WordPress News Roundup March 2006: WordPress 2.0.2 Fixes XSS as the Widgets Plugin Goes Public

March 2006 combined a security release with a symbolic win. WordPress 2.0.2 fixed privately reported cross-site scripting problems. At the end of the month the Widgets plugin, already popular on WordPress.com, was released for everyone. In between, the web standards advocate Jeffrey Zeldman moved his site to WordPress, a switch that meant a great deal to the people who built it.

WordPress Core Updates

• WordPress 2.0.2 (March 10): The 2.0.2 release fixed several bugs and previously undisclosed XSS issues reported privately to the team. It credited Michael Boman, Mark Jaquith, Robert Deaton and David House.
• Widgets plugin (March 29): A month after launching on WordPress.com, WordPress Widgets came out of testing as a plugin for self-hosted blogs, with documented APIs and guides for theme and plugin authors. The team said it would consider adding widgets to a future version if adoption went well.
• Lyceum and the MU approach: When iBiblio released Lyceum, a multi-user fork of WordPress, Mullenweg explained why WordPress MU had rejected its single-table design. WordPress.com spread its users across 4,096 databases so it could keep scaling cheaply, and he warned that a fork would find it hard to keep up with the big changes coming in 2.1.

Other WordPress News

• Zeldman switches: On March 9 Jeffrey Zeldman moved zeldman.com from almost 11 years of hand-coding to WordPress and published an essay on why. Mullenweg said Zeldman was one of the few people he had imagined using the software when he started it.
• SxSW meetup: WordPress users met for dinner at Austin’s Thistle Cafe on March 11 during South by Southwest. It was the same venue as BarCamp Austin.
• Secure blogging: WordPress.com added SSL support, and Mullenweg moved his conference blogging to his WordPress.com blog because of it.
• A sponsored spellchecker: Automattic sponsored a spellchecking feature for WordPress.com that it later highlighted as part of what it shared with the community.
• 130,000 blogs: The widgets announcement said more than 130,000 blogs were now hosted on WordPress.com.

Security Alerts and Plugin Vulnerabilities

Version 2.0.2 was the main security news. The announcement also pushed back on what it called “snake-oil” reports circulating on security mailing lists in the days before. Some described issues too small to justify a release, and others were simply false. The team promised to act quickly on real problems and asked users to be sceptical of unverified claims, a tension between WordPress and the security-disclosure world that would come up again and again.

Industry Trends and Insights

Big media companies were shopping for social web startups. At the Under the Radar conference, Fox Interactive’s Ross Levinsohn surprised the room by saying he had just bought one of the presenting companies, and MySpace was said to be averaging 275,000 sign-ups a day. Mullenweg blogged from the event. In that climate, WordPress’s steady, community-led growth, with switchers like Zeldman, looked unusually durable.

Founder of the Month: Jeffrey Zeldman

Jeffrey Zeldman co-founded the Web Standards Project and A List Apart and wrote the book on designing with web standards. His decision to run his own site on WordPress told designers that the software had earned the trust of the standards movement it had always tried to follow.

Looking Ahead to April 2006

The Widgets plugin would get its first real test as themes and plugins added support for it. Work on WordPress 2.1 continued, and Automattic was dealing with fast growth at both WordPress.com and Akismet.