O:9:"MagpieRSS":17:{s:6:"parser";i:0;s:12:"current_item";a:0:{}s:5:"items";a:10:{i:0;a:13:{s:5:"title";s:32:"WordPress 2.8.6 Security Release";s:4:"link";s:74:"http://wordpress.org/development/2009/11/wordpress-2-8-6-security-release/";s:8:"comments";s:83:"http://wordpress.org/development/2009/11/wordpress-2-8-6-security-release/#comments";s:7:"pubdate";s:31:"Thu, 12 Nov 2009 19:17:20 +0000";s:2:"dc";a:1:{s:7:"creator";s:10:"Ryan Boren";}s:8:"category";s:16:"ReleasesSecurity";s:4:"guid";s:39:"http://wordpress.org/development/?p=966";s:11:"description";s:354:"2.8.6 fixes two security problems that can be exploited by registered, logged in users who have posting privileges.  If you have untrusted authors on your blog, upgrading to 2.8.6 is recommended.
The first problem is an XSS vulnerability in Press This discovered by Benjamin Flesch.  The second problem, discovered by Dawid Golunski,  is an issue [...]";s:7:"content";a:1:{s:7:"encoded";s:591:"<p>2.8.6 fixes two security problems that can be exploited by registered, logged in users who have posting privileges.  If you have untrusted authors on your blog, upgrading to 2.8.6 is recommended.</p>
<p>The first problem is an XSS vulnerability in Press This discovered by Benjamin Flesch.  The second problem, discovered by Dawid Golunski,  is an issue with sanitizing uploaded file names that can be exploited in certain Apache configurations.  Thanks to Benjamin and Dawid for finding and reporting these.</p>
<p><a href="http://wordpress.org/download/">Get WordPress 2.8.6</a>.</p>
";}s:3:"wfw";a:1:{s:10:"commentrss";s:79:"http://wordpress.org/development/2009/11/wordpress-2-8-6-security-release/feed/";}s:5:"slash";a:1:{s:8:"comments";s:1:"0";}s:7:"summary";s:354:"2.8.6 fixes two security problems that can be exploited by registered, logged in users who have posting privileges.  If you have untrusted authors on your blog, upgrading to 2.8.6 is recommended.
The first problem is an XSS vulnerability in Press This discovered by Benjamin Flesch.  The second problem, discovered by Dawid Golunski,  is an issue [...]";s:12:"atom_content";s:591:"<p>2.8.6 fixes two security problems that can be exploited by registered, logged in users who have posting privileges.  If you have untrusted authors on your blog, upgrading to 2.8.6 is recommended.</p>
<p>The first problem is an XSS vulnerability in Press This discovered by Benjamin Flesch.  The second problem, discovered by Dawid Golunski,  is an issue with sanitizing uploaded file names that can be exploited in certain Apache configurations.  Thanks to Benjamin and Dawid for finding and reporting these.</p>
<p><a href="http://wordpress.org/download/">Get WordPress 2.8.6</a>.</p>
";}i:1;a:13:{s:5:"title";s:21:"Bug Hunt in Progress!";s:4:"link";s:62:"http://wordpress.org/development/2009/11/bug-hunt-in-progress/";s:8:"comments";s:71:"http://wordpress.org/development/2009/11/bug-hunt-in-progress/#comments";s:7:"pubdate";s:31:"Sat, 07 Nov 2009 00:50:39 +0000";s:2:"dc";a:1:{s:7:"creator";s:10:"Jane Wells";}s:8:"category";s:11:"Development";s:4:"guid";s:62:"http://wordpress.org/development/2009/11/bug-hunt-in-progress/";s:11:"description";s:273:"Just in case anyone forgot, the first of the November bug hunts for version 2.9 is now in progress, and will last another day. If you&#8217;ve got a dev environment set up, please consider pitching in to run some tests and help get us closer to the 2.9 milestone release. 
";s:7:"content";a:1:{s:7:"encoded";s:355:"<p>Just in case anyone forgot, the first of the <a href="http://wordpress.org/development/2009/10/upcoming-bug-hunts/">November bug hunts</a> for version 2.9 is now in progress, and will last another day. If you&#8217;ve got a dev environment set up, please consider pitching in to run some tests and help get us closer to the 2.9 milestone release. </p>
";}s:3:"wfw";a:1:{s:10:"commentrss";s:67:"http://wordpress.org/development/2009/11/bug-hunt-in-progress/feed/";}s:5:"slash";a:1:{s:8:"comments";s:1:"0";}s:7:"summary";s:273:"Just in case anyone forgot, the first of the November bug hunts for version 2.9 is now in progress, and will last another day. If you&#8217;ve got a dev environment set up, please consider pitching in to run some tests and help get us closer to the 2.9 milestone release. 
";s:12:"atom_content";s:355:"<p>Just in case anyone forgot, the first of the <a href="http://wordpress.org/development/2009/10/upcoming-bug-hunts/">November bug hunts</a> for version 2.9 is now in progress, and will last another day. If you&#8217;ve got a dev environment set up, please consider pitching in to run some tests and help get us closer to the 2.9 milestone release. </p>
";}i:2;a:13:{s:5:"title";s:18:"Upcoming WordCamps";s:4:"link";s:62:"http://wordpress.org/development/2009/11/upcoming-wordcamps-3/";s:8:"comments";s:71:"http://wordpress.org/development/2009/11/upcoming-wordcamps-3/#comments";s:7:"pubdate";s:31:"Fri, 06 Nov 2009 02:42:53 +0000";s:2:"dc";a:1:{s:7:"creator";s:10:"Jane Wells";}s:8:"category";s:8:"WordCamp";s:4:"guid";s:39:"http://wordpress.org/development/?p=960";s:11:"description";s:330:"There are six WordCamps coming up before the end of the year, and since I like to make sure people know about it when there&#8217;s a WordCamp near them, here&#8217;s the list, with some personal commentary thrown in. If you just want the list without my asides, check out the full schedule at WordCamp.org.
WordCamp Phoenix [...]";s:7:"content";a:1:{s:7:"encoded";s:5769:"<p>There are six WordCamps coming up before the end of the year, and since I like to make sure people know about it when there&#8217;s a <a href="http://central.wordcamp.org/">WordCamp</a> near them, here&#8217;s the list, with some personal commentary thrown in. If you just want the list without my asides, check out the full schedule at <a href="http://wordcamp.org">WordCamp.org</a>.</p>
<p><a href="http://phxwordcamp.com/">WordCamp Phoenix</a> is first up, on November 13. I&#8217;d planned on attending this one myself before they changed the date (it was originally scheduled for the 7th), but will sadly have to miss it as it conflicts with WordCamp NYC. If you, like me, can&#8217;t make it to Phoenix, be sure to check their web site for information on the <a href="http://phxwordcamp.com/live-video-stream/">live stream</a> they&#8217;re planning to provide. If it&#8217;s anywhere near the quality of the stream from Portland or Seattle earlier this fall, it&#8217;ll be just like being there, but without a t-shirt to show for it (and theirs has stripes, so if you&#8217;re local, you should go!). My only consolation in missing this WordCamp is that I&#8217;ve seen about half of the <a href="http://phxwordcamp.com/speakers/">speakers</a> before. If you&#8217;re going, don&#8217;t miss the session by <a href="http://johnhawkinsunrated.com">John Hawkins</a> on <a href="http://wordpress.tv/2009/09/20/john-hawkins-plugin-building-portland09/"><em>Building a WordPress Plugin</em></a>; it got me to write my first plugin in Portland! <a href="http://ma.tt">Matt</a>&#8216;ll be there, will you?</p>
<p><a href="http://www.wordcampvictoria.ca/agenda/">WordCamp Victoria</a> is next, on November 14. This is another one I&#8217;d love to go to, but can&#8217;t because it&#8217;s at the same time as New York&#8217;s. I would especially have liked to go because it looks like the <a href="http://www.wordcampvictoria.ca/speaker-biographies/">speakers</a> are all local, and I haven&#8217;t seen any of them speak before. Occasionally WordCamps lose a little of the local feeling by focusing on visiting speakers, so it&#8217;s nice to see so many Vancouverites on the list. They&#8217;ll have a Blogger track and a Technical track running concurrently, so there should a little something for everyone. No word on a live stream, but hopefully they&#8217;ll be able to catch some of the presentations on video and post them to <a href="http://WordPress.tv">WordPress.tv</a> after the event.</p>
<p><a href="http://wordcamp.kapook.com/en/">WordCamp Bangkok</a> is scheduled for November 15. I have to admit that the first thing that catches my eye on their agenda is &#8220;WordPress Band.&#8221; I&#8217;ve known WordCamps to have <a href="http://wordpress.tv/2008/10/31/wordcamp-sf-2008-andy-skelton-deserve/">people</a> <a href="http://wordpress.tv/2008/10/31/wordcamp-sf-2008-chuck-lewis-the-seo-rapper/">performing</a> <a href="http://vimeo.com/5354329">songs</a> before, but a whole band? Might be a first. I hope they&#8217;ll post the video to WordPress.tv, too.</p>
<p><a href="http://2009.newyork.wordcamp.org/">WordCamp New York City</a> is the same weekend as the previous three, on November 14-15. In the interest of full disclosure, I need to tell you that I&#8217;m one of the organizers of WordCamp NYC, so my informative comment about it here may be a little biased. <img src='http://wordpress.org/development/wp-includes/images/smilies/icon_smile.gif' alt=':)' class='wp-smiley' />  That said, we have over <a href="http://2009.newyork.wordcamp.org/speakers/">50 confirmed speakers</a> (both local and visiting), and <a href="http://2009.newyork.wordcamp.org/program/">2 full days of content</a> in 8 &#8212; count &#8216;em, 8 &#8212; tracks. Newbies get a free year of hosting and walked through setting up a WordPress blog in workshop format, while the other tracks have specialized content for Bloggers, CMS Users, Beginning Developers, Advanced Developers, Academic Users, people interested in MU/BuddyPress, and the Open Source Community. Did I mention the <a href="http://2009.newyork.wordcamp.org/plugintheme-competition/">theme and plugin contest</a>? Or the <a href="http://2009.newyork.wordcamp.org/2009/10/28/my-favorite-conference-shirt/">awesome shirts</a>? How about the Genius Bar, or the Hacker Room? The additional Unconference sessions? If you&#8217;re anywhere near NYC that weekend (and with the Acela, that&#8217;s anywhere from Boston to D.C.), you should definitely come. I&#8217;ll be there, Matt&#8217;ll be there, lead developer Mark Jaquith will be there, lead developer of BuddyPress Andy Peatling will be there, and too many other WordPress luminaries and locals to mention. If we hit 800 registrations by November 12, I&#8217;m baking cookies for everyone.</p>
<p><a href="http://peru.wordcamp.org/">WordCamp Peru</a> will be on November 28 in Lima. I was checking out their topics list, and it looks like they&#8217;re planning to cover all the usual topics around blog administration, security, increasing traffic, and integration with social media sites. No speaker list yet, but if you&#8217;re in Peru, it looks like this will be a nice gathering of WordPress users, and they&#8217;re hoping to have around 100 people attend.</p>
<p><a href="http://wordcamporlando.org/">WordCamp Orlando</a> is the last of the year, on December 5. They haven&#8217;t published a speaker list or schedule yet, but I know Matt will be there, Mark Jaquith will be there, and I will be there. I know some other awesome core contributors are planning to come, but I don&#8217;t want to jinx anything, so if you&#8217;re curious, come see for yourself. Plus, Florida in December!</p>
<p>&nbsp;</p>
<p>&nbsp;</p>
<p>&nbsp;</p>
";}s:3:"wfw";a:1:{s:10:"commentrss";s:67:"http://wordpress.org/development/2009/11/upcoming-wordcamps-3/feed/";}s:5:"slash";a:1:{s:8:"comments";s:1:"0";}s:7:"summary";s:330:"There are six WordCamps coming up before the end of the year, and since I like to make sure people know about it when there&#8217;s a WordCamp near them, here&#8217;s the list, with some personal commentary thrown in. If you just want the list without my asides, check out the full schedule at WordCamp.org.
WordCamp Phoenix [...]";s:12:"atom_content";s:5769:"<p>There are six WordCamps coming up before the end of the year, and since I like to make sure people know about it when there&#8217;s a <a href="http://central.wordcamp.org/">WordCamp</a> near them, here&#8217;s the list, with some personal commentary thrown in. If you just want the list without my asides, check out the full schedule at <a href="http://wordcamp.org">WordCamp.org</a>.</p>
<p><a href="http://phxwordcamp.com/">WordCamp Phoenix</a> is first up, on November 13. I&#8217;d planned on attending this one myself before they changed the date (it was originally scheduled for the 7th), but will sadly have to miss it as it conflicts with WordCamp NYC. If you, like me, can&#8217;t make it to Phoenix, be sure to check their web site for information on the <a href="http://phxwordcamp.com/live-video-stream/">live stream</a> they&#8217;re planning to provide. If it&#8217;s anywhere near the quality of the stream from Portland or Seattle earlier this fall, it&#8217;ll be just like being there, but without a t-shirt to show for it (and theirs has stripes, so if you&#8217;re local, you should go!). My only consolation in missing this WordCamp is that I&#8217;ve seen about half of the <a href="http://phxwordcamp.com/speakers/">speakers</a> before. If you&#8217;re going, don&#8217;t miss the session by <a href="http://johnhawkinsunrated.com">John Hawkins</a> on <a href="http://wordpress.tv/2009/09/20/john-hawkins-plugin-building-portland09/"><em>Building a WordPress Plugin</em></a>; it got me to write my first plugin in Portland! <a href="http://ma.tt">Matt</a>&#8216;ll be there, will you?</p>
<p><a href="http://www.wordcampvictoria.ca/agenda/">WordCamp Victoria</a> is next, on November 14. This is another one I&#8217;d love to go to, but can&#8217;t because it&#8217;s at the same time as New York&#8217;s. I would especially have liked to go because it looks like the <a href="http://www.wordcampvictoria.ca/speaker-biographies/">speakers</a> are all local, and I haven&#8217;t seen any of them speak before. Occasionally WordCamps lose a little of the local feeling by focusing on visiting speakers, so it&#8217;s nice to see so many Vancouverites on the list. They&#8217;ll have a Blogger track and a Technical track running concurrently, so there should a little something for everyone. No word on a live stream, but hopefully they&#8217;ll be able to catch some of the presentations on video and post them to <a href="http://WordPress.tv">WordPress.tv</a> after the event.</p>
<p><a href="http://wordcamp.kapook.com/en/">WordCamp Bangkok</a> is scheduled for November 15. I have to admit that the first thing that catches my eye on their agenda is &#8220;WordPress Band.&#8221; I&#8217;ve known WordCamps to have <a href="http://wordpress.tv/2008/10/31/wordcamp-sf-2008-andy-skelton-deserve/">people</a> <a href="http://wordpress.tv/2008/10/31/wordcamp-sf-2008-chuck-lewis-the-seo-rapper/">performing</a> <a href="http://vimeo.com/5354329">songs</a> before, but a whole band? Might be a first. I hope they&#8217;ll post the video to WordPress.tv, too.</p>
<p><a href="http://2009.newyork.wordcamp.org/">WordCamp New York City</a> is the same weekend as the previous three, on November 14-15. In the interest of full disclosure, I need to tell you that I&#8217;m one of the organizers of WordCamp NYC, so my informative comment about it here may be a little biased. <img src='http://wordpress.org/development/wp-includes/images/smilies/icon_smile.gif' alt=':)' class='wp-smiley' />  That said, we have over <a href="http://2009.newyork.wordcamp.org/speakers/">50 confirmed speakers</a> (both local and visiting), and <a href="http://2009.newyork.wordcamp.org/program/">2 full days of content</a> in 8 &#8212; count &#8216;em, 8 &#8212; tracks. Newbies get a free year of hosting and walked through setting up a WordPress blog in workshop format, while the other tracks have specialized content for Bloggers, CMS Users, Beginning Developers, Advanced Developers, Academic Users, people interested in MU/BuddyPress, and the Open Source Community. Did I mention the <a href="http://2009.newyork.wordcamp.org/plugintheme-competition/">theme and plugin contest</a>? Or the <a href="http://2009.newyork.wordcamp.org/2009/10/28/my-favorite-conference-shirt/">awesome shirts</a>? How about the Genius Bar, or the Hacker Room? The additional Unconference sessions? If you&#8217;re anywhere near NYC that weekend (and with the Acela, that&#8217;s anywhere from Boston to D.C.), you should definitely come. I&#8217;ll be there, Matt&#8217;ll be there, lead developer Mark Jaquith will be there, lead developer of BuddyPress Andy Peatling will be there, and too many other WordPress luminaries and locals to mention. If we hit 800 registrations by November 12, I&#8217;m baking cookies for everyone.</p>
<p><a href="http://peru.wordcamp.org/">WordCamp Peru</a> will be on November 28 in Lima. I was checking out their topics list, and it looks like they&#8217;re planning to cover all the usual topics around blog administration, security, increasing traffic, and integration with social media sites. No speaker list yet, but if you&#8217;re in Peru, it looks like this will be a nice gathering of WordPress users, and they&#8217;re hoping to have around 100 people attend.</p>
<p><a href="http://wordcamporlando.org/">WordCamp Orlando</a> is the last of the year, on December 5. They haven&#8217;t published a speaker list or schedule yet, but I know Matt will be there, Mark Jaquith will be there, and I will be there. I know some other awesome core contributors are planning to come, but I don&#8217;t want to jinx anything, so if you&#8217;re curious, come see for yourself. Plus, Florida in December!</p>
<p>&nbsp;</p>
<p>&nbsp;</p>
<p>&nbsp;</p>
";}i:3;a:13:{s:5:"title";s:19:"Upcoming Bug Hunts!";s:4:"link";s:60:"http://wordpress.org/development/2009/10/upcoming-bug-hunts/";s:8:"comments";s:69:"http://wordpress.org/development/2009/10/upcoming-bug-hunts/#comments";s:7:"pubdate";s:31:"Sat, 31 Oct 2009 21:28:00 +0000";s:2:"dc";a:1:{s:7:"creator";s:10:"Jane Wells";}s:8:"category";s:49:"DevelopmentEventstestingbetabugssprintticketstrac";s:4:"guid";s:39:"http://wordpress.org/development/?p=953";s:11:"description";s:339:"As we near completion of the 2.9 milestone, it&#8217;s that time of dev cycle again, when we ask all you community developers who&#8217;ve been putting off contributing to core to dust off your dev environments and help us get closer to being release-ready. How? Bug hunts! Yes, that time-honored tradition (in the time of WordPress, [...]";s:7:"content";a:1:{s:7:"encoded";s:3637:"<p>As we near completion of the 2.9 milestone, it&#8217;s that time of dev cycle again, when we ask all you community developers who&#8217;ve been putting off contributing to core to dust off your dev environments and help us get closer to being release-ready. How? Bug hunts! Yes, that time-honored tradition (in the time of WordPress, anyway) of everyone pitching in to test patches and report the results, working on solutions to major bugs, and helping to clear out Trac has come around again, and we&#8217;re scheduling not one, but two bug hunts over the next couple of weeks to ensure that everyone has enough time to prepare and <a href="https://core.trac.wordpress.org/">participate</a>.</p>
<p><strong>#1</strong> &#8211; The first bug hunt of 2.9 will be Thursday through Saturday, November 5-7, 2009. This should give people a few days to plan for it, upgrade their dev environments if they haven&#8217;t been following trunk, and figure out how to allot their time. We&#8217;re stretching over both weekdays and weekend to try and accommodate everyone&#8217;s schedule.</p>
<p><strong>#2 </strong>- The second bug hunt will be a week later, Saturday through Monday, November 14-16, 2009. This should make it possible for anyone who needs more than a week to set some time aside to participate. This bug hunt will coincide with <a href="http://2009.newyork.wordcamp.org/">WordCamp NYC</a>, where a special Hacker Room will be set aside for people to go and work on 2.9 bug tickets alongside regular core contributors including Mark Jaquith and Matt Martz (sivel from IRC).</p>
<h4>The Goals</h4>
<p><strong>Test, test, test existing patches!</strong> You can see all tickets with patches that need testing by checking <a href="http://core.trac.wordpress.org/report/13">this report</a>. When you&#8217;ve tested a patch, report your results in the ticket comments, so core committers can see how the patch is faring.</p>
<p><strong>Fix known bugs! </strong>You can see the bugs that need patches by checking <a href="http://core.trac.wordpress.org/report/16">this report</a>. Look for the ones that seem that they&#8217;ll affect the most people or have the biggest impact by being fixed. Edge case bugs should be lower priority.</p>
<p><strong>Report new bugs! </strong>As you&#8217;re testing out the development version, if you come across a bug, <a href="http://core.trac.wordpress.org/search">search trac</a> to see if someone has reported it yet. If so, add a comment with your experience to the ticket so we&#8217;ll know it&#8217;s affecting more than one person. If no ticket exists yet, <a href="http://core.trac.wordpress.org/newticket">create one</a>.</p>
<p>Core committers will be around (in the #wordpress-dev channel at irc.freenode.com) both weekends to review patches that have been thoroughly tested, answer questions as needed, and give feedback on patches that need more work before being commit-worthy.</p>
<p>If you&#8217;ve never participated in a WordPress bug hunt before, but you&#8217;d like to get involved, we&#8217;d love to have you join us! To prepare, you&#8217;ll want to <a href="http://www.google.com/search?q=setting+up+a+wordpress+test+environment&amp;ie=utf-8&amp;oe=utf-8&amp;aq=t&amp;rls=org.mozilla:en-US:official&amp;client=firefox-a">set up a test environment</a>, start using the current development version/maybe install the <a href="http://westi.wordpress.com/2009/06/22/making-it-easy-to-be-a-wordpress-tester/">beta testing plugin</a>, join us in the #wordpress-dev IRC channel, and read up on <a href="http://codex.wordpress.org/Automated_Testing">automated testing</a>.</p>
";}s:3:"wfw";a:1:{s:10:"commentrss";s:65:"http://wordpress.org/development/2009/10/upcoming-bug-hunts/feed/";}s:5:"slash";a:1:{s:8:"comments";s:1:"1";}s:7:"summary";s:339:"As we near completion of the 2.9 milestone, it&#8217;s that time of dev cycle again, when we ask all you community developers who&#8217;ve been putting off contributing to core to dust off your dev environments and help us get closer to being release-ready. How? Bug hunts! Yes, that time-honored tradition (in the time of WordPress, [...]";s:12:"atom_content";s:3637:"<p>As we near completion of the 2.9 milestone, it&#8217;s that time of dev cycle again, when we ask all you community developers who&#8217;ve been putting off contributing to core to dust off your dev environments and help us get closer to being release-ready. How? Bug hunts! Yes, that time-honored tradition (in the time of WordPress, anyway) of everyone pitching in to test patches and report the results, working on solutions to major bugs, and helping to clear out Trac has come around again, and we&#8217;re scheduling not one, but two bug hunts over the next couple of weeks to ensure that everyone has enough time to prepare and <a href="https://core.trac.wordpress.org/">participate</a>.</p>
<p><strong>#1</strong> &#8211; The first bug hunt of 2.9 will be Thursday through Saturday, November 5-7, 2009. This should give people a few days to plan for it, upgrade their dev environments if they haven&#8217;t been following trunk, and figure out how to allot their time. We&#8217;re stretching over both weekdays and weekend to try and accommodate everyone&#8217;s schedule.</p>
<p><strong>#2 </strong>- The second bug hunt will be a week later, Saturday through Monday, November 14-16, 2009. This should make it possible for anyone who needs more than a week to set some time aside to participate. This bug hunt will coincide with <a href="http://2009.newyork.wordcamp.org/">WordCamp NYC</a>, where a special Hacker Room will be set aside for people to go and work on 2.9 bug tickets alongside regular core contributors including Mark Jaquith and Matt Martz (sivel from IRC).</p>
<h4>The Goals</h4>
<p><strong>Test, test, test existing patches!</strong> You can see all tickets with patches that need testing by checking <a href="http://core.trac.wordpress.org/report/13">this report</a>. When you&#8217;ve tested a patch, report your results in the ticket comments, so core committers can see how the patch is faring.</p>
<p><strong>Fix known bugs! </strong>You can see the bugs that need patches by checking <a href="http://core.trac.wordpress.org/report/16">this report</a>. Look for the ones that seem that they&#8217;ll affect the most people or have the biggest impact by being fixed. Edge case bugs should be lower priority.</p>
<p><strong>Report new bugs! </strong>As you&#8217;re testing out the development version, if you come across a bug, <a href="http://core.trac.wordpress.org/search">search trac</a> to see if someone has reported it yet. If so, add a comment with your experience to the ticket so we&#8217;ll know it&#8217;s affecting more than one person. If no ticket exists yet, <a href="http://core.trac.wordpress.org/newticket">create one</a>.</p>
<p>Core committers will be around (in the #wordpress-dev channel at irc.freenode.com) both weekends to review patches that have been thoroughly tested, answer questions as needed, and give feedback on patches that need more work before being commit-worthy.</p>
<p>If you&#8217;ve never participated in a WordPress bug hunt before, but you&#8217;d like to get involved, we&#8217;d love to have you join us! To prepare, you&#8217;ll want to <a href="http://www.google.com/search?q=setting+up+a+wordpress+test+environment&amp;ie=utf-8&amp;oe=utf-8&amp;aq=t&amp;rls=org.mozilla:en-US:official&amp;client=firefox-a">set up a test environment</a>, start using the current development version/maybe install the <a href="http://westi.wordpress.com/2009/06/22/making-it-easy-to-be-a-wordpress-tester/">beta testing plugin</a>, join us in the #wordpress-dev IRC channel, and read up on <a href="http://codex.wordpress.org/Automated_Testing">automated testing</a>.</p>
";}i:4;a:13:{s:5:"title";s:25:"Plugin Compatibility Beta";s:4:"link";s:67:"http://wordpress.org/development/2009/10/plugin-compatibility-beta/";s:8:"comments";s:76:"http://wordpress.org/development/2009/10/plugin-compatibility-beta/#comments";s:7:"pubdate";s:31:"Wed, 28 Oct 2009 12:11:39 +0000";s:2:"dc";a:1:{s:7:"creator";s:12:"Mark Jaquith";}s:8:"category";s:11:"Development";s:4:"guid";s:39:"http://wordpress.org/development/?p=944";s:11:"description";s:351:"The number one reason people give us for not upgrading to the latest version of WordPress is fear that their plugins won&#8217;t be compatible. As part of our continuing efforts to make WordPress core, plugin, and theme upgrades as painless as possible, Michael Adams developed and launched a beta of a new &#8220;Compatibility&#8221; feature in [...]";s:7:"content";a:1:{s:7:"encoded";s:3193:"<p>The number one reason people give us for not upgrading to the latest version of WordPress is fear that their plugins won&#8217;t be compatible. As part of our continuing efforts to make WordPress core, plugin, and theme upgrades as painless as possible, Michael Adams developed and launched a beta of a new &#8220;Compatibility&#8221; feature in the plugin directory, powered by your votes. When viewing a plugin in the directory, select a WordPress version and a plugin version from the drop-downs. If there has been feedback about this WordPress / plugin version combination, we&#8217;ll show you what percentage of responses marked that combination as compatible vs how many marked it as incompatible.</p>
<p><img src="http://markjaquith.wordpress.com/files/2009/10/compatibility-viewing.png" alt="Compatibility: Your Setup: (WordPress Version drop-down) (Plugin Version drop-down). Log in to vote. The Concensus: 44% negative, 56% positive" title="Compatibility viewing" width="220" height="254" class="alignnone size-full wp-image-365" /></p>
<p>If you log in, you&#8217;ll be able to help us gather this information! Just select a WordPress version / plugin version combination and click the &#8220;Works&#8221; or the &#8220;Broken&#8221; button. Please note that this shouldn&#8217;t be used to report minor issues with a plugin. You should mark a plugin as &#8220;Broken&#8221; only if its core functionality is truly broken when run on the specified WordPress version.</p>
<p><img src="http://markjaquith.wordpress.com/files/2009/10/compatibility-voting.png" alt="Compatibility: Your Setup: (WordPress Version drop-down) (Plugin Version drop-down). (Broken button) (Works button). The Concensus: No data" title="Compatibility voting" width="227" height="276" class="alignnone size-full wp-image-366" /></p>
<p>Right now we&#8217;re just in information gathering mode. So get out there and vote! Don&#8217;t just vote on broken plugins&#8230; cast a &#8220;Works&#8221; vote for every plugin that works on the version of WordPress you are using. This can help improve the signal-to-noise ratio in our data and prevent a few mistaken &#8220;Broken&#8221; votes from weighing too heavily.</p>
<p>For developers, we&#8217;re now including this data in our API. The <code>plugin_information</code> action now returns a &#8220;compatibility&#8221; member with the multidimensional array format:</p>
<p><code>array( {WP version} => array( {plugin version} => array( {% of reporters who say it works}, {# responses} ) ) )</code></p>
<p>If the API knows which version of WordPress you are using (for example, if you are making this query using the <code>plugins_api()</code> function from with WordPress), the API will only return compatibility information for your version of WordPress.</p>
<p>Eventually, we&#8217;d like to gather this compatibility feedback from within WordPress, allowing you to vote directly from your plugins admin screen. The ultimate goal is to use this information to inform you of plugin incompatibilities with a new version of WordPress during the upgrade process. For that to be useful we need a large set of high quality compatibility data. Start voting!</p>
";}s:3:"wfw";a:1:{s:10:"commentrss";s:72:"http://wordpress.org/development/2009/10/plugin-compatibility-beta/feed/";}s:5:"slash";a:1:{s:8:"comments";s:1:"4";}s:7:"summary";s:351:"The number one reason people give us for not upgrading to the latest version of WordPress is fear that their plugins won&#8217;t be compatible. As part of our continuing efforts to make WordPress core, plugin, and theme upgrades as painless as possible, Michael Adams developed and launched a beta of a new &#8220;Compatibility&#8221; feature in [...]";s:12:"atom_content";s:3193:"<p>The number one reason people give us for not upgrading to the latest version of WordPress is fear that their plugins won&#8217;t be compatible. As part of our continuing efforts to make WordPress core, plugin, and theme upgrades as painless as possible, Michael Adams developed and launched a beta of a new &#8220;Compatibility&#8221; feature in the plugin directory, powered by your votes. When viewing a plugin in the directory, select a WordPress version and a plugin version from the drop-downs. If there has been feedback about this WordPress / plugin version combination, we&#8217;ll show you what percentage of responses marked that combination as compatible vs how many marked it as incompatible.</p>
<p><img src="http://markjaquith.wordpress.com/files/2009/10/compatibility-viewing.png" alt="Compatibility: Your Setup: (WordPress Version drop-down) (Plugin Version drop-down). Log in to vote. The Concensus: 44% negative, 56% positive" title="Compatibility viewing" width="220" height="254" class="alignnone size-full wp-image-365" /></p>
<p>If you log in, you&#8217;ll be able to help us gather this information! Just select a WordPress version / plugin version combination and click the &#8220;Works&#8221; or the &#8220;Broken&#8221; button. Please note that this shouldn&#8217;t be used to report minor issues with a plugin. You should mark a plugin as &#8220;Broken&#8221; only if its core functionality is truly broken when run on the specified WordPress version.</p>
<p><img src="http://markjaquith.wordpress.com/files/2009/10/compatibility-voting.png" alt="Compatibility: Your Setup: (WordPress Version drop-down) (Plugin Version drop-down). (Broken button) (Works button). The Concensus: No data" title="Compatibility voting" width="227" height="276" class="alignnone size-full wp-image-366" /></p>
<p>Right now we&#8217;re just in information gathering mode. So get out there and vote! Don&#8217;t just vote on broken plugins&#8230; cast a &#8220;Works&#8221; vote for every plugin that works on the version of WordPress you are using. This can help improve the signal-to-noise ratio in our data and prevent a few mistaken &#8220;Broken&#8221; votes from weighing too heavily.</p>
<p>For developers, we&#8217;re now including this data in our API. The <code>plugin_information</code> action now returns a &#8220;compatibility&#8221; member with the multidimensional array format:</p>
<p><code>array( {WP version} => array( {plugin version} => array( {% of reporters who say it works}, {# responses} ) ) )</code></p>
<p>If the API knows which version of WordPress you are using (for example, if you are making this query using the <code>plugins_api()</code> function from with WordPress), the API will only return compatibility information for your version of WordPress.</p>
<p>Eventually, we&#8217;d like to gather this compatibility feedback from within WordPress, allowing you to vote directly from your plugins admin screen. The ultimate goal is to use this information to inform you of plugin incompatibilities with a new version of WordPress during the upgrade process. For that to be useful we need a large set of high quality compatibility data. Start voting!</p>
";}i:5;a:13:{s:5:"title";s:34:"WordPress 2.8.5: Hardening Release";s:4:"link";s:75:"http://wordpress.org/development/2009/10/wordpress-2-8-5-hardening-release/";s:8:"comments";s:84:"http://wordpress.org/development/2009/10/wordpress-2-8-5-hardening-release/#comments";s:7:"pubdate";s:31:"Tue, 20 Oct 2009 23:30:00 +0000";s:2:"dc";a:1:{s:7:"creator";s:14:"Peter Westwood";}s:8:"category";s:16:"ReleasesSecurity";s:4:"guid";s:39:"http://wordpress.org/development/?p=935";s:11:"description";s:313:"As you know over the past couple of months we have been working on the new features for WordPress 2.9. We have also been working on trying to make WordPress as secure as possible and during this process we have identified a number of security hardening changes that we thought were worth back-porting to the [...]";s:7:"content";a:1:{s:7:"encoded";s:1610:"<p>As you know over the past couple of months we have been working on the new features for WordPress 2.9. We have also been working on trying to make WordPress as secure as possible and during this process we have identified a number of security hardening changes that we thought were worth back-porting to the 2.8 branch so as to get these improvements out there and make all your sites as secure as possible.</p>
<p>The headline changes in this release are:</p>
<ul>
<li>A fix for the Trackback Denial-of-Service attack that is currently being seen.</li>
<li>Removal of areas within the code where php code in variables was evaluated.</li>
<li>Switched the file upload functionality to be whitelisted for all users including Admins.</li>
<li>Retiring of the two importers of Tag data from old plugins.</li>
</ul>
<p>We would recommend that all sites are upgraded to this new version of WordPress to ensure that you have the best available protection.</p>
<p>If you think your site may have been hit by one of the recent exploits and you would like to make sure that you have cleared out all traces of the exploit then we would recommend that you take a look at the <a href="http://wordpress.org/extend/plugins/exploit-scanner/">WordPress Exploit Scanner</a>.  This is a plugin which searches the files on your website, and the posts and comments tables of your database for anything suspicious. It also examines your list of active plugins for unusual filenames.  You can read more about this plugin here &#8211; &#8220;<a href="http://ocaoimh.ie/exploit-scanner/">WordPress Exploit Scanner</a>&#8220;</p>
";}s:3:"wfw";a:1:{s:10:"commentrss";s:80:"http://wordpress.org/development/2009/10/wordpress-2-8-5-hardening-release/feed/";}s:5:"slash";a:1:{s:8:"comments";s:3:"289";}s:7:"summary";s:313:"As you know over the past couple of months we have been working on the new features for WordPress 2.9. We have also been working on trying to make WordPress as secure as possible and during this process we have identified a number of security hardening changes that we thought were worth back-porting to the [...]";s:12:"atom_content";s:1610:"<p>As you know over the past couple of months we have been working on the new features for WordPress 2.9. We have also been working on trying to make WordPress as secure as possible and during this process we have identified a number of security hardening changes that we thought were worth back-porting to the 2.8 branch so as to get these improvements out there and make all your sites as secure as possible.</p>
<p>The headline changes in this release are:</p>
<ul>
<li>A fix for the Trackback Denial-of-Service attack that is currently being seen.</li>
<li>Removal of areas within the code where php code in variables was evaluated.</li>
<li>Switched the file upload functionality to be whitelisted for all users including Admins.</li>
<li>Retiring of the two importers of Tag data from old plugins.</li>
</ul>
<p>We would recommend that all sites are upgraded to this new version of WordPress to ensure that you have the best available protection.</p>
<p>If you think your site may have been hit by one of the recent exploits and you would like to make sure that you have cleared out all traces of the exploit then we would recommend that you take a look at the <a href="http://wordpress.org/extend/plugins/exploit-scanner/">WordPress Exploit Scanner</a>.  This is a plugin which searches the files on your website, and the posts and comments tables of your database for anything suspicious. It also examines your list of active plugins for unusual filenames.  You can read more about this plugin here &#8211; &#8220;<a href="http://ocaoimh.ie/exploit-scanner/">WordPress Exploit Scanner</a>&#8220;</p>
";}i:6;a:13:{s:5:"title";s:42:"Getting involved with the 2.9 beta testing";s:4:"link";s:84:"http://wordpress.org/development/2009/10/getting-involved-with-the-2-9-beta-testing/";s:8:"comments";s:93:"http://wordpress.org/development/2009/10/getting-involved-with-the-2-9-beta-testing/#comments";s:7:"pubdate";s:31:"Mon, 12 Oct 2009 22:16:09 +0000";s:2:"dc";a:1:{s:7:"creator";s:14:"Peter Westwood";}s:8:"category";s:25:"Development2.9betatesting";s:4:"guid";s:39:"http://wordpress.org/development/?p=922";s:11:"description";s:292:"We have been hard at work now for a few months on the new features that will be coming in WordPress 2.9, and we are near the time when the first beta version will be available. We&#8217;ll need your help with beta testing the new features and ironing out any bugs.
There are a number of [...]";s:7:"content";a:1:{s:7:"encoded";s:2938:"<p>We have been hard at work now for a few months on the new features that will be coming in WordPress 2.9, and we are near the time when the first beta version will be available. We&#8217;ll need your help with beta testing the new features and ironing out any bugs.</p>
<p>There are a number of different ways in which you can get involved in the testing process, and each way is suited for each persons skill set and comfort level.  First of all, you can join the <a href="http://codex.wordpress.org/Mailing_Lists#Testers">wp-testers</a> mailing list to keep up to date with the testing progress and to discuss things with the other testers.  Secondly, you can head over to the <a href="http://core.trac.wordpress.org/">Trac ticketing system</a> and either create tickets for bugs you find or <a href="https://core.trac.wordpress.org/milestone/2.9">use some of the useful searches</a> to look for patches that need testing or that need someone to try and reproduce the issue.</p>
<p>During the beta phase we are going to focus on stabilizing the new features and removing existing bugs which are well-understood and have easily testable solutions.  During this process we will not be adding any new enhancements so as to ensure that the focus is on making the 2.9 release as bug-free as possible.  We will also try and have a few special bug hunt days where one or more experienced WordPress developers will be available to help people track down issues and get patches committed to fix bugs.</p>
<p>To make is as easy as possible for you to get a beta testing install up and running we have put together a small WordPress plugin which makes it really easy to convert a test install of the latest release version of WordPress into a beta test install of the next up and coming release.  The plugin is called <a href="http://wordpress.org/extend/plugins/wordpress-beta-tester/">WordPress Beta Tester</a> and is available to download from WordPress Extend or can be installed using the built-in plugin installer.  Please make sure you to only install this plugin on a test site. We do not recommend running beta versions on your normal, live sites in case anything goes wrong.  You can read more about the plugin in &#8220;<a href="http://westi.wordpress.com/2009/06/22/making-it-easy-to-be-a-wordpress-tester/">Making it easy to be a WordPress Tester</a>&#8221;</p>
<p>We are aiming to release the first beta version of 2.9 around the end of October, after we have put the finishing touches on the new features. Then we switch to full on beta testing mode and your help and feedback will be very much appreciated.  During the beta test program will push out new builds for automated upgrades regularly. Once we feel that a suitable level of stability has been achieved we will move into the release candidate phase. We hope to be able to make the final release 2.9 build available in either late November or early December.</p>
";}s:3:"wfw";a:1:{s:10:"commentrss";s:89:"http://wordpress.org/development/2009/10/getting-involved-with-the-2-9-beta-testing/feed/";}s:5:"slash";a:1:{s:8:"comments";s:2:"72";}s:7:"summary";s:292:"We have been hard at work now for a few months on the new features that will be coming in WordPress 2.9, and we are near the time when the first beta version will be available. We&#8217;ll need your help with beta testing the new features and ironing out any bugs.
There are a number of [...]";s:12:"atom_content";s:2938:"<p>We have been hard at work now for a few months on the new features that will be coming in WordPress 2.9, and we are near the time when the first beta version will be available. We&#8217;ll need your help with beta testing the new features and ironing out any bugs.</p>
<p>There are a number of different ways in which you can get involved in the testing process, and each way is suited for each persons skill set and comfort level.  First of all, you can join the <a href="http://codex.wordpress.org/Mailing_Lists#Testers">wp-testers</a> mailing list to keep up to date with the testing progress and to discuss things with the other testers.  Secondly, you can head over to the <a href="http://core.trac.wordpress.org/">Trac ticketing system</a> and either create tickets for bugs you find or <a href="https://core.trac.wordpress.org/milestone/2.9">use some of the useful searches</a> to look for patches that need testing or that need someone to try and reproduce the issue.</p>
<p>During the beta phase we are going to focus on stabilizing the new features and removing existing bugs which are well-understood and have easily testable solutions.  During this process we will not be adding any new enhancements so as to ensure that the focus is on making the 2.9 release as bug-free as possible.  We will also try and have a few special bug hunt days where one or more experienced WordPress developers will be available to help people track down issues and get patches committed to fix bugs.</p>
<p>To make is as easy as possible for you to get a beta testing install up and running we have put together a small WordPress plugin which makes it really easy to convert a test install of the latest release version of WordPress into a beta test install of the next up and coming release.  The plugin is called <a href="http://wordpress.org/extend/plugins/wordpress-beta-tester/">WordPress Beta Tester</a> and is available to download from WordPress Extend or can be installed using the built-in plugin installer.  Please make sure you to only install this plugin on a test site. We do not recommend running beta versions on your normal, live sites in case anything goes wrong.  You can read more about the plugin in &#8220;<a href="http://westi.wordpress.com/2009/06/22/making-it-easy-to-be-a-wordpress-tester/">Making it easy to be a WordPress Tester</a>&#8221;</p>
<p>We are aiming to release the first beta version of 2.9 around the end of October, after we have put the finishing touches on the new features. Then we switch to full on beta testing mode and your help and feedback will be very much appreciated.  During the beta test program will push out new builds for automated upgrades regularly. Once we feel that a suitable level of stability has been achieved we will move into the release candidate phase. We hope to be able to make the final release 2.9 build available in either late November or early December.</p>
";}i:7;a:13:{s:5:"title";s:28:"How to Keep WordPress Secure";s:4:"link";s:63:"http://wordpress.org/development/2009/09/keep-wordpress-secure/";s:8:"comments";s:72:"http://wordpress.org/development/2009/09/keep-wordpress-secure/#comments";s:7:"pubdate";s:31:"Sat, 05 Sep 2009 19:22:03 +0000";s:2:"dc";a:1:{s:7:"creator";s:4:"Matt";}s:8:"category";s:19:"DevelopmentSecurity";s:4:"guid";s:39:"http://wordpress.org/development/?p=908";s:11:"description";s:301:"A stitch in time saves nine. I couldn&#8217;t sew my way out of a bag, but it&#8217;s true advice for bloggers as well &#8212; a little bit of work on an upgrade now saves a lot of work fixing something later.
Right now there is a worm making its way around old, unpatched versions of WordPress. [...]";s:7:"content";a:1:{s:7:"encoded";s:6131:"<p>A stitch in time saves nine. I couldn&#8217;t sew my way out of a bag, but it&#8217;s true advice for bloggers as well &#8212; a little bit of work on an <a href="http://codex.wordpress.org/Upgrading_WordPress">upgrade now</a> saves a lot of work fixing something later.</p>
<p>Right now there is a worm making its way around old, unpatched versions of WordPress. This particular worm, like many before it, is clever: it registers a user, uses a security bug (fixed earlier in the year) to allow evaluated code to be executed through the permalink structure, makes itself an admin, then uses JavaScript to hide itself when you look at users page, attempts to clean up after itself, then goes quiet so you never notice while it inserts hidden spam and malware into your old posts.</p>
<p>The tactics are new, but the strategy is not. Where this particular worm messes up is in the &#8220;clean up&#8221; phase: it doesn&#8217;t hide itself well and the blogger notices that all his links are broken, which causes him to dig deeper and notice the extent of the damage. Where worms of old would do childish things like defacing your site, the new ones are silent and invisible, so you only notice them when they screw up (as this one did) or your site gets removed from Google for having spam and malware on it.</p>
<p>I&#8217;m talking about this not to scare you, but to highlight that this is something that has happened before, and that will more than likely happen again.</p>
<p>A stitch in time saves nine. <a href="http://codex.wordpress.org/Upgrading_WordPress">Upgrading is a known quantity of work</a>, and one that the WordPress community has tried its darndest to make as easy as possible with one-click upgrades. <a href="http://codex.wordpress.org/FAQ_My_site_was_hacked">Fixing a hacked blog, on the other hand, is quite hard</a>. Upgrading is taking your vitamins; fixing a hack is open heart surgery. (This is true of cost, as well.)</p>
<p>2.8.4, the current version of WordPress, is immune to this worm. (<em>So was the release before this one.</em>) If you&#8217;ve been thinking about upgrading but haven&#8217;t gotten around to it yet, now would be a really good time. If you&#8217;ve already upgraded your blogs, maybe check out the blogs of your friends or that you read and see if they need any help. A stitch in time saves nine.</p>
<p>Whenever a worm makes the rounds, everyone becomes a security expert and peddles one of three types of advice: snake oil, Club solutions, or real solutions. Snake oil you&#8217;ll be able to spot right away because it&#8217;s <em>easy</em>. Hide the WordPress version, they say, and you&#8217;ll be fine. Uh, duh, the worm writers thought of that. Where their 1.0 might have checked for version numbers, 2.0 just tests capabilities, version number be damned. </p>
<p>The second type of advice is Club solutions; to illustrate, I&#8217;ll quote from <a href="http://diveintomark.org/archives/2002/10/29/club_vs_lojack_solutions">Mark Pilgrim&#8217;s excellent essay on spam 7 years ago, before WordPress even existed</a>:</p>
<blockquote><p>The <em>really</em> interesting thing about these approaches, from a game theory perspective, is that they are all <a href="http://slate.msn.com/?id=2041" title="Slate, August 3, 1997: Property Is Theft: When protecting your own property is stealing from others">Club solutions, not Lojack solutions</a>.  There are two basic approaches to protecting your car from theft: <a href="http://www.theclub.com/">The Club</a> (or The Shield, or a car alarm, or something similar), and <a href="http://www.lojack.com/">Lojack</a>.  The Club isn’t much protection against a thief who is determined to steal <em>your</em> car (it’s easy enough to drill the lock, or just cut the steering wheel and slide The Club off).  But it is effective protection against a thief who wants to steal <em>a</em> car (not necessarily <em>your</em> car), because thieves are generally in a hurry and will go for the easiest target, the low-hanging fruit.  The Club works as long as not everyone has it, since if everyone had it, thieves would have an equally difficult time stealing any car, their choice will be based on other factors, and your car is back to being as vulnerable as anyone else&#8217;s.  The Club doesn’t deter theft, it only deflects it.</p></blockquote>
<p>Club blog security solutions can be simple (like an .htaccess file) or incredibly complex (like two-factor authentication), and they can work, especially for <em>known exploits</em>. Club solutions can be useful, like using a strong or complex password for your login &#8212; no one would recommend against that. (Another club solution is switching to less-used software on the assumption or more like the software&#8217;s claim that it&#8217;s perfect and more secure. This is why BeOS is more secure than Linux, ahem.)</p>
<p>In the car world, if someone figured out how to teleport entire cars to chop shops, The Club wouldn&#8217;t be so useful anymore. Luckily for manufacturers of The Club, this hasn&#8217;t happened. Online and in the software world, though, the equivalent happens almost daily. There is only one real solution. <strong>The only thing that I can promise will keep your blog secure today and in the future is upgrading.</strong></p>
<p>WordPress is a community of hundreds of people that read the code every day, audit it, update it, and care enough about keeping your blog safe that we do things like release updates weeks apart from each other even though it makes us look bad, because updating is going to keep your blog safe from the bad guys. I&#8217;m not clairvoyant and I can&#8217;t predict what schemes spammers, hackers, crackers, and tricksters will come up with with in the future to harm your blog, but I do know for certain that as long as WordPress is around we&#8217;ll do everything in our power to make sure the software is safe. We&#8217;ve already made upgrading core and plugins a one-click procedure. If we find something broken, we&#8217;ll release a fix. Please upgrade, it&#8217;s the only way we can help each other.</p>
";}s:3:"wfw";a:1:{s:10:"commentrss";s:68:"http://wordpress.org/development/2009/09/keep-wordpress-secure/feed/";}s:5:"slash";a:1:{s:8:"comments";s:3:"451";}s:7:"summary";s:301:"A stitch in time saves nine. I couldn&#8217;t sew my way out of a bag, but it&#8217;s true advice for bloggers as well &#8212; a little bit of work on an upgrade now saves a lot of work fixing something later.
Right now there is a worm making its way around old, unpatched versions of WordPress. [...]";s:12:"atom_content";s:6131:"<p>A stitch in time saves nine. I couldn&#8217;t sew my way out of a bag, but it&#8217;s true advice for bloggers as well &#8212; a little bit of work on an <a href="http://codex.wordpress.org/Upgrading_WordPress">upgrade now</a> saves a lot of work fixing something later.</p>
<p>Right now there is a worm making its way around old, unpatched versions of WordPress. This particular worm, like many before it, is clever: it registers a user, uses a security bug (fixed earlier in the year) to allow evaluated code to be executed through the permalink structure, makes itself an admin, then uses JavaScript to hide itself when you look at users page, attempts to clean up after itself, then goes quiet so you never notice while it inserts hidden spam and malware into your old posts.</p>
<p>The tactics are new, but the strategy is not. Where this particular worm messes up is in the &#8220;clean up&#8221; phase: it doesn&#8217;t hide itself well and the blogger notices that all his links are broken, which causes him to dig deeper and notice the extent of the damage. Where worms of old would do childish things like defacing your site, the new ones are silent and invisible, so you only notice them when they screw up (as this one did) or your site gets removed from Google for having spam and malware on it.</p>
<p>I&#8217;m talking about this not to scare you, but to highlight that this is something that has happened before, and that will more than likely happen again.</p>
<p>A stitch in time saves nine. <a href="http://codex.wordpress.org/Upgrading_WordPress">Upgrading is a known quantity of work</a>, and one that the WordPress community has tried its darndest to make as easy as possible with one-click upgrades. <a href="http://codex.wordpress.org/FAQ_My_site_was_hacked">Fixing a hacked blog, on the other hand, is quite hard</a>. Upgrading is taking your vitamins; fixing a hack is open heart surgery. (This is true of cost, as well.)</p>
<p>2.8.4, the current version of WordPress, is immune to this worm. (<em>So was the release before this one.</em>) If you&#8217;ve been thinking about upgrading but haven&#8217;t gotten around to it yet, now would be a really good time. If you&#8217;ve already upgraded your blogs, maybe check out the blogs of your friends or that you read and see if they need any help. A stitch in time saves nine.</p>
<p>Whenever a worm makes the rounds, everyone becomes a security expert and peddles one of three types of advice: snake oil, Club solutions, or real solutions. Snake oil you&#8217;ll be able to spot right away because it&#8217;s <em>easy</em>. Hide the WordPress version, they say, and you&#8217;ll be fine. Uh, duh, the worm writers thought of that. Where their 1.0 might have checked for version numbers, 2.0 just tests capabilities, version number be damned. </p>
<p>The second type of advice is Club solutions; to illustrate, I&#8217;ll quote from <a href="http://diveintomark.org/archives/2002/10/29/club_vs_lojack_solutions">Mark Pilgrim&#8217;s excellent essay on spam 7 years ago, before WordPress even existed</a>:</p>
<blockquote><p>The <em>really</em> interesting thing about these approaches, from a game theory perspective, is that they are all <a href="http://slate.msn.com/?id=2041" title="Slate, August 3, 1997: Property Is Theft: When protecting your own property is stealing from others">Club solutions, not Lojack solutions</a>.  There are two basic approaches to protecting your car from theft: <a href="http://www.theclub.com/">The Club</a> (or The Shield, or a car alarm, or something similar), and <a href="http://www.lojack.com/">Lojack</a>.  The Club isn’t much protection against a thief who is determined to steal <em>your</em> car (it’s easy enough to drill the lock, or just cut the steering wheel and slide The Club off).  But it is effective protection against a thief who wants to steal <em>a</em> car (not necessarily <em>your</em> car), because thieves are generally in a hurry and will go for the easiest target, the low-hanging fruit.  The Club works as long as not everyone has it, since if everyone had it, thieves would have an equally difficult time stealing any car, their choice will be based on other factors, and your car is back to being as vulnerable as anyone else&#8217;s.  The Club doesn’t deter theft, it only deflects it.</p></blockquote>
<p>Club blog security solutions can be simple (like an .htaccess file) or incredibly complex (like two-factor authentication), and they can work, especially for <em>known exploits</em>. Club solutions can be useful, like using a strong or complex password for your login &#8212; no one would recommend against that. (Another club solution is switching to less-used software on the assumption or more like the software&#8217;s claim that it&#8217;s perfect and more secure. This is why BeOS is more secure than Linux, ahem.)</p>
<p>In the car world, if someone figured out how to teleport entire cars to chop shops, The Club wouldn&#8217;t be so useful anymore. Luckily for manufacturers of The Club, this hasn&#8217;t happened. Online and in the software world, though, the equivalent happens almost daily. There is only one real solution. <strong>The only thing that I can promise will keep your blog secure today and in the future is upgrading.</strong></p>
<p>WordPress is a community of hundreds of people that read the code every day, audit it, update it, and care enough about keeping your blog safe that we do things like release updates weeks apart from each other even though it makes us look bad, because updating is going to keep your blog safe from the bad guys. I&#8217;m not clairvoyant and I can&#8217;t predict what schemes spammers, hackers, crackers, and tricksters will come up with with in the future to harm your blog, but I do know for certain that as long as WordPress is around we&#8217;ll do everything in our power to make sure the software is safe. We&#8217;ve already made upgrading core and plugins a one-click procedure. If we find something broken, we&#8217;ll release a fix. Please upgrade, it&#8217;s the only way we can help each other.</p>
";}i:8;a:13:{s:5:"title";s:33:"WordPress 2.8.4: Security Release";s:4:"link";s:64:"http://wordpress.org/development/2009/08/2-8-4-security-release/";s:8:"comments";s:73:"http://wordpress.org/development/2009/08/2-8-4-security-release/#comments";s:7:"pubdate";s:31:"Wed, 12 Aug 2009 01:41:54 +0000";s:2:"dc";a:1:{s:7:"creator";s:4:"Matt";}s:8:"category";s:16:"ReleasesSecurity";s:4:"guid";s:39:"http://wordpress.org/development/?p=903";s:11:"description";s:329:"Yesterday a vulnerability was discovered: a specially crafted URL could be requested that would allow an attacker to bypass a security check to verify a user requested a password reset. As a result, the first account without a key in the database (usually the admin account) would have its password reset and a new password [...]";s:7:"content";a:1:{s:7:"encoded";s:724:"<p>Yesterday a vulnerability was discovered: a specially crafted URL could be requested that would allow an attacker to bypass a security check to verify a user requested a password reset. As a result, the first account without a key in the database (usually the admin account) would have its password reset and a new password would be emailed to the account owner. This doesn&#8217;t allow remote access, but it is very annoying.</p>
<p>We fixed this problem last night and have been testing the fixes and looking for other problems since then. <a href="http://wordpress.org/download/">Version 2.8.4 which fixes all known problems is now available for download</a> and is highly recommended for all users of WordPress.</p>
";}s:3:"wfw";a:1:{s:10:"commentrss";s:69:"http://wordpress.org/development/2009/08/2-8-4-security-release/feed/";}s:5:"slash";a:1:{s:8:"comments";s:3:"392";}s:7:"summary";s:329:"Yesterday a vulnerability was discovered: a specially crafted URL could be requested that would allow an attacker to bypass a security check to verify a user requested a password reset. As a result, the first account without a key in the database (usually the admin account) would have its password reset and a new password [...]";s:12:"atom_content";s:724:"<p>Yesterday a vulnerability was discovered: a specially crafted URL could be requested that would allow an attacker to bypass a security check to verify a user requested a password reset. As a result, the first account without a key in the database (usually the admin account) would have its password reset and a new password would be emailed to the account owner. This doesn&#8217;t allow remote access, but it is very annoying.</p>
<p>We fixed this problem last night and have been testing the fixes and looking for other problems since then. <a href="http://wordpress.org/download/">Version 2.8.4 which fixes all known problems is now available for download</a> and is highly recommended for all users of WordPress.</p>
";}i:9;a:13:{s:5:"title";s:18:"Upcoming WordCamps";s:4:"link";s:62:"http://wordpress.org/development/2009/08/upcoming-wordcamps-2/";s:8:"comments";s:71:"http://wordpress.org/development/2009/08/upcoming-wordcamps-2/#comments";s:7:"pubdate";s:31:"Fri, 07 Aug 2009 01:07:03 +0000";s:2:"dc";a:1:{s:7:"creator";s:10:"Jane Wells";}s:8:"category";s:11:"Development";s:4:"guid";s:39:"http://wordpress.org/development/?p=899";s:11:"description";s:322:"Every now and then I see someone ask in the dev channel how they can meet up with other local WordPress developers. We&#8217;re thinking about ways to make WordPress.org more of a resource to facilitate local connections, but in the meantime, I thought it might be helpful to publicize some  upcoming  WordCamps, the [...]";s:7:"content";a:1:{s:7:"encoded";s:2708:"<p>Every now and then I see someone ask in the dev channel how they can meet up with other local WordPress developers. We&#8217;re thinking about ways to make WordPress.org more of a resource to facilitate local connections, but in the meantime, I thought it might be helpful to publicize some <a href="http://central.wordcamp.org/schedule/"> upcoming  WordCamps</a>, the weekend conferences organized by local communities to talk about all things WordPress. </p>
<p><strong><a href="http://wordcamp.org.nz">WordCamp New Zealand</a>:</strong> Wellington, New Zealand, August 8-9, 2009</p>
<p><strong><a href="http://wordcamphsv.org/">WordCamp Huntsville</a>:</strong> Huntsville, Alabama, USA, August 15–16, 2009</p>
<p><strong><a href="http://la.wordcamp.org/">WordCamp Los Angeles</a>:</strong> Los Angeles, California, USA, September 12, 2009</p>
<p><strong><a href="http://wordcamp.ph">WordCamp Philippines</a>: </strong>Makati City, Philippines, September 19, 2009</p>
<p><strong><a href="http://www.wordcampportland.org/">WordCamp Portland</a>: </strong>Portland, Oregon, USA, September 19-20, 2009 <em>(Last year&#8217;s PDX WordCamp was awesome, IMO.)</em></p>
<p><strong><a href="http://www.wordcampseattle.com/">WordCamp Seattle</a>: </strong>Seattle, Washington, USA, September 26, 2009</p>
<p><strong><a href="http://wordcampbirmingham.org/">WordCamp Birmingham</a>:</strong> Birmingham, Alabama, USA, September 26-27, 2009</p>
<p><strong><a href="http://wordcampnl.org/">WordCamp Netherlands</a>:</strong> Utrecht, Netherlands, October 31, 2009</p>
<p><strong><a href="http://2009.newyork.wordcamp.org/">WordCamp NYC</a>:</strong> New York, New York, USA, November 14-15, 2009 <em>(<a href="http://2009.newyork.wordcamp.org/2009/07/24/logo-contest-again/">Logo contest in progress</a>!)</em></p>
<p><strong><a href="http://wordcampmexico.wordpress.com">WordCamp Mexico</a>:</strong> Mexico City, Mexico, November 20, 2009</p>
<p>If any of these are within a reasonable distance to you, consider attending. WordCamps are a great way to meet other WordPress users, find collaborators, and expand your t-shirt collection*. I know I&#8217;ll be hitting at least a few of these; WordCamps are also a great way to get user feedback to take into consideration while we&#8217;re making decisions about what to include in core. </p>
<p>You can always find an up-to-date list of upcoming WordCamps at <a href="http://central.wordcamp.org/">WordCamp Central</a>. You can also try searching for WordPress groups at <a href="http://www.meetup.com/">Meetup.com</a> to find more regular monthly gatherings in your area. </p>
<p>*<em>Most WordCamps include an event t-shirt in the registration fee. </em></p>
";}s:3:"wfw";a:1:{s:10:"commentrss";s:67:"http://wordpress.org/development/2009/08/upcoming-wordcamps-2/feed/";}s:5:"slash";a:1:{s:8:"comments";s:2:"13";}s:7:"summary";s:322:"Every now and then I see someone ask in the dev channel how they can meet up with other local WordPress developers. We&#8217;re thinking about ways to make WordPress.org more of a resource to facilitate local connections, but in the meantime, I thought it might be helpful to publicize some  upcoming  WordCamps, the [...]";s:12:"atom_content";s:2708:"<p>Every now and then I see someone ask in the dev channel how they can meet up with other local WordPress developers. We&#8217;re thinking about ways to make WordPress.org more of a resource to facilitate local connections, but in the meantime, I thought it might be helpful to publicize some <a href="http://central.wordcamp.org/schedule/"> upcoming  WordCamps</a>, the weekend conferences organized by local communities to talk about all things WordPress. </p>
<p><strong><a href="http://wordcamp.org.nz">WordCamp New Zealand</a>:</strong> Wellington, New Zealand, August 8-9, 2009</p>
<p><strong><a href="http://wordcamphsv.org/">WordCamp Huntsville</a>:</strong> Huntsville, Alabama, USA, August 15–16, 2009</p>
<p><strong><a href="http://la.wordcamp.org/">WordCamp Los Angeles</a>:</strong> Los Angeles, California, USA, September 12, 2009</p>
<p><strong><a href="http://wordcamp.ph">WordCamp Philippines</a>: </strong>Makati City, Philippines, September 19, 2009</p>
<p><strong><a href="http://www.wordcampportland.org/">WordCamp Portland</a>: </strong>Portland, Oregon, USA, September 19-20, 2009 <em>(Last year&#8217;s PDX WordCamp was awesome, IMO.)</em></p>
<p><strong><a href="http://www.wordcampseattle.com/">WordCamp Seattle</a>: </strong>Seattle, Washington, USA, September 26, 2009</p>
<p><strong><a href="http://wordcampbirmingham.org/">WordCamp Birmingham</a>:</strong> Birmingham, Alabama, USA, September 26-27, 2009</p>
<p><strong><a href="http://wordcampnl.org/">WordCamp Netherlands</a>:</strong> Utrecht, Netherlands, October 31, 2009</p>
<p><strong><a href="http://2009.newyork.wordcamp.org/">WordCamp NYC</a>:</strong> New York, New York, USA, November 14-15, 2009 <em>(<a href="http://2009.newyork.wordcamp.org/2009/07/24/logo-contest-again/">Logo contest in progress</a>!)</em></p>
<p><strong><a href="http://wordcampmexico.wordpress.com">WordCamp Mexico</a>:</strong> Mexico City, Mexico, November 20, 2009</p>
<p>If any of these are within a reasonable distance to you, consider attending. WordCamps are a great way to meet other WordPress users, find collaborators, and expand your t-shirt collection*. I know I&#8217;ll be hitting at least a few of these; WordCamps are also a great way to get user feedback to take into consideration while we&#8217;re making decisions about what to include in core. </p>
<p>You can always find an up-to-date list of upcoming WordCamps at <a href="http://central.wordcamp.org/">WordCamp Central</a>. You can also try searching for WordPress groups at <a href="http://www.meetup.com/">Meetup.com</a> to find more regular monthly gatherings in your area. </p>
<p>*<em>Most WordCamps include an event t-shirt in the registration fee. </em></p>
";}}s:7:"channel";a:8:{s:5:"title";s:26:"WordPress Development Blog";s:4:"link";s:32:"http://wordpress.org/development";s:11:"description";s:33:"WordPress development and updates";s:13:"lastbuilddate";s:31:"Thu, 12 Nov 2009 19:17:20 +0000";s:9:"generator";s:34:"http://wordpress.org/?v=2.9-beta-1";s:8:"language";s:2:"en";s:2:"sy";a:2:{s:12:"updateperiod";s:6:"hourly";s:15:"updatefrequency";s:1:"1";}s:7:"tagline";s:33:"WordPress development and updates";}s:9:"textinput";a:0:{}s:5:"image";a:0:{}s:9:"feed_type";s:3:"RSS";s:12:"feed_version";s:3:"2.0";s:5:"stack";a:0:{}s:9:"inchannel";b:0;s:6:"initem";b:0;s:9:"incontent";b:0;s:11:"intextinput";b:0;s:7:"inimage";b:0;s:13:"current_field";s:0:"";s:17:"current_namespace";b:0;s:19:"_CONTENT_CONSTRUCTS";a:6:{i:0;s:7:"content";i:1;s:7:"summary";i:2;s:4:"info";i:3;s:5:"title";i:4;s:7:"tagline";i:5;s:9:"copyright";}}