<div class="rss-widget"><ul><li><a class='rsswidget' href='https://wptavern.com/open-source-leadership-summit-to-live-stream-keynote-sessions-february-14-16' title=' The Linux Foundation’s Open Source Leadership Summit is happening in Lake Tahoe, CA, February 14-16, 2017. The invitation-only event brings together open source technology leaders to collaborate across different projects and share best practices. The organizers will be live streaming all of the keynote sessions for free throughout the three-day event for a total of 17 presentations. A few sample topics and speakers include:  State of the Union – Jim Zemlin, Executive Director of the Linux Foundation A Conversation with Linus Torvalds (with Jim Zemlin) State of Blockchain – Christopher Ferris, CTO of Open Technology, IBM Security and Privacy in a Hyper-connected World – Bruce Schneier, Security Expert Building and Motivating Engineering Teams – Camille Fournier, Senior Thinker and Raconteur How Cross-Foundation Collaboration is a Win for Open Source – Abby Kearns, Executive Director, Cloud Foundry Foundation  Anyone who wants to join the keynote sessions via live stream will need to sign up ahead of the event. The keynotes will be broadcast in Pacific Daylight Time and viewers can return to the signup page to watch live. Viewers are encouraged to use the event’s official #lfosls hashtag to tweet about the sessions as they are watching. '>WPTavern: Open Source Leadership Summit to Live Stream Keynote Sessions February 14-16</a></li><li><a class='rsswidget' href='https://wptavern.com/why-plugins-sometimes-disappear-from-the-wordpress-plugin-directory' title='Nearly 50K publicly available plugins call the WordPress plugin directory home but once in awhile a few of them seem to disappear. There is usually a good reason for why this happens but the only information available to the public is a page that says the plugin cannot be found. If the plugin is popular enough, concerned users will contact us and ask to investigate what happened. Mika Epstein, Plugin Directory Representative, says there are a number of reasons for why a plugin can end up hidden from view, “The most well-known, but not the most common, is security issues,” Epstein said. “Plugins are removed and, by default, hidden mostly because we’re on bbPress 1.0 and there is not as granular a control with post statuses when compared to WordPress itself.” The plugin review team has three options to choose from when altering a plugin’s visibility, active, closed, and disabled. Although rarely used, when a plugin is disabled, it is hidden from view but updates are able to be pushed out. I asked Epstein why there’s not more detailed information when a plugin is hidden and the answer is complex, “The lack of information is partly technical as bbPress 1.0 is limited and partly because we can’t all agree on the right way to disclose, when to disclose, and when not to disclose,” she said. “Obviously the last thing we want are people getting hacked, but it presents us with a few options and they all have flaws. We’ve not been able to determine a way to tell people ‘This plugin is gone, don’t use it’ and ‘This plugin is gone, but use it if you want.’ without putting users at risk.” Epstein uses WooCommerce and Jetpack as examples, “Let’s say I close Jetpack today and tell people ‘WordPress decided not to support it anymore.’ But tomorrow I close WooCommerce and tell people ‘I can’t tell you why.’ That means an intelligent person knows that WooCommerce is probably vulnerable.” It’s a conundrum without an easy solution. The team typically closes plugins which makes the plugin’s page disappear. This has the added benefit of making it more difficult to determine if the plugin ever existed. Then the team contacts and works with the developer directly. Most closures are done with the knowledge of the plugin author as they are often the ones who request that their plugins be closed. The New WordPress Plugin Directory Will Modernize Plugin Administration Announced at WordCamp Europe 2016, the WordPress plugin directory redesign has been in open beta for about eight months. WordPress Plugin Directory Redesign In addition to bringing a fresh new look to plugin pages, the migration away from bbPress to WordPress will help make the plugin review team’s job easier, “Like far too many things in Plugin Land, everything depends on modernizing the backend to something that is functional.” Epstein said. “Once the new directory is out and I have some more people trained to do reviews properly, then we’ll have the bandwidth to sit down and really figure out a best solution. “A stopgap might be making the page say ‘This plugin is no longer available.’ But I’m personally not sure if that would make FUD better or worse.” If you discover that a plugin you rely on has suddenly vanished from the directory, don’t panic. Depending on the issue, plugins usually reappear within a week unless the author has requested that it be closed. To learn what’s involved and how the plugin review team does its job, listen to episode 231 of WordPress Weekly. I also encourage you to read our detailed interview with Epstein published in 2014, in which most of the information is still accurate. '>WPTavern: Why Plugins Sometimes Disappear From the WordPress Plugin Directory</a></li><li><a class='rsswidget' href='https://wptavern.com/wordpress-rest-api-vulnerability-exploits-continue' title='photo credit: Code &amp; Martini by Ivana Vasilj – cc license It has been nearly two weeks since the WordPress security team disclosed an unauthenticated privilege escalation vulnerability in a REST API endpoint in 4.7 and 4.7.1. The vulnerability was patched silently and disclosure was delayed for a week to give WordPress site owners a head start on updating to 4.7.2. Last week hundreds of thousands of vulnerable sites had already been defaced and the damage reports are still rolling in. Over the weekend the attacks increased and WordPress security firms have seen more attempts blocked by their firewalls. Sucuri, the website security firm that reported the vulnerability to WordPress, was tracking the “Hacked by w4l3XzY3” campaign last week and estimated 66,000 defacements. That particular campaign has now passed 260,000 pages indexed by Google. It is one of nearly two dozen defacement campaigns targeting the vulnerability. “During the past 24 hours we have seen an average growth in defaced pages per campaign of 44%,” Wordfence CEO Mark Maunder said on Friday. “The total number of defaced pages for all these campaigns, as indexed by Google has grown from 1,496,020 to 1,893,690. That is a 26% increase in total defaced pages in just 24 hours.” Maunder referenced a Google Trends chart which he said demonstrates the success the defacement campaigns have had over the past week. The spike began on the day WordPress disclosed the vulnerability.  &amp;q; However, White Fir Design, another company that offers security services, disputes Wordfence’s claims that 1.8 million pages were hacked. The ~2  million pages figure is cited in reports from BBC, The Enquirer, Ars Technica, CIO.com, and other publications. White Fir Design contends that the hacked pages that have been indexed by Google are not an accurate representation. Sucuri CTO Daniel Cid also does not fully agree with Wordfence’s assessment of the situation. After doing some research over the weekend, Sucuri estimates more than 50,000 sites hacked with 20-30 pages per site defaced. This would be roughly a million on the lower end of the estimate and ranges up to 1.5 million. Sucuri is also starting to see more serious attempts on the REST API vulnerability in the form of remote code execution (RCE) attacks on sites using plugins that allow for PHP execution from within posts and pages. One such campaign attempts to inject a PHP include to add content from a compromised site and then inject a backdoor hidden in /wp-content/uploads. “Defacements don’t offer economic returns, so that will likely die soon,” Cid said. “What will remain are attempts to execute commands (RCE) as it gives the attackers full control of a site – and offers multiple ways to monetize – and SPAM SEO / affiliate link / ad injections. We are starting to see them being attempted on a few sites, and that will likely be the direction this vulnerability will be misused in the coming days, weeks and possibly months.” Hackers are targeting any sites that haven’t updated to 4.7.2 – there doesn’t seem to be any pattern among them. A quick look at the Google results for the most active campaigns shows that compromised sites include blogs, media, government, education, sports, medical, and technology websites. Why the REST API is Enabled by Default The WordPress REST API is enabled by default, as the plan is for more admin and plugin functionality to rely on the REST API in the future. After the recent attacks, several users commented on the vulnerability disclosure to ask why it is enabled by default. “The security issue is in a feature I do not use on any of my sites (REST API) and yet still, this feature is first enabled by default and second since WordPress 4.7 you even need a plugin – which could introduce further security issues – to disable the feature?” one user (@helios2121) commented on the post. “Please rethink your approach to security. Make features that not everyone needs opt-in. Or at least give a way to opt out without requiring additional plugins.” Morten Rand-Hendriksen opened a trac ticket to discuss disabling the REST API by default and only enabling it when the site admin requests it, or a theme or plugin is dependent on it. Core Committer Sergey Biryukov confirmed that the plan is to introduce more core functionality that relies on REST API. “Turning off the REST API is like turning off admin-ajax.php — both will break your site,” Biryukov said. Rand-Hendriksen asked why the content endpoints cannot be protected by default while allowing the REST API to be on by default for admin purposes. Another user asked why the Users endpoint isn’t protected by default (i.e. https://news.microsoft.com/wp-json/wp/v2/users or https://www.obama.org/wp-json/wp/v2/users), which “makes it easier than ever to get all the usernames” on any site using 4.7+.  “If you really want to disable the REST API on your site(s), this is our current recommendation: restrict it to authenticated users,” Core Committer James Nylen said. “However, we want to continue to increase adoption and usage of the REST API, and I expect that even this modification will break more and more WP functionality as time goes on, such as API-driven themes and embeds.” Nylen recommends the Disable JSON API plugin for those who want to follow that recommendation on sites using WordPress 4.7+. The plugin currently has more than 10,000 active installs. The WordPress security team worked diligently to mitigate the attacks by helping hosts and security firms put protections in place before the issue was made public. However, the full disclosure of the vulnerability was buried on the Make/Core blog, a site that is not widely read among regular WordPress site owners. The link to the disclosure was published as an addendum to the previous post on the WordPress news blog a week later. “While I appreciate the responsible disclosure of this issue and the effort to resolve it, I hope you consider making future announcements via a new post on the WordPress News site, rather than just appending an update to a previous post,” user @johnrork commented on the official disclosure. “I am probably not the only one who could have avoided being compromised had this shown up as a new item in my RSS reader on Wednesday.” Those who read the Make blogs had a head start on fixing their own sites and/or their clients’ sites. Those who depend on the WordPress news blog for information on security updates probably read the post when it was initially published and never returned to see the update a week later. An issue this severe warranted WordPress’ transparency in a new post on its news blog. This would have also automatically sent out a tweet to more than half a million followers on the official WordPress account and the Facebook account which has more than a million likes. Fortunately, the number of vulnerable sites that also have plugins that could allow attackers to piggyback on this vulnerability is a much smaller number. Defaced sites are embarrassing but easy to fix. In most cases administrators need only update to 4.7.2 and roll back the defaced posts to the most recent revision. Most site owners have no idea how fast exploits begin to pop up after public disclosure, but this situation provided a gentle reminder of the importance of updating WordPress and the benefit of leaving automatic updates on. '>WPTavern: WordPress REST API Vulnerability Exploits Continue</a></li><li><a class='rsswidget' href='https://wptavern.com/10up-unveils-elasticpress-io-elasticsearch-as-a-service-for-wordpress-sites' title=' 10up launched ElasticPress.io this week, its new Elasticsearch SaaS product with plans starting at $299/month. Elasticsearch is an open source, distributed search engine that speeds up searching by using JSON documents to store data in indices. The indices store mapping fields to the corresponding documents and the engine searches the index instead of a site’s entire database. Elasticsearch can perform near-real-time searches and is highly scalable, but the setup is technically demanding. It is used by many large companies, such as GitHub, Soundcloud, Etsy, Netflix, Cisco, and Samsung. It is also one of the most popular enterprise search engines for WordPress sites, as searching WordPress tables with thousands or even millions of records is simply not going to be fast. The WordPress plugin directory has a dozen plugins for using and extending Elasticsearch but 10up’s ElasticPress is by far the most popular with more than a thousand installs. After supporting the plugin for several years, along with many enterprise clients using Elasticsearch, 10up decided to create a hosted service that integrates with ElasticPress. “The reason we created this solution for our clients, and that we’re now making this public, is that we don’t think anyone has provided a super easy, end-to-end (plugin to hosted service) that offers all of the benefits of Elasticsearch and our ElasticPress plugin, while being completely agnostic to your site hosting,” 10up founder Jake Goldman said.  ElasticPress.io is an end-to-end solution that is specifically tailored for those using the ElasticPress plugin. This is one of the key differences between managing your own Elasticsearch infrastructure with a service like AWS. ElasticPress.io controls both the hosting and the plugin, allowing the service to optimize performance for both. “There are a number of really neat use cases for ElasticPress on our roadmap that add either risk (security) or headaches (complicated setup and management procedures) if you can’t control both ends,” Goldman said. “For instance, there are optional Elasticsearch modules (just like there are optional Apache and Nginx modules) for features like indexing media that many hosted Elastic services don’t enable by default or support. We also want to be able to index and handle content that isn’t public, and many hosted Elastic services aren’t locked down / secured end-to-end with the website by default.” How ElasticPress.io’s Pricing Compares to Competitors Elastic, the creators of Elasticsearch were one of the first companies to launch Elasticsearch as a service in 2012. Two years later the company raised $70 million in a Series C funding round. Dozens of other Elasticsearch as a service companies have sprouted up since then, with pricing ranging from under $20 to tens of thousands of dollars depending on the resources offered. The ElasticPress.io service is the first of its kind in the WordPress ecosystem. Most hosting companies do not have it built into their enterprise level plans. WordPress.com VIP is one of the few that offers Elasticsearch for sites on its plans which range from $5,000 – $25,000 per month. WP Engine has an Elasticsearch solution as part of its Labs program, which is based on a fork of ElasticPress. However, the solution has not yet been officially added to the company’s enterprise plans.  @10up @mgibbs189 @cabgfx @sbangnielsen @SearchWP ElasticPress plus lower cost providers is still extremely powerful for under $12 a month — Scott Kingsley Clark (@scottkclark) February 10, 2017  For the most part, developers who have to implement Elasticsearch for a WordPress site are faced with hosting their own instance and managing it themselves. This is the most cost effective option but comes with a great deal more responsibility. “Elasticsearch is a quickly evolving platform, and they don’t exactly have the same commitment to infinite backwards compatibility that WordPress has these days,” Goldman said. “Major Elasticsearch upgrades can break old integrations. That means the site owner needs to either worry about automatic version upgrades breaking their site, or has to manage their upgrades carefully. By controlling the integration with Elastic on the website site and controlling the hosting, we can carefully handle version upgrades for customers while making sure nothing breaks.” 10up is aiming at the higher end of the market where customers are looking for convenience and access to the creators of ElasticPress for support. Goldman anticipates many of those customers will be similar to the product’s existing customers who simply need a robust keyword search or related content engine that will “just work.” ElasticPress.io is also targeting smaller and mid-tier businesses that are experiencing performance bottlenecks with WordPress’ native query engine. “Those customers are typically relying on rather complicated faceting / filtering of content, the classic use-case being a WooCommerce store where customers are constantly filtering on a handful of unique (unique = hard to cache) meta data all the time,” Goldman said. “That’s where ElasticPress really shines: our native WooCommerce support and optimization take those very taxing queries and makes them lightning fast.” As the service is fairly unique in the WordPress space, ElasticPress.io’s pricing has room to evolve as 10up learns from its customers. The plans currently range from $299 – $999 per month with increasing storage space and tiered support response times. Goldman said they haven’t ruled out other pricing points and may explore more pricing options in the future. '>WPTavern: 10up Unveils ElasticPress.io: Elasticsearch as a Service for WordPress Sites</a></li><li><a class='rsswidget' href='https://poststatus.com/jason-cohen-wp-engine-founder/' title='Welcome to the Post Status Draft podcast, which you can find on iTunes, Google Play, Stitcher, and via RSS for your favorite podcatcher. In this episode, I interview Jason Cohen, the founder of WP Engine and current CTO. I talked to Jason about a whole lot of things, mostly to do with growing well. Whether you’re growing revenue, company size, or personal development — this is a conversation about growth, and how to do it well. Unlike many entrepreneurs in the WordPress space, WP Engine isn’t Jason’s first business. He’s done this before, and made plenty of mistakes. He talks about what he’s done differently at WP Engine and how its made him a happier person. This interview took place at LoopConf, and Jason was a keynote presenter. His LoopConf talk pairs well with our discussion. You can catch the first segment on video, and the entire conversation is on the audio podcast.   https://audio.simplecast.com/60233.mp3 Direct Download Links  WP Engine LoopConf Jason’s blog  Sponsor: iThemes This episode is sponsored by iThemes. The team at iThemes offers WordPress plugins, themes and training to help take the guesswork out of building, maintaining and securing WordPress websites. For more information, check out their website and thank you to iThemes for being a Post Status partner. Photo by Brian Richards for Post Status'>Post Status: Jason Cohen, founder of WP Engine, on growing your company well — Draft Podcast</a></li></ul></div>