WordPress News Roundup January 2013: WordPress 3.5.1 Ships as Automattic Buys Simperium

January 2013 opened with WordPress in a reflective mood. The project’s look back at 2012 counted two major releases (3.4 and the media-focused 3.5), five security releases, the launch of the Make network of team blogs, a first Community Summit and 67 WordCamps worldwide. With that behind it, the core team spent the month setting up WordPress 3.6, while the first maintenance release of 3.5 closed a set of security holes.

Outside core, the month was dominated by business stories: Automattic bought the company behind Simplenote, and a long-simmering argument about the GPL and Envato’s marketplaces boiled over when it collided with WordCamp speaking rules.

Mergers, Acquisitions, and Investments

• Automattic acquires Simperium: On January 24, Automattic announced it had acquired Simperium, the Y Combinator-backed startup behind the Simplenote note-taking app and a data-syncing service of the same name. Founders Mike Johnston and Fred Cheng and their small team joined Automattic, and Matt Mullenweg wrote that both Simplenote and Simperium would keep running and get more attention. Simperium’s syncing technology would later turn up across Automattic’s apps.

No other notable deals were announced in the WordPress space this month.

WordPress Core Updates

• WordPress 3.5.1: Released on January 24, 3.5.1 was the first maintenance release of 3.5 “Elvin”, fixing 37 bugs in the editor, the new media manager and multisite network setup. It was also a security release for all earlier versions, closing a server-side request forgery and port-scanning issue that abused pingbacks, two cross-site scripting holes involving shortcodes and post content, and an XSS flaw in the bundled Plupload library.
• The 3.6 cycle begins: A planning session on January 2 kicked off WordPress 3.6, with Mark Jaquith and Aaron D. Campbell as release leads. Rather than one big theme, the release was split into feature teams, each posting regular updates on make.wordpress.org/core: a new Post Formats interface, revisions, autosave and post locking, menus, an editorial flow project and distraction-free writing improvements.
• Post Formats front and centre: The Post Formats UI team posted progress reports almost weekly. The goal was to give each format (link, quote, image, video and so on) its own editing fields, a bet that would become one of the defining stories of the year.

Other WordPress News

• The Envato and GPL argument: The month’s loudest debate began when a ThemeForest author was told he could not speak at or volunteer for WordCamps because the themes he sold there were not licensed fully under the GPL. ThemeForest used a split licence, and WordCamp guidelines required speakers and sponsors to distribute 100% GPL products. Developers such as Alex King questioned the wisdom of building a business on a marketplace whose terms limited pricing, licensing and direct sales, and the pressure on Envato to offer a full GPL option grew quickly.
• Sensei from WooThemes: WooThemes released Sensei, a learning-management plugin with built-in quizzes and grading that tied into WooCommerce for selling courses. It put WooThemes into the growing market for WordPress-powered online courses.
• WP Tavern goes quiet: Jeff Chandler, who built WP Tavern into one of the community’s best-known news sites, announced he was stepping away from it in late January. The site fell silent for several months before returning in May, a reminder of how fragile independent WordPress journalism was.
• Managed hosting grows up: Page.ly added a point of presence in London, and ZippyKid began requiring code audits for some high-traffic sites before hosting them, both signs of managed WordPress hosts competing on performance rather than price.

Security Alerts and Plugin Vulnerabilities

The main security news was WordPress 3.5.1 itself. The pingback SSRF fix mattered beyond individual sites, because XML-RPC pingbacks could be abused to probe internal networks and, as later attacks showed, to send traffic at third parties. The release credited security researchers Gennady Kovshenin and Ryan Dewhurst for reviewing the fix, and Jon Cave of the WordPress security team for finding the XSS issues.

Industry Trends and Insights

• Licensing as a business question: The ThemeForest dispute showed that the GPL was no longer an abstract philosophy debate. For theme sellers it touched income, community standing and where they could sell.
• Automattic beyond blogging: Buying a syncing company signalled that Automattic was thinking about apps and data across devices, not only WordPress.com.
• Feature teams as a process experiment: Splitting 3.6 into parallel teams was an early step toward the “features as plugins” model WordPress would formally adopt later in 2013.

Theme of the Month: Twenty Twelve

Twenty Twelve, which shipped with WordPress 3.5 the month before, was the default theme on every fresh install in January. Its clean, responsive single-column layout and Open Sans typography made it the reference point theme developers were measuring against, and it set the stage for the more opinionated Twenty Thirteen being planned for 3.6.

Plugin of the Month: Sensei

Sensei was the month’s most notable new commercial plugin. By building quizzes, lessons and course sales on top of WooCommerce, WooThemes showed how one well-adopted plugin could become a platform for others, and it gave course creators a serious alternative to standalone LMS software.

Host of the Month: ZippyKid

Vid Luther’s ZippyKid made a point this month by requiring code audits for some high-traffic customers at no extra charge, arguing that sloppy code on busy sites hurt everyone. It was an early example of a managed WordPress host selling expertise rather than just servers. The company would rebrand as Pressable later in the year.

Founder of the Month: Mike Johnston

Mike Johnston co-founded Simperium and led the team that built Simplenote. With the Automattic acquisition, he and his co-founder brought syncing expertise into the company behind WordPress.com, and the relaunched Simplenote apps that followed later in 2013 were the first visible result.

Looking Ahead to February 2013

February should bring the first look at Twenty Thirteen and more progress reports from the 3.6 feature teams, with a beta still targeted for the spring. WooThemes is preparing WooCommerce 2.0, and the Envato community is waiting to see whether ThemeForest will respond to the GPL pressure with a fully GPL licensing option.