Storms of WordPress Controversy  ## Metadata - Author: [[Modern Earth]] - Full Title: Storms of WordPress Controversy - Category: #articles - Document Note: --- tags: - #wordpress - #governance - #open_source Author: [James Giroux] Source: [jamesgiroux.ca](https://jamesgiroux.ca/acf-gets-a-fork-by-wordpress-org/) Reference: [ACF Gets Forked by WordPress.org] date created: 2024-10-12 22:45 --- # Title: ACF Gets Forked by WordPress.org: Impact on WordPress Community ## Table of Contents: - [📝 Summary](#-summary) - [📖 Main Content](#-main-content) - [🗒️ Notes](#️-notes) - [📖 References](#-references) - [🗣️ Paraphrase](#-paraphrase) - [📰 Newsletter](#-newsletter) - [✅ Action Items](#-action-items) - [🧪 Hypotheses](#-hypotheses) - [📊 Methodology](#-methodology) - [❓ Questions](#-questions) - [🔮 Future Research](#-future-research) - [💡 Implications](#-implications) - [🧠 Learning Styles Assessment](#-learning-styles-assessment) - [📊 Accessibility Assessment](#-accessibility-assessment) - [🌍 DEIB Assessment](#-deib-diversity-equity-inclusion-and-belonging-assessment) - [✅ Logical Validity](#-logical-validity) - [🔍 SEO Evaluation](#-seo-evaluation) - [🎯 Conclusion](#-conclusion) ## 📝 Summary: WordPress.org recently forked the Advanced Custom Fields (ACF) plugin, leading to the creation of Secure Custom Fields (SCF). This decision was driven by security concerns and WordPress’s desire to remove the commercial elements present in ACF. WP Engine, which owns ACF, is not happy with this move and has filed a lawsuit, accusing WordPress co-founder Matt Mullenweg of using trademark law to advance personal agendas. ## 📖 Main Content: Secure Custom Fields was introduced by WordPress.org as a non-commercial, secure alternative to ACF. The key reason for this fork was addressing vulnerabilities in the ACF plugin related to HTML sanitization and removing upsells. The fork has sparked significant controversy in the community, with WP Engine accusing WordPress of strong-arming them into compliance. The incident highlights tensions between community-driven governance and corporate influence. ### 🗒️ Notes: - **Security Concerns**: WordPress forked ACF to address vulnerabilities. - **Commercialization**: SCF is designed to be a free, non-commercial version of ACF. - **Lawsuit**: WP Engine filed a lawsuit against Automattic and Matt Mullenweg over the handling of the fork and related trademark issues. - **Impact on Users**: WordPress.org automatically migrated ACF users to SCF, while WP Engine provides ACF updates separately. ## 📖 References: - [James Giroux on WordPress Fork](https://jamesgiroux.ca/acf-gets-a-fork-by-wordpress-org/) - [WordPress.org](https://wordpress.org/news/2024/10/secure-custom-fields/) ## 🗣️ Paraphrase: 1. **Original Insight**: WP Engine criticized WordPress for forcing ACF’s fork, stating it disrupted their operations. **Paraphrased**: WP Engine argued that WordPress’s decision to fork ACF disrupted their workflow and was an unnecessary intervention. 2. **Original Insight**: WordPress cited security vulnerabilities in ACF as the main reason for the fork. **Paraphrased**: The driving force behind WordPress’s fork of ACF was the need to address security concerns and better protect user data. ## 📰 Newsletter: **Title**: WordPress Introduces Secure Custom Fields, Forking ACF 🚨 Big changes are happening in the WordPress community! WordPress.org has officially forked the popular ACF plugin, launching Secure Custom Fields (SCF). SCF addresses security vulnerabilities and removes the commercial elements found in ACF. However, this move has sparked controversy, with WP Engine filing a lawsuit. Want to stay informed on the latest? Learn more about SCF and its impact at [WordPress News](https://wordpress.org/news/2024/10/secure-custom-fields/). ## ✅ Action Items: This article is crucial for your ongoing work advocating for open-source governance and contributor transparency. The SCF fork exemplifies the challenges in balancing community ownership with corporate involvement, offering a case study on how governance structures in open source can influence decision-making and contributor engagement. As an aspiring OSPO leader, understanding this dynamic can help shape your approach to managing future projects. ## 🧪 Hypotheses: - Hypothesis 1: Forking a commercial plugin like ACF into a free, open-source tool will strengthen WordPress’s security reputation. - Hypothesis 2: The controversy around the fork may cause divisions in the WordPress community between corporate and open-source advocates. ### 📊 Methodology: - **Data Collection**: Survey WordPress developers and users about their views on the SCF fork. - **Research Design**: Quantitative data through community polls, qualitative interviews with plugin developers. - **Analysis**: Compare SCF adoption rates with those of ACF pre-fork. ### ❓ Questions: - How will the WordPress community react long-term to this forced plugin fork? - Could similar situations arise for other popular commercial plugins in WordPress? ### 🔮 Future Research: - Investigate the long-term effects of plugin forks on community engagement and open-source governance. - Assess how companies like WP Engine adapt to this new paradigm of plugin management in open-source ecosystems. ### 💡 Implications: The SCF fork could set a precedent for how WordPress handles plugins that balance community-driven needs with commercial interests. If successful, this approach may influence governance strategies across other open-source projects. ### 🧠 Learning Styles Assessment: 1. **Visual Learners**: Provide flowcharts outlining the differences between ACF and SCF. 2. **Aural Learners**: Include podcast discussions covering the legal and community aspects of the fork. 3. **Logical Learners**: Add a step-by-step breakdown of the security enhancements in SCF. ### 📊 Accessibility Assessment: - **Screen Reader Compatibility**: Ensure SCF’s documentation and interface are accessible via screen readers. - **Keyboard Navigation**: Optimize plugin UI for users who navigate with keyboards only. ### 🌍 DEIB Assessment: - **Inclusive Language**: Encourage transparency in communication between WordPress and WP Engine to foster community inclusivity. - **Representation**: Introduce diverse viewpoints in community discussions to include underrepresented voices in the governance process. ### ✅ Logical Validity: - **Sound Reasoning**: WordPress’s decision to prioritize security over commercialization reflects its open-source mission. - **Potential Fallacy**: Critics may argue that WordPress’s intervention could be seen as leveraging power unfairly, but the justification lies in improving user safety. ### 🔍 SEO Evaluation: 1. **Keywords**: Secure Custom Fields, ACF, WordPress fork, plugin governance. 2. **Meta Description**: A short and concise meta description that emphasizes SCF’s security improvements and the implications for the community. ## 🎯 Conclusion: The SCF fork is a pivotal moment for the WordPress ecosystem, reflecting the challenges of maintaining open-source governance while balancing corporate involvement. As the situation unfolds, it will offer key insights into community-driven decision-making and how future plugin forks may be handled. - Document Tags: [[Matt Mullenweg]] [[wordpress]] [[wpdrama]] [[wp engine]] - Summary: In recent or coming days, you may be seeing news about WordPress and its community. Over the past two weeks, what began as a WordPress-community matter - URL: https://modernearth.net/storms-of-wordpress-controversy/ Statue of woman holding scales of justice balancing logos for WordPress and WP Engine In recent or coming days, you may be seeing news about WordPress and its community. Over the past two weeks, what began as a WordPress-community matter expanded fairly quickly to the wider tech community and will likely be moving into mainstream sources, and for this reason, some form of comment is warranted from us for the benefit of our clients. I’ve considered myself a part of the WordPress community for over two decades while using, recommending, hosting, and building with WordPress – hundreds of projects, from microsites to complex business-critical applications. The community is in some turmoil at the moment, as news stories will suggest. On October 2, 2024, a large WordPress-focused web host, [WP Engine](https://wpengine.com/), filed a lawsuit against WordPress co-founder Matt Mullenweg and his company, Automattic, which operates WordPress.com.[1](https://modernearth.net/storms-of-wordpress-controversy/#fc2749ac-d622-40e8-9cf8-01b066650092) If the lawsuit and potential fallout worry you, you’re not alone – but this is a “don’t worry” post. If we’ve recommended WordPress you in the past, I’ll explain why we aren’t changing that recommendation now despite the basis of the lawsuit, and what we’re watching for going into 2025. #### Backstory & Complaint The two companies involved each have revenue in the range of $400-500 million per year, and the issue is muddied by another site, [wordpress.org](https://wordpress.org/), owned and run by Mullenweg personally and not by the WordPress Foundation which *technically* owns the trademark. Mullenweg oversees development of the WordPress project generally, with different leaders for each of three major releases per year. His “.org” site serves as a hub for the distribution and support of all things WordPress and is essentially a non-commercial though not a neutral environment. The controversy begins with Mullenweg, who doesn’t feel that WP Engine voluntarily contributes enough to the open source WordPress project, and over some months, he attempted to get WP Engine to commit to doing so, presenting a term sheet to WP Engine demanding (among other things), 8% of its annual gross revenue be paid to Automattic or 8% of its employee’s time (or some combination) be contributed to the project in exchange for the use of the WordPress trademark. Automattic is a direct competitor to WP Engine. WP Engine declined to negotiate, and carrying out a threat on September 20th, Mullenweg used his closing address at WordCamp US to publicly accuse WP Engine of being a bad actor (and worse), encouraging people to stop dealing with WP Engine. Following Mullenweg’s talk, each filed “Cease and Desist” letters with the other. A tense week followed, during which Mullenweg blocked WP Engine’s access to the software repositories on wordpress.org. He wrote several public posts and did interviews attempting to explain and rally support for his position, acknowledging that he is using trademark law to achieve his objective. Generally speaking. In the wake of these events, WP Engine formally filed suit, an outcome that was already looking inevitable. The suit lists 11 complaints, including libel, slander, interference, unfair competition, estoppel, and attempted extortion. There’s a lot to unpack, but those are the main points of fact. Straw polls suggest considerably more community support exists for WP Engine, and 159 people took advantage of a generous severance offer to leave Automattic if they weren’t aligned with its CEO. #### Addressing Concerns There are some fundamental reasons we’ve chosen to build with WordPress, and which remain in place to provide us with assurances through the kinds of turbulence which tend to raise concern especially among enterprise users. Remembering back to 2003, one reason we began building websites with b2, the predecessor to WordPress, is the software license. There were actually *three* separate “forks”, or new branches of the b2 software – b2 Evolution, b2++, and WordPress (I tried them all back in the day). b2++ was later renamed WPMU (for “WordPress Multi-User”) and to a large degree maintained compatibility with WordPress themes and plugins. The two projects were eventually merged in 2010. WordPress, like b2 before it, is open source software licensed under the [GNU General Public License, or GPL](https://www.gnu.org/licenses/old-licenses/gpl-2.0.html). This license allows users to modify and redistribute the software, but bans them from changing the license to a more restrictive one. For this reason, the software has inherited the GPL terms from b2, and will always remain free to modify and distribute. Extensions (plugins) that rely on WordPress must also be licensed under the GPL. Over the years, we have maintained confidence in Matt’s leadership of the technical aspects of the project, and this remains generally intact. Within the WordPress developer community, there are approximately 20 people who have authority to commit changes to the project, and a number of those are similarly capable of providing solid technical direction. Unfortunately, the current issues have revealed very significant shortcomings in the governance of the WordPress Foundation and raised concerns for many about Matt’s leadership in general. #### Looking Ahead Regardless of how the lawsuit proceeds from here and whatever its outcome may be, the WordPress community will be doing some reflecting and restructuring in the days, weeks, and months ahead. What I expect to come out of it fits generally into four areas: 1. distribution of the software from multiple mirrored sources to remove overall access control from any one of them; 2. greater certainty on the use of the WordPress trademark or discontinuation of its use; 3. one or more “forks” of the project into different branches, each with a new name; and 4. proper governance structures for oversight with meaningful dispute resolution policies in and for each of the above. If Mullenweg continues to lead the project in the same role beyond the coming year, it will be either because the project has been forked and those who have lost confidence have moved elsewhere, or because the other three areas have been addressed to the satisfaction of the community. Of the outcomes in these four areas, all but one are inherently positive. If the project is to continue under a single branch, the name of the software project may need to change for governance and trademark reasons, but without recommending it, at this point it would be surprising if WordPress were not forked again (as has happened in the past). One or more forks of WordPress in the current climate may have better than normal odds of gaining critical mass with a user base and contributors supporting it into the future, drawing groups of users away from WordPress. I would hope that any new branches of the software will work to maintain compatibility and interoperability with each other and with WordPress, as this would strengthen the ecosystem as a whole. It is very possible to have multiple “flavours” of a CMS like WordPress that can go in slightly different directions with different project priorities while maintaining compatibility to a large degree with existing and future plugins. An example of another project licensed under the GPL and one we’ve been following and using since the 1990s is the GNU/Linux operating system, where the variety of available Linux distributions (a much larger and more complex code base) illustrate how this can work, having different projects with different priorities and with software distributed from multiple mirrored repositories while maintaining a large degree of interoperability. I would anticipate that 2025 may see longer than typical release cycles for WordPress (and/or its equivalents if that happens) as the community shifts, reorganizes, and strengthens itself. During that time, I do *not* have any genuine concern about ongoing security and bugfix releases. #### Falling Forward I know many people in the community, whose corporate participants include large agencies, hosts, and large enterprise users who have replaced proprietary or in-house custom software with WordPress. Many of those, like NASA and The New York Times, have a history of sharing software they write or modify, and have the resources to maintain, update, and release new versions, working together or independently. The biggest short-term blow will be among enterprise users, as some will hesitate to adopt it until the dust settles. While the state of enterprise WordPress won’t look as rosy for a while, it doesn’ t change the underlying facts about the software’s suitability to a task. Mullenweg has harmed his community, but communities tend to rally in times of stress or hardship. The people I’ve met or follow in the WordPress community today include a set of principled and highly capable individuals whom I believe will be able to help the community heal, improve, and thrive. The next year or so may see some uncertainty surrounding WordPress, but I expect the software it is today will continue to be the core of whatever we’re using in the future, by any name it may then have. This is why, based solidly on the [four freedoms of the GPL](https://www.gnu.org/philosophy/free-sw.en.html#four-freedoms) and the resilience of the WordPress community, we are not rescinding our recommendation of its use, nor making plans to change. As we’ve done in the past with other software or extensions, our clients can trust us to carry on watching carefully for any adjustments we need to make in order to ensure continued support and maintenance for the sites we’ve built and are building with WordPress. 1. I won’t be delving deeply into the specifics, or linking to the primary documents, though I have reviewed them as I follow closely and engage in discussion. There are already a large number of [summaries](https://gist.github.com/adrienne/aea9dd7ca19c8985157d9c42f7fc225d) [available](https://wpbiz.dev/notepad/wordpress/automattic-vs-wp-engine-in-the-media/) with or without helpful commentary, and a few items are offered here for further reading to provide a sense of why posts like this are becoming necessary. ▸ [State of Enterprise WordPress](https://soewp.com/) ▸ [Things get nasty in lawsuit between WordPress.org and WP Engine](https://www.cio.com/article/3545272/things-get-nasty-in-lawsuit-between-wordpress-org-and-wp-engine.html) ▸ [Matt Mullenweg: ‘WordPress.org just belongs to me’ | The Verge](https://www.theverge.com/2024/10/4/24262232/matt-mullenweg-wordpress-org-wp-engine) ▸ [When Benevolence Fades | Tedium](https://tedium.co/2024/10/03/wordpress-wp-engine-lawsuit-open-source-impact/) [↩︎](https://modernearth.net/storms-of-wordpress-controversy/#fc2749ac-d622-40e8-9cf8-01b066650092-link), Storms of WordPress Controversy, Modern Earth, 01ja0xvd9rq14mn5aqt730r8gy.