that.

[00:30:24] Oliver Sild: Yeah, it’s the best news of the white paper, to be honest, because that means that there was 150% more vulnerabilities being identified. Imagine if there was zero vulnerabilities being identified and only, and all those vulnerabilities would be sitting there, still doing that, and just nobody would know about those, until someone who with malicious intention could just take advantage of them.

I wouldn’t be surprised if this year we are going to see even a bigger increase because there’s just so much more attention being put into identifying those vulnerabilities and helping the plugin developers to make their code even more secure.

We are for sure investing a lot into it with Patchstack Alliance. Like last year we paid out like 13 K in the bounties for like individual ethical hackers who just let us know about vulnerabilities that they found in any plugins in the WordPress ecosystem, and we just paid them for that effort. So we’re definitely going to double down this year on that as well. So we’ll see how that will affect this year.

[00:31:31] Nathan Wrigley: Yeah, it’s interesting because on the face of it, if the number of vulnerabilities is larger, the immediate instinct around that is to assume that things have got worse. And of course the statistics could be for all sorts of reasons. As you’ve just described, there’s perhaps more eyeballs looking to discover these things. There’s initiatives like your own and the bug bounty, which have enabled people to actually feel that they’re getting remunerated for that. And so they’re more serious in the endeavor to search for them. But also, maybe it’s a product of the fact that WordPress itself is just growing, and as it grows, there’s going to be more eyeballs looking for these things, but also possibly it becomes a bigger target. And so there are more of these things out there. There’s more plugins, there’s more themes, there’s more code and it’s just a sort of byproduct.

But anyway, interesting take on it. Definitely worth looking at. That was the rise in vulnerabilities now onto more sort of specific details about what these types of vulnerabilities are. A significant proportion of the things that you concerned yourself this year with were XSS vulnerabilities, which is cross site scripting. For those people who are not really familiar with that, would you just paint a picture of what cross site scripting vulnerabilities are, and any thoughts on why it represents almost 50% of everything that you’re seeing?

[00:32:54] Oliver Sild: I think cross site scripting is just one of the easiest things to find the web. See, cross-site scripting, for example, you take like a website search bar, if you go to a WordPress site and there’s like a search bar. And if you, for example, write inside of this search bar, like HTML code, for example, and then what happens is that this, the functionality that is searching this information from the site for example, is going to show you the results, and this HTML code that you put there would then basically be meshed together with the kind of code of the website and it would just basically load it.

I think actually even a better example would be with comments. Wherever you have, like WordPress don’t have that issue, but for example, or earlier days, there was a lot of websites with commenting sections. And then if there was an issue where if you basically post any HTML code with some, maybe Java script, something that was maybe popping up like an alert for you and you post that comment there, then what would happen is that the site would then basically render that into as part of the code of the website.

So when it was even saved in that case, then the siet would basically load the code that was posted there as actual comment. So this is like a sanitation thing as well. So you want to make sure that you make a difference between actual code and what the content is that is being submitted to the website or the input in that sense.

[00:34:26] Nathan Wrigley: So it represents almost the majority, 49.8 something percent of everything that you find. But I guess that is as you describe, it’s because it’s relatively straightforward to pull off. Possibly at least from my perspective, the vulnerabilities then shrink in terms of percentage and towards the very bottom, I guess the worst really that you could have is remote code execution. And that number is not 0.94% of everything that you were looking at. So I guess there’s some positive message to come out with that. Less than 1% of all the things were truly very serious indeed.

[00:35:02] Oliver Sild: Yeah, indeed. As always easiest stuff comes out the first. So these are the ones that are usually reported the most, that are mostly visible and accessible in terms of, for even a simple thing can just submit something into a comment form, and see if it’s going to load something in a weird way. So this kind of vulnerability is going to be found very easily.

[00:35:27] Nathan Wrigley: Yeah. Now moving on to plugins. Curious thing that you’ve discovered again from the data that you’ve managed to gather is that there are actually fewer plugins in use, which, you would imagine, would reduce the attack surface. And so you would equally think that the number of things that you were having to clean up regularly or that you were discovering had been broken, would go down. But it seems that there’s a sting in the tail. So there’s fewer plugins, but more of them are being left without being updated.

[00:35:56] Oliver Sild: Indeed. Yeah. This was an interesting find. I expect that, I do still expect that the number of plugins, we’re going to see this number dropping more and more, even in the upcoming years, as people are getting more and more aware around the security implications when you’re just, using a lot of plugins on the website.

But I think it’s also about the kind of hygiene thing where users are also not so prone anymore to leave like deactivated plugins standing there on the website. So they’re starting to delete those things. And I think people are seeing more and more that plugins, like each of the plugin that you install to your website can be like a link, can be like an entry point for a hacker if there is a vulnerability found in that specific plugin.

So basically the less buttons you have, you reduce the risk significantly. So it was interesting yes, to see that even though the number of plugins installed per website is actually dropping. But at the same time, the amount of plugins out of those that were outdated was actually higher. I’m not a hundred percent sure that what is like the actual cause of that, or if it’s just like something that we see this year, but I think next year we’re going to have more data to see more into why that could be.

[00:37:21] Nathan Wrigley: Yeah, it’s curious on the 50,000 websites that you were analyzing in order to generate this report down from 23 plugins and themes, now residing at about 18. 18 different plugins and themes installed. Yeah, that’s interesting. We’ll revisit that next year and see where we’re at. I guess this is a fairly obvious thing to say, but it was worth pointing out, the seventh point on your list of things was that the easy to exploit vulnerabilities remain the main targets, like I said, that’s fairly straightforward.

[00:37:52] Oliver Sild: Anything that is unauthenticated and basically that can be automated.

[00:37:57] Nathan Wrigley: So it’s old tried and tested things that the hackers know can be achieved. They’re going to go after the low hanging fruit. And sadly, the eight point that you make is that old vulnerabilities remain as great big targets. So things which could have been fixed from last year, still are hanging out there and being exploited.

[00:38:19] Oliver Sild: Yeah, indeed. I think a big reason for that, there are all these automated hacking tools. I mean that people don’t load from Github or from hacking forums and places like that, where guys who, you know, sometimes kids who get into, like looking into hacking, trying to maybe yeah getting into that field. They are basically downloading software that is prebuilt by someone and there’s someone made it at the point where there was specific vulnerabilities just introduced. So they have hard-coded the exploitations into those tools and these tools are still available, and people who are getting into the kind of dark side, I’d say, are then starting to play with those tools.

So this is one of the reasons why we see that happening. We’ve seen a few of those tools as well. This kind of proves the point. But then in terms of that, like there isn’t a lot of hits that these tools are probably getting, because most of those websites that running those plugins have already been either patched or either hacked already and then patched.

[00:39:29] Nathan Wrigley: Yeah. An interesting thing that comes up later is really around the personnel who are responsible for updating things. And you’ve got a couple of points on this, but we’ll try to tackle them in one go. Whilst there’s an increase in awareness of security on WordPress websites, no doubt because of publications such as your own, it would appear that there’s not a lot of time, space, money provided. So who is responsible for updating things could be really crucial. And it says on your report that 53% of respondents stated that they updated their components weekly. Some, perhaps as many as 20% did things daily. 18% possibly monthly updates happening. So that’s quite an important blend in the picture. That the frequency of updates, crucial I suppose. If you’re leaving things for an entire month and a not keeping yourself up to date with the news, I’m sure that there’s many websites where monthly is just off the charts. It would probably be more like every six months or possibly not at all.

But then also, the difficulty in actually finding a budget to do these things. And you make the point that many, many websites be they run by an agency or an individual, or just a solopreneur. They have no budget for this kind of thing. They’re just crossing their fingers and hoping for the best. So do you want to talk around that? The people involved, the time that they’ve got, the frequency of updates and the budget that they’ve got?

[00:40:59] Oliver Sild: Yeah. The frequency is an interesting take because in terms of how fast we are often seeing attacks happen against websites when a new vulnerability, or let’s say a critical vulnerability is being found in a plugin that the website is using. These like when we are not even talking about zero days in this case. Zero days are the ones that nobody knows the vulnerability before it’s already being attacked.

But for example, sometimes the vulnerability is being discovered, disclosed. And after that, hackers learn about that and then they are going to basically exploit that. So there’s like a cat and mouse game. Who patches first? Is it the hacker or, sorry, who uses the vulnerability first? Is it like the website owner who was going to update this and patches it, or is it the hacker who manages to exploit this before to website owner managers to update it?

And this time period is actually somewhere around one hour.

[00:41:54] Nathan Wrigley: Wow.

[00:41:54] Oliver Sild: Yeah. So this is something that has to be kept in mind that, daily updates sounds good as well. And from there on, the longer time to take for updating, the more risk there is for the website.

But the interesting thing is like the auto updates. Have you put like WordPress autoupdate into Google search and look that into what kind of articles are popping up?

[00:42:21] Nathan Wrigley: No, but I can imagine you’ve got some interesting insights there.

[00:42:25] Oliver Sild: Basically the majority of the articles are about how to turn off WordPress auto updates.

[00:42:32] Nathan Wrigley: Yeah.

[00:42:33] Oliver Sild: I remember when WordPress auto updates came for the plugins, and basically like most of the kinds of articles or like how-to’s use we’re about to come to turn it off. Because people are still scared the websites are going to break down if there’s some feature breaking update coming for a plugin. So this is something interesting about the updating side of things that we’ve been seeing over the year.

[00:43:00] Nathan Wrigley: Yeah. That’s a really interesting, difficult seesaw to think about. The idea of being, if you switch off auto updates, which of course is available for multitude of things in WordPress, including plugins, you can just have click a button next to the plugin and it will just automatically update it.

A lot of people concerned that the update might break the site. So in terms of them having to do some additional work to un-break it, or re-install from a backup or whatever it is that they need to do. That concern in many cases overrides the possibility that there could be some vulnerable software there, a plugin, which is vulnerable.

I guess it’s a difficult one to decide which way to go. But it’s curious that a lot of people have decided to not implement automatic updates because presumably of the fear of things going astray in the way it looks or a plugin breaking. And of course that is a legitimate concern.

Just seen over the last week that a couple of major plugins had problems where they broke significant parts of the websites, and they had to roll back those updates and then ultimately figure out a patch and then release that as the new update, which then got automatically updated. So I can see where people’s concerns come from there. I guess your advice would be switch on automatic updates because having a hacked website is probably better than having a modestly broken website.

[00:44:23] Oliver Sild: Yeah. And actually the other way around. I heard you were saying that the hacked website is better than broken website. So I was saying the other way around, so it’s better to have a broken website than a hacked website.

[00:44:37] Nathan Wrigley: That’s what I intended to say if I got that wrong. I apologize. Yeah.

[00:44:40] Oliver Sild: But yeah, basically, yeah, it’s better to have a broken website because you can at least put the maintenance mode on and do something about that and fix it. And usually like how WordPress is behaving right now is that it also lets you know if something was breaking down and it doesn’t like, the site doesn’t throw you a bunch of errors.

It isn’t like that anymore. So it isn’t that much of a risk at that point anymore to be completely afraid of plugin auto updates.

[00:45:09] Nathan Wrigley: Yes. Then that’s a good point. And you will also hopefully receive an email with some kind of information about the problem that may have brought your site down.

Okay. Turning then to the budget. This is really interesting, the data that you’ve gathered, as much as 28% of people who responded said that they basically had zero budget to protect their websites. In other words, 28% of those people were just hoping for the best and crossing their fingers. And a further 27% said that they had a monthly budget of between $1 and $3.

The numbers vary. There are people who had significantly more and people who were somewhere in between, but quite an interesting spread there from zero to quite a lot. And the majority of these numbers are tending towards a very small budget I guess that you would argue that, it ultimately, it would be better to have something than nothing.

[00:46:01] Oliver Sild: For sure. Yeah. I guess the zero budget also means free plugins right? In a way of using like free security plugins and then it doesn’t mean a hundred percent that don’t use anything or they don’t have any measures in place. But at the same time, what we are also seeing is that security is still a hard sell.

Especially when we talk to agencies where the customers are like, aren’t you supposed to take care of it? Not understanding that the security is a thing that needs to be taken care of separately. That is a part of ongoing process and that you should basically prevent them rather than just deal with the consequences later on.

There was another good point where we also asked from the same people about how much they have paid for malware cleanups within the past year. And that was like, there was one, I think the highest responder was like, who said he spent 4.8 K dollars on cleanups last year. That’s a lot of websites that you can secure or protect.

And basically we even get some sort of service on top of it, or like incident response assistance that like we offer where, specialists are jumping in and fixing everything if something should happen, even though we had security in place.

[00:47:21] Nathan Wrigley: Now, obviously you’re here representing Patchstack, and Patchstack is a commercial company. You’re in the business of securing websites, but you’re also in the business of paying your employees. So you need to pay to use the service. There was an interesting piece which got written over on the Master WP website, and I will make sure to link to it in the show notes. And there’s a further piece which we’ll get to in a minute.

It was written by Rob Howard on March the 14th and it was called, is WordPress security getting better or worse. In this piece, he takes your report to task and largely it’s around the kind of language that you use. There’s definitely merit in going and reading it, but you then, one of your team members issued a non rebuttal rebuttal of that piece.

But just for a couple of minutes, let’s just delve into that. I think his concern is that the way that you portray the report is, let’s use the word sensational. His argument would be that it’s in your interest as a provider of security solutions to paint a picture, which is, let’s say somewhat alarming, there’s all of these problems, and look at the enormous array of different vulnerabilities that there are out there.

And therefore you bring the statistics to bear that best represent the fact that there are problems. So just wanted to give you a chance to talk about that. And I will also mention. The rebuttal piece, again on the same website, interestingly, Master WP it’s by Robert Rowley, they’re both Robs, so you’ll probably have to read them one at a time.

And this is called, rebuttal, how Patchstack is improving WordPress security. So I’m just giving you a platform here to reply to Rob Howard’s piece, where he takes you to task for using sensational language and massaging the figures so that they, he accuses you of using sloppy statistics.

[00:49:08] Oliver Sild: Yeah, to be honest, I’m not a hundred percent sure like what is really sensational about that? But in a way, when we put together the whole white paper, we just basically looked at the numbers. We look at the numbers and we are presenting what it is. I understood that one of the things that may be what he thinks about is sensational is the, that there is 150% increase in vulnerabilities being discovered.

It is something that we can just say, and it’s a fact. The question how do you interpret that, whether negative or positive? That needs more context. And the context we do give. The context is that just means that there is more vulnerabilities being identified, which is a good thing because to WordPress is getting more secure because of that.

So when this post was published by Rob, we actually went over it, then we were like, oh, actually there’s like a lot of good points because obviously we are also a little bit tunnel visioned when we are dealing with that much of data and hooking into the problem that we are trying to solve. And then we’re obviously talking about that, how we’re talking in house, in a way.

So we should, I get his in terms of like a criticism that we probably should also be more specific in terms of how we are, or like what our intentions behind that are, like whether we see in a negative way or in a positive way. But yeah, like I, we were really happy about the piece that he wrote. We even shared his piece, which wrote criticism about Patchstack on the Patchstack Facebook page, on the Patchstack Twitter. We were like, hey, see what he wrote. There were really good points. And then later on we obviously responded to that with our take on what we actually meant by that and where we thought he may be, in some cases, wrong and where he was right as well.

[00:51:11] Nathan Wrigley: Yeah. It’s interesting. Obviously statistics can be in every walk of life, statistics can be looked at in a variety of different ways. And you only have to look at virtually any parliamentary system on earth to realize that the opposition can present the same statistics in an entirely different fashion and it’s completely plausible and the numbers are correct.

Yeah, I think some of the things that he was saying was it would just be nice to have some sort of background, some insight into, so for example, does the increase, this 150% figure that was mentioned, is that because there are more plugins that are out there? How serious are these vulnerabilities that we’re talking about? If there’s an increase, but 99% of those were benign and did virtually nothing, could they be lumped in as 150% increase? Has the total number of plugins in the entire market changed? And what are your reporting methodologies in terms of what is it that you’re actually trying to do from the report? Are you just trying to be a purveyor of information? Or is there a hope from the Patchstack piece that some customers will come your way as well? So just those pieces really?

[00:52:18] Oliver Sild: Yeah. I guess if the statistics didn’t come from like some internal data that we are not showing anyone, it’s the public CVE’s that we are one of the authorities to generate the publicly or like the internationally kind of standard vulnerability identification IDs. There’s three companies in the space which can do that in the WordPress ecosystem. And we’re one of them. So like this vulnerability information, it’s all public to the, to everyone, we are just showing that’s how much there was in 2020. That’s how much there is in 2021.

There is no kind of translation whether if it was actually not that much of an increase or not. The question isn’t about about like increase, I guess in general, I think the question is about why it was increasing. And the increase isn’t because, at this point the increase isn’t because the WordPress is getting more plugins to the wordpress.org.

We actually, even, I think in the rebuttal piece have shown how much percentage the wordpress.org repo has grown over the year compared to the same period. The thing literally is, there’s just more eyes. There’s more people looking for the vulnerabilities in the plugins and they’re identifying more vulnerabilities.

These vulnerabilities may or may not be in there already for years. It’s the number of vulnerabilities that the 150% of increasing vulnerabilities found in WordPress ecosystem means that there was just 150% more vulnerabilities found in WordPress ecosystem. Basically, it means just that.

Now, if you want to give that positive or negative meaning, it is definitely up to you. Of course we could have tried probably present that in a better way and maybe, I’m not sure if we actually wrote in our white paper that we find this a good thing. I need to double check it really quickly, but we usually like anywhere we talk, we always say that it’s a good thing. It is what it is.

[00:54:31] Nathan Wrigley: Yeah. It’s interesting because the language that Rob would like is definitely more on the sort of optimistic side, isn’t it? So instead of bringing out the things that are going wrong, he would like to emphasize the things that are going right, so for example, he rewrites something where the illustration is that there’s problems, and he says that a possible alternative headline would be not 0.65% of WordPress sites get an important update. So I guess it’s stressing the negative.

[00:54:59] Oliver Sild: Would you read that?

[00:55:00] Nathan Wrigley: Yeah. And that’s an interesting thing about human nature, isn’t it? Because you only have to look at newspapers for example, or headlines in articles on the web to realize that well, people are, they’re drawn to controversy to some extent aren’t they? They like the sort of sensational aspect. And so yes, interesting point. Yeah, really interesting point.

[00:55:19] Oliver Sild: And in our case, if, when we released the white paper as well, we even saw in some cases where journalists were, we didn’t tell them what, we didn’t actually even send it out in that way that all you need to use, like some sort of headlines, but we did see the journalists just take out some piece of data and they would just make their own kind of headline based on that.

In a way, I think people need to also think. I understand that, okay, let’s then talk about this issue in a so positive way that like nobody would even understand that there is like a problem at all. But is that our goal? If we want to make WordPress ecosystem more secure, we need to talk about those issues.

There are issues and these issues are being solved, and we are showing that there is like increased effort in solving those. Let’s talk about those things. We shouldn’t just let’s try to somehow sugar coat it in a way or

[00:56:17] Nathan Wrigley: Thank you. I will definitely mention both of those articles in the show notes. We’re going to have to round it up because we’re approaching the amount of time that we’ve got. Before we go though, obviously we know that you’re at Patchstack, which is at patchstack.com. But should anybody wish to reach out to you personally, are there any good ways for people to do that?

[00:56:38] Oliver Sild: Yeah, anyone can reach out to me on Twitter. I think that’s the easiest way to reach out either DM or just tag me. It’s @oliversild. And then yeah, if you want to look at what we are doing. If you’re a plugin developer, you can always get like security testing for you’re plugin through Patchstack. If you’re an agency and you want to have security overview and a vulnerability overview, every single website that you have across your portfolio, then you can use Patchstack for that.

And for hosting companies, we also have so they would always know if new vulnerabilities are being reported to us by the ethical hackers community. Or if we are adding new items to the database from any other sources. So Patchstack database, Patchstack audits. We’re basically doing anything around WordPress plugins and trying to make the whole ecosystem more secure.

[00:57:31] Nathan Wrigley: Oliver Sild, thank you very much for joining me on the podcast.

[00:57:35] Oliver Sild: Thanks Nathan.

What the Next 20 Million Devs Want — With Tiff in Tech and Stereotype Breakers’ Masha Zvereva

The world is shortly going to need another 20 million developers, and with over 1,000 engineering leaders joining us for INTERACT on April 7th, there’s no better time to talk to two people who have captured the minds of millions of developers - and will be featured at INTERACT - Tiffany Janzen and Masha Zvereva.

In addition to their own tech careers, both women have become prominent voices in the dev community, Tiffany is most well-known for her Tiff in Tech YouTube channel and Masha for her company Stereotype Breakers.

360: Sarah Fossheim

I got to talk to Sarah Fossheim this week! One of the impressive things that Sarah does is near photograph-quality recreations of iconic old technology in HTML & CSS. I enjoyed the fact that neither of us quite totally knows what some of these machines even did, but appreciate their incredible aesthetics. Perhaps my favorite part of the conversation was emphasizing that this work, while almost being a relaxing hobby in the vein of knitting, still levels up one’s CSS ability. Sarah got me thinking that it’s not just CSS, but perhaps equally or more importantly HTML ability, the ability to break down sections into components and think about how smaller parts become a whole, just like any other website work.

Time Jumps

  • 00:52 Guest introduction
  • 01:45 Where do you find inspiration?
  • 04:12 Calculator Pen
  • 04:55 Roland Pen
  • 07:02 Sponsor: Retool
  • 08:26 Working with Text
  • 10:35 What’s the connection to musical equipment?
  • 13:46 Ethical Design Guide
  • 21:36 What resources for training around accessibility are there?
  • 24:06 Polaroid camera Pen
  • 26:21 Have your coding skills improved?

Sponsor: Retool

Custom dashboards, admin panels, CRUD apps—build any internal tool faster in Retool. Visually design apps that interface with any database or API. Switch to code nearly anywhere to customize how your apps look and work. With Retool, you ship more apps and move your business forward—all in less time.

Thousands of teams at companies like Amazon, DoorDash, Peloton, and Brex collaborate around custom-built Retool apps to solve internal workflows. To learn more, visit retool.com.

The post 360: Sarah Fossheim appeared first on CodePen Blog.

#19 – Evangelia Pappa & Bernhard Kau on Making WordCamp Europe Safe and Diverse

On the podcast today we have Evangelia Pappa & Bernhard Kau.

WordCamp Europe is the biggest in-person event in WordPress. Last time the event was held, in 2019, there were over 3,000 attendees and hundreds of volunteers who participated.

The 2020 event, which was due to take place in Porto Portugal was cancelled due to the outbreak of Covid. Ever since then pretty much all WordPress events have been done online. The community has stayed together and kept things going, but it’s time to return to the in-person event.

This is great news, but what can we expect from such an event. Whilst the pandemic is less of a concern than it was just a few months ago, it’s not gone away.

On the podcast today we talk to two of the WordCamp Europe 2022 organisers and discuss what preparations they’ve been making to ensure that the event is as safe as possible. How will social distancing work? Will you need to wear a mask? Will there be social  aspects to the event?

Hopefully the podcast will put your mind at rest about the precautions that have been taken, and possibly help you make up your mind about whether you want to attend in-person, or participate via the live streaming.

We also get into the subject of diversity. A few months ago, some members of the community questioned the makeup of the event in terms of the organising team.  

We discuss how the team reacted to this. Whether they thought that the concern was justified and what they’ve been doing since then to address those concerns.

Hopefully the event will take place this year, and if you enjoy WordCamps, but have never been a part of the organising team,  it’s really interesting to pull back the curtain and see some of what’s required to put an event of this scale on.

Evangelia’s Twitter

Evangelia’s website

Bernhard’s Twitter

Bernhard’s Capital P podcast

Bernhard’s website

Transcript

[00:00:00] Nathan Wrigley: Welcome to the Jukebox podcast from WP Tavern. My name is Nathan Wrigley. Jukebox is a podcast which is dedicated to all things WordPress. The people, the events, the plugins, the blocks the themes, and in this case, diversity within the community. If you’d like to subscribe to the podcast, you can do that by searching for WP Tavern in your podcast player of choice, or by going to WP Tavern.com forward slash feed forward slash podcast. And you can copy that URL into most podcasts players.

If you have a topic that you’d like us to feature on the podcast, well, then I’m very keen to hear from you and hopefully get you, or your idea, featured on the show. Head over to WP Tavern.com forward slash contact forward slash jukebox. And you can use the contact form there.

So on the podcast today, we have Evangelia Pappa, and Bernhard Kau. WordCamp Europe is the biggest in-person event in WordPress. Last time the event was held in 2019, they were over 3000 attendees, and hundreds of volunteers who participated. The 2020 event, which was due to take place in Porto. Portugal, was canceled due to the outbreak of COVID. Ever since then, pretty much all WordPress events have been done online.

The community has stayed together, but it’s time to return to in-person event. This is great news, but what can we expect from such an event. Whilst the pandemic is less of a concern than it was just a few months ago, it’s not gone away. On the podcast today, we talk to two of the WordCamp Europe 2020 organizers, and discuss what preparations they’ve been making to ensure that the event is as safe as possible.

How will social distancing work? Will you need to wear a mask? Will there be a social aspect to the event? Hopefully, the podcast will put your mind at rest about the precautions that have been taken, and possibly help you make up your mind about whether you want to attend in-person, or participate via the live streaming.

We also get into the subject of diversity. A few months ago, some members of the community questioned the makeup of the event, in terms of the organizing team. Some felt that not enough work had been done to ensure that everyone was represented in the decision making of the event. We discuss how the team reacted to this, whether they thought that the concern was justified, and what they’ve been doing since to address those concerns.

Hopefully the events will take place this year, and if you enjoy WordCamps, but have never been part of the organizing team, it’s really interesting to pull back the curtain and see some of what’s required to put on an event of this scale.

If you’re interested in finding out more, you can find all the links in the show notes by heading over to WP Tavern.com forward slash podcast, where you’ll find all the other podcast episodes.

And so. without further delay. I bring you, Evangelia Pappa, and Bernhard Kau. I am joined on the podcast today by Evangelia and Bernhard. Hello both of you.

[00:03:58] Evangelia Pappa: Hey there.

[00:03:59] Nathan Wrigley: Very nice to have you on the podcast today. These two fine people are going to be talking to us today about WordCamp Europe, which is happening later in 2022. There’s a couple of things that we’re going to be talking about, particularly around the two topics of COVID and also about the diversity aspect of the organization of the event. We’ll come to those two things later, but I’m just going to ask you, one at a time to introduce yourself properly. We always do this at the beginning of the podcast. Just to let the listeners know who you are, what’s your relationship with WordPress and so on. So, let’s make a start. Let’s go for Evangelia, let’s begin there.

[00:04:34] Evangelia Pappa: Hey there to everyone. My name is Evangelia. I come from Greece. I am a recruitment specialist for WPMU Dev. I like blogging. I love and breathe for the WordPress community, not only the global one. And I’m really happy and passionate about the people and culture.

[00:04:54] Nathan Wrigley: Thank you so much and the same question, Bernhard.

[00:04:57] Bernhard Kau: Yeah. Hello. I’m Bernhard Kau. I’m located in Berlin, Germany. I’m a WordPress developer for a small agency in Potsdam and, I’m also an active blogger on my blog posts, also a podcaster and longtime contributor to the community. I think it was in 2009. I started.

[00:05:13] Nathan Wrigley: Thank you both very much indeed. Now we know that in the recent past, all events have been called off. WordCamp Europe last took place, I believe it was in 2019 in Berlin. Subsequent events have been online. There were possibly attempts made to put things back in the real world, but then they were kiboshed by the reality, the COVID strain, which was spreading throughout the world, but it has been decided that the time is now right to bring this event back. Just very briefly, is it going to be the same event that we would have been attending back in 2020 had COVID not have taken hold of the world.

In other words, are you trying to put on the full scale event, or is it in some way pared back?

[00:05:56] Evangelia Pappa: We’re going back to in-person events. In fact, we were going back to the events we didn’t have in 2020. It’s a live event, an in person event. We can host 4,500 people, which is an amazing number judging, from the pandemic that has kept us in lockdown. I’m not quite sure yet if we will be able to have everyone, but at least we will be able to see a smiley faces.

[00:06:22] Nathan Wrigley: Okay, and Bernhard.

[00:06:23] Bernhard Kau: Yeah, I think in general it’s going to be the exact same when we’ve initially planned in 2020. We’ve canceled in 2020, I think in March. Like around the time, we just decided just after WordCamp Asia postponed their events and for 2021, we, in the beginning said it’s going to be online as well.

We think now is the time to have an in-person event again. And we hope that we get the same amount of attendees we were expecting in 2020. But we cannot tell if that’s going to happen. And also if all attendees will be able to join the event, but we probably come to that a bit later.

[00:06:57] Nathan Wrigley: I guess only time will really tell whether that’s the case or not. In terms of the organization of the event, it strikes me that many people listening to this podcast, perhaps they’ve never attended a WordPress event and they may very well of course be new to the WordPress community. So maybe just if we spend a very brief amount of time discussing the structure of the organization team. In other words, explain how it is that you came to be involved, and perhaps emphasize the fact that everybody involved in the event is a volunteer. So let’s go for Evangelia.

[00:07:26] Evangelia Pappa: This is a very important topic because we will need to share stories with Bernard. I was with the WordPress Greek community since 2015 and it was pure luck. I mean, I met the community in 2015 and I was just attending a meetup to see what exactly is. What is WordPress? What is a WordPress meetup? What is that community I’m reading about? My skillset at that point had to do with PR and media, as I was working as a radio producer and as a generalist at that point. And I started writing the press releases that had to do with events of the WordPress Greek community, and suddenly I became a member of the organizing team. After two local WordCamps in Athens, the team that has become a family decided that we should volunteer to a bigger event to see how exactly it is happening. And we had never been to a WordCamp Europe, so we decided to apply as volunteers altogether. Since we were selected, we traveled to Belgrade and this was our first experience with WordCamp Europe. When we finished, let’s say WordCamp Europe in 2018 in Belgrade, we decided we would like to apply as organizers and some of us are organizing WordCamp Europe for around two, three years now.

[00:08:47] Nathan Wrigley: Thank you very much, and Bernhard.

[00:08:49] Bernhard Kau: Yeah. Usually becoming an organizing team member for WordCamp Europe, you probably have been a volunteer before for WordCamp Europe, or you’ve been an organizer for a local WordCamp. We really want to see some experienced organizers in the team. It’s not a necessity. So we even have some people very new to the community.

In fact, in Berlin, we even had one in the local team who never attended a WordCamp himself before joining the organizing team, but he was organizing a local meetup in a city in Germany. But because it’s a huge time investment, we really need people dedicated enough to spent nine months organizing an event that size. A usual WordCamp, a local one, is maybe four or five months of organizing and WordCamp European is a whole lot different, and this is also why we need people being willing to go all the way from the beginning to the end and organizing events. And quite naturally, there’s always things happening that become more important than organizing a WordCamp, and so those people drop off because they just volunteer their time, they’re not getting paid. Yeah that’s also natural. And from the 2020 organizers we initially had for Porto, many of them continued. Some take a break. I personally took a break in 2021 because it was an online event. And I could see myself in better health for the in-person events once it’s going to happen.

And so many of the organizers that were initially on board for 2020 are back again, but some didn’t have the time again to join the organizing team for this year. So, we are a bit smaller in size, but still we have quite a good team to organize this year’s event.

[00:10:35] Nathan Wrigley: How many people do you have currently, and how many people did you have previously? You mentioned that it was smaller this time. I’m just curious to know what kind of numbers we’re dealing with on the volunteer side, whether that’s organizers who are doing the event prior to the actual event, as well as those people who show up and volunteer their time during the event. How many people in total are you looking at there?

[00:10:54] Bernhard Kau: So organizers plus volunteers, I would say it’s around 260 to 300 people.

[00:11:01] Nathan Wrigley: Okay. That gives us a really good metric as to just how large it is. Needless to say it’s incredibly complicated to sort out and incredibly complicated to put on. It’s a marvelous event, but there’s so many moving parts. It must be really difficult to get right. And so rewind to whenever it was now, I can’t remember the exact month of the year, but WordCamp Asia was about to have its first meeting and we all know the story, COVID spread throughout the world, and WordCamp Asia was canceled. The events around the world, the whole thing just rippled and all of those events were canceled and it feels to me like WordCamp Europe is one of the first, if not the first, I think there’s been a, maybe a couple in the United States that have happened more recently. But you’ve taken the decision that you’re going to bring it back. And, as with all these things, safety and keeping everybody updated about the situation and how you are hoping to maintain safety is going to be important.

And that’s a big component of this podcast episode, to reassure people as to what you’ve done. So, let’s get into that discussion.

In terms of the organization team, what are some of the key things that you would like the audience to hear? If they were hovering over the hotel booking button or the airplane purchasing button, or maybe just getting the ticket itself, and something in the back of their mind is niggling them. They’re potentially a little bit worried thinking about all of the different things that could happen that have happened over the last few years. What are some of the main things that you could highlight, which would assuage their fears and let them know that you’re taking the safety in terms of COVID seriously.

[00:12:40] Evangelia Pappa: To be honest because I am at this let’s say situation at the moment, trying to book my accommodation and flights for a Porto. I did make a list with the things that I would need to have ready or have with me do to arrange my travel. But first of all I felt safe to go there. Not everyone feels safe because we have been through two very difficult years, but this is the reason because we are also humans and we do care about safety and health, not only of the attendees, but also our families.

We are going to come back home after the event and we don’t want to contaminate anyone or give COVID to our family and put anyone in danger. We are taking measures for the venue and for the event, measures that are regulations of the Portuguese government, and also some extra measures right now that are mandatory, like the facial masks, which is not a measure that is mandatory in other countries most probably. We do have hand sanitizers that will be available inside the venue. And we will keep also social distancing guidelines, at the moment is to respect the distance of two meters.

We also know that the regulations are changing. So we are keeping an eye and monitoring the whole situation and the restrictions in Portugal. And at the same time, it’s not only you know, about the event and the venue, but we need to be careful a little bit outside, and before we get to the venue or while traveling. And also make sure we have whatever is needed to travel for the entry to Portugal.

[00:14:25] Nathan Wrigley: Thank you very much Bernhard. Anything that you would like to add into that?

[00:14:29] Bernhard Kau: Yeah. In the organizing team, we agreed that the bare minimum would be any regulation the Portugal government would put in place. But on top of that, we really want to make sure that everyone is safe. We have parents within the organizing team, just having a new child and, they want to come home to a family and not having bad feelings about infecting them.

And so we also take additional measurements that might not be necessary by like government law, but we still think they are something we want to have. Serving food outside, not inside, because we really want to have a strict mask mandate and eating with a mask is not possible. So we’ve moved the catering to outside.

You have fresh air and it’s safer to eat without a mask being outside and not inside. So things like these. We really try to make the best possible measures to keep everyone safe. And we probably also provide some testing stations where people can get themselves tested, if they feel that they want to know if they are infected or not. We really want to make everyone feeling safe, attending the event.

[00:15:33] Nathan Wrigley: Let’s just drill down into a few of those. You mentioned that there was going to be social distancing. Maybe the word in forced is the wrong word, but the request to be socially distant. So in an ideal world, in all of the indoor components of WordCamp EU this year, you’re going to be asking people to stay whatever the minimum safe distance is, be that a couple of meters or six feet or whatever it works out to be. That’s going to be a request. And I think I heard the word mask being used as well. So if you’re in an indoor space, there’s going to be a supposition that you’re going to be wearing a mask as well. Is that right? Did I hear that correctly?

[00:16:09] Evangelia Pappa: You will need to wear your mask, covering all over the nose and your mouth. Also went in closed spaces and outside the venue. At the moment though, the Portuguese government requires the face mask covering only in closed spaces, but we will also see how that goes in the future. At the moment the facial mask is mandatory in and outside of the venue. We’d like to see people wearing it, that if they don’t wear it correctly, we might popup, pinging on your shoulder and asking you to wear it properly.

[00:16:42] Nathan Wrigley: Thank you. The event arena itself is a simply magnificent piece of architecture. I believe, forgive me if I’ve got this wrong, it’s called the Superblock Arena and it’s a giant dome, and so the central auditorium where I guess some of the larger events will take place are going to be in that gigantic auditorium, but there’ll be many smaller. spaces in use as well. And I would imagine a lot of people would want to know whether or not you’re kind of limiting the amount of people that can go into certain spaces at certain times. So for example, this room over here we’ve only got a capacity for 15 people and you may not sit in this chair, but you can sit in this one so that we maintain the social distancing. Is that all happening as well? You’re limiting the numbers that can go into different parts of the building. Is that happening?

[00:17:31] Bernhard Kau: We are limiting the number of people who could go into the arena and that we would allow as attendees. I think the arena has a capacity of well over 7,000 people. And we are not going to have 7,000 attendees. And also we have different floors. So like the place we were talking about is the main floor.

And this is going to be split between an exposition, area and track one. And then one level lower, we have the second track and we also have the workshop rooms and those rooms are quite large and we would not allow too many people into the workshops. So there’s enough space between attendees. So it’s not really a fully packed area. And also we have lots of area around. There’s a huge, a nice park around and we’d like to see attendees browsing through the park and enjoying everything around. So only when they go to visit the sponsors or some of the sessions or workshops, they go inside. And as we said earlier, we have the catering outside and also things like WP Cafe would be located outside. So it’s really attendees going in and out. And if they need to. distance themselves a bit, they can find places around.

[00:18:43] Nathan Wrigley: It’s lucky that you’re doing it in Portugal and not Great Britain. You may have found it quite difficult to have the outdoor component quite so easily, but I presume the weather in Porto, Portugal is going to be fairly predictable.

An important question I suppose to ask is, whether or not you guys have actually seen this space because it’s very easy on a piece of paper or on a computer screen to take a look at what the venue looks like, but actually being there in person and imagining it on a piece of paper are two very different things. So have people from the committee been, looked around, made judgments based upon being there in the real world?

[00:19:19] Bernhard Kau: We just had a venue visit last month and a huge number of our organizing team was there, I think it was 15 people, something like that. I don’t know the exact number. And some organizers have been there multiple times. I was not there, unfortunately myself, because in 2020, when we decided to go online, I was not going to see the venue.

And then this year, just two weeks before I was going to go to Portugal, I got to COVID myself, canceling my travel plans. But those organizers who went there, they took pictures. They even had a video walkthrough. So all the organizers who were not able to go to the place, they have a pretty good impression of what it looks inside.

And those teams really need to know how it looks. Like the sponsor’s team, the content team. They really know how to arrange things And we also have a company helping us with many of the logistics and they have been to the arena multiple times. So they really have a good plan on how to make things in the best way possible in the arena and the park around.

[00:20:20] Nathan Wrigley: Thank you. That’s great. Evangelia, it sounded like you needed to add something to that.

[00:20:24] Evangelia Pappa: A team that is seeing the venues very often in every WordCamp Europe is always a local team. That is the one also that selects the venue after a very careful research, when they apply for the call for her city. Because you see, we are always in search of a venue that can provide us certain things.

The ability of people that have certain issues to be able to enter and navigate a big space that can host a specific amount of people and stuff like that. So, they have already checked the venue before they apply for the called for host city, and also, they need to visit it often in order to check other things that are necessary.

And usually we have two visits, two venue visits for the rest of the team, where the team leads are available to the visit, or they send a representative of the team. I wasn’t able this year to the venue, visit too. But I had a representative of the team to check for the spaces that my team would need so we can discuss further. It’s not only, the plans, for floor plans.

[00:21:28] Nathan Wrigley: Thank you very much, indeed. Now the next question is, obviously the answer that you give here is subject to change, but assuming that WordCamp Europe were to happen over the next week or so, do you know what the restrictions are right now in Portugal, in terms of, let’s say, for example, as Bernhard, you just said you had COVID relatively recently. Do you know what the restrictions are in terms of accessibility, your ability to fly into Portugal? Should you have had COVID and I guess, it’s a question nobody wants to probably happen to them, but nevertheless, if you were to catch COVID in Portugal, do you know what your options are there in terms of repatriating yourself and getting yourself home? Do you have to isolate in a hotel or wherever you may be settled for a period of time before you can come out and resume normal life?

[00:22:21] Bernhard Kau: I cannot tell you what would happen if you get COVID while being in Portugal. The local team could probably answer the question. For entering Portugal, as of today, you need to have proof of full vaccination. That’s between 14 and 270 days old. You can also have a proof of recovery from COVID 19. That’s quite usual in European countries. It’s not so normal in other countries that a proof of recovery is also treated the same as the vaccination. And you also need to present a negative pre-departure test. So it’s a PCR test or a rapid antigen test, that’s not older than 24 hours. And for me, when I was planning to travel to Portugal, I would just get a test at the airport, like an antigen test. And that would be enough to enter the country. But Portugal is lowering restrictions right now. And, our local team leads was telling us that they are at level one and level zero would be no restrictions. And they will soon be at level 0.5. So they are about to lift all restrictions.

So I would assume that even having a negative tests for entering the country would not be in place anymore when we have the event, but you’d never know. It’s still a long time to go. I mean for your own safety, it’s probably good advice to have full vaccination, if it’s possible for yourself.

If there’s no medical condition hindering you from being vaccinated. And then also when I see my family or people, I know that’s not as healthy. I just get myself tested. So I’m safe that I’m not infecting someone. So that would be my advice to get yourself tested before you travel to Portugal, because you don’t want to get stuck in another country, you being infected and then you might not know how to isolate in a hotel room or something. And then how many days you need to stay there before you can leave. But that’s something I don’t really know, like the restrictions in Portugal, if you are getting infected and then traveling back to your country.

[00:24:21] Nathan Wrigley: Yes, but thank you. That was an excellent answer nevertheless, and like everything else, if you are planning to travel, just make sure you’ve got the necessary documents. And now along with the ride, is have your documents. Your travel insurance, your passport, and also some proof that you have been inoculated or that you have had COVID or that you are COVID free. So that’s just another thing to add into the itinerary of things, which you must bring along. But thank you. Yeah, that’s great.

You mentioned that there was going to be testing stations in the venue. Is that, presumably they are what we call in the UK at least anyway, lateral flow tests. So you just had a different word for it, but they’re going to be freely available are they, or is it, do we need to pay for those? How does that work?

[00:25:03] Bernhard Kau: Those will be freely available for attendees. If they choose to get a test and we would not have testing mandatory for everyone entering. And we would probably need to have some kind of proof that you are not positive. So either recovery, vaccination, something like this, which would be checked when you get your tickets. Your badge for the event. But we would not have a mandatory test for every single day for every attendee, that would just be too much. But if you feel you would want to get tested, we have some testing next to the venue. So you don’t have to go to a public testing place somewhere in Portugal.

Because I also think that they are not free for people not located in Portugal. So that Like be a high cost. And then also let’s say we have 4,000 attendees and they all want to get tested in the testing centers around the venue. That would be quite a lot of work for them. And we probably would have attendees coming late because they need to wait for some hours to get their test.

[00:26:04] Evangelia Pappa: At the moment, we will have this option and also if someone has symptoms of COVID like fever, or they have a difficulty breathing or a cough or they feel they have an issue or they test positive. They can contact immediately the Portuguese national health service. We have listed the telephones on our website too, and we will have someone available to assist them when they are outside of the venue and, also, they can call 1 1 2, that is the number for emergencies. At the moment, people that test positive need to be isolated. However, previously it was mandatory also for the high risk contacts. This limitation has been eliminated, it has been removed. So now only people that test positive for COVID will be required to be in isolation.

At the same time another measure like the digital certificate that was required for entry into restaurants, bars places like that. Was required and now is no longer required. However, it is required if you’re traveling, like we said previously, and you need to cross the borders or you need to pick a flight or something like that. And also the capacity limits of closed spaces has been eliminated. Previously there was a capacity limit and according to the last measures, this does no longer exist. Looking at the situation right now seems like the pandemic is phasing beyond, things are improving daily.

So we have the hope that if variation prevails among the others, it will be lot easier on people, and also more restrictions will be eliminated until we get to the event date.

[00:27:49] Nathan Wrigley: Now, I know that we all love WordPress and we love attending WordPress speakers, presentations and so on, but another thing we love is the after-party. I suspect that this is a very large reason why many people attend these events. It’s just such good fun. Now that, I’m presuming, has been modified in its scope and in its limitations, and what have you. So just very briefly, the social side of things, how is that different now?

[00:28:14] Bernhard Kau: Yeah, basically the same applies as for the conference days. So we would have foods and drinks served outside. So we make sure that’s if you eat or drink something and you cannot wear your mask at the same time, you do that outside. And for the party itself we have it inside, it’s in the same area as track one was the same day.

So like after the closing remarks, we would move everything out and then this area would be for the after party. And it’s quite huge space, so there’s enough space for those who want to go inside and listen to music. And those who want to talk to other people, they would probably go outside because it’s quiet outside, and there they can also have drinks and food.

[00:28:52] Nathan Wrigley: Okay. This section wasn’t a part of the show notes when I originally wrote down the questions, I was going to be asking you but, in the last couple of weeks, we’ve had really seismic events happening in Europe. On the Eastern side of Europe. We’ve had the events happening in the Ukraine. And I don’t know if there are any thoughts as to whether this will change anything, whether or not the event has any posture on that at all. I don’t really have a question around that. Just whether or not the Ukrainian situation has forced something to be changed on the WCEU side?

[00:29:26] Evangelia Pappa: At the moment the war is not changing anything regarding the event. Location dates, restrictions remain the same for everyone. We can say how things might end up in the future. It will depend also, for example, in the Portuguese government, in case they have any restrictions for citizens from Russia for example. As things that are floating at the moment, and it might not change anything regarding the event.

However, this is a very tough topic and being Europeans, we have a really big history of wars on this continent. And some of them are really recent. It definitely does not make us happy and it does affect everyone. Mentally, mostly, in the rest of the continent. As many of us have colleagues there, relatives, friends and we wake up and sleep with the news everyday.

Talking about the WordPress side of things and the community. Both countries, Ukraine and Russia have active local workers, communities, and our organizing team in WordCamp Europe includes members from Ukraine and Russia? This is a very difficult period. One thing that makes us proud during this whole situation is to say that we have members of the organizing team that are offering their help actively and our hearts and minds at the moment are with our people over there.

If we have any information about further restrictions that might be, we will definitely inform everyone through the website and the social media. At the moment, nothing is changing regarding the event.

[00:31:03] Nathan Wrigley: Okay, moving on then, that’s the first part of our discussion. And this next part will probably be a little bit shorter, but nevertheless, equally important. After the event website had gone live with the organizing committee details and the speakers being announced and the sponsors and all of that. There was some conversation that arose, I believe, but I could be wrong about this, I believe it began on Twitter. Where questions were raised about the event. I’m not sure specifically around which aspect of the event, whether it was the speakers or whether it was the event organizers. Maybe it was both or one or the other, I’m not entirely sure.

But there were questions raised about the diversity of the event. I know that upon those questions being raised, the response you gave was pretty swift, and there was a lot of soul searching going on. I don’t know who wants to answer it first, but really, do you want you to summarize what the concerns that members of the community were raising about WordCamp EU and the diversity of it.

[00:32:08] Evangelia Pappa: It was a social media post on Twitter that started the whole conversation. And it was based on the diversity of the organizing team Which is something that was a really difficult discussion and a really difficult thing this year. You see this organizing team and this conference in 2022, it’s coming back after two years of lockdowns. It was really difficult to get it started to find people that were able to commit.

So the problem that this Tweet was raising was that there was not any black person among the organizers. However, where I come from for example we don’t even say black, because it’s considered, a form of racism. When we saw that Tweet, it was really difficult for us.

Nobody had reached out. Nobody asked why we don’t have people of skin color or why we have, for example only Europeans and North Americans or anything regarding diversity. But suddenly we are being called out on social media. It gives the team, the feeling of being chased unfairly.

Europe has a different background and history regarding many things. Before we start a discussion about diversity, or inclusion, which is definitely important. If you do not discuss, we cannot fix anything. But you need to have some knowledge about how things worked out when we started organizing. How things are progressing during organizing the event.

At the same time, you need to take a look at the background of the organizing team and also the background of Europe. Location, culture, demographics, history, and all this factors that can help identify what is the diversity we need to aim to. So definitely, seeing it from the point of view of someone that resides in the United States.

It’s not a good thing to see an organizing team that doesn’t include a person of skin color. I’m not quite sure if I’m using the correct word, because I’m not a native speaker in English. So, I hope it is the correct word, but I don’t want to use the black color, because, where I come from, it’s not a nice thing to call people like that. I understand where the person that started the Tweet comes from, and I understand also the people that were replying on threads and the whole discussion. However, we should make a larger discussion to understand how diversity factors and what metrics are different in the US and in Europe and in Asia, for example. Because there is not any continent that doesn’t need to take care of diverse.

[00:34:59] Nathan Wrigley: Bernhard, anything to add to that?

[00:35:02] Bernhard Kau: Yeah. As I mentioned earlier, we had quite a tough time getting the organizing team together because many of the organizers have been on the organizing team in 2020 before we canceled the in-person events and went to an online event. You can also see on the 2020 page on the organizers page there’s the in-person team, and then there’s the online event team.

And you can see that back then, it also was a quite diverse team. But it was really hard to convince all the organizers who’ve committed themselves in 2020 to rejoin the team. So we really had to find people who are willing to invest that huge amount of time into organizing and WordCamp Europe, and for us, diversity is not just dictated by skin color or by gender or something.

It’s also by origin, from which country applicants are coming from also in terms of how experienced are people. We don’t want to be gatekeepers only inviting the same organizers over and over again. So we really want to have some experienced organizers, but we also want to welcome new organizers. And then it might be that you have to reach out to people.

But for 2022, it was really hard to find people that were in the organizing team in 2020 to rejoin. And that was one of the many factors why we are not as diverse as we’ve been in the past. And it’s true that reaching out to people is important, but in these times it’s really hard. And also, many organizers weren’t really sure, and it was back in September, I would say when we asked people and back then the COVID situation was not as positive in quotes as today. So people were really not sure if WordCamp Europe in-person is going to happen at all. And if they would be able to help organizing it.

[00:36:51] Evangelia Pappa: People are not able to commit at the moment. Not only their time, but it also costs some money. I know it doesn’t sound, really romantic. But being volunteers, we’re not being paid for the time that we offer while organizing. And at the same time we have to be present at the event. So this means accommodation. This means travel expenses. And even if someone wants to assist is not able to travel to the event and knows it in advance, then they know they will not be selected. This is one thing. Because, practically, there are funds, companies that can fund someone and help them do this trip, but not everyone knows it, or not everyone is willing to ask for this kind of help. And this is really important. At the same time, as Bernard said, feeling not safe, and also not believing that the event is going to be in person was one of the reasons that people were turning our invitations down, and this is totally understandable.

During two years we had so many online events, not only WordPress related, but, we had so many online events. We did everything online, zoom meetings with the companies you work with, with clients with everyone. So, you were stuck on a display. People still when we started didn’t believe we are going to go for an in-person event.

Frankly, they were saying, I don’t want to do an online event again. I don’t want to be part of it. I don’t want to commit myself, and then in the end we end up with an online event. And I understand that it was tiring for many people, online events have different duties than in person events, and it wasn’t so easy to get it going and get the ball rolling.

[00:38:43] Nathan Wrigley: Thank you very much. So since that tweet was posted and this diversity debate began. Are you able to tell us the ways that you’ve interacted with those people? The lessons potentially that may have been learned, but also the things which you are now doing differently. Measures that affect this particular event, or perhaps you’ve put things on hold and you’ve got procedures, which might be different for the next WordCamp Europe, whether or not you’re both involved I don’t know, but things that would be done differently the next time around. So, essentially I’m wrapping that up all in the phrase of, are there any lessons that you’ve learned here?

[00:39:22] Bernhard Kau: I think the lesson that the whole WordPress community learned is that diversity is important. And it’s something the whole community has to have an eye on. It’s not just the organizing team, and it’s something that can help an organizing team to solve because being a diverse team is not just posting a call for organizers form and waiting for people to respond.

It’s how you promote the call for organizers. How do you maybe find people you invite directly into the organizing team? And there are some great resources and some great initiatives. There’s the diversity training program which targets more towards speakers. The same things can be applied to organizers as well.

And I have been taking part in this training and many other organizers as well. So we really know how to make sure that the next organizing team is even more diverse as the current one. But for this event, we cannot change the organizing team. It was hard enough to get enough people. We also had help from some companies. Volunteering some employees to us. So we have enough people to get all the workload done we have in the organizing team. But for other things, it’s a bit easier, like for the call for speakers and call for volunteers there it’s easier to have a diverse group of people. And this is always something we kept in mind.

So in the past we’ve increased the number in the gender ratio. But as I said earlier, diversity is not just dictated by gender. So we really want to have a very diverse group of speakers. So in terms of gender and experience and all of that. And the content team really focuses on that a lot and has focused a lot in the past. And the volunteers, I would say every year, you can see that the volunteers group is really diverse. We have people from all around the world because being an organizer, you need to be within some time zones. It’s really tough to have someone from, I don’t know, Australia in the organizing team, we had some people from that time zone back in 2019, which is really a challenge.

But for volunteers it’s really easy to invite everyone to become a volunteer because they all have to travel to Porto and time zones are not a huge tissue. But for the organizing team, that’s really something that can be challenging.

[00:41:42] Nathan Wrigley: Thank you has the debate on Twitter, has it led to a conversation? In other words, when that was mentioned on Twitter, presumably it was a calling out of something that people felt needed addressing. Did you engage with those people and ask for their opinion and what it was that they thought needed to be looked at? How has that conversation, that debate move forward over the last several weeks?

[00:42:06] Evangelia Pappa: Regarding having a discussion with the people on Twitter. We don’t want to use the social media for such conversation as some of the social media, not good enough, and not the proper way of communication for such discussions. And the reason is for example, Twitter has a limitation of characters. It’s not easy to make a discussion over there for diversity. That is a huge topic and really important for the whole community. So we had to have another way to discuss this and move forward with a whole situation. You see, diversity means you belong here and you’re not the only one. So you give people the opportunity to representation and the feeling of inclusivity.

It is one of the things that makes a community viable and creative. It means that people with different backgrounds are able to express themselves freely. They are able to stand behind their ideas. They have a voice. And this is very important. And it is a goal that takes time. It’s not a post a post on Twitter that, you know, can make things different, there is no a quick hack.

We can only focus on the work that is needed to make it happen. And it takes time. It’s not going to happen from one day to the other. It takes time and we need to work on this. So we have asked for help from WordCamp central. We have asked for resources, the ones that Bernard mentioned previously, and we’d like to thank everyone for this help.

And a great open discussion has been opened to the make WordPress website which is a discussion well to follow closely about diversity in WordPress events. This was the way, not WordCamp Europe, but WordPress community in general approached the people that felt underrepresented and opened this topic about WordCamp Europe, because it’s not only about WordCamp Europe it’s about all the WordCamps and also local events like meetups.

[00:44:02] Nathan Wrigley: I think that I’ve asked all of the questions that I would like to ask. Just one quick thing. We were talking previously about hybrid events and the fact that people were possibly a little bit fed up of being online, but for those people who, for example, are unable to attend WordCamp Europe, is there a plan this time around to have any of the sessions broadcast live?

In my parlance I’m terming that a hybrid event live mixed with online. Is that going to be happening at WordCamp Europe this year? Or is it just live with WordPress TV to look at them after the fact?

[00:44:38] Bernhard Kau: We’ve been livestreaming WordCamp Europe, I think since 2017, when we were in Paris. Maybe even in Vienna. So we had live streams for a long time. What would make WordCamp Europe really a hybrid event is the opportunity to connect the online world with the offline world. So for example, we are planning to have in the Q and A after a session, someone taking questions from the online audience and asking the speakers onstage some questions from the online audience so they feel more connected to what’s happening in Portugal. We cannot have every aspect of the events being put into the online world as well, but we really try to make it more hybrid. So those were just watching on our websites. They can also participate in some way, and we are still figuring out in the many different ways how we can make as many aspects of the WordCamp Europe also available for the online world, but at least for the Q and A, this is a plan we already agreed on. So we would have questions from the online audience after the speakers onstage.

[00:45:47] Nathan Wrigley: Lovely. Thank you very much. If anybody wanted to reach out to both of you, either of you, are you able to share the best place to do that? That could be a Twitter feed or it could be an email address, whatever you’re comfortable with. So I’ll start with Bernhard.

[00:46:04] Bernhard Kau: I think that the best and easiest way is either by my personal block or through Twitter. You probably have to put that into the show notes, my exact Twitter handle. It’s second cowboy, but it’s K A U. So my my last name that’s my Twitter handle and yeah, my blog post and my block is listing as well. So that’s probably the best way to get in contact with me.

[00:46:26] Nathan Wrigley: Thank you very much and Evangelia.

[00:46:29] Evangelia Pappa: If someone needs to get in contact with us as organizers of WordCamp Europe, they can always find us at europe @ wordcamp dot org, which is the official email of WordCamp Europe. If someone needs to talk to us directly, social media I think is the best way at the moment. And. Twitter or Facebook or something like that.

Mine is, Evangelia Pappa my handle on Twitter, so they can find me over there too.

[00:46:55] Nathan Wrigley: I will make sure to put all of those into the show notes, which can be found on the WP Tavern website. Bernhard, Evangelia, thank you so much for talking to me about WordCamp Europe today. I really appreciate it.

[00:47:09] Bernhard Kau: Thanks for having us.

[00:47:10] Evangelia Pappa: Thank you for having us.

#18 – Leonardo Losoviz on the Block Protocol’s Efforts To Make Blocks Work Universally

On the podcast today we have Leonardo Losoviz. He’s here today to talk about The Block Protocol.

Ever since WordPress 5.0 was released several years ago, we’ve been using blocks to create content inside of WordPress. More and more blocks have been developed to manage the creation of content, and the display of this content on the front end.

With WordPress 5.9, anyone using a block based theme has been able to manage more of their site with blocks; the header, the footer, menus and more.

It’s a real shift in the way that content and sites are created, and puts end users in control of the way that their website looks. But, the content that you create with your WordPress blocks are limited to your website.

It’s not just WordPress that is using blocks though. Go to almost any modern SaaS app and you’ll see content blocks in use. It’s such an easy process to understand. You want text, use a text block, perhaps an image, use the image block. In this way, non technical users can build up their content easily.

For obvious reasons, every app and CMS which is using blocks has built their own implementation for their own needs; the needs of their users and customers.

The Block Protocol is a new attempt to unify the way that blocks work. If you create a block on your WordPress site, that same content could be consumed and used elsewhere, seamlessly. The reverse would be true as well. If you stop to think about it, that’s a really powerful idea.

Leonardo talks to us today about the Block Protocol, what it is and how it might work.

We discuss some of the benefits that the protocol might bring, as well as some of the barriers which are undoubtedly in the way of its development and adoption. Who might benefit from using such a protocol and whether or not we can realistically expect this to be implemented in the near future.

The Block Protocol

Leonardo’s article about The Block Protocol

Leo’s website

Leo’s Twitter

Graph QL plugin website

Block Protocol Project Aims to Create Universal Block System, May Collaborate with Gutenberg

‘Standards’ XKCD cartoon

Transcript

[00:00:00] Nathan Wrigley: Welcome to the Jukebox podcast from WP Tavern. My name is Nathan Wrigley. Jukebox is a podcast which is dedicated to all things WordPress. The people, the events, the plugins, the blocks, the themes, and in this case, the future of blocks outside of WordPress. If you’d like to subscribe to the podcast, you can do that by searching for WP Tavern in your podcast player of choice, or by going to WP Tavern.com forward slash feed forward slash podcast. And you can copy that URL into most podcast players.

I’d really like to hear from anyone out there who would like to come onto the podcast and talk about whatever it is that you do with WordPress. It might be that you’re a developer, a WordCamp organizer, a contributor, a designer. Honestly, if it’s about WordPress, I’m keen to hear from you and hopefully get you on the show. Head over to WP Tavern.com forward slash contact forward slash jukebox, and use the contact form there.

So on the podcast today, we have Leonardo Losoviz. He’s here to talk about the block protocol. Ever since WordPress 5.0 was released several years ago. We’ve been using blocks to create content inside of WordPress. More and more blocks have been developed to manage the creation of content, and the display of this content on the front end. With WordPress 5.9, anyone using a block-based theme is able to manage more of their site with blocks. The header, the footer, menus and more. It’s a real shift in the way that content and sites are created and puts the end user in control of the way that their website looks. But the content that you create with your WordPress blocks are limited to your website. It’s not just WordPress that’s using blocks though. Go to almost any modern SaaS app and you’ll see content blocks in use.

It’s such an easy process to understand. You want text, use a text block. Perhaps an image, well use the image block. In this way, non-technical users can build up their content easily. For obvious reasons, every app and CMS, which is using blocks has built their own implementation for their own needs. The needs of their users and their customers.

The block protocol is a new attempt to unify the way that blocks work, so that if you create a block on your WordPress site, the same content could be consumed and used elsewhere, seamlessly. The reverse would be true as well. If you stop to think about it, this is a really powerful idea.

Leonardo talks to us today about the block protocol, what is, and how it might work. We discuss some of the benefits that the protocol might bring, as well as some of the barriers which are undoubtedly in the way of its development and adoption. Who might benefit from using such a protocol, and whether or not we can realistically expect this to be implemented in the near future.

If you’re interested in finding out more, you can find all the links in the show notes. Head over to WP Tavern.com forward slash podcast. And look for episode number 18. And so without further delay, I bring you Leonardo Losoviz.

I am joined on the podcast today by Leonardo Losoviz. Hello Leonardo.

[00:04:02] Leonardo Losoviz: Hey, Nathan, how are you?

[00:04:03] Nathan Wrigley: Very good. Thank you for joining us on the podcast today. We’ll get stuck into the main content a little bit later. We’re going to be talking today about something called the block protocol. But before that a little introduction from you, Leonardo, if that’s okay, how come you’re on a WordPress podcast? What is it that draws you to WordPress? Are you a coder or a developer? What’s your background with tech?

[00:04:24] Leonardo Losoviz: I’m a developer. I’ve been working with WordPress since 2012 I believe. And, I work or I have a plugin that is a GraphQL server for WordPress and I work with that pretty much every day. And as I develop the plugin I have insights on other topics. So in particular, the whole of the block protocol is one of the things that I could connect to because of my background with GraphQL.

[00:04:50] Nathan Wrigley: Thank you very much indeed. Now I’m going to draw everybody’s attention to an article. I will link to it in the show notes. So if you’re not familiar, go to WP Tavern.com forward slash podcast, and today’s episode will be listed there.

And in that set of show notes will be links to all of the bits and pieces that we happen to mention today. And the first one is an article that you wrote on the smashing magazine website called implications of WordPress joining the block protocol. This is an idea that was raised really recently. The idea being that there is this third party idea, it’s not a WordPress idea and it’s called the block protocol.

Would you just like to very, in the broadest possible terms? Just tell us what the block protocol is.

[00:05:37] Leonardo Losoviz: All right. I will try my best.

[00:05:38] Nathan Wrigley: Thank you.

[00:05:39] Leonardo Losoviz: So the block protocol is an idea to get blocks to be interoperable between different applications. So right now, when we are using WordPress, we have the WordPress editor. We are composing a blog post with blocks and seeing the latest version of WordPress, version 5.9. We can also create layouts. We can create the full site, via what’s called a full site editor ,via blocks. Now these blocks that we’re using on WordPress, they can only be used in WordPress.

So there’s this guy, Joel Spolsky a very famous guy. He created a stack overflow., If I’m not, if I’m not wrong. Yeah. So he came up with this idea called the block protocol, and the idea will be to get the blocks in this case from WordPress, but from any other software tool and to port them into whichever other application. Be it based on WordPress or not.

So the idea is that now we can reuse blocks among applications the same way that we can reuse components like JavaScript components nowadays. So for instance if you’re a developer, and possibly you have coded a component for React, and then you have another website for another client, you can reuse the same component.

So the idea is to do something similar with blocks. That you have developed a block for your WordPress site. And the day after tomorrow you have a different application, which is based on Node JS or on a different CMS. And you want to reuse the same block that you have for your WordPress site. With the block protocol, you could do that.

[00:07:15] Nathan Wrigley: So, everybody I would imagine who’s listening to this podcast has some familiarity with the new block editor. That is to say, rewind to WordPress 5.0 in come blocks. Blocks are now the way that we create all content, and increasingly the way that we create everything around our website, especially with the 5.9 release and full site editing and so on.

But what may not be obvious to most users is that that content is, it is completely siloed within WordPress. So as you’ve just described, if you create some text or you create an image, you are really going to struggle in any meaningful way to take that and put it somewhere else. The best you can really hope for is going in and copying and putting it into your clipboard on your computer and then going and pasting it elsewhere.

But the intention, I believe of the block protocol, is to make it so that applications, no matter where they are based, there’ll be able to communicate with each other. And the picture that you put inside of Gutenberg would be available to some other piece of software that’s nothing to do with WordPress. Have I more or less summed it up there?

[00:08:22] Leonardo Losoviz: Yeah. What you have to take into account is that with the blocks, you create content. So when we’re talking about content, you can copy paste it into different application, it’s all HTML at the end of the day. It will work here. It will work there. But blocks, we’re talking about functionality. About being able to use this functionality to create the content in first place.

So think of any block that you might actually think of, say a Google map, that you can point and click on the map, and then you have the location that you want to display. So this is functionality. Like behind the functionality you will be producing HTML, which is the embedding of the Google map. But you’ll know, you need to know how to code HTML to do that. You don’t want to do that. You want to do it with a WYSIWYG. That is, visual that you click on a dynamic map. This functionality is a block, and this is the functionality that we want to port across applications. So this is more than content.

[00:09:21] Nathan Wrigley: Perfect. Thank you so much for clarifying that. Okay. The article, at the beginning, you go to, you go into explain how Joel Spolsky he has got this project called the block protocol. And again, I will link in the show notes to that so that you can go and find the website there. There’s a fairly impressive website where they explain things in pretty good detail with lots of documentation, and so on. But the reason that we’re talking, is that it would appear that fairly recently, Matt Mullenweg reached out to Joel.

I don’t know if it was that way round or Joel reaching out to Matt, but either way some conversation began, I believe it was perhaps on Twitter, where Matt was essentially saying, look, it would be really interesting if we could make all of this work with Gutenberg blocks. So in other words, why don’t we see if there’s some possibility of making your block protocol and WordPress work together. So that stuff can be egress and enter WordPress websites, to other different parts of the web.

Now, in order to understand this better, you then went on to explain how a block is actually created. You’ve got this paragraph entitled what is a block. And I think, for most users of WordPress, if you’re a developer this obviously would be different, but if you’re a casual user of WordPress or you’re a publisher or an implementer, it might be that in the block editor, you just see the block and it’s a little rectangular icon and you click the button and it comes onto the website.

Of course, there’s a lot of incredible technology going on in the background. And I just wonder if you could explain to those of us who don’t necessarily understand, what is a block what’s actually going on in the background?

[00:11:00] Leonardo Losoviz: All right. If you do not understand what a block is, that’s good. You do not need to understand. All you need to do is to be able to use it. So this is, it’s complex in the sense that, you know, the simpler something is to be used, the more difficult it is to implement. Which is the great thing about Apple products. You know, that the box is just white. But that whiteness, they have a huge team of designers to come up with.

So the block, if you’re able to use a WordPress editor, then the book already succeeded. You don’t need to understand how it works or what it is, apart from the fact that you need to use it to create content, which is in this case to write a blog post or, since the later version of WordPress to create the full, the overall site, by clicking at elements.

So then what is a block? It’s a concept. It’s a unit of something, in this case it’s code, that you interact with to create content on the site. If you’re a developer, you will be developing blocks. You can be a designer and that you will be applying styles to blocks. But at the end of the day, it’s a concept. It’s not really an implementation. It’s just this idea of what you said, you know, like a square, that you click on the square possibly, and something will happen on the website. You will have created content. So yeah, it’s one of those things that now it appears everywhere because WordPress is trying to make it widespread.

This is what Matt Mullenweg had attempted to do with his concept of reducing the different interfaces that we have to interact with. So in the past with WordPress, you could create content via short codes or with the classic editor, or with the customizer. The block replaces all of these. You had to learn only one thing, which is the block, the interface with the block, and you’re able to create your website, whatever it is that you need to create.

Maybe you want to add a video. You want to embed a picture, something very simple. But now also we have more functionality, like editing pictures and possibly even editing videos in the future. It’s taking more roles. It is like an application to create cotent.

[00:13:13] Nathan Wrigley: I guess this approach is absolutely lovely. You’ve got a nice little graphic on your website where you talk about the fact that the block is kind of a container for all sorts of child components. So you could have all sorts of different things inside your block. So a block doesn’t just have to be one simple thing. It could be a multitude of layered things which could become incredibly complicated. But the point is the block encapsulates them all, but it’s siloed within WordPress. You can’t easily get it out.

And well, maybe there are ways that you can get it out, but it’s not relatively straightforward for the likes of me. So along comes Joel Spolsky with his block protocol. And the idea is that he would like all of these different bits and pieces to be interoperable. So that a block on WordPress might be able to interact, and I believe on the article that you wrote, you mentioned a couple of things. You mentioned a SaaS product called Notion, which is a bit like a note taking app, but it’s much more complicated than that. You can do all sorts of things like add bullet lists and what have you. And the premise therefore would be well, wouldn’t it be great if we could take the content that we’ve created inside of Gutenberg, inside of WordPress, and we could just have it so that it was completely interoperable and it was transparent. You could throw it over for example, to Notion or anything else. So is that the dream here is that what Joel and his block protocol is trying to enable? To make there a standard set of ways of doing things, such that everything, everywhere can communicate with anything else?

[00:14:56] Leonardo Losoviz: Yeah, you said just right. It is a dream. It’s something that seems to be a bit out of reach. So far it’s a potential, it’s an idea, but from idea to implementation, it’s a long road. In particular, I don’t think that Notion will want to be part of this movement because there’s nothing in it for them. I believe that Notion has spent so much time and money developing their own blocks. So I don’t see why they will be sharing them with the wider world. Basically, if they give us their blocks, we can embed them in our WordPress site and recreate Notion. And this is the same with Medium. I don’t see them participating in this idea.

Now they could still use it, because a block protocol is a protocol. You can use it for your own internal use. That means that Medium or Notion they could have sub applications, or they could have their own internal team, their own development team, that they have internal applications and they could use the block protocol to reuse their own blocks within their own applications. But that will not be shared with us. We are using WordPress and I don’t expect to have Notion give the WordPress users access to their blocks.

[00:16:08] Nathan Wrigley: Yeah. So I guess where you’ve got a proprietary piece of software and their way of creating revenue I suppose, is on their, the system that they’ve built with components and blocks and the ability to have a beautiful UI and all of that. It’s unlikely in your estimation that they would wish to become part of this because it removes that unique value proposition. If it’s simple to put that data in exactly the same form elsewhere, it’s unlikely they would want to be a part of that because it upsets that business model. However, that being said all is not lost. The block protocol opens up the opportunity for lots of different scenarios, not necessarily the SaaS proprietary platforms that we mentioned, but in your piece, you go on to describing in quite a large amount of detail that the types of people, teams, and applications, and so on that you feel the block protocol would fit well with. So should we just delve into this? Who might want to use the block protocol?

[00:17:07] Leonardo Losoviz: Okay. First one is, if you do not have money, which is quite a general condition for a lot of startups, then you would want to use a block, develop protocol to use blocks that are already developed by somebody else, that you can just customize for your own use.

And this is important because coding blocks is labor intensive. You need a dedicated team and that’s money and that’s time. Think about WordPress. The WordPress editor, up to now, it took five years. You have been started five years ago. And now only now after five years we have full site editing. I believe that, that was not their idea when they launch it at the very beginning or when they were planning at the very beginning. They had never expected that it will take five years to be at this stage.

It took that time because high quality software takes time to produce. Think about the accessibility issues that it will have in at the very beginning, which were fixed, but it took time. So once again, if you want to create a website using blocks and you had to create it from scratch. Then you’re going to be spending a lot of money. Now you could alternatively, depend on the block protocol, use the blocks by WordPress and just customize them for your own application. So that’s the first one.

The second one is if you have a website that you want it to be fancy, or you want to be appealing, like Medium, like Notion, but it’s kind of falling behind because, you know, I mean, we all share the same users. So I think that’s Facebook when it came out, it was a sort of tragedy for website developers who didn’t have a lot of money to hire a team because people are expecting the same quality as Facebook. Like interactivity, dynamic functionality. Eventually they released React and we could do the same, but it takes time and it takes effort.

So then once again, you need to compete against these guys. If your website is not looking good, you will fall behind, nobody going to come to your website anymore. And nowadays the technology barrier is quite high in the sense, design is so amazing. Some websites out there are so amazing and they’re are all for free.

So if somebody developed really nice looking blocks and you don’t want to fall behind, you can just use it. So in my article, I was using Mailchimp as an example, because the Mailchimp editor for creating the newsletters, it was kind of falling behind a bit. I had noticed that they were experimenting with a new editor, which was similar to the WordPress editor.

I cannot find it anymore. It was buggy and I just couldn’t use it for long, and I revert back to their current experience. So I was wondering if Mailchimp could benefit from using the WordPress blocks. So you can see WordPress, MailChimp is a multi-billion company. Like, I don’t know, ten billion dollars recently or something like that. So they could benefit from this.

Then I believe that as a content management systems in particular, I quote Drupal, they could use it because Drupal has already expressed interest in using Gutenberg. In using the WordPress editor for creating content. So now with the block protocol, it will be easier to achieve this.

The reason why it will be easier is because WordPress right now, when you develop, the WordPress editor doesn’t need to care about anyone. They just care about themselves. So at the same time that you create the functionality, on the client side, all the dynamic stuff, the layouts and everything. There has to be a backend that can field the functionality. So we have the WordPress Rest API. So whenever you have a new block, possibly the block will need a new Rest endpoint to fetch data and interact with the server. All of that is happening on WordPress and WordPress needs to certify it. But right now WordPress only cares about WordPress.

I know WordPress can certify its own requirements. Then it’s good to go. So Drupal right now needs to be catching up with WordPress all the time. If WordPress 5.8 comes out and Drupal catches up with it, and then on WordPress 5.9, they changed the API and they’re having a bit of changes lately. Then Dupal will need to also change its own API to catch up. So it’s a lot of effort to be playing catch up all the time. But if we, if they go through the block protocol, WordPress cannot go it alone anymore. They will need to satisfy a requirement imposed by a third party. So then Drupal could say, okay, now we’re integrating into WordPress anymore, all I need to do to certify this contract with this clear guidelines, set up by the third party, and as long as I do this and WordPress does the same, then I can use WordPress blocks without having to be always running behind them. So I think it could be a good thing for Drupal in particular, because they showed interest and in general, any content management system.

And finally I said, open source projects, they could use this because I hope that will happen not really with components. So if you’re a React developer and you want to have a select dropdown, you don’t need to call it from scratch. You just go to NPM, to the registry and you can search, React dropdown or React select. And that will be like quite a few components that we can download. You can install and you can have in your application.

So a block, it’s also a component. It’s a high level component, which has a definite functionality and is trying to achieve a certain goal. So I can see that if that happened in the past with components, it will also happen in the future with blocks, that developers will create blocks, which can be used by anyone.

Think of blocks like modifying like editing video or editing images. Or whatever it is really. Games, the could actually create games and published them on blocks as blocks. And then any website will embed them on their own, their own application.

[00:23:13] Nathan Wrigley: It’s a really nice list. I can really see exactly what you’re talking about, especially the sort of time saving, labor saving aspects of this. You know, teams who have a modest budget who can just leverage things which have already been built and contributed out as open source blocks within this block protocol, it’d be really useful. And like you say, applications where the constraints of money or perhaps experience are going to cause it to be really difficult to get over the line. And if you can then just dip into a bunch of prebuilt blocks that other people have already committed, that would be brilliant. And like you say, content management systems and the one that you mentioned Drupal, who’ve gone out of their way to link with Gutenberg and make their own module so that they can use Gutenberg. Yeah. It’s really interesting.

All of that though, is about, it’s about the benefits, I guess, to people if WordPress were to adopt this. So this is about people gaining a benefit, but you go on to describe it in the opposite direction. You talk about the benefits to the WordPress project of the block protocol.

Do you want to just explain your reasoning behind that? Who, well not who, what are the benefits? What are the benefits that will be brought to WordPress as a whole by the block protocol?

[00:24:32] Leonardo Losoviz: All right. The first thing I believe is that WordPress will keep growing. And the reason for that is at WordPress right now, it’s used as a content management system. But if it also provides blocks, then developers can use WordPress on a different role, which is to create the layout, the client site for the applications. So then WordPress will become more entrenched in the toolkit for creating websites. And even though WordPress right now is really quite big, you know, Matt Mullenweg wants to be even bigger, right? Like, so I think that this is a potential outcome that will happen. That WordPress becomes the default tool to create sites. Not just content management system, as it may be the case that right now, but also to create layouts for even static sites, like HTML based sites that were created with JavaScript. Now you can use WordPress for that, which is something quite new. I mean, you’ll then think of WordPress to create static HTML sites via JavaScript. But this could be a possibility.

Then if this were to happen, the modern world of developers will come into WordPress, JavaScript developers, React, Vue, Angular. So they might want to become engaged and become contributors. So I was checking the Stack Overflow survey, and currently there are three times more JavaScript developers than PHP developers in the market. So then think about it. If you’re suddenly opening up the gates to these guys, you’re opening up to, potentially three times of many contributors as we have not right now. I mean, assuming a similar rate of contribution, of course, I mean, this is just pure guessing. But the fact that you’re opening the gates to them can only bring, either nothing happens or they come in and they contribute. So this is a potential good outcome.

Then, you could have blocks available from other parties that you can import into your WordPress site. So if you have an image editor that somebody hacked ready for their own application and they use a block protocol, you can embed it to your WordPress site.

The other aspect is that the WordPress editor or Gutenberg does not live everywhere on the WordPress site. So right now, when you go to the WP admin, you’re interacting with Gutenberg. But in the WordPress site that you’re creating as a developer, you don’t have Gutenberg there. On the client side, on the site that the visitors are accessing, there’s no Gutenberg there.

So the implication of that is that it not so easy to create nice layouts or dynamic functionality, using React or using Vue or using whatever else. So power the website that your visitors are accessing. So if we had a block protocol, we could create this on a much simpler way because now Gutenberg will be talking to the WP admin or to the blocks, via the block protocol.

And the block protocol will be a single API to create websites, whether it is a WP admin, which is already going through Gutenberg, or on the public facing site, that if you’re good with React, you can create a React client that talks to the block protocol. And the block protocol will embed the blocks that you already have provided by WordPress.

So whether you’re gaining from what you already have. The idea with this is that you have this set of blocks that they only have a limited use, which is only from within the WP admin. Now you will also make these blocks available to the site, to the public facing site. Some blocks, they make no sense because they are only for editing content in the WP admin. But think of a game, you can develop a block that is a game and you could embed it on the public facing site.

So then why not? You could. Or an audio player like, this podcast, you can create a block that is a podcast player and you embedded on the site and it’s something that is just one line of code. You just add the block and everything is already existing. So once again, either you gain or nothing happened.

And then I think that blocks could be helpful in that coming phase four Gutenberg phase three, which is still some time to go, possibly 2023. Which is going to be based on collaboration. They’ve yet to use the WordPress editor or to create Google docs like experience. To communicate with other people, to collaborate that you can edit the same document. And then you can add comments on the side and you can integrate the comments or suggestions. You leave feedback. So all of these is going to be the next phase of Gutenberg. As it is now, it can only happen in the WP admin. So if we had a block protocol, all of this could also be brought to the client side. Now, particularly because you will not need to log into the WP admin any more to collaborate.

And for instance, if I have a WordPress site, I don’t give access to random people. I just give access to my editors, or the writers, right. But what if I want to collect input from normal folks from visitors? Right now the only option that I have is comments, but that’s not integrated within the editing workflow. So if you had the block protocol, you could replicate the same workflow, editing workflow experience on the public facing site and allow visitors to give you feedback or collaboration.

And then one other aspect that I mentioned in the article is that you can simplify how you render blocks dynamically, because right now there is an issue that Gutenberg has, which is that you need to create the same logic twice, once in JavaScript to render the HTML, when you’re editing the content in the WordPress editor. And once in PHP, when you’re rendering on the client for the visitor, that’s the dynamic content. So that means that the same call has to be called twice in two different technologies. And for what I have seen in the GitHub issue that was bringing this up, not everyone is comfortable with the two languages.

You might be comfortable with JavaScript, but not with PHP, or you might become comfortable with PHP, and not with JavaScript. So this gives you the alternative to do it only in JavaScript, which is not ideal because, if you do it on PHP, then you can print it on the HTML already, which has better for SEO. But at least you have the possibility to do it.

And if that were to happen, I believe that more React developers could also be engaged with WordPress because they don’t need to work with PHP anymore. They will be basically working React all the way. And it will still be a WordPress site, which is quite interesting.

And yeah, I have one more issue, one more item to mention. Which is that you can bring in developments from outside. So as I was mentioning, I’m working with GraphQL myself and what happened with GraphQL is quite interesting, quite remarkable, that you have produced a huge ecosystem of clients and tools. Which is the couple from each other. They’re not collaborate. They’re not talking to each other,. But all of these tools, they can operate with each other because they all follow the same specification.

So one single case that is quite easy to follow is static documentation of the endpoints that you’re creating with Graph QL. I believe that the same can naturally happen if we use a block protocol, that some developer out there can create a tool to create static documentation of the blocks that then you can use to document the blocks for WordPress. And if that were the case, you don’t need to develop these in-house. So that means that the WordPress contributors, they can free up their time to do something that is specific to WordPress.

[00:32:48] Nathan Wrigley: I do like the idea of people being able to access all of the pretty amazing stuff that’s been created by the WordPress community already. That seems to be really interesting. If this were to happen, all of that good stuff that’s been made would be available elsewhere and not bound distinctly to Gutenberg, but also the idea that you mentioned and somewhat counter-intuitive to me, I wouldn’t have thought about it.

The idea of having all of these blocks on the front end and the notion that you don’t need to be logged in. I guess, all sorts of complex things that are otherwise out of bounds at the moment suddenly become possible. And so as yet, unimagined scenarios potentially will become possible in the future.

Further down in your article, you’ve got a section where you have some nice diagrams which might be worth the listeners actually going to look at. The sections called, decoupling the WordPress editor from Gutenberg. And you make the point that at the moment, the block is bound directly to Gutenberg, you know, there’s an inextricable link between them. And they need to be decoupled. And the block protocol sits firmly in the middle. Is there a lot of work that would need to be done there in your estimation? Does that feel like a huge leap that would happen anytime soon, were this all be pushed forward?

[00:34:12] Leonardo Losoviz: I think it’s going to be a bit difficult, yes. Not because it is difficult, but because the devil is in the details. You know, I believe this is something that you get completely right, or people will not use it. It has to be perfect. And until you get the level of perfectness, it can take five years, like it took with WordPress editor with full site editing, right? Now, I don’t think that they will take five years, but the idea that something so simple can still be quite difficult. I think that will be the case. Now, why do I say this? One thing is what I was saying is that WordPress right now only cares about WordPress, but once it connects with the book protocol, WordPress will need to care about the world.

So it cannot do whatever it wants to do. It doesn’t have that freedom anymore. It will be constrained by rules. And the block protocol is not set yet. It’s a work in progress actually right now is also a draft. There’s no version one dot zero. So these guys are coming up with it. And the best way that you have to come up with it, I guess if I have in a real use case example, right. So I don’t think they have anything on this sort of, because it is still the idea. So you develop an application, they use the block protocol, you will find problems. Problems that had not foreseen.

So what I want to say with this is, the idea is magnificent. The concept is great, but I believe that as they implement it, they will keep finding challenges to make it really usable for everyone in a way that it makes sense, also. You remember bootstrap, right? Like the CSS framework? When bootstrap came out, every single website that was using bootstrap looked the same way.

You can customize it. You have different colors. Fair enough, but all the websites use the same grid system of 12 columns, and you knew it was a bootstrap website. So for instance, one of the difficult things here will be, how do we use the block protocol to create blocks that allow you to create a website that is still personal, that is still unique. That doesn’t look like every other website out there. So everyone that wants to use the WordPress blocks, they don’t want to look like they’re using the WordPress blocks, possibly. They might not want to look cheap. I gave the example of Mailchimp before. Image if Mainchimp used the WordPress blocks and then Mailchimp looked like a WordPress site? It’s like, hey Mailchimp, come on. You are worth 10 billion USD, what’s going on with you? They have to have personality, and a lot of those things, they would be a bit difficult to come up with. Fine, you can have CSS on top of it, but the components that you have inside the block. So as we said before, a block is basically a component, high-level component that is loading other components.

All of that is fixed inside of the block. If you want to have a different functionality, you will need to add it inside of the block. But you cannot add so much stuff because then the block will be bloated. So then it has to be lean, but you still want to have personality that you have to have a functionality that no other website has, et cetera.

So what I want to say is let’s see, let’s see how well, it goes, but I don’t think it’s going to be easy, to be honest.

[00:37:35] Nathan Wrigley: Yeah. It feels like it might be a bit of an uphill struggle. We’d mentioned just before we pressed record on this podcast. To some extent, it brings to mind an XKCD cartoon. I will make sure to link to this in the show notes, but there’s a wonderful cartoon on XKCD where they say the situation is there are currently 14 competing standards. This is ridiculous. We need to develop a universal standard that everybody is covered by that sorts out all use cases. And then soon after that, it says, well, the actual situation after that is, there are now 15 competing standards. And I wonder if we revisited this conversation in a couple of years time, whether or not this would have taken time to move forward, because obviously, you know, the resources to create the Gutenberg project and to push it forward are very limited.

It’s like you say, it took five years to do where we’ve got two so far and I suspect, if we were to rewind to five years ago, the expectation would be that it had gotten a little bit further by then. So I guess I’m just nervous that it might end up being a bit of a dead end possibly and end up consuming a lot of time. The devil, as you say, would be in the detail.

[00:38:51] Leonardo Losoviz: I’m actually hopeful because I think the block protocol is a first attempt to make this. Now it is true, what you are saying XKCD that you have all of the different blocks implemented by different parties, but nobody’s trying to interact with any other block or any other application out there. So this is the first guy who is trying to say, let’s get all the blocks communicating. So in a way, it has credit. Okay, is it not so dire this situation yet? And I’m also quite hopeful because of what happened with Graph QL. That is a specification that, just by complying with the specification, great things may happen.

So what I want to say with this is that the block protocol, you develop it, you put it out there. And you let the community react and they might actually react in ways that you had not foreseen in advance. They can surprise you. You can actually create magic out of this, that you don’t need to coordinate different teams to work together. With the protocol you’re basically working together, and in this case, what you’re actually doing is having WordPress be used by the world outside of WordPress. And at the same time, you have WordPress being able to reach out to code that was not coded for WordPress. So the potential is so good that even though the path ahead may look broken it may look difficult, I think it’s utterly worth pursuing. It depends on the interest from the community. I don’t know if the community is interested to be honest. If you’re from WordPress, maybe there’s not so much for you to gain from this. If all you see is WordPress. If you will have WordPress now, and you only plan to use WordPress forever more. Yeah. Maybe there’s not so much for you. But, if you are open-minded of thinking, hey, unexpected things will happen from this. Then you can get really excited about this. I’m particularly excited myself.

[00:40:44] Nathan Wrigley: Good. Yeah. That’s great. One of the things you mentioned a little while ago was the fact that at the moment, WordPress is kind of inward facing, you know, the Gutenberg, the output of Gutenburg and all of the things that are inside of Gutenberg. WordPress only needs to worry about WordPress. So, that’s kind of looking inside to what the project needs to achieve for its own goals of democratizing publishing. Do you feel that the fact that if it turned outwards and integrated with the block protocol and thereby had to obey the standards that that brought with it, are there any drawbacks to that? Are there any situations you can imagine where there would be a conflict of interests or things would become more difficult or more time consuming or just not done in a way that they’re done so far? That might cause things to stall.

[00:41:31] Leonardo Losoviz: I think the biggest drawback might be that the world out there doesn’t care about this. And you’re spending your energy. So invite them, to welcome them and nobody cares and nobody comes in and so it was a lot of wasted effort. Of course. I mean, that’s always the case with everything. Like whenever you do an open source project, people may show up or they might not. And therefore for you or the same. The thing is that you have to do it because you have a real use case, that if you’re going to do it, it’s because you know that you will benefit.

If this is just a proposition that you think, okay, this looks good. Let’s try and invest a lot of energy to invite others to come in. And then the community out there, they’re like, yeah, I don’t care WordPress, and I’m happy with what I’m using right now. You know, they moved on to different technologies and you’re trying to convince others and they don’t care then. Yeah, I think that, that’s the biggest issue that if we’re going to do this, there has to be a clear cut use case for WordPress to benefit. Now I did try to say many, several use cases in there in my article, but of course, I mean I’m and dreaming of sorts. If you have an application that can reuse blocks across two different technologies, for instance, WordPress and something else and you already had that. So for instance, okay, you have a technology, a company like Stripe that they need to cater to different technologies, they cater to PHP and they cater to JavaScript, to Go and to everything else because they provide APIs to connect with them and they have an interface or they maybe have different applications powered by different technologies.

Then they will certainly benefit. So we need to be sure that when we go for, forward with this idea, that we have a real use case that we wanted and that we’re not trying to impress all the time to somebody and then they don’t get excited. They don’t come in and, it was wasted effort. I think that’s the biggest potential drawback. Conflict of interest that you mentioned.

I don’t know. I don’t think so. I haven’t thought about it, but Matt Mullenweg way was to make the open web open, open, open. Just now, he created, he bought the Openverse. Yeah. Yeah. So you might actually think conflict of interest. Yeah. I’m sure he will have conflict of interest that doesn’t stop him. As in if he has to give something for free, that will compete with some paid commercial product, or there, he will do it anyway.

I cannot think of a conflict of interest in this case, but I don’t think that that would be a reason enough to know to not do it. At least based on previous experiences.

[00:44:14] Nathan Wrigley: When we’re recording this, which is in March 2022, as far as I’m aware, there’s been no more public outpourings of whether this will go on. The debates, not debate, but the Twitter thread that was begun between Matt and Joel, I don’t think it’s been updated too much. Do you have any insight or is it exactly where we were a couple of weeks ago?

[00:44:36] Leonardo Losoviz: Yeah, I don’t have any insight. I believe that we are where we were, yeah. I wrote the article on this Smashing in part to try to start this conversation with the community, and yeah, they need to take it up.

I actually, I keep checking the block protocol, the project on the website. They are still developing it, but once again, it’s still a draft. So you can expect this to take a long time, many months still. So this might actually be slow and it ,might be a slow and steady process. I believe.

[00:45:11] Nathan Wrigley: Well, so be it, if that’s the way it needs to be. Really really interesting project. You’ll find all of the links that we mentioned in the show notes.

You also talked about the fact that it would be nice to get this conversation begun. That’s why you wrote the piece. With that in mind, is there anywhere that you make yourself available? Perhaps a Twitter account or some email address or public facing website? Is there a particular place that you would like to mention where we could find you?

[00:45:39] Leonardo Losoviz: Right. Yeah, my Twitter is my surname, which is Losoviz, and my personal website is leoloso dot com. And then my plugin is Graph QL dash API dot com. And then, yeah, basically I’m always around, and I like email, I’m not so, I’m not so big on social media myself. I don’t participate so much. You will not see me really on Twitter.

But if you send an email to me, which you can do through my personal website, I will certainly reply.

[00:46:10] Nathan Wrigley: Thank you very much Leonardo for joining us on the podcast today. I really appreciate it.

[00:46:15] Leonardo Losoviz: Okay, thanks so much, Nathan. Very, very happy that you invited me.

359: Tiffany Choong

I had tons of fun talking to Tiffany Choong this week! I loved learning her process on creating countless code art Pokémon characters. Just look at it and wing it! Wild. While I’m not nearly as creative as Tiffany, I feel some kinship looking through her Pens. Like how there are all these amazingly creative ones that clearly took tons of effort, that don’t have nearly the hearts they deserve (c’mon dino loader!), and then relatively simple practical Pens (like a menu) that go nuts with popularity and it’s hard to know why.

Time Jumps

  • 01:05 Guest introduction
  • 02:05 Recreating Pokemon
  • 03:15 Rage animation
  • 05:20 What’s your process for drawing shapes?
  • 06:34 Let’s snuggle Pen
  • 07:39 Does your job allow you to use this creativity?
  • 08:37 Using Vue
  • 10:39 Untitled dinosaur Pen
  • 11:19 Education background
  • 15:45 Your favorite pens
  • 16:51 SVG as a medium
  • 21:32 Reaching for CSS instead
  • 24:05 Supporting IE 11
  • 27:01 #CodePenChallenge Pens
  • 28:21 Magical mobile menu

The post 359: Tiffany Choong appeared first on CodePen Blog.

What Devs Need To Teach CEOs About AI w/ Lexion’s Emad Elwany

For decades Artificial Intelligence has been a focus of best-selling science fiction authors and an antagonist for blockbuster Hollywood movies. But AI is no longer relegated to the realm of science fiction, it inhabits the world around us. From the biggest enterprise companies to plucky startups, businesses everywhere are building and deploying AI at incredible speed. 

In fact, open source allows anyone with a laptop to build impressively good AI models in a day.

358: CJ Gammon

I got to chat with CJ Gammon this week! CJ is a creative technologist, a term he’s tried to hang onto as he does more development work, so he can continue to communicate that he’s a designer as well. CJ has been at Adobe for nearly 10 years and has played with a huge variety of interesting creative technologies.

Time Jumps

The post 358: CJ Gammon appeared first on CodePen Blog.

#17 – Destiny Kanno and Joe Simpson on Why They Started BlackPress

On the podcast today we have Destiny Kanno and Joe Simpson.

Destiny and Joe are the key figures behind a new initiative called BlackPress.

The goal of BlackPress is to bring more creators of Black African descent into the WordPress community, and also provide a community space for those already there to connect, learn from, and support each other.

It’s still in the early stages and they are trying to grow with a dedicated Slack channel and regular Meetups. It’s intended to be a safe space for people who share their vision to work together and try to figure out what such a community might look like.

We talk on the podcast about the journeys they have both had in the WordPress space and why they decided to collaborate on this project. What does the WordPress community need to be mindful of when WordCamps, Meetups and other events are organised? Is it true that WordPress events are open to all people equally? What are the aspirations that they have for their own events in the future, and how can you join the BlackPress community?

It’s a really thought provoking discussion, and shines a light on a very important issue.

BlackPress Slack channel

BlackPress Meetup To Host Meet and Greet Mixer on January 27

Transcript

[00:00:00] Nathan Wrigley: welcome to the Jukebox podcast from WP Tavern. My name is Nathan Wrigley. Jukebox is a podcast which is dedicated to all things WordPress. The people, the events, the plugins, the blocks, the themes, and in this case, diversity within the community. If you’d like to subscribe to the podcast, you can do that by searching for WP Tavern in your podcast, player of choice.

All by going to WP tavern.com forward slash feed forward slash podcast. And you can copy that URL into most podcast players. If you have a topic that you’d like us to feature on the podcast, I’m keen to hear from you, and hopefully get you or your idea featured on the show. Head over to WP Tavern.com forward slash contact forward slash jukebox and use the contact form there.

So on the podcast today, we have Destiny Kanno and Joe Simpson. Destiny and Joe are key figures behind a new initiative called BlackPress. The goal of BlackPress is to bring more creators of black African descent into the WordPress community, and also provide a community space for those already there to connect, learn from and support each other.

It’s still in the early stages, and they’re trying to grow with a dedicated Slack channel and regular meetups. It’s intended to be a safe space for people who share their vision to work together and to try to figure out what such a community might look like. We talk on the podcast about the journeys they’ve both had in the WordPress space and why they decided to collaborate on this project.

What does the WordPress community need to be mindful of when WordCamps, meetups, and other events organized? Is it true that WordPress events are open to all people equally? What are the aspirations that they have for their own events in the future? And how can you join the BlackPress community? It’s a really thought provoking discussion and shines a light on a very important issue.

If you’re interested in finding out more, you can find all the links in the show notes by heading over to WP Tavern.com forward slash podcast, where you’ll find all the episodes. And so without further delay, I bring you Destiny Kanno and Joe Simpson. I am joined on the podcast by two people Destiny Kanno, and Joe Simpson. Hello.

[00:03:00] Joe Simpson: Hey Nathan.

[00:03:01] Destiny Kanno: Hey there.

[00:03:02] Nathan Wrigley: Can I take it one at a time, if that’s all right, I’ll start with you. Destiny. We’re going to have a conversation today about a subject, which is probably, let’s say it will be broad and deep and probably some different opinions will arise.

But, first of all, I think it might be nice to have a little bit of a background story of both of you. Briefly or in long form, whichever you prefer. Destiny, could you give us a little bit of background? How come you’re on a WordPress podcast? What’s your relationship to the WordPress community?

[00:03:31] Destiny Kanno: Yes. Thank you for the intro, Nathan. So I started my journey with WordPress in 2017. I was working at a small Japanese digital agency, and at the time we were working on a few WordPress sites, but, to be fully honest, I didn’t really get that involved with them until I switched over to Automattic as a dot com happiness engineer.

And that’s where my real push to learn WordPress better started off. And I did that for about two years, moved over to the WordPress VIP sector, working with large enterprise clients using WordPress at scale. And now I currently sit in our dot org division with a lovely community member people, who are working in that area, as a developer relations as advocate.

[00:04:19] Nathan Wrigley: Thank you very much. Indeed. Could I ask the same question of you, Joe? Briefly what’s your relationship with WordPress?

[00:04:25] Joe Simpson: Oh sure. Nathan, my journey is two-pronged, it’s a before and an after. Way back around 2011, I worked for a public transit agency here in Los Angeles, and our CSS goddess and lead developer both left our company within a month of each other. And I inherited a WordPress site. I was a graphic designer turned HTML novice, and I had to quickly learn WordPress.

And that was my first experience with the WordPress community. We were able to move our site over to WordPress VIP. And from that point I learned about WordPress in a disciplined way. How to commit code properly and things like that. So speed ahead to 2017, I had a heart event. 200% blocked artery, and I had to take a leave of absence from work.

During that 90 day period, I decided to do the things that I really loved. And one of the things that had such a positive impact on me was WordPress. And I attended my first meetup. I decided later instead of driving into Los Angeles, and getting home at 11 o’clock at night after work, I wanted to start a community locally here in Santa Clarita, where there wasn’t one.

And then also that became a WordCamp. And we hosted three WordCamps here in Santa Clarita. So I’ve been in the community as a builder, as a community rep, and now I’m on the team. I’m a team rep for the WordPress, make WordPress accessibility team. And now that leads me to this initiative as well. I’m trying to give back in different ways and in effect, WordPress from a different angle now.

[00:05:50] Nathan Wrigley: Okay, I’m going to be referring during the course of this, to an article which was written by Justin Tadlock over on WP Tavern. It was called BlackPress meetup to host meet and greet mixer on the 27th of January. That has now been and gone. This episode will probably be going out in March 2022. And so I want to know from both of you and it doesn’t matter who begins first or whether you cross talk, that’s absolutely fine, we can work that out later. I want to know what this event was all about. Why did you two decide to create the BlackPress meet up, and also slack channel? What was the primary thinking? What were you trying to accomplish?

[00:06:30] Destiny Kanno: That’s a great question, Nathan. So from my side of things, at Automattic, I co-founded our black employee resource group which we call Cocomatic, in April, 2020. And so for me, working with that group, we wanted to figure out a way to also bring this community to folks of black African descent, into the WordPress community space as well.

So I worked alongside another colleague of mine, Neisha Sweet, to come together, the community side and work on what we now call BlackPress, and bring that to life. In our initial initiatives or ideas that we had in our first talks were about students really, you know, bringing more students of color, specifically black students across the globe. So that’s why we say black African descent, into WordPress and giving them that kind of mentorship, sponsorship, earlier in the process so that they can really get involved, whether it’s in high school or ideally in college. And we also had talks about targeting HBCU, historically black universities and colleges as well.

And so that really was in my mind, and Joe, please add on, you know, like the birth of why we wanted to have this initiative at the beginning,

[00:07:48] Joe Simpson: And I’m on the other side of the fence where I’m fully in the community and I’m an open source advocate, and I use it as part of my day to day. And my community activities brought me to this initiative as well. Someone on the foundation side, reached out to me and mentioned that there were some folks interested in this.

And for me, the reason that I got involved with WordPress and I decided to take the stage as a speaker, was that I didn’t see anybody that looked like me on stage and I decided to propose a speech and then it went from there. So, this was a natural fit for me because I have a nephew that attended an HBCU and just the initiative of reaching a larger global audience and getting more people involved in how we can impact WordPress and its direction was very exciting for me.

[00:08:35] Nathan Wrigley: Can I just ask you to tell me what an HBCU is? Because that acronym is not one that’s in my vocabulary?

[00:08:43] Destiny Kanno: Yeah. So that’s a historically black university and college. It’s mainly a, I believe, an American thing, stemming off of, segregation in our past here. We have a few members of BlackPress that went to those schools, and so that was a target area for us of bringing more folks into WordPress.

[00:09:01] Nathan Wrigley: Okay, thank you. That just cleared that up for me, that’s great. So you had your first event back in January. I’d just like to figure out what your thoughts were on how that went. So if we could just open up your little history book, how did the meeting go? Was It well attended? Did you manage to make some decisions about what it is that you’re going to be doing in the future? You can take this in whichever direction you like.

[00:09:23] Destiny Kanno: It had a great meetup attendee, yes. We had about 24 folks say, yes, we want to do this. But I think with all community events, about half is going to come if you’re lucky more than that. And so we were just grateful when the day came, when we had about nine folks, including Joe and myself attend.

And the discussions we had were definitely about, where we’re coming from in terms of our WordPress journey. Where we’d like to improve ourselves. And also what we’d like to get out of the BlackPress group. And that included, you know, how to make your site better, to how to be a better developer. Talking about design. There’s a lot of things that folks want to share and learn about together within this group is what we discovered during the mixer.

[00:10:07] Joe Simpson: Yeah, what was really awesome too, is that not just in the meetup space did people express an interest in BlackPress? There was Slack channel that was set up. That channel has grown incredibly fast, as the word is getting out, and as meetups are basically word of mouth, then you have to get the word out and then eventually more people would join.

We had an online Slack discussion that was well attended as well. So it’s really exciting that people are coming to our space to talk and discuss these issues.

[00:10:34] Nathan Wrigley: Do you have a fixed agenda about what it is that you would like to achieve? Or are you still very much in the stages of trying to work out with those people who show up what it is that you want the project to become, who it is that you want to take the responsibility for certain things? Do you have any things solidified yet, or is it still very much figuring it all out?

[00:10:56] Destiny Kanno: We are still very much hoping to get to this large HBCU college style, WordCamp style event. And so we’re looking for folks to step up to organize, but we also understand that that takes a bit of onboarding, and resource sharing in order to make that happen.

[00:11:15] Joe Simpson: And to add onto that, I know in general, as a meetup organizer myself, these things take time. But it’s always based on the energy, enthusiasm of people that come to the project. So, as we get more and more people on board, and, for example, the Slack channel is a great place where everyday someone’s sharing information, starting the discussion, so those type of people hopefully will take a larger role in the group and the group will just grow organically.

[00:11:44] Nathan Wrigley: Could you drop the URL? I will put it in the show notes, but perhaps one of you could say it out loud so that anybody listening, perhaps sitting in a cafe or something could put their phone down and go and actually visit that site. What’s the URL for the Slack channel?

[00:11:59] Joe Simpson: Oh the Slack channel. It’s a super long gobbledygook URL. We could probably create a short link for it.

[00:12:05] Nathan Wrigley: Okay, I’ll add it into the show notes. So I would add that anybody listening to this, just head over to the show notes on WP Tavern, and look for the podcast section there, and from there you can find those things.

I was interested to hear you Joe say, we’re going to be straying into an area which maybe is uncomfortable. I don’t know. See how we go. You said that you were concerned in the past that you’d attended events and there was nobody that looked like you. Two things that I want to ask from that. First thing, what does that feel like? That’s my first question. And secondly, has any of that changed in the recent past?

[00:12:43] Joe Simpson: I would say to clarify the statement, it was that I didn’t see people that look like me on stage. Now in the WordPress community, there were people that look like me in the audience, at all the WordCamps that I had attended, but again, seeing someone on stage and talking about WordPress, I hadn’t seen that.

And ironically, the first event that I was accepted to, directly before me, Joe Howard presented. So that very day was the first day I saw someone. So from that point forward, it’s become more and more diverse in the WordPress space, diversity has been a big point of emphasis over the past three or four years.

So I would say it’s changed dramatically. And I know for me, in the communities that I’m involved with, that’s always an emphasis on what we do. The WordCamps that we’ve started, our organizing team has been incredibly diverse. Our WordCamps have all been at least 50 50 or a larger percentage in the other direction in terms of being a well-represented and diverse in terms of gender, as well as race.

So it’s just something that happens naturally in the spaces that I try to associate with, or that I flow within. So it’s just natural. And to me, I think you mentioned that some uncomfortability or things of that nature. For me, my experiences in the WordPress space haven’t been that way.

And I want to make sure that whenever someone’s involved with initiatives I’m involved in, it should always be open to anyone and everyone, and make sure that you feel that you can express yourself and get your ideas across.

[00:14:11] Nathan Wrigley: Destiny. Could I ask you the same question? Now, obviously it doesn’t reflect back on something that you said earlier, but I’m guessing that there are moments in the past where you’ve looked around you at events and just pondered those questions. What is the mix of people in this arena? And am I going to feel comfortable? Should I be one of the speakers? Do I feel comfortable here? Are people represented equally?

[00:14:31] Destiny Kanno: Yeah. So I have to out myself. I have not been to a WordCamp yet, say that with a single tear in my eye. I’ll be there at WordCamp EU. So in terms of like a WordCamp style event I don’t have any experience that I can speak to, but in terms of other events, and just growing into myself as well. Definitely, it’s true what Joe is saying. Just seeing someone that looks like you in speaker or organizing position, is a bit of a position of power, right? In those positions where you’re showing leadership or you’re showing what you could become. A person in this space that’s respected and well listened to is important to folks of all kinds.

But when I’m going to events, I’m looking for that, but I’m also in the community space, seeing how people treat me. Am I able to speak my mind respectfully, of course, in a way that’s true to myself? Am I able to come in and be vulnerable too and not be laughed at because my experience in the space, or perhaps the fact that I am the only black woman in the room.

So not just being on stage, but also just how we can navigate the spaces are two things that I look for in an inclusive kind of event.

[00:15:40] Nathan Wrigley: I’d really like for this podcast to possibly make people think about something that they haven’t really been confronted with before, and so I’m going to return to the question if it’s okay with you the actuality. Now, in Destiny’s case, it’s not going to be a WordPress event, and Joe, you may like to cast your mind to a WordPress event, or it may be something completely different because I just want to put myself in your shoes for a moment where you attend an event and you look around the room and it’s pretty clear that the representation is not what it could be. Make of that what you will. I want to know what that actually feels like. I apologize if that’s a question, which is something that you don’t wish to answer, but I’m going to ask it anyway.

[00:16:27] Destiny Kanno: Joe, do you want to go first on that one?

[00:16:29] Joe Simpson: Oh, sure. For me, and I shared this story over time. When I first got into the community. That enthusiasm or that level of excitement that you often feel when you’re around someone that’s new to WordPress or open source or something that they’re really interested in. I needed to harness it.

And initially, my local WordCamp here, I want it to be involved and I had all these ideas and I was sketching out things. And if you know me, I go overboard. And I’d proposed all these ideas and how I wanted to get involved, and unfortunately I wasn’t in that events clique, so to speak, and no fault of theirs, every event is based on relationships between the organizers and the volunteers and things of that nature. I was just some new guy. What that rejection or what that inability to have my ideas heard, what that spawned was, what I’ve done here locally in Santa Clarita or what I’ve tried to do in everything that I’ve been involved in is just to bring my voice and have my voice heard and be in the room.

So I think it’s motivation for me. I think anytime we get a rejection or a no, for me, it just drives me to get involved and become part of that discussion. That’s just me personally, and I can’t speak for others. But I feel like in terms of being a diverse person in a non-diverse environment and having people consider other ideas. I’ll give you a different example. In WordCamps, for example, sometimes they ask for very specific things in terms of the speakers that they’re looking for. For example, there was an event in Canada and they only wanted, I think Gutenberg topics. And so that limits the type of presentations they’ll get. It may be exciting in terms of pushing something that’s hot in the WordPress community through, but just naturally it excludes people that don’t have expertise in Gutenberg.

So just having people consider all different options or all different voices is something that isn’t done. And I think these type of initiatives bring that to light and that can only help in the long term.

[00:18:31] Nathan Wrigley: Thank you. Destiny, same question.

[00:18:33] Destiny Kanno: Yeah, so I’ll draw on a bit of life experience for this one. So I lived in Japan for about five years and that is a country where, you really need to speak Japanese to get around for the most part. So, this is a feeling I think anyone can have, right. This feeling of either alienation because you haven’t been able to learn the language and bond with the people in a way that is respectful to their culture, but also you understand their culture. And so you can either, blend in, walk the walk and talk the talk, or you can feel alienation. And that’s one like from the ex-pat kind of spectrum. I think there’s a more simpler example that I can give, like taking us all, that we’ve all been. I shouldn’t say all, a lot of people have been schoolchildren, and I think most of us know what it’s like to be maybe the new kid at school or start your first day.

I like to think that most kids, they don’t come in thinking about white supremacist culture and all of these things. We’re just going to school, we, we’re listening to our emo music or whatever that is. You know, othering people based on appearances, and in that scenario, I think is, an indoctrination process, based on systemic societal issues, because as a child, you’re just thinking, oh my gosh anyone like me, I might like some grunge music that no one’s ever heard of. And in that case you’re trying to fit in any way you can. And maybe you’ll find the people that accept you no matter what, or maybe you won’t. But in that scenario, I personally think a lot of the time, it’s not about, skin tone, it’s about, cliques and whether or not you’re going to be accepted. So, definitely not WordPress examples, but I feel like these are two things that I think anyone can wrap their mind around, this feeling of being othered in some way.

[00:20:16] Nathan Wrigley: We talk often in the WordPress space that it’s basically open to anybody. The idea being that it’s open source software. If you have a desire to be part of the community, you can because everybody is available. Maybe there’s some discussion to be had here because I have a feeling having spoken to a variety of people over the last few years about this, that may not be entirely true.

In other words, being able to show up and contribute, may be contingent upon a whole bunch of other factors. So for example, your ability to have the time available, your ability to have your employer second you into work. Your ability to be in a situation where you are, I don’t know, stable enough and have enough support to allow you to have the free time and so on and so forth. I wonder if there’s anything to say about that, about the wider goals of open source software in this case, WordPress, and whether or not you feel that WordPress as a whole needs to think more about this notion of well, anybody can contribute because it’s totally open to everybody. Is that true?

[00:21:25] Destiny Kanno: I think it’s true in that anyone can contribute, like full-stop right. Anyone with a computer and internet access. So those are two requirements actually, can contribute. Other than that, there’s other factors like how well will you be recognized for your contributions. Who is getting recognized?

So contribution only goes so far, but participation, sponsorship, being seen in leadership roles, there’s a whole other area where, maybe some folks cannot break through as easily.

[00:21:59] Nathan Wrigley: Joe, any thoughts on that?

[00:22:01] Joe Simpson: Well, I mean, I do think it’s possible and I think it happens everyday. It’s just a matter of making those opportunities available, to as wide an audience as possible. I know I participated in some diverse speaking workshops, and I know in terms of the events that I’ve done, we’ve made a conscious effort to include new speakers, to include people who haven’t presented before, and we offer them training, or give them a stage. They can come and speak at our meetup to practice and to get that sense of ownership or that sense of buy-in. And I think that’s for me, finding out where those avenues for inclusion are and making sure that they’re available and known to people that are coming into the community. Those voices that are diverse, making sure that they know that there are opportunities to do that. And the example that I gave earlier in terms of that frustration that I had when I first wanted to get involved with a WorkCamp event, I didn’t know that there was a call for speakers or call for organizing. I mean, I didn’t know of any of the paths or processes that were already in place because I was new and sometimes things in the open source community, you have to figure out on your own.

So for me, with an initiative like this, what I’m hoping is that this collaboration with the folks on the Automattic side and our community, is this new collaboration can open up so many more doors for people to get involved in making sure that if you want to speak, hey, you should do this. Hey, this event’s coming up. They need organizers. This is how you help organize. And being that conduit will only make things more diverse and more inclusive. I think a lot of times those avenues are, they expect that you know those, but most people don’t. So what I always try to do in our community events and hopefully as we move forward with this one is to make sure that people know the path or the opportunities that are there and how they can take full advantage of them.

[00:23:47] Nathan Wrigley: Let’s do a little bit of blue sky thinking. Let’s imagine that the BlackPress project is a runaway success. And a couple of years from now, you know, there’s a real up swelling of support and the community has grown really strongly, and all of the issues that you’ve dealt with today have been looked at and addressed, and you’ve come up with some novel solutions for different problems. Do you just want to give us some ideas about the kind of things that you would, Joe, you just touched on a few of them, but the concrete things that you want to have happen. In other words, how many people would you like to be a part of that community? What kind of job titles, for want of a better word, would you like to have? What kind of documents would you like to have produced or videos or whatever it may be? What concrete things would you wish could happen, let’s say two years from now?

[00:24:37] Destiny Kanno: I would say in an ideal world two years from now, we would have folks from every region of the world, involved in the project, maybe even some, EU, EMEA APAC channels as well. Just connecting us all, in WordPress, in the BlackPress community. That would be an amazing goal. All of that network essentially, folks that anywhere in the world you go, there’s going to be a WordPresser that you can connect with or see at a WordCamp and enjoy time with.

So that’s definitely in my mind, a amazing goal for us to have. BlackPress Isn’t trying to replace the larger WordPress community, it’s not trying to become like a make Slack in that way, and at least in my mind, Joe definitely correct me if I’m wrong here.

[00:25:19] Joe Simpson: I totally agree.

[00:25:20] Destiny Kanno: Yeah, like we, but we still want to have a space where, as you got to Nathan, you know, we can help better circulate opportunities amongst each other. We can help better sponsor, mentor, prepare each other for organizer roles, for speaking engagements. So that is definitely a goal that we have, and are iterating on, even right now.

[00:25:40] Joe Simpson: Destiny summed it up pretty well. I mean, just having that place where we can help the next generation of contributors and creators in the WordPress space would be awesome. Wouldn’t it be cool if BlackPress had panel at WordCamp US or WordCamp Europe? Or if we do an HBCU, a WordCamp style event. What if we did a world event? In the past three years? What I’ve really been excited about is, the pandemic has forced us all inward, unfortunately, but the offshoot of that is that all of our meetups are now global. We have people that come in from Europe that come in from Africa that come in from Australia, growing it into Asia.

Those kinds of things are really exciting because, not all of us can travel to a WordCamp event, even when everything was in person. I may not be able to fly to WordCamp US in Nashville, for example, because of work commitments or personal commitment, the virtual spaces allowed us to grow in a different direction.

So I’m excited that once things go back to a more in-person or even a hybrid situation, those people that we’ve reached out to all over the world will really have an impact on WordPress.

[00:26:45] Nathan Wrigley: Thank you very much, indeed. So that was our blue sky thinking moment. We were casting the net two years into the future and imagining what great things are possible. Let’s go back to today, rein it in a little bit. You’ve obviously beginning something. The enthusiasm is often great at the beginning and then reality of what needs to be done sets in and you realize that, okay, this is where we’re at we haven’t reached these grand goals. Right now. If I could wave a magic wand and give you the things that you need to happen in the next couple of months, what would those look like? Are you looking for new membership? Is it all about the people? Is it trying to find people from different locales?

What do you really want to do in the next couple of months to kickstart this whole enterprise?

[00:27:29] Destiny Kanno: Well, we had our first meetup as we noted at the beginning of this call, last month. So to keep momentum we’re continuing with our meetups. So we actually have another one tomorrow from 5:00 PM Pacific time. And that is with Allie Nimmons from Underrepresented in Tech, discussing that. Next month we have one coming up to discuss 5.9 and full site editing.

So that is keeping up with our meetups is one way that we’re hoping to definitely increase membership and grow our community. I don’t think I said before, but when we started in January this year kicking off these events in our Slack, we only had about 17 ish people. Now we’re at 50 in our BlackPress meetup as well. We are hitting 50 plus as well. We are seeing people being excited about this initiative and we’re growing and that’s definitely something that’s going to help us toward our goals of creating these events as well.

[00:28:23] Nathan Wrigley: Yeah, so more boots on the ground, more people, fresh ideas. And I guess that’s the nice thing about growing a community at the beginning is that you have a vague idea of where the direction of travel would like to go, but then the people arrive and maybe hijack the enterprise and say, actually, what about this idea? Oh, that’s curious, I didn’t think about trying that out. Let’s give that a go. So yeah, boots on the ground would be good. Joe, anything to add to that?

[00:28:48] Joe Simpson: I was just going to say, it’s all of the things that Destiny mentioned. Just the more events you have, the more people will come. The more you get the word out, the more the group will grow. So to me, just being consistent and the events that Destiny’s mentioned will gain exposure being on podcasts, such as this one, more people will hear the message. Will hear what we’re trying to do, and hopefully it’ll come and it’ll just grow that way.

[00:29:09] Nathan Wrigley: Okay, one other question. It occurs to me that you obviously want the membership to grow. BlackPress we described that you’d like it to be swelling into the future. Is there any kind of walled garden around this? Is there any part of the community that you are going to welcome more? Or are you going for full inclusivity? Everybody is welcome. Please all come and give us your ideas.

[00:29:37] Destiny Kanno: Yes, this is a great question. And we get it all the time. Who is allowed, quote, unquote, allowed to join BlackPress meetup or Slack, and this meetup, and community, we treat it like any other community in WordPress. It’s welcome to all. However folks of non-black African descent, who we’re calling allies, just be aware that this is a space where, they should be uplifting black voices or looking for ways to advocate for, or sponsor or share ideas in a way that isn’t taking away from the experiences of the community here that we built. So it’s a safe space for everyone, but just keep it in mind.

Taking up space as a real thing, right? And this is a space where you’re able to be, but also with an understanding that it is for folks of black African descent. We want to be able to collaborate and share ideas, but we also want to ensure that this is a safe space for the target community as well.

It’s really all of us that need to be doing this work to get to a better place where we don’t even, meet these kinds of offshoot communities. I think ideally everyone wants to be in that space where, everywhere in WordPress, it’s yeah, we acknowledge that you are different, and we love that you’re different. And we’re going to talk about your perspective and respect that, and we’re all going to be great, but we’re still in a space where differences are seen as something to other or not be included.

And so that’s, I think where this idea of that’s your space, so I don’t want to be in there bothering you, maybe comes from in my head.

[00:31:11] Joe Simpson: We mentioned it at the top when we kicked off the conversation, a lot of times we’ll have people that will call out the fact that they’re not black or is it okay to ask this question a certain way? But I think that level of consciousness is what moves the discussion forward.

So in my circles, there’s an understanding. If I generate the level respect that I should, that shouldn’t be an issue. And you’re always welcome to participate and to ask certain questions. So the story that I love to share is when I went away to college and, you know, oftentimes during spring breaks or things of that nature, you may go to your roommates, family’s home or vice versa. And I grew up in in an inner city environment. And one of my roommates, when he came with me and we were headed back to college campus, he said, wow, I didn’t know it was like that. No one really noticed I was white. And to me, that’s sort of the spirit of what I try to do in the WordPress space, it’s like, respect me, but there aren’t any walls or any barriers to what you and I, as friends or as colleagues, or as co-organizers should have. We should both be able to speak freely.

And within the WordPress space where there are codes of conduct for meetups and, there’s guidelines and rules for all this stuff that is the WordPress way or the WordPress community. As long as we’re in that environment, our conversations will flow and be organic. So, it should never be an issue.

[00:32:30] Destiny Kanno: I was just going to add just thinking about reflecting on that question a bit more, I feel like it’s as a black person navigating the world, we have to ask that question like all the time. Can I join? Will I be accepted? Will people listen to me? So yeah, like when I think about that question now, I’m just thinking like, that’s part of, trying to become a community. I don’t know, you know, into a community. Yeah. I think it all just boils down to respect. Are you entering that space respectfully or are you trying to, make it all about you?

[00:33:01] Nathan Wrigley: Thank you so much. Just before we wind it up, what would be the best place to interact with the pair of you? Maybe we’ll take it one at a time, but maybe one of you wants to deal with the usual thing, maybe there’s an email address or a Twitter handle, or let’s see if we can dig out that Slack group address or whatever.

But where’s the best place to contact you about BlackPress more generally. And then if you wish to tell us specifically, where could we find you personally best online, that might be helpful too. So let’s start with Destiny.

[00:33:34] Destiny Kanno: Yeah, I think the make WordPress Slack is a good space to start if you’re there. And if you’re not, you should join. And if not, you can also find me on Twitter, the destiny wp.

[00:33:46] Joe Simpson: Yeah, for the meetup group, you can find us on meetup.com slash BlackPress dash meetup. And you can find me anywhere in the WordPress space. Joe Simpson Junior on WordPress.org. Twitter, LinkedIn, it’s always Joe Simpson, Jr. So, I welcome anyone that wants to reach out and find out more about BlackPress.

[00:34:05] Nathan Wrigley: That was really interesting. Thank you Destiny and Joe, thank you for coming onto the podcast today. I really appreciate it.

[00:34:12] Destiny Kanno: Thank you, Nathan.

[00:34:13] Joe Simpson: Yeah. Thanks for having us.

357: Ryan Mulligan

This week I get to talk to Ryan Mulligan! Ryan put together a Collection of some of his personal picks for favorite Pens and we get a chance to talk through a lot of them. There are some classic moments here I really feel, like when something you consider pretty basic gets way more popular than you ever thought it would. Ryan has a knack for feeling out really cool new technologies and then quickly using them to build great demos that play up what those technologies were born to do.

Time Jumps

Sponsor: Automattic

Automattic are the makers of WordPress.com, the fastest and easiest place to spin up a WordPress site, without sacrificing the power of self-hosted options. If you sell stuff on WordPress.com, the built-in help to do that is powered by WooCommerce, the premier eCommerce solution for WordPress. It’s the same WooCommerce whether you are on WordPress.com or not. If you are self-hosted, you can almost certainly take advantage of Jetpack, Automattic’s WordPress plugin that adds enormous functionality to WordPress, like a vastly improved site search, real-time backups, security features, and tons more.

The post 357: Ryan Mulligan appeared first on CodePen Blog.

#16 – Jonathan Bossenger on Cleaning Up WordPress Notifications

On the podcast today we have Jonathan Bossenger.

He’s here to talk about WordPress notifications and how they are managed.

If you’ve been using WordPress for any length of time, then you’ll have seen notifications appear in the admin area of your site. These messages can be useful, they might tell you that something needs to be updated, or that something was successfully saved.

There’s also a chance that you’ve seen notifications for other purposes as well. Perhaps a plugin would like you to notice their upgrade offer, or that they have a sale on.

All these notifications fall into the same place, and when multiple of them arise at the same time, the admin area can become cluttered and confusing, especially for novice users.

It’s possible that you don’t mind these notifications, but it seems that many people do, and feel that they’re being overused. They would prefer not to see so many notifications, and if notifications are to appear, that there are limitations on what they can show, and how large they can be.

In the podcast Jonathan talks about his concerns regarding WordPress notifications, and the fact that there’s no system in place to limit what they can display and for what purpose.

He’s currently working on WP Notify, which is a project aiming to put a notifications area in to your WordPress website. All notifications would appear in this area, and there would be constraints about what could, and could not, be displayed there.

It’s not about removing notifications completely, more about putting them in a defined place, like you might find on your mobile phone.

We talk about how notifications are currently created and how there are few limits on what they can do. How overuse of notifications can be a cause for concern, and how Jonathan’s solution aims to add a unified system to WordPress which would put the user in control of the notifications.

Jonathan’s website

WP Notify on GitHub

Transcript

[00:00:00] Nathan Wrigley: Welcome to the Jukebox podcast from WP Tavern. My name is Nathan Wrigley. Jukebox is a podcast which is dedicated to all things WordPress. The people, the events, the plugins, the blocks, the themes, and in this case, the way that we manage announcements in the WordPress admin. If you’d like to subscribe to the podcast, you can do that by searching for WP Tavern in your podcast player of choice, or by going to WP Tavern dot com forward slash feed forward slash podcast. And you can copy that URL into most podcast players.

I’d really like to hear from anyone out there who would like to come on the podcast and talk about whatever it is that you do with WordPress. It might be that you’re a developer, a WordCamp organizer contributor, a designer. Honestly, if it’s about WordPress, I’m keen to hear from you, and hopefully get you on the show. Head over to WP Tavern dot com forward slash contact forward slash jukebox. And you use the contact form there.

So on the podcast today, we have Jonathan Bossenger. He’s here to talk about WordPress notifications and how they are managed. If you’ve been using WordPress for any length of time, then you’ll have seen notifications appear in the admin area of your site. These messages can be useful. They might tell you something needs to be updated. Or that something was successfully saved. There’s also a chance that you’ve seen notifications for other purposes as well. Perhaps a plugin would like you to notice their upgrade offer, or that they have a sale on. All these notifications fall into the same place, and when multiple of them arise at the same time, the admin area can become cluttered and confusing, especially for novice users.

It’s possible that you don’t mind these notifications, but it seems that many people do, and feel that they’re being overused. They would prefer not to see so many notifications. And if notifications are to appear, that there are limitations on what they can show, and how large they can be.

In the podcast, Jonathan talks about his concerns regarding WordPress notifications and the fact that there’s no system in place to limit what they can display, and for what purpose. He’s currently working on WP Notify, which is a project aiming to put a notifications area into your WordPress website. All notifications would appear in this area and there would be constraints about what you could and could not display there. It’s not about removing notifications completely, more about putting them in a defined place. Like you might find on your mobile phone. We talk about how notifications are currently created and how there are a few limits on what they can do. How over use of notifications can be a cause for concern, and how Jonathan’s solution aims to add a unified system to WordPress, which would put the user in control of the notifications.

If you’re interested in finding out more, you can find all the links in the show notes over at WP Tavern dot com forward slash podcast, and look for episode number 16. And so without further delay, I bring you Jonathan Bossenger.

I am joined on the podcast today by Jonathan Bassinger. Hello Jonathan?

[00:04:01] Jonathan Bossenger: Hello, Nathan, how are you?

[00:04:02] Nathan Wrigley: I’m very well. Jonathan is joining us today to talk about WordPress notifications. Now I could introduce this subject and say all sorts of things off the bat. My thoughts on things, but it would probably muddy the water.

So Jonathan, it’s over to you. Tell us about WordPress notifications and the issues that you see, and then we’ll get into the weeds and discuss the finer points.

[00:04:26] Jonathan Bossenger: Sure. No problem. So, before I start, I’d like to mention that my problems with WordPress notifications come from both the point of view of a contributor to WordPress, and also a person who makes money off WordPress.

So some of the first products that I created for WordPress were plugins and part of those plugins required me to give some kind of feedback to the user if they had saved settings, or if there was some change that they had to make or whatever the case may be. And then from there I moved on to building plugins for clients or doing custom work.

And the point that I noticed that there was a problem as it were with notifications was when I used to log into client’s websites, as a new administrator and I was flooded with, and I’m sure we’ve all seen the screenshots of this on social media, but flooded with notifications from this plugin that has just been updated to, this plugin has an upgrade, a paid upgrade to this plugin is just on this over here. This theme has got this, that, and the next thing. And I’m reading half a page, sometimes a full page, of notifications before I can even start working with the dashboard. The, in big inverted air-quotes, problem with notifications is the fact that there is no official centralized way to register and present notifications to the user other than using admin notices.

So if you’re a developer of a plugin or developer of a theme, there is the admin notices hook that you can hook into, but you can pretty much hook any HTML into that hook. So the documentation gives you some guidelines as to status classes that you can use for your div to display it in red or green as a success or an error, but you have full leeway to build anything you want there.

So you could build a full page notification. You could build a tiny notification. They are guidelines in the plugin and theme handbooks that gives you guidelines of what you should do and what you should stick to. But there’s nothing to force you down that path. And with notifications. These admin notices traditionally should be being used to give the user feedback.

So I’ve created a post, I hit save, and I need to see a message that says, yay, my post has been saved. This admin notices functionality is now being, and I don’t want to use the word abused, so I’m not going to, but overused by folks who are trying to give the user some other form of notification, some other piece of messaging, some other piece of information.

[00:07:01] Nathan Wrigley: So the problem is a historical one in that WordPress core has the capacity to pop-up things, which presumably the intention was that anybody who wished to use these would have something legitimate to say. As you say, post has been saved, something has been deleted and so on, and there are no constraints around really what you can put in there.

It could be enormous. It could be very wordy. It could contain images, animated gifts, and so on. And there’s no real constraints about the way that it can be implemented. And I think for the most experienced users of WordPress, that is to say somebody that’s dabbling in there everyday, you kind of become a little bit numb to it and you just log into WordPress and immediately dismiss them all, click whatever option is available to make them go away.

But there they were and clients, people less experienced, I think the problem might reside in the fact that they might cause some sort of alarm, you know, it might be, oh, well, why is that appearing? There’s probably some kind of upgrade that I should have had. Why haven’t I got the upgrade and so on and so forth.

So it’s a historical problem. Do you know, roughly speaking, how far do we need to rewind the clock before the, in inverted commas, over use of these began. When was the first time you saw this being used for ulterior motives?

[00:08:23] Jonathan Bossenger: So it’s difficult for me to say that 100%, because I’ve only been very active in the WordPress space since around 2015.

I use WordPress as a blogging platform from about 2009, but that’s, as far as it went, I had a blog. I had maybe a security plugin installed, maybe a forms plugin, but I was just using it for blogging purposes. So it was only in 2015, 2016 that I started building for WordPress that I started seeing, personally seeing these issues.

I would say that since it’s definitely gotten worse. There was a stage in about 2017, 2018 that I started seeing it more and more and more. The thing that you mentioned earlier about, you know, as an experienced user of WordPress, we see these notifications. We know how to dismiss them. We know how to click. The concern that I always have is never mind somebody who’s a client, nevermind somebody who is a business owner. Let’s just look at somebody who wants to blog with WordPress or build themselves as simple website with WordPress. What is the user story gonna look like? They’re going to either through their hosting company, they’re going to install WordPress through some kind of one-click install.

Maybe they’re using a managed hosting environment, which does it all for you. Maybe they’re technically savvy enough to download the zip file and upload it to a server. They’re going to install it. They’re going to start using it. They’re going to need to have, maybe a contact form. They’re going to need to maybe have some kind of plug-in functionality.

They’re going to start looking for plugins to install things. Then as you say, suddenly, they’re going to see these messages and these messages are going to be jumping out at them. And these messages are different sizes and different shapes, and it just creates this very jagged, jarring experience for the new user.

Now we can’t blame WordPress because WordPress Core itself is using admin notices correctly. We can’t really blame plugin developers and theme developers because, they’re trying to get this information to the user, with a system that’s not designed for it. So the problem is not one single entity’s problem.

The problem is all of our problems. That’s the kind of the way I look at it. We all need to work together with WordPress Core, with plugin developers, with team developers and find a better way to register these, non, I don’t like to call them notifications because to me a notification is… your post has been saved successfully, or you have created a new post.

So let’s call them announcements just for the sake of this podcast. We need to find a way to register these announcements that are outside of the scope of the day-to-day use of WordPress and present them to the user in a way that is clean and nice, and doesn’t, doesn’t disturb them using WordPress on a day to day, but is accessible and they can, and they can see the information that they see in a, in a way that is formalised.

[00:11:23] Nathan Wrigley: Do you think then the notifications that we have at the moment, which can consume any HTML, let’s imagine that nothing additional were to be added into WordPress, and we’ll get on to your project a little bit later, but if we were simply to have it that just text could go in there and that text could be limited, say to a certain string length, I don’t know, 30 characters or something.

Would that potentially solve the problem in your eyes? Or are there situations where anyone may need more than that, because obviously if we just limited it to text, we could still put all sorts of interesting and perhaps unwanted messages in there.

[00:11:58] Jonathan Bossenger: So I speak to you now as a developer. And let me tell you that if you put some kind of limitation down, some clever developer will come along and figure out how to work around this. As it is, you know, the admin, the admin notice the system as it is, is kind of restrictive, but the only way that you could physically restrict it, is if you, every time a new plugin submission comes in, you had somebody physically inspecting every single instance of the notification system and making sure that this person was following the guidelines. And I’m sure we all remember a number of years ago that the theme team was kind of coming under fire because they were taking a long time to review themes.

And that was because everything was still being done manually. The plugging team is a small number of people due to the security that’s involved in getting plugin submitted and what plugins have to deal with. So expecting a team of people to physically inspect every single admin notice that comes through. I mean, sure, you could probably automate it in some way, but we all know that developers are crafty. We all know that developers, I mean, that’s part of what being developed is, finding ways to solve difficult problems. So you put a constraint down in front of a developer on an open source project, you know, code that is publicly available.

And say, right, we’re now stopping you from doing X. They’re going to find a way. So to me it’s a little bit less of the stick and more of the carrot. We need to provide a way that gives developers the ability specifically, and I speak now as somebody who failed dismally to try and start a plugin business.

But one of the biggest things that I struggled with was marketing. How do I market my paid products off of my free ones? You know, WordPress dot org plugin repository and the theme repository is, we all know this, is one of the top places to get yourself known, put out a free product, get customers into the funnel, but then how do you turn them into paying customers?

We know we have a problem with sponsorship of open source products. It’s spoken about all the time. How do we, how do we balance the needs of the open source project and the people that are building plugins for it and how do we balance the need for them to market to their customers, to, to bring, you know, free customers into the paying funnel, in a way that isn’t disruptive to regular users of WordPress?

And in my opinion, the only way that we can do that is by creating something that is well-defined in terms of, this is how you do things, this is how you register things. But it’s not, it’s not being thrown into the user’s face when they want to see that information. To me, that’s the only way that, that we do it in

[00:14:34] Nathan Wrigley: In terms of describing problematic notifications or announcements or whatever term we’d like to use. There must be a point where in your own mind it strays from being, well, that’s totally acceptable. Everybody ought to be seeing that. And then there’s some kind of gray area, no man’s land where that feels a bit shady, I’m not quite sure what to make of that. And then presumably there are examples which you could mention where it’s clearly something that you would strongly urge people not to do.

Do you want to just describe examples of maybe things which you think are totally legitimate and then also some examples, we should probably not use any names, examples where you’ve seen things that you think actually, I think that you’re pushing a little bit too hard then.

[00:15:19] Jonathan Bossenger: Sure. I can definitely give some examples. I won’t give names because that’s just not something I want to start doing right now, but I can give you some personal examples of notifications that I’ve dealt with.

For those of you who don’t know, I used to be a developer for a company called Castos. We managed a podcasting plugin for WordPress. And at that stage, I was very focused on making sure that our notifications were not disruptive to our users or any other user of the WordPress site that happened to have the plugin installed.

So as an example, our one, let’s call it onboarding form to try and get customers to sign up for our podcast hosting service, was only available on the plugin settings page. So only when you went to the plugin settings on the right-hand side, there was a nice little sidebar with a little graphic to say, hey, if you’re enjoying the plugin, but you’re looking for a way to host your files, here’s a form you can fill in. We’ll give you a 10% discount to try it out. To me, that’s not disruptive, because the user can still use their settings. They can still make changes. They’re not seeing this notification at the top of the screen in their face every time, it’s off to the right. It’s there, it’s visible, but it’s not disruptive.

The other thing we were very focused on is when we do update messages. So when the plugin gets updated, if there’s some kind of process that needs to be run, maybe there’s a database upgrade that needs to be run. That to me makes sense as a, let’s call it a site-wide notice, or a more general admin notice, but we kept them very limited. Maybe one sentence. We didn’t use the red color or the green color, we just kept it gray and just said, hey, we noticed you’ve recently updated. Here’s a link to click through to make the changes. But specific things related to the plugin. So if we would, I can actually give you a perfect example. There were some changes in the Apple podcast categories and Apple podcasting was changing how the categories worked.

And so what we did was, if you loaded up the plugin and you updated the plugin, you saw no messages, you saw no notifications, you could carry on doing your things, because it would all just work. When you went to the page that allows you to control your categories, there we showed you a specific message to say, by the way, did you know Apple have recently updated their categories, your old categories are still going to work, but it would be a good idea to change your categories on this page. And then as soon as the person saved that page, that notification goes away. So to me, that’s an example of how, as a developer, you can sort of think of, you know, how do I get free users onto the paid version?

You know, how do I display relevant information to the user? Some of the bad things that I’ve seen, there are a couple of popular page builders that I won’t name. I think I might’ve tweeted about it. So maybe if you go back in my feed, you might find. With the Block Editor coming out. When you load up a new post, you have this option to select, and the only reason I know this is because for various reasons, I have both of these page builders on my site because I’ve done some demo content with them for tutorials in the past. When I create a new post, I get this big, these two big buttons saying, do you want to use this page builder? Do you want to use that page builder? Or do you want to use the default page builder. When I select, and this might’ve changed, cause it’s been a while since I’ve done this, but when I select default page builder, at the very top of the Block Editor, there are now these two big buttons, saying switch back to the other page builders, switch back to the second page builder that you have installed. To me, that’s kind of pushing it, because I’ve already chosen that I want to use the default editor. Now to keep bugging me. And the other thing that I hated about those buttons were, they both had their own colour schemes. So they were very jarring in the block editor. Cause I keep my WordPress on a very clean theme. So now I’ve got these big, bold colors at the top of my editing area. And they were both using separate fonts as well. They weren’t using standard WordPress dashboard fonts.

So to me, that was very much in my face and almost getting to a point where I wanted to stop using their products because they were being so vibrant about that. There was another example recently where somebody had, I can’t remember the details but, I think it was, I think it was The Tavern site, where somebody had added, I think it was a signup or an upgrade or something button as a HTML field in the settings sidebar, which there was quite a bit of conversation around. To me again, that’s the problem, you know, where you are using space that should be used for one purpose, you know, control or settings or whatever. And now you’re taking over that space to put in your notifications or your upgrades or upsells. Those to me are the kind of the problematic areas.

[00:19:53] Nathan Wrigley: It sounds to me as if you’re demarcating in your own head at least, the pages, the places on a website which have legitimate use. So the general admin, if you just click the dashboard link and you’re into WordPress and you’re not in any particular setting for any particular plugin. You feel that those ought to be limited to possibly text and just very informational in nature and something which is more or less critical, something which you must take care of because otherwise. Right. Okay. So that’s what belongs there. But if you were to go into the settings page of any particular plugin, that’s more of a free for all.

Do you feel that there’s any constraints there or are you, you mentioned that for Castos, you have a sidebar. I remember seeing that have actually used that before. And there it was, and it did genuinely feel as if that was the right place for it, because I was already in the settings. I was thinking that I was going to be interacting in some way with Castos, and so the upgrade felt like an appropriate place. Any limitations on that? Are we allowed to go full page in there or should there be some constraints around that?

[00:21:03] Jonathan Bossenger: Well, for me, it’s always about the user experience. So, I feel like a lot of developers, they understand the the balance between creating a good user experience and interacting with your users. The company that I work for now, Delicious Brains, it was about a year ago now released version two of WP Migrate DB Pro with a new user interface, and the notifications that come up when you log into the plugin page and the plugin settings, they’re just so nice and clean and they don’t overwhelm you.

They are useful information, you know. Even if you install the free plugin, there’s a little bit of a thing at the top, but it doesn’t bombard you. So in my opinion, yes, if you’re building a product for WordPress today, and you are forced to use admin notices. You should think about how you’re registering these things.

One of the, one of the things that I spent the most time on when we were releasing updates to the plugin at Castos was triggering certain notifications only at certain points. So, when there was an upgrade from 1.2 to 1.3, then trigger a certain notification. But then when the user dismisses that notification save the fact that they’ve dismissed it and don’t show it again.

So we actually spent time thinking about this, because there’s nothing worse and this actually happened. So the reason we spend the time is because something happened. We launched an update, it included an upgrade step that the user had to action. But we didn’t have any kind of check in place. So every single time a new user installed the plugin, they got this upgrade.

Now that’s fine in the scope of one plugin. Think about let’s say 15 popular plugins do that. Your user comes along and likes those plugins and installs those plugins and suddenly has 15 notifications in their main dashboard they have to deal with. If those were separated, off and in the settings for each plugin, then it would limit that amount of overwhelm. And they would only see that notification when they’re dealing with those settings. So I do believe that putting plugins specific notifications in certain places is a better way. The problem you have with that though, is that the other reason developers use notifications is to push users into that funnel.

And I am not standing here today saying we shouldn’t allow developers to do that. I strongly support people who are working on open source products, being able to be given the ability to earn income, to be able to be given the ability to turn non-paying customers, into paying customers. But we need to do it in such a way that it doesn’t overwhelm the users.

It doesn’t frustrate them. We should be making it a, we should be making the process of signing up for our product as fun and pleasant as it is using WordPress. And if we are bombarding our customers with notifications from day one when, and that’s why I say we, we have to find a better way to do this. We can take what we currently have and try and patch it up because what we currently have has been overused for so long and is already.

So what’s the word I want to use? I don’t want to use broken because it means that it was working before, but it’s been again, I don’t want to say misused because that sounds so negative. Used incorrectly, used for the wrong reasons, because the reasons that exist, the reasons that exist today, for people to use these notifications are ten times more, what they were, you know, five, ten years ago.

[00:24:31] Nathan Wrigley: Some of the examples that I’m going to give here come into my head when I’m thinking about advertising and overwhelm of advertising and misuse. And so a good example would be, if you go to a news site, I can think of an example of a local news site to me. And I go there and I find it incredibly difficult to use that website because they’ve taken the path of advertising and there are adverts, splattered everywhere so much so that it’s almost impossible to find the actual content. The content is split up into small paragraphs and they are punctuated by advertisements. And I feel that’s probably the argument that you’re making is that if we clutter the UI, if we allow the UI to be cluttered by things which people didn’t necessarily wish or need to see, then we are making the experience poorer. And I go to that website. I find it quite difficult to stay there. It may be that I need the content so badly that I’ll persevere, but I’ve got this instinctive reaction to get away. And we don’t wish people to enter WordPress, have an initial experience which is poor and continually frustrated.

However, on the flip side, there’s obviously some sort of commercial need, as you’ve described. People would wish to turn their free projects into paid projects and have some subscribers. And I guess plugin developers would point to the fact that in a normal situation, you would get a product and probably give up your email address in return for that. But on the WordPress side, if they come to the repo and download your free plugin, you have no access to that. You haven’t managed to get them into a funnel in any way, shape or form. They’re just consuming your product, and that’s the end of the road. They may use it forever, and I have no idea who you are or any other product that you may offer.

And in fact, they may well miss out on something which they genuinely, legitimately needed. And so the developers would argue, I guess, that we need some way to do this. We’re going to try to keep it under control, but I suppose the problem is human nature. Is that given the fact that the area is open to any HTML as you described, it just starts to get overused. The boundaries get pushed, things that were acceptable yesterday are going to be pushed further. And then what’s acceptable in a year’s time may get pushed further. And your position, I suppose, is we just want to reign this in a little bit.

Another thing which comes to mind is commercial television. On the TV side of things, probably radio as well, we’ve gotten quite used to the fact that our content will be punctuated with adverts. We’ve walked across the mental bridge that, I cannot watch this program unless it is paid for by advertising. So every 15 minutes or so I will cope. I’ll sit there and I’ll consume the adverts or I’ll go and make a cup of coffee.

I guess making coffee is the equivalent of dismissing something in WordPress, but that’s just part of life. So I do wonder where most people will sit on this. They realize that there’s a commercial need for these things to exist. And so they cope with it, but it may not be ideal.

[00:27:37] Jonathan Bossenger: And that’s one of the reasons why we need something new because I am, I’m not, I’m not saying that we should punish all plugin developers because they want to make a living.

I’m not just saying that. As I said earlier, I failed at building a plugin business because I didn’t know how to market myself properly. I didn’t know how to turn plugins that I built for free into a paid product and how to convert customers. And I kind of think there are others that have done it successfully and there are those that haven’t. So I’m here just saying, you know, developers shouldn’t be paid for their work.

I a hundred percent agree that they should be paid for their work. And I don’t believe, as I said, I don’t believe the problem is the plugin developers. Because if you think about it, let’s go back to the example I had of, you know, Seriously Simple Podcasting. We release an update, so we show that update to the user on the dashboard.

When I’m testing that, I’m just seeing that one notification, but when the user has it on their website, they’re seeing that notification plus however many other useful, important notifications are being pushed out by other plugins. You might be in a situation, and I have seen this before, where you’ve got an admin dashboard with ten important notifications.

Because there’s been a WordPress update. So that means what plugin X had to make a change in how they do something, so you need to run an upgrade. Plugin Y made an upgrade change to their tables, so you need to run that. This plugin did this. And those are all legitimate notifications. Now, first of all, the user doesn’t know what’s more important and what is primary? You know, they’re all just the same color. They’re all just red. So it’s all just a stress factor. So number one, how do we give plugin developers the option to say, hey, this is a minor update, so you should do this, but not the end of the world. Like with the categories, the example I gave earlier.

How do we give another plugin developer the option to say, this is rather important. If you don’t do this, something could go wrong with your site. Then how do we say, okay, this is a really low end thing. This is just, you know, okay, the plugin’s been updated and make a note of this change and you can read it later if you want to. We have no way of doing that right now. We have no way of giving plugin developers, theme developers, an option to create a status level and have a certain type of message that the user can go through.

I mean, we live in a world where our mobile phones have amazing notification systems. And I can control what notifications I want to read. So I have a Facebook account purely to interact with the folks on some of the WordPress groups that I’m in. But I switched those notifications off, because none of those notifications are primarily important to me. But I certainly switched the notifications to the messaging app that I have with my wife, because those notifications that are important to me. I allow my banking notifications to come through.

If my banking app sends me advertising, I’m okay with that because I accept the fact that they’re a business. They need to make money. I’m already giving them some of my money every month with banking fees and all of that, but they want to make more, fine, I accept that. Because the benefits of receiving the SMS to tell me that my credit card has been cloned, do I want to cancel it, overrides my distaste by advertising, but that, that exists as a concept. WordPress doesn’t have that place where I, as a user can choose, even simply which notifications I want to see and which I don’t. So if I say I’m using SEO plugin X, whatever the name is, and I want to see the notifications because my SEO is important.

Then I will probably accept any upsells or upgrade notifications and I will either read them or just mark them as read, but I will be happy to receive them because the rest of the information they’re giving me to keep my SEO on board to make sure my meta tags are right, is my featured image working, is my social media image working? All those things that are important to me, I will accept their messaging. And I believe that in doing something like that, where there is a specific, formalized way of doing things. If I see SEO plugin X is using that system, giving me the user the control to receive the messaging, and SEO plug in Z is not, I personally will have more of a inkling to use X, because X is putting the control of notifications back in my hands, which I respect and anybody who’s bombarding me, I’ll have less of an inkling to want to use their product.

[00:32:02] Nathan Wrigley: I think the mobile phone example is really excellent because we can probably all identify with that. There’s usually some kind of drop down notification held and little icons appear to alert you to the fact that there’s something there to read, if you wish. And then of course you scroll down and you can very quickly dismiss them. But then they are, there in a confined area. And that area is familiar to you as the place where notifications are. It can be totally ignored. You could come back to it in five days time, safe in the knowledge that they will be there still.

And were are they important? Well, that’s on you, you knew they were there and you decided to ignore them. And then further to that, I’ve seen a trend recently within mobile phone apps to have notification settings within the apps. So you can go in and say to the banking app, look, I’m very happy to receive the critical updates about security breaches, but I’d probably rather not have the, I don’t know, here’s our latest mortgage deal kind of notifications.

The premise there must be that the banking app realizes that there is some balance of trust to be gained. And if you keep pushing the relevant to some, but irrelevant to most, notifications out at some point, the trust scale tips, and you become tired of this app and you may uninstall it. Now, in the case of banking, it maybe that’s a step too far, you’te kind of wedded to that, but you can imagine something where there are three or four rivals and you’re trying to weigh up, which one’s better for you. The overwhelm of notifications may just be the thing that tips you against it.

So let’s move into the project that you’ve got, WP Notify, because that feels to me as if you’re trying to replicate the mobile phone model. In other words, everything is tucked away in a particular area. Do you want to describe this enterprise just in broad brush strokes, and then we’ll talk about specifically what it does, and also how you may get involved in where the project’s at right now.

[00:34:00] Jonathan Bossenger: Sure. So, the goal of WP Notify, as we originally defined in the initial post. And before I get into that, I just want to give a shout out to, sorry dude, I can’t pronounce your surname, but he was the guy who came up with a proposal originally. He tweeted that he didn’t have time to try and move it forward. So I contacted him and I picked it up from there. But his original proposal was very simply, we need a better notification system for WordPress. We can’t take what we currently have, which has been overused, which is limited, and it’s limited in its technology, but unlimited in what people can do with it, and that’s the problem. We can’t take that and make that better. We need something brand new. And then once we have something brand new, that works, that makes sense that balances the needs of the user and the open source project. And the developers who are trying to earn money from their project. Once we have something like that, then it’s easier to control, to tame these notifications.

Then it’s easier to put guidelines in place. And then when the developers build their plugins, they are almost forced because when they register a notice, they can only register three fields. Those are the only three fields that are allowed. They can put whatever texts they wanted them, but those are the three fields. They can’t go overboard. They can’t make it bigger. They have a specific format, and the way they look. They’re allowed to add certain things, but not other things. That’s just where we’re at. So that’s what an WP Notify is. It’s a project that we kicked off now in 2019. So it’ll be going on for three years in August.

It’s an open source, what’s known as a feature plugin. So a feature plugin is something that is, I want to say, not sponsored by, has been accepted by WordPress Core in general as a good idea. We have an official GitHub repository on the WordPress organization and we have a Slack channel, and we are slowly trying to build this better notification system for WordPress.

[00:35:57] Nathan Wrigley: So imagine that I’ve enabled this, I’ve downloaded it and activated it. I will, by the way, link to the GitHub repository and various other things.

[00:36:07] Jonathan Bossenger: I wouldn’t install and activate it just yet, because it’s not something that you can actually use yet.

[00:36:12] Nathan Wrigley: So rewind. I haven’t installed it. I haven’t activated it. None of that stuff has happened. What does it look like? What will it present me with? As a user if I’m looking at the screen, what will I be seeing?

[00:36:24] Jonathan Bossenger: Okay. So it’s difficult to obviously, you know, describe this in a podcast environment, but the idea is very similar to what we were chatting about when we spoke about the Android or the iOS, the mobile phone notification system.

The idea is to have some kind of icon, not a jumping blinging one, but some kind of icon, be it a bell or something. I think in the design that is. That shows some kind of user interface messaging to say, you have new notifications. The user is then able to click on that. They’re able to see the notifications come up, they’re able to scan through, see which ones are important to them, see which ones aren’t. Read the ones that are dismissed, the ones that aren’t. The other idea as we spoke about earlier is to give the user the control over who they want to receive notifications from. So if they keep getting a bunch of notifications from plugin X that are never useful to them, they can turn it off if they want to.

If they receive notifications from plugin X that are useful for them, they leave them on. It is up to the user to then choose to either read or dismiss those notifications. We don’t want to go as far as saying, we’re only going to show notifications that are state changes or update changes.

We want the plugin developers to be able to advertise their products. We want the theme developers and the product developers to be able to say, hey, we’ve got a black Friday special on. We’ve got a discount code running, whatever. We want those things, but we want them in a way that the user has the control. So there are some designs, as you can see, if you go through to the GitHub repository on the read me page, we have links to our design documents.

We have links to our requirements documents. We spent about, due to the nature of open source, we spent probably about a year and a half just working on what are the requirements version one? And that went through a lot of process of feedback and revisions. Then we worked on design and that went through feedback and revisions as well.

Now we’re starting at the sort of initial implementation phase and our first goal, our first short term goal right now is to take those designs, and actually implement them purely as HTML so that you, Nathan, or anybody else who is interested, could install the plugin and just see what we’re planning. Just to get a visual idea of what this could look like.

The goal after that is to then get feedback from the community. From the plugin developers, from the theme developers, from the users, from the open source community. And say, does this solve the problem we’re trying to solve? If it does, then we can start looking at how do we implement this?

[00:38:46] Nathan Wrigley: How has the project been received? Have you had a lot of engagement? Has it been a difficult struggle trying to get people involved? What’s your opinion on where you’re at given the time that’s been spent on it?

[00:38:55] Jonathan Bossenger: That’s so here’s where we get into a little bit of personal history on this. For me, it’s been a little bit difficult because I’m not a fully sponsored contributor to opensource. I have a day job. And my day job requires me to do certain things for the business that I work for, be it, when I started it was Castos, now it’s Delicious Brains. I am allowed X amount of time to contribute to open source, but it’s not, I’m not allowed to spend my whole day. So I’ve kind of worked in a bit of a, it’s called a project manager slash wrangler role, just to try and get people interested.

We had, when we launched, we had, if you go to the initial launch post, we had loads and loads of comments and everybody was keen and everybody was excited. The problem was, in my opinion at least, everybody had their own idea of how this should work. And there was actually a stage, and if you go back into the history of the meetings, there was a stage where there was a bit of a of almost people fighting with each other in the meetings. Because one was saying it should be done this way, and one was saying it should be done then the other way. And we hadn’t even, we hadn’t even done requirements gathering yet, but people were already deciding how to build this thing. But we didn’t even know what we were building yet. So that kind of tapered off, and then we got a nice core group of folks. There was maybe ten of us. I can’t remember the exact numbers, but around ten of us that were meeting regularly. We were doing the requirements gathering. And I want to shout out to a bunch of people here Mervin, Hernandez, Ari. I can’t pronounce his surname, but he works at Yoast now, he was the theme team representative. Aaron from who was at Auttomatic, she’s somewhere else. A couple of other folks that I’m forgetting right now. I apologize in advance, but they were really involved and keeping things going. There was another chap who I know he’s a WordPress user name, but I don’t know his first name. His represented prestigious as Ramen. I don’t remember his first name. He was very influential in getting the PHP side going. And what’s happened now is we’ve kind of reached this point where COVID happened, and people’s lives changed. And I noticed that things started going down a bit and we just kind of kept chugging along and chugging along.

And what I’m now seeing is that with all of this conversation, that’s going on, people are coming back into the project. So we had a bit of work done last year on getting that HTML going, which I mentioned earlier. That kind of died down. And then recently somebody joined again and said, hey, I want to help out.

So I think the biggest problem that we have as an open source feature plugin, if you will, is just getting the, and it’s difficult in an source environment because you don’t, you don’t have a lot of easy ways to connect the folks. You have to make blog where you can create posts and I’ll blame myself here. I probably wasn’t keeping up the post as much as I should have. But you don’t really have like an official way to, you know, call to arms and get people involved. So whenever I do see these posts that jump up and down about notifications are a problem, then part of me goes, well, we’re here, we’re over here, come and have a look.

So we have had some people coming in, now, it looks like we’re moving forward again with HTML side of things. So I’m hoping that very soon we’ll be able to actually release this installable plugin that doesn’t do much, but actually just looks like what it’s going to look like. And I’m hoping my, my hope is that when we can do that, when we can physically give people something to install, and see, then they will get excited and start getting involved again.

[00:42:08] Nathan Wrigley: If I were an end user of WordPress and I had things tucked away in a notification panel or whatever that might be, that feels to me like, well, a good repository for notifications. I’m just wondering from the plugin developer side, especially from the perspective of somebody who is, really, as clean as a whistle. They never misstep and misuse notifications. They just keep everything very slim and very lean and they don’t bother us too much. What would the future for them look like? Are they going to be additional hurdles that they would have to jump through? Let’s imagine a scenario in two or three years time. WP Notify has become part of Core and everybody needs to go through the process of registering their notifications in the correct way.

What would the burden be like? Is it very minimal on the plugin developer side? How does that work?

[00:42:57] Jonathan Bossenger: So I’ll say this, I don’t see admin notices going anywhere anytime soon. And one of the reasons for that is because WordPress Core uses it extensively and will probably continue to do so until we move completely towards a JavaScript admin dashboard.

But I don’t see admin notices going anywhere anytime soon. So those developers that are using admin notices in big air quotes correctly, won’t be affected. Those that are using them in different places, but unobtrusively currently it’s a case of, you register a hook. Your write a little bit of HTML, and your notice works. On the WP Notify side, we want to make it as easy as that as well. So they will be a defined structure. You can actually see, I can send you a link. There’s a document where we have the defined structure of a notification. And if I remember correctly, it’s title and description. So very similar to what an admin notice currently looks like. An admin notice just has a description area, if you will. It doesn’t even, it’s not even defined, it generally gets used as a description area. We’ve added a title. And then I seem to recall, can’t remember hundred percent, I’ll have to double check, but I think we’ve also added a possibility to register a URL.

So if the user needs to click on a link to go and trigger some other action or click on a link internally in WordPress to trigger some action. So as a developer, you would have a similar rich user interface where currently you would hook into an admin notice. You would register a callback. Your call back would continue HTML.

In WP Notify you would have a similar hook and then you would register an object, and the object has your title, your description, and if you wanted your URL. So we want to keep it as easy to use as what admin notices is, but as friendly to the user as possible.

[00:44:34] Nathan Wrigley: I think probably Jonathan I’ve asked everything that I wish to ask. The inevitable thing is, is there anything that you wished to describe that I didn’t ask you about?

[00:44:43] Jonathan Bossenger: No. At the end of the day, The only thing that the only thing that I’m, let’s call it keen on, if you want a better word is to move this forward. So right now I’m going to use this opportunity to say if there are any front end developers or any developers out there who are very good at turning design into HTML. You want to find some way to contribute to WordPress, we have an open track ticket, where some work has been done. If we can get that over the line, that will make a huge. Then, if there are any developers who want to make this happen and they’re very good on the PHP side, or they’re very good on the JavaScript side, please come along and take a look.

Everything is linked through on our GitHub Wiki. We have a project Wiki dedicated towards the requirements documents, the design, the requirements analysis we did, the open issues and the pull request. It’s all there. So come along and come and join us, come and help us build a better notification system for WordPress, because once we can put that in place, then we can make amazing things happen.

[00:45:42] Nathan Wrigley: Jonathan, if somebody were interested in reaching out to you personally, because they would like to contribute in some way or just find out more. Do you have any links or websites or social channels that you frequent?

[00:45:54] Jonathan Bossenger: Sure. I am on Twitter. It’s John underscore Bossenger because Jonathan Bossenger was too long for Twitter, back in the day. You’re also welcome to email me. My email address is my full name. Jonathan Bossenger at gmail dot com. I don’t mind sharing that email address because Gmail’s pretty good at handling spam. And I would just say that if you do email me to ask me questions, please give me some time because I am very strict with how I manage my emails.

So I’ll check that mailbox once a day and reply when necessary. Finally, if you want to get involved, go to github dot com slash wordpress slash wp hyphen notify and go through from there. If you are already contributing to WordPress and you’re already in the WordPress Slack, there is a feature notifications channel where we have our meetings every Wednesday.

And I think it’s 2:00 PM UTC, please feel free to come and join. And you’re welcome to DM me in that Slack. Email is the best. I’m a little bit old now, so this whole Twitter DM thing is something I still struggle with. So, if you want to ask me questions, email is . Probably the best. Otherwise get me onto Twitter.

[00:46:49] Nathan Wrigley: Jonathsn Bossenger, thanks for joining us today on the podcast.

[00:46:52] Jonathan Bossenger: No problem. Thank you. .

356: Amit Sheen

I got to talk with Amit Sheen this week about his journey into creative coding. Even his early work is incredibly interesting and recent work is downright stunning. Now he’s entering a phase of sharing what he knows with workshops like Pushing CSS to the Limit. Here’s a list of Pens we talk about in the podcast (mostly):

Time Jumps

Sponsor: Retool

Custom dashboards, admin panels, CRUD apps—build any internal tool faster in Retool. Visually design apps that interface with any database or API. Switch to code nearly anywhere to customize how your apps look and work. With Retool, you ship more apps and move your business forward—all in less time.

Thousands of teams at companies like Amazon, DoorDash, Peloton, and Brex collaborate around custom-built Retool apps to solve internal workflows. To learn more, visit retool.com.

The post 356: Amit Sheen appeared first on CodePen Blog.