# This Week in WordPress #351  ## Episode metadata - Episode title: This Week in WordPress #351 - Show: WP Builds - Owner / Host: Nathan Wrigley - Guests: [Courtney Robertson](https://share.snipd.com/person/a97234f7-b024-489f-8d45-bbb49aa34990), [Tim Nash](https://share.snipd.com/person/ee54661b-e63d-41e6-ae81-e0a45faf9406) - Episode publish date: 2025-10-07 - Episode AI description: Tim Nash, a security consultant specializing in WordPress, discusses the concept of randomness in computers and its implications for AI. Courtney Robertson, an open source developer advocate, highlights the new accessibility knowledge base on wpaccessibility.org. They also explore the recent WordPress 6.8.3 security updates and the significance of Tammie Lister’s Blocktober project. Additionally, the panel reflects on improving plugin discoverability and the celebration of the free Ollie Menu Designer plugin, emphasizing community contributions and ethical tech practices. - Mentioned books: [The Cathedral and the Bazaar](https://share.snipd.com/book/8804a419-26a7-4c15-9d84-ead96a984877) by [Eric S. Raymond](https://share.snipd.com/person/56e8fd4e-d0a7-47e3-bad0-f16972f51c6b) - Duration: 01:39:07 - Episode URL: [Open in Snipd](https://share.snipd.com/episode/033add9a-1a37-4214-8125-dd0cc2d02ee6) - Show URL: [Open in Snipd](https://share.snipd.com/show/11e8bcf5-550e-4d5b-a024-6b2775756bc4) - Export date: 2026-02-17T23:20:52 ## Snips ### [Computers Can't Make True Randomness](https://share.snipd.com/snip/a5effc54-75ba-4192-b3a5-733f7a2fc96c) 🎧 17:08 - 23:12 (06:03) <iframe src="https://share.snipd.com/embed/obsidian-player/snip/9a647d12-66dc-4baf-926f-85443f350a40" width="100%" height="100" style="border: none; border-radius: 12px;" sandbox="allow-scripts allow-same-origin allow-forms allow-popups allow-clipboard-write" ></iframe> - Computers are fundamentally deterministic and cannot produce true randomness without an external source. - Pseudo-random outputs can be 'good enough' for many uses but are ultimately reproducible if you know the inputs. #### 💬 Quote > Because they're programmed. I mean, literally, if you think about it, they use logic. > — Tim Nash Tim Nash on why computers cannot produce true randomness #### 📚 Transcript **Nathan Wrigley:** Why can't they do random stuff? **Tim Nash:** Because they're programmed. I mean, literally, if you think about it, they use logic. Yeah. Logic is all structured. And now just try think in your mind how you would logically break down something to be random. Do you know, this was for me the thing that I **Nathan Wrigley:** always said until like two years ago when obviously that moment passed, I always thought this argument, why computers can't do random, would be the exact reason they could never make art. They could never make a song. They could never create a painting because it occurred to me they didn't have that that ill-defined thing which creativity see there's a bit of randomness and serendipity in it but that's not the case like they can now do art and they can do songs but they still can't do **Tim Nash:** random so i mean if you gave you know the big the main famous phrase if you gave an infinite number of monkeys typewriters that eventually make shakes write shakespeare yeah that's pretty much what ai is you're just giving it we're just giving it some slightly more some constraints and pointing it towards a a source to start with so ai is going to all is what ai produces is not random. And it's not creative. Because the heart of **Nathan Wrigley:** so much security out there, like, for example, I have Bitwarden. It's password manager. I click the random password generator button. And this thing which approximates random to me, you know, 40 characters of just pseudo random junk comes out. And I think, yeah, that's random. And it's totally not random. Presumably, you could work backwards if you knew what all the things were that were lined up to get that password out. I don't know if that's the case, because I imagine it's interrogating your computer for what the heck's the CPU doing? What's the temperature of this thing over here? What's the screen over here? You know, it combines all of these things, which creates this simulation of random, but it's still not random. If you knew all the inputs the output would always be the same i guess uh to a certain extent yes um but generally so the other thing is **Tim Nash:** how random do we need it to be and that actually is what the crux of that article was really about was not i think everybody can accept uh if we are building logic systems and deterministic systems we can't make random it has to have an external source for its randomness otherwise because it can't possibly come up with something there's no logic to make something random so once we get past that we can we can make something look random and as you say if we have enough variances enough things that we're pulling those inputs through, actually too many proves to be an interesting secondary problem. But we can make something look random. And if it looks random, is that good enough? Now, if in certain security considerations around encryption, no, we want things a little bit more random than you might imagine um but even in those scenarios we still can find ourselves where we can say it's good enough it's not perfectly random but it is good enough but if i'm just picking you know i have six blog posts and i want to show one of them to you randomly. We don't need to be that random about that. That's fine. We can come down to a safer set of like, yeah, this is cool. You could work this out ultimately, but it's kind of stuff to run. Sorry to interrupt **Nathan Wrigley:** there. a new, because I feel like we shot past the Turing test like a year and a half ago and nobody blinked and I was like, oh yeah, computers can talk to us now. We would never know. Like that was always going to be a thing the Turing test that just sort of seems like yeah okay it's in the rear view mirror now but would would if a computer could could produce a random number and it could be proven to be random would that be some portion of the Turing test would that be just **Tim Nash:** to check you realize you can't produce a random number i i want **Nathan Wrigley:** to say that i can seven there you go yeah yeah you absolutely can't produce a random you had to think **Michelle Frechette:** about it i **Nathan Wrigley:** know think about it yeah okay we **Michelle Frechette:** get a finite set of digits it's **Nathan Wrigley:** so infuriating because you get this whole debate about consciousness and where the heck the number seven actually popped up from it's irrelevant because the number seven is definitely not random all right nine then no **Courtney Robertson:** tim what company is it i feel like you would know this there is a company that uses photographs of random stuff in their lobby like not random yeah they've **Nathan Wrigley:** got a wall of lava lamps haven't they **Courtney Robertson:** yeah that yeah lava lamps or other place but **Nathan Wrigley:** you you would you would be like if you were a laplacian determinist and you think you could rewind i couldn't spell it so i would never be that no but you know i mean his his whole thing was like if you could predict that if you could well obviously heisenberg says you can't but anyway uh if you could predict where every molecule in the lava lamp was at any moment and you knew what it was moving, you'd be able to predict each lava lamp. Of course, it's just out of the bounds of compute. You can't compute. more importantly, the sensor that's taking the photo is waste. It **Tim Nash:** would mean that that doesn't matter. But that's irrelevant. I mean, irrelevant to that. Even that was then proven that those lava lamps work in ultimately not true **Nathan Wrigley:** randomness but we just need to get close to true randomness can i just say i i totally have proof of the existence of randomness it's called my cat my **Tim Nash:** cat is totally random there's just nothing normal about my cat you know it just comes and sits on your face in the middle of the night. I imagine that your cat thinks **Nathan Wrigley:** very logically. Very sensible cat, yeah. It's fascinating. Anyway, there you go. So computers cannot do random. And if you think that they can, you're wrong. Maybe, like I said, one day that'll **Tim Nash:** be the thing. And probably you can't do random either. Let's be clear. Humans, animals, whether it's a cat, whether it's a human, whether it's a computer, we all are relatively in our approach. --- ### [Apply Security Updates Immediately](https://share.snipd.com/snip/21b8176f-1bbc-47bf-993b-e5c75df25175) 🎧 32:35 - 36:58 (04:23) <iframe src="https://share.snipd.com/embed/obsidian-player/snip/f1f983be-1751-4957-9654-0ca8d3d5184e" width="100%" height="100" style="border: none; border-radius: 12px;" sandbox="allow-scripts allow-same-origin allow-forms allow-popups allow-clipboard-write" ></iframe> - Update WordPress immediately when security releases arrive and enable auto-updates for client sites. - Remember core security fixes are sometimes backported to older branches but only the latest version is actively supported. #### 💬 Quote > WordPress 6.8 was dropped during the course of this week. It was a security fix. So, you know, it says it in bold here. It is recommended that you update your sites immediately. > — Nathan Wrigley Nathan Wrigley announcing the WordPress 6.8 security release #### 📚 Transcript **Nathan Wrigley:** Not really a lot to say here, excepting that if you are running client websites and they're not auto-updating, which you really probably should at this point, WordPress 6.8 was dropped during the course of this week. It was a security fix. So, you know, it says it in bold here. It is recommended that you update your sites immediately. The only bits and pieces that I can see down here, there were a couple of things in terms of security. A data exposure issue where authenticated users could access some restricted content. And then across site scripting, XSS vulnerability requiring an authenticated user role that affects the nav menu. And yeah, hopefully that's going to all have been taken care of. This sentence, this sentence caught me short. So I've never really parsed this sentence. Maybe it's always been there at the bottom of these security change lock, you know, security posts. But it says this, tell me if I'm wrong, is this new or is this always the case? As a courtesy, these fixes have also been made available to all branches eligible to receive security updates currently through 4.7. As a reminder, only the most recent version of WordPress is actively supported. I don't know why I thought, is that a new posture or is that how it's always been? No, that's... **Tim Nash:** Oh, go on, Connie. Go on, Connie. **Courtney Robertson:** Sorry. So, hosting perspective here, there are sites, if people are on a not managed plan, they can choose to run an old version of WordPress. And in running that old version of WordPress, security fixes still need to be addressed. And so those are being deployed pretty much across all hosting environments. Whereas if there is just a feature or like some kind of a bug, right? Like a normal bug, the feature doesn't work or something like that. That's not going to backport the security issues so much. So they do try to indicate when that happens and we do see it also in plugins as well less common in themes but that's just because uh people aren't switching those around quite as frequently i guess okay **Nathan Wrigley:** okay thank you **Courtney Robertson:** tim you can verify me on if **Tim Nash:** because it is an absolute pain to backport security things and uh there has been discussion every six months or so comes around the should we be backporting and there is positives and negatives towards backporting at the moment the clear important thing is that officially WordPress only supports the very latest release yeah so if you were in a state where it was something where you required compliance reasons that you had to be up to date you couldn't claim that 4.7 or whatever the that version is is the latest version or in compliance uh it is as i say really time consuming and uh there has been a lot of we shouldn't maybe the security team shouldn't be backporting uh maybe that's not helping people update a long way but they're maintaining that process uh especially the 4.7 branch because that was the last one before foresight editing and if you sort of look at the various graphs of where people stopped updating, there's very few prior to 4.7 installs out on the web, still some. I came across one that was on 1.5 something the other day. I like, wow, how did it stop? Did log into that? No, no. I think if you log into it, it dies. I'm not sure. It's like a Schrodinger's wordpress site it's there on your paper it **Courtney Robertson:** works as long as no one logs in **Tim Nash:** yeah exactly um but 4.7 you do see this like little spike and that is where people have gone oh i will not move over to goodson god it just and being full seven editing that came in version five. **Nathan Wrigley:** Okay. **Tim Nash:** Rightly or wrongly. **Nathan Wrigley:** Yeah. You **Tim Nash:** also weirdly now see quite a lot of people who went to Classic Press at that point back on, stuck on that 4.7 branch. You've got this very strange sort of group of people who are there. So they're backporting to, that's why it backports specifically to the 4 branch. At some point that will end. Yeah. It's got to because the WordPress is diverging away. And as Courtney said, they're not backporting new features in there, otherwise it would just be a release. --- ### [PatchStack Publishing Oops Caused Panic](https://share.snipd.com/snip/1c460f1b-7c75-413e-8cfb-08bf55baf194) 🎧 37:33 - 39:47 (02:14) <iframe src="https://share.snipd.com/embed/obsidian-player/snip/728a42c1-1399-404d-9630-128589f4d49e" width="100%" height="100" style="border: none; border-radius: 12px;" sandbox="allow-scripts allow-same-origin allow-forms allow-popups allow-clipboard-write" ></iframe> - PatchStack accidentally published a vulnerability notice before a fix was available and caused widespread cached warnings. - That single mistake triggered automated emails and host banners, showing how fragile coordinated security communication can be. #### 💬 Quote > It was the little oopsie that Patchdac did, where they inadvertently released the, there was a security issue before the patch was made available, which they themselves went, whoopsie. > — Tim Nash Tim Nash describing PatchStack's accidental premature publication #### 📚 Transcript **Tim Nash:** I didn't see that. Just a little bit trigger-happy. So if you had Patchnack installed on any of your sites or if your host was pulling in Patchnack, for a little while it was telling you that you've had a security vulnerability in your WordPress core and there was no fix available. So that was **Nathan Wrigley:** a little oops. Out of **Courtney Robertson:** the 10,000... Sorry, **Nathan Wrigley:** Courtney, you go. Sorry. I **Courtney Robertson:** think I saw that there was about the individual that had this leak, and I know his name, but I choose not to draw extra attention there, is that out of 10,000 or so times that this person has reviewed things, having this go through. And addition to that, the vulnerabilities, you had to actually do a good bit of work to exploit them. **Tim Nash:** Yeah, this really is one of those moments that you have to stand on one and pat your head and do the terrible thing. And even then... It's like you **Courtney Robertson:** have to get through some security to get to do the thing to make the exploit. Right. And so in the sense of is this a high risk? No, this is not a high risk. But the urgency to ship the release came because whoops, now it's out there. And there are a lot of things that the security team could be working on if they have more bodies or whatever to get all of that through um that we just don't know about yeah **Nathan Wrigley:** so **Courtney Robertson:** you know **Nathan Wrigley:** i didn't pick up on that patch stack story and that is a really interesting point of failure isn't it that that obviously an organization like patch stack presumably has many of these balls sort of juggling in the air simultaneously and you know they get fixed they announce they talk about it publicly blog post what have you but if they accidentally click the publish button oh i mean they do have a fairly **Tim Nash:** robust system for this not to happen and this was just a genuine little yeah **Nathan Wrigley:** yes **Tim Nash:** yes but yes and and then it was an oopsie followed by oh caching calab will screw with you as as notifications were all cached in places. People who had automated emails were sending them out. You had hosting companies putting banners all over their things. And you've got to feel, you know, you sat there watching this happen, and then you're like, oh, that was meant to go out next week. --- ### [Build A Block A Day With Blocktober](https://share.snipd.com/snip/99fda8c6-fc3f-4f0c-84c4-c952f82d4ef7) 🎧 42:09 - 45:36 (03:26) <iframe src="https://share.snipd.com/embed/obsidian-player/snip/df35d8d2-b5c8-478c-b025-12d8e8a9c910" width="100%" height="100" style="border: none; border-radius: 12px;" sandbox="allow-scripts allow-same-origin allow-forms allow-popups allow-clipboard-write" ></iframe> - Try Blocktober (Tammy Lister's project) as a rapid creative exercise: one block per day using Telex prompts. - Use generated blocks to explore interactive mini-apps and showcase unusual UI possibilities. #### 💬 Quote > A block a day for the month of October. I, as in Tammy, will be using Telex by Automatics, like a prompt system for creating blocks and plugins and things like that. > — Nathan Wrigley (quoting Tammy Lister) Introduction to Tammy Lister's Blocktober project #### 📚 Transcript **Nathan Wrigley:** Here it is. Why did nobody secure this name before? That was so obvious. Blocktober. What a great idea. So, Tammy, with the help of the Telex platform by Automatic. Well, I'll just read it. The idea is simple. You it on the screen, too. Oh, sorry. Apologies. I thought I'd gone there. That better. Yeah, thank you. I'm so sorry. I thought I had. So here we are. This is Blocktober, well, B-L for those that can't see the screen, dot fun, and then forward slash Blocktober, if you want to get to this page. So the idea was simple, she says. A block a day for the month of October. I, as in Tammy, will be using Telex by Automatics, like a prompt system for creating blocks and plugins and things like that, but I think blocks specifically, to make these and posting each day at 12 p.m. UK time, one block a day all month. uh yeah if you go back to the the home page here we go you can try some of them out this is a work in progress i confess i i tried snake um but i got very annoyed very very quickly because it turns out i'm not very good at it and petris **Courtney Robertson:** might be more your speed than nathan it starts a little slower. Do **Nathan Wrigley:** you know what? **Courtney Robertson:** Yeah, it's blocky blocks. The problem **Nathan Wrigley:** with any of these games is I just get really annoyed. I have this high expectation of myself and then I can't live up to it and it really annoys me. **Courtney Robertson:** I gave you 20 minutes of my day playing Tetris the one day. **Nathan Wrigley:** Oh, okay. i feel really bad because i was at least 45 minutes **Tim Nash:** to an hour before i realized how much i'd spent playing that game i range quite i'm sorry we robbed panel of at least an hour and a half can **Michelle Frechette:** we make a block about lego and then it's a block in a block as well which would be so fun tammy **Nathan Wrigley:** can you can can i just ask that you are you create a random number generator, please? That's got to be one. It's number 30. And can you use, I don't know, a lava lamp to assist in the creation of that as well? But yeah, what a great idea, Terry. Go on, Courtney. **Courtney Robertson:** Slightly off topic, but Tammy may appreciate. The random number generator, Tammy, should always answer 42. Oh. **Nathan Wrigley:** He says reaching, he's slightly out of the reach, copy of the Hitchhiker's Dad for the Galaxy. That's a good answer. Yeah, so all I can say is go and have a look. Tammy is, obviously, it's a lot of fun. Tammy's having a great time creating these different bits and pieces. So we've got Snake, we've got Journaling Prompt, we've got Pixel Block, Terminal Block, ASCII, Tetris, and obviously the post about the actual whole enterprise. **Tim Nash:** Ignoring, I don't want to ignore, but the fun ones like Snake and Tetris, actually, the changelog that was published, I mean, it might have been today. Oh, it's the one at the top. I actually thought, that's super cool. I might actually use that. **Nathan Wrigley:** So what does this one do? This creates a changelog from what? You give it a source, it generates you a changelog. That is neat. Yeah. Yeah, that is a good idea. So a block that outputs a changelog. This can have a GitHub URL, uploaded file, or pasted content. You can edit the markdown and so do some simple styling. The idea would be to simply show on a page, changing keeping it simple to start. That is nice, and it sort of sums it up beautifully, doesn't it? Look at that. Ooh. --- ### [Discoverability Needs Measured Experiments](https://share.snipd.com/snip/27dc54ad-bb94-4a57-90d0-37667ba61de0) 🎧 48:02 - 53:58 (05:55) <iframe src="https://share.snipd.com/embed/obsidian-player/snip/6d3a84b6-32ff-4aa0-a797-ef9cbdf38410" width="100%" height="100" style="border: none; border-radius: 12px;" sandbox="allow-scripts allow-same-origin allow-forms allow-popups allow-clipboard-write" ></iframe> - Plugin discoverability on WordPress.org is broken for new authors and needs experimentation. - Small, reversible experiments (e.g., featuring eight plugins for a week) can reveal measurable uplift without permanent changes. #### 💬 Quote > Let's feature eight different plugins for one week and track what happens to their install numbers. That's it. Simple, measurable, reversible. > — Nathan Wrigley (summarizing Nick Hamsey) Proposal to experimentally feature plugins to test discoverability #### 📚 Transcript **Nathan Wrigley:** So Nick Hamsey, I confess I had not heard of Nick Hamsey until a few weeks ago. And now Nick Hamsey seems to be the poster child of really good ideas in the WordPress space, certainly getting lots of attention. And I don't know that we've ever had the same person on this show being featured twice. But there's a couple of things that he wrote this week, and we're going to mention them both. This is the first one. Good Chaos, WordPress discovery, a WordPress plugin discovery experiment. Can I just say before we introduce this, I think this should happen. I think this is good enough just off the bat to just give it a try. Why not? It's basically for those people who submit their plugin, like create a plugin, do all the hard work, make it, you know, put loads of effort into it. And then submit it to.org only to discover that the days of build it and they will come, well, they came and went. That's just not going to happen. If you put your plugin into the WordPress repo, you're up against 56, whatever it is, 59,000 other bits of content. So it's going to be hard to find traction and find that new audience. So got a great idea. I have some thoughts there okay should you want to do you want to say it now yeah yeah **Courtney Robertson:** yeah so for the plugin directory experiment i think many people look at this and say absolutely yes i also think that some of the ideas are ideas that other contributors have shared over the years okay Okay. And have had no traction about having, uh, for instance, like an area of most recently published plugin on the directory. Um, and so I think what I would love, I am adoring the ideas Nick is putting forward. I am concerned that if these ideas get an uptick, that Nick gets the uniqueness credit that's there that other contributors may not. And I believe, not entirely certain, but I believe Nick might be an automatic employee. So I want to handle with delicate fingers here, you know, but these are ideas that we need to see and i want to hear more of nick's ideas it's a good reminder to also realize that sometimes when we have an idea that we think nobody else has had this is amazing this is great um let's dig back and explore if others have had that idea and maybe why it did not get implemented yet oh and what we could do to solve for that **Nathan Wrigley:** Yeah, okay. Right? So, sorry, thank you for that. And I think you're right. I had never come across this idea before, kind of just intuited from that that Nick was the originator of it. But you are, I'm sure, right, that there's probably people who've had a similar idea in the past. I have a slightly unique, not unique, but I have a different take in that I get contacted a lot by people who've got a brand new plugin because, you know, they want a bit of exposure or something like that. And it is fairly heartbreaking, actually, especially this time of year, this Black Friday time of year. Loads and loads of these things come your way. And, you know, so somebody will submit something to go on that Black Friday page and you'll look at it and you'll think, wow, that thing that they've got looks really cool. Like the plugin is great. The website is great. It's all great. I've never heard of them. And yet they've been going for several years. How, how on earth has that happened? And you know, they're just missing the jigsaw piece of the, of the marketing side possibly or something. So just getting back to Nick or, you know, et al, whoever has had that idea in the past, the idea is this, that there's a featured tab in the plugin directory on.org, which showcases many things. And he's saying it seems to, you know, show things which are already successful, featured things which have already gained traction, already got an audience. So the simple idea is, why not learn from other platforms like, for example, the Shopify app store, the Mac app store, Google's play store, and so on and so forth. And his idea, very solid. It's just this very exacting proposal. Let's feature eight different plugins for one week and track what happens to their install numbers. That's it. Simple, measurable, reversible. We select eight quality plugins i don't know what that means but let's imagine that there's a bit of thought behind that that deserve a shot at visibility give them featured placement for exactly one week and watch what happens and that there's more to it than that but um yeah it really he's just trying to say let's just give some people the opportunity to surface their work. And, of course, I imagine exactly what everybody's going to say off this one is, who are the eight? Aren't we just creating a new subset of people who are then featured? **Michelle Frechette:** Let's just randomly generate them. **Tim Nash:** Oh, oh, oh, oh. Oh, that's such a good idea. But can you just imagine the, oh, no, we have an algorithm. And what that sort of drama would be. Yeah. But just as a thought, we desperately need better plug-in discoverability. Yes. I don't think there's a single person who thinks that the current system works well, unless you happen to be one of the eight featured on the featured page, absolutely, you know, if you search, even if you know the name of a plugin and you search for it, there's a reasonable chance that even if you put the correct name in, it still doesn't come up first in the search directory, depending on various things. So we all know this. We all know discoverability is a problem. So any work that we have by anybody who says, let's go and improve it. The problem has been that everybody who we've tried many times jumping up and down and saying, we need to improve this. It is a area that seems to be walking on eggshells. And it seems to be very difficult to get traction. I'd love there to be like a featured editor section. I'll be honest, I think hosting companies should have far more control over the plugins page. It would be great. --- ### [Look Beyond WordPress.org For Plugins](https://share.snipd.com/snip/42ce72a8-51f5-4be5-a186-6a54917e6a04) 🎧 58:10 - 01:00:55 (02:45) <iframe src="https://share.snipd.com/embed/obsidian-player/snip/c4b10ebf-dc46-4d06-bbaf-74749f14f2e3" width="100%" height="100" style="border: none; border-radius: 12px;" sandbox="allow-scripts allow-same-origin allow-forms allow-popups allow-clipboard-write" ></iframe> - Use FAIR or alternative registries to find plugins outside wordpress.org and enable decentralized sources for plugin discovery. - Explore fair.pm and AspirePress.org/plugins to browse plugins not listed on wordpress.org. #### 💬 Quote > If you want to learn more about fair which is a distributed way for getting your plugins finding your plugins that doesn't necessarily rely on wordpress.org... go to fair.pm. > — Tim Nash Tim Nash recommending FAIR as a decentralized plugin source #### 📚 Transcript **Courtney Robertson:** now, folks can choose to install plugins that are on some Git repo. So that could be GitHub or GitLab, Bitbucket, et cetera. Pick your version to sure. And plugins will go through a process of getting decentralized IDs. It basically means a security number, essentially numbers, letters, similar to if you go to install, for those that are devs, if you go to install an extension inside a VS Code, it asks you, do you trust this source? Well, WordPress implicitly trusts the sources of WordPress.org hosted plugins. Usually folks get other plugins either because they're rolling their own or because they have purchased something premium. Whereas if you want to start finding and discovering all of these types of things that are out across various Git repos, et cetera, if they get on board with having a decentralized id getting the certificate basically it will become discoverable in the search system if you are using fair to source your updates and installs so you can go through in that direction as well and i think that some of the ideas that are here just kind of reiterating these are really good ideas of increasing discoverability and i i want to see anything that is a directory help to surface that more. And I know John is here from WP Plugins A to Z. I know that his show alone has covered, wow, lots of plugins every week. So, **Nathan Wrigley:** yep. I think that's... Yeah. There you go. There you go. Yeah, that's's interesting he's probably got a really unique approach on it every week there's a there's always one thing that gets more comments than anything else so far this week this has been the thing just before you jump **Tim Nash:** in the comments as both me and courtney have mentioned it repeatedly uh fair is if you want to learn more about fair which is a distributed uh way for uh getting your plugins finding your plugins that doesn't necessarily rely on wordpress.org the idea is it's completely decentralized if you go to fair.pm that will give you a load more information about it just in case it's something that you've not come across before and **Courtney Robertson:** if anyone wants to just kind of browse around um the address for around fair sources, the plugins right now through Aspire and Aspire Press in particular. So if you go to AspirePress.org/plugins, that will also get you there. So you can browse around without having to do the work of installing fair at the plugin directory. Essentially, the fair will see at this **Nathan Wrigley:** time. Oh, I see. So you can look at it as if it were installed. You can view an example of it. --- ### [Menu Design Reimagined With Blocks](https://share.snipd.com/snip/94e37d2a-bd9d-4767-a752-f3929c477775) 🎧 01:12:16 - 01:17:18 (05:01) <iframe src="https://share.snipd.com/embed/obsidian-player/snip/97fd2e61-7900-4296-b5d1-dc9b6328f219" width="100%" height="100" style="border: none; border-radius: 12px;" sandbox="allow-scripts allow-same-origin allow-forms allow-popups allow-clipboard-write" ></iframe> - Ollie Menu Designer demonstrates how block-based navigation can vastly improve site editor menus. - Mike McAllister released most pro features for free, and the plugin integrates smoothly with core patterns. #### 💬 Quote > Ollie has had for a little while a menu designer whereby you can create your WordPress navigation in a full site editing theme using blocks. > — Nathan Wrigley Nathan Wrigley on Mike McAllister's Ollie Menu Designer #### 📚 Transcript **Nathan Wrigley:** So Ollie from Mike McAllister, Ollie has had for a little while a menu designer. Well, I say a little while, a few weeks. A menu designer whereby you can create your WordPress navigation in a full site editing theme using blocks. And I think it's fair to say that native, the core version of the options available for navigation are, let's go with limited, let's use that word. And so Mike has come along and dropped what was a pro plugin. And I believe pretty much all of the features that were in the pro, you know, that shipped with the pro version of his theme is now encapsulated in this free thing. I think there's a couple of like edge case features that haven't been included. Anyway, the round of applause across the social web has been fairly dramatic, actually. Lots of people applauding loudly, not only that he's done this, but also the product itself. Many people seem to use it and think, actually, this is it. I be wrong about this, but I have a recollection that Matt Mullenweg even suggested it was maybe kind of core worthy. yep **Courtney Robertson:** and uh it was on twitter when matt had replied to um mike's comment about having this ready he was nudging contribute it to core um and i think it was done in a in a okay way like it wasn't give me your proprietary code kind of a thing um and so i love seeing that mike is doing this mike was known when ollie was getting off the ground for having an onboarding wizard and that that kind of created a little kerfuffle at a time because it was not the normal way that themes did things to have tendency on a plugin right um i have just so enjoyed mike's willingness to continue forward with this i do use the ollie theme on my site, and so I had early access to test out this plugin. I have been the person to write the lesson plan on learn.wordpress many times, revising it about FSEs. Sorry, we don't say FSE anymore. That's been a thing for a couple years. We say site editor. Yes. And so in site editor i was the one that handled on learn.wordpress for a number of years continually revising the content of the menu editor because it was just so so i'm really hoping i'm just going to not use other words yeah but i'm really hoping to see that maybe this will come into the site editor experience, bits of this at least, because it is such a more intuitive way of laying out what you want in your menu and has more features available to it. Just the mechanics for somebody that is new to site editor of fussing with the menu is probably the area of site editor I most want to see improved. There's **Nathan Wrigley:** loads of screenshots on the.org repo with it and you just get an idea. You can basically build more or less anything that you'd imagine and obviously Mike does an incredible job of putting screenshots where he really demonstrates how amazing you can make it. So bravo. Tim, Michelle, anything on that? I Mike's stuff. **Tim Nash:** He makes things so I can make things that look rubbish. Something like DaveySecurity101.com is running OLLI. Like Courtney, I had access to this a few weeks over the previous weeks. It's just easy. it doesn't it it sort of fits into site editing well without neat and it doesn't feel like it's different and unique i got confused the other day when it wasn't on a site and then i remembered that it was actually part of something you know there was something i had to install so even in a very short space of time i just was like well where's my menu template? Why have I not built one yet? That's strange. Isn't there one there by default? No, Tim, there isn't. No. **Nathan Wrigley:** And just, you can probably answer this because you played with it. Does it use core tools? I think it does. **Tim Nash:** Yeah. It's all just ultimately behind the scene patterns and just a tiny little switching option in there it's brilliant as far as you're concerned it it feels totally native and it's only the only bit that it's doing is where it's displaying it okay okay **Nathan Wrigley:** interesting so there we go a general round of applause i think for mike mccallister's ollie what is it called exactly again ollie menu designer completely free available. Read the description. And actually, if you want a more in-depth approach, there's this on the repository by Ray Moray. She talks about it and obviously has a back and forward conversation with Mike McAllister. **Tim Nash:** Also, just worth emphasizing, you don't need Oli. It will work with any site. Oh, good point for you, **Nathan Wrigley:** yeah. I realize we kept saying the word Ollie a lot I mean I **Tim Nash:** don't think he calls it Ollie's menu I think it's just menu designer in the okay okay **Nathan Wrigley:** thank you it's **Michelle Frechette:** menu designer on the repo yeah okay yeah --- ### [Block Bad Logins At The Edge](https://share.snipd.com/snip/bdac61ab-179c-4e40-b224-cffd74870255) 🎧 01:20:14 - 01:21:52 (01:38) <iframe src="https://share.snipd.com/embed/obsidian-player/snip/091999a2-575f-417c-9dc3-540892301490" width="100%" height="100" style="border: none; border-radius: 12px;" sandbox="allow-scripts allow-same-origin allow-forms allow-popups allow-clipboard-write" ></iframe> - Block login attackers at the edge (Cloudflare) instead of recording IPs on-site to avoid database growth. - Use the 'Block Logins with Cloudflare' plugin to update Cloudflare rules and stop bad actors before they hit your server. #### 💬 Quote > Instead of storing the IPs in your local database so that they hit your site and consume your resources, it basically updates Cloudflare's rules and blocks the bad bots at the Cloudflare level. > — Tim Nash Tim Nash explaining the Cloudflare-based login-blocking plugin #### 📚 Transcript **Nathan Wrigley:** Yeah, so this is a plugin, it's on GitHub, it's called Block Logins with Cloudflare, and not block as in WordPress block, but block as in stop. We all know what Cloudflare does, but what does this do? So **Tim Nash:** you published this, so you should know. Yeah, yeah, I do. So the quick answer is that quite often when we try to block bad bots from logging into your site, most people will have come across plugins that will just like, say, after five attempts go, I'm not letting you in anymore. Nearly always, these involve storing the IP in the database, and a bad actor comes along and uses a new IP. And so your database grows and grows and grows, and your login gets slower and slower and slower. They're generally really... The sort of thing that people think are really good for security tend to be really terrible. The better solution is to get your host to do this for you. If, however, you're in a scenario where your host is not using things like fail-to or tarp hitting and various other methods, you might be using Cloudflare. In which case, wouldn't it be better if Cloudflare just blocked it all for you? And this plugin does exactly that. So instead of storing the IPs in your local database so that they hit your site and consume your resources, It updates Cloudflare's rules and blocks the bad bots at the Cloudflare level, meaning it never hits your site. It's never using your resources and gives you very much. You're not going to be slowing yourself down by ineffectively dossing yourself by trying to block the rats in the first Yeah, that doesn't sound good. So it's quite cool. --- ### [Centralized Infra Creates Single Points Of Failure](https://share.snipd.com/snip/8675035e-ca2a-4846-9407-6868226b2df0) 🎧 01:22:50 - 01:23:50 (00:59) <iframe src="https://share.snipd.com/embed/obsidian-player/snip/08246f92-e61c-4f5d-94eb-a25fcca9275e" width="100%" height="100" style="border: none; border-radius: 12px;" sandbox="allow-scripts allow-same-origin allow-forms allow-popups allow-clipboard-write" ></iframe> - A few companies (Cloudflare, AWS, Google) now control critical parts of the web, creating single points of failure. - Centralization simplifies services but risks large outages and ethical or political coercion. #### 💬 Quote > If you've got to look at scary points of infrastructure failure, you have Cloudflare, you have Amazon. Yeah. AWS and those two together. > — Tim Nash Tim Nash on dominant infrastructure providers and risk #### 📚 Transcript **Tim Nash:** we live in a world where if you've got to look at scary points of infrastructure failure, you have Cloudflare, you have Amazon. Yeah. AWS those two together. You can then argue things like Azure and Google Cloud. Once you've got, if you have any infrastructure problem that hits both Cloudflare and AWS on the East Coast, half the internet ceases to be. Yes, crazy. And we're not just talking the web, as in websites. So much infrastructure runs through Cloudflare. Yeah. We would be losing, and so many services that maybe not actually are even HTTP-based go through Cloudflare's infrastructure, go through AWS's infrastructure. So yeah, we have these giant points of failure. Cloudflare is a really good example of a company that does awesome stuff and I actively want support. And at the same time, I actively don't implement a lot of the stuff that they use because I do not want to be caught up in Cloudflare being inevitably something going wrong. --- ### [Codes Of Conduct Are Crucial For Open Source](https://share.snipd.com/snip/61cf4a37-d8c5-4814-b5ec-20324888bbe7) 🎧 01:28:44 - 01:34:59 (06:15) <iframe src="https://share.snipd.com/embed/obsidian-player/snip/3c298c22-42eb-451d-be9f-0272e8317bca" width="100%" height="100" style="border: none; border-radius: 12px;" sandbox="allow-scripts allow-same-origin allow-forms allow-popups allow-clipboard-write" ></iframe> - Major figures in open source debate removing codes of conduct, which threatens contributor safety and inclusivity. - Codes of conduct must exist and be enforced to protect newcomers and sustain healthy communities. #### 💬 Quote > This idea of ending a code of conduct is alarming to me because when things are opaque, when there is not a standard to know what is appropriate and not appropriate, it is detrimental to the bazaar. > — Courtney Robertson Courtney Robertson on threats to codes of conduct in open source #### 📚 Transcript **Nathan Wrigley:** This was from you, Courtney, right? It **Courtney Robertson:** is, yeah. So the pulse check on wider open source, Nathan glossed through. There's some drama over in the Ruby community, DHH saying things. Matt has had his blogging back and forth previously with DHH. And now we're seeing Eric Raymond, who is the author of The Cathedral and the Bazaar, which is kind of one of those fundamental principles under a lot of open source, calling for an end to code of conduct. And so what we're seeing in some large figureheads in open source, the open web, is on par with what we're seeing in global politics right now. This idea of ending a code of conduct is alarming to me because when things are opaque, when there is not a standard to know what is appropriate and not appropriate, it is detrimental to the bazaar. In Eric's case, the cathedral and the bazaar, the bazaar is the marketplace where people come and build the big cathedral, essentially. And so Morton has a lot to say on that one, Morton Rand Hendrickson. But this idea of getting rid of a code of conduct, it's kind of like saying we have no, we're only here to focus on just the software, not the community, not the people involved in creating this software. And so that puts the individuals that contribute to this at risk. I really hope that we don't see what Eric is proposing make its way into other open source projects. Eric is known for having some other opinions that are equally as savory or unsavory, depending upon your mindset. I will post this. **Nathan Wrigley:** We obviously haven't had a chance to really dig into the weeds of it, but this is on the itsfoss.com website. It's called The Man Who Started Open Source Initiative Advocates for Abolishing Codes of Conduct. You can read it for yourself, but he basically is arguing that codes of such codes, and I'm going to quote from the article, such codes have failed their stated purpose entirely rather than fostering collaboration. He claims they have been called tools causing disruption. And he now believes that it really should be encapsulated with this one sentence. The code of conduct should be removed and everything should be written under this one guideline. If you are more annoying work with than your contribution than your contributions justify you will be ejected i don't really know how to pause that because there's a lot um subjective stuff in there yeah yeah quite so anyway interesting to see that some uh some things are moving in one direction you know we saw the blue sky thing there trying to at least go in one direction. We obviously got these people, DHH from Ruby. And now, what was this guy's called again? Eric. Eric Raymond. Thank you. I really like Cameron Jones's **Tim Nash:** comment. **Nathan Wrigley:** Oh, thank you. Cameron has said the following. There's some drama in the Ruby communities. Like saying there's been a little debate in the Middle East. Yes, uh do you know what we don't have time **Courtney Robertson:** to dig in that's **Nathan Wrigley:** exactly it we could literally develop like three hours and still not get to the bottom of the uh the ruby community problem i think um maybe that's for another time add **Michelle Frechette:** to what courtney has said i think that it would be detrimental to our community at large to get rid of our codes of conduct. Having been the target of bullying in our community in the past, having done the training to be somebody who helps keep people within the code of conduct and understanding what both sides of that look like. And the recent article that I've seen saying that somebody has been removed from our community for misappropriating funds through WordCamp. I think it's really important that we have a set of guidelines. And nothing is black and white, right? What is bullying? How can bullying be construed? What is the harm of any particular act? That's where people come in and have the ability to look at each situation and make value judgments about harm to keep those in our community safe. I'm not going to be as I'm not going to be drummed out of our community. there are people who are working their way into the community and who don't have as tough a skin or as big a shoulders as I do, who would feel incredibly othered and less likely to continue to contribute or begin to contribute if they were the target of some of those things. And so I would argue vehemently that we need to keep code of conduct in place. **Courtney Robertson:** When I experienced the bullying that led to me taking some years away from WordPress, there was no code of conduct yet. And there were no standards. And certainly, no one was going to uphold those. And so I think the impetus is that if we have a set of standards, that it applies throughout the organization. And that helps ensure the mental well-being. Because a lot of people that are new to contributing to open source don't understand to even look for a code of conduct. They're just new. They don't know what to do if something goes wrong until they're in the situation if something's going wrong. And so how do we protect folks that are in that realm and ensure that they become aware of a code of conduct? I love how at Linux Foundation events, we see the code of conduct on a roll-up banner right by the check-in desk. And I feel like that is, you know, you may not stop and read the whole thing, but at least you can't be completely unaware either. Right. Because it's almost an obstacle. And it is when you go to it's the fine print when you go to buy tickets to things. Right. But I feel like it is really important for us to watch as a community that we know what are our standards of your newer. Check into our codes of conduct. Check into what is appropriate at events or not. Check into what is appropriate conduct when you're contributing to any of the teams. And throughout the organization entirely, we need to make sure that we're upholding those standards for everybody in the project. --- Created with [Snipd](https://www.snipd.com) | Highlight & Take Notes from Podcasts