Open Channels FM: The Real Challenge of Technological Solutions: Exclusion in the Age of Verification
David Snead, director of the Secure Hosting Alliance and a long-time Internet policy leader, shares his perspective on the complexities that emerge when technological solutions like age verification are implemented in the digital infrastructure space. Dave’s reflection highlights how the push for more secure, regulated environments can unintentionally create barriers for vulnerable or less tech-savvy […]
Otter Blocks 3.2.0: AI Page Building and a New Design Library
Otter Blocks 3.2.0 is now live, bringing AI that builds full sections and pages, a redesigned AI writing toolbar, AI form autoresponders, a completely rebuilt Design Library, a new Content Slider block, more reliable forms, and full WordPress 7.0 support. This release focuses on the slowest part of building in the block editor: getting started…. The post Otter Blocks 3.2.0: AI Page Building and a New Design Library appeared first on Themeisle Blog.
How to Connect AI Agents With WordPress using MCP (Step by Step)
AI assistants like Claude Code, Cowork, and ChatGPT are incredible productivity boosters, and if you wished that you could connect these AI tools with WordPress directly, then you’re not alone. Lately, I have been using WordPress MCP by WPVibe to let my AI assistant manage my website, and it’s truly amazing how much time this saves. You can simply ask it to create a post, upload image, handle admin tasks, and more from a single conversational prompt. In this step by step tutorial, I’ll show you how to connect your favorite AI tools with WordPress using MCP along with sharing a few work examples, so you can see what becomes possible when you combine WordPress + AI. You can use the quick links below to jump to any section: What is a WordPress MCP and What Can It Do? What You Need Before Getting Started Step 1. Set Up MCP on Your WordPress Website Step 2. Connect Your AI Tools to WordPress What You Can Do Once You’re Connected (Worked Examples) Is WordPress MCP Safe? Troubleshooting Connection Issues Frequently Asked Questions About WordPress MCP What is a WordPress MCP and What Can It Do? MCP stands for Model Context Protocol. It is as an open standard that lets AI assistants connect to outside tools and services. Think of it as a universal adapter. Instead of every AI tool building a custom integration with every service, they all speak the same language, so any tool and service that support MCP can work together. With a WordPress MCP, your AI assistant can see what your website supports and carry out tasks from a plain-text prompt. It does this using a connection WordPress already has built in (the REST API), so there’s nothing extra to install. You can use WordPress MCP to manage your WordPress site and perform tasks including: Draft and publish posts – Create blog posts as drafts, set titles, add categories and tags, and publish when you’re ready. Upload media – Pull images from any public URL directly into your WordPress media library. Manage categories and tags – Create or rename taxonomy terms and assign them to posts. Run admin tasks – Flush your site cache, check which plugins are active, and activate or deactivate plugins. Use plugin abilities – On WordPress 6.9+, many plugins register their own actions the AI can discover and run automatically Each of these can be done from a plain-text prompt from your favorite AI tool like Claude Code, Cursor, ChatGPT, etc. I’ll show you the exact prompts once you’re fully set up. What You Need Before Getting Started Self-hosted WordPress 6.9 or later – With the REST API enabled (it’s on by default). You need version 6.9 or later for plugin abilities API which is allows you to use AI to manage plugins like AIOSEO, WPForms, etc. A publicly accessible site – Your site must be reachable on the internet because local development sites won’t work unless exposed via a tunnel. A free WPVibe account — You’ll create this during setup. An HTTPS-enabled site — WordPress application passwords require SSL and they won’t function on http:// sites. See our guide on how to add SSL and HTTPS to WordPress. Step 1. Set Up MCP on Your WordPress Website The easiest way to add MCP to a self-hosted WordPress site is with WPVibe.ai. It’s free and runs on a hosted server, so there’s no infrastructure to configure. It also works with every major AI tool through a single setup. You can read our full WPVibe review for a deeper look at everything it can do, but this guide covers what you need to get connected. Other ways to set this up: There’s also an official WordPress MCP Adapter, which pairs with the new Abilities API in WordPress 6.9, but it’s built for developers and needs manual configuration. Install and Activate the Vibe AI Plugin First, you will need to install and activate the free WPVibe plugin. If you need any help, our guide on how to install a WordPress plugin covers each step. Along with connecting your AI tools, the WPVibe plugin unlocks WP-CLI commands, theme file editing, and the plugin abilities that I talk about later in this guide. Once activated, go to Vibe AI » Vibe AI in your WordPress dashboard. You’ll see the MCP server URL and a three-step setup guide. Keep this tab open. You’ll need the URL in the next step. Step 2. Connect Your AI Tools to WordPress With WPVibe set up, connecting your AI tool takes under a minute. You add the same server URL to any AI client you use: https://mcp.wpvibe.ai/mcp. You’ll find instructions on how to do this in the official WPVibe documentation. But let me show you exactly where to find that setting in some popular AI platforms. Connecting Claude If you’re just getting started, I recommend beginning with Claude. The simplest method is to add the WPVibe URL once via Claude.ai on the web, and it syncs automatically to Claude Desktop, Claude Code, and the Claude mobile apps with no separate setup needed. Note: On Team and Enterprise workspaces, only an Owner or Admin can add connectors. Individual members on those plans can authenticate with WPVibe once the admin has added it, or use the Claude Code method in step 3 below. Free, Pro, and Max plans: In Claude.ai, go to Customize » Connectors. Click the + button, select ‘Add custom connector’, and paste https://mcp.wpvibe.ai/mcp. Team and Enterprise (admin only): Go to Organization settings » Connectors. Click ‘Add’, select Custom » Web, and paste the WPVibe URL. Claude Code (any plan): In your terminal, run claude mcp add –scope user wpvibe –transport http https://mcp.wpvibe.ai/mcp. Then, open Claude Code, type /mcp, select wpvibe, and choose ‘Authenticate’. Once saved, follow the on-screen prompt to authorize your WordPress site. Connecting ChatGPT WPVibe is available directly in the ChatGPT App Marketplace, so both free and paid users can connect without copying server URLs or editing config files.
Dennis Snell: See DATA, CDATA, RCDATA, and PCDATA oh my!
HTML and XML are markup languages based on plaintext files. This means that any given character could be part of a syntax form (a tag, a comment, a character reference, etc…) or it could be representing itself the way it reads in the file literally. <tag>· Text node</tag> Whenever a character might be ambiguous, both languages require explicit indication of the intent of the character. In HTML this occurs via escaping, while XML allows escaping or wrapping the content in a marked section, specifically a CDATA section. <tag><![CDATA[<tag>· Text node</tag>]]> These terms confuse me at times, especially since CDATA and CDATA sections are distinct forms of the same content, and it’s easy to conflate each term. This post is here to disambiguate the terms, their meanings, and why they exist. The punchline comes at the end, but the story is hopefully worth the read. Markup and mixed content One of the first jobs of a parser for any plaintext-oriented format is to determine if the next input character represents real text or is part of a syntax form that carries special meaning. If it’s a syntax form we would call it markup, but if the characters are part of real text meant for display or rendering or reading then we call it data. Anything that is not syntax is data. The interpretation of the next character depends on the region of the document in which it’s parsed. While the rules for syntax forms are complicated1, this post will focus on the data forms. PCDATA — “parsed character data” May form: tags, comments, sections, character references, literal text. Characters in this region could be data or could form the start of a new markup element. It’s “parsed” because it needs parsing before determining what it represents. The HTML specification renames this to Data, which is simpler and a bit harder to search for. In XML, however, it’s used in a document-type definition (DTD). When an element may contain content — text — its data model must include #PCDATA. Otherwise the only characters allowable within that element are other elements, comments, and whitespace. XML documents are required to be valid SGML documents, so its own specification adopts the terminology from SGML’s. Those who have worked with DTDs might note that elements in XML may contain #PCDATA while attributes contain CDATA instead. First of all, the # is there only to make it explicit that PCDATA is referring to the reserved keyword, rather than a <pcdata> element. Secondly, there’s a good reason for this, which is that attributes can only contain text — they can’t contain other elements of markup. If an attribute value could contain a <span> element, for example, then the attribute value would need to be #PCDATA instead, but this is prevented by design. PCDATA actually contains more than just literal text and elements. In addition to comments, processing instructions, and other node-like syntax, one important feature of PCDATA is the character reference. These make it possible to represent characters that would conflate with syntax (such as ‘<’ — <) or which might be cumbersome to enter on a keyboard (such as ‘§’ — §). When parsing, each character in these sequences neither creates an element nor displays as the text itself; rather, the entire sequence is parsed and translates into the character it refers to. HTML pre-specifies a fixed set of named character references, but any Unicode code point may be referenced by its decimal or hexadecimal numeric index. While XML also allows referencing code points by their index2, it only pre-specifies the five named characters which correspond to its main markup introducers: <, >, &, ‘, and “. In XML, any additional named character references are created through the DTD by defining entities. CDATA — “character data” May form: [character references], literal text. If a character isn’t markup, then it’s character data, which means that it’s representing its literal self or it’s part of a character reference. Once the parser has entered this region it will not create markup elements. CDATA is the most confusable kind of character data; this is because there are many kinds of CDATA that share the same name: XML attributes may contain CDATA, where character references are decoded. XML CDATA sections only contain CDATA, but character references are not decoded. HTML kind of has the same CDATA sections, but only in foreign elements (inlined SVG and MathML elements). SGML elements may be declared to have a CDATA content model, in which case all content until the appropriate closing tag is to be parsed as character data, where character references are not decoded. CDATA sections contain only literal text Many people are familiar with CDATA sections, but it took me far longer to understand them than my intuition led on. They are the vestige of SGML “marked regions” which tell the parser to handle a specific range of bytes in a special way. The CDATA section is one of those, which tells the parser to completely turn off until it reaches ]]>. <![CDATA[literal characters only in here]]> It had other marked sections, however, which served different purposes. <![IGNORE[everything in here is ignored; it doesn’t exist.]]><![INCLUDE[in here things <em>do</em> exist as normal.]]><![RCDATA[read on to learn about RCDATA!]]> The IGNORE and INCLUDE sections may seem strange, since SGML already has comments, and INCLUDE effectively does nothing, but the sections can be marked by replaced entities, making for conditional inclusion which can be overwritten via command-line arguments when invoking the SGML parser. <!ENTITY % review-only “IGNORE”>…<![%review-only;[<aside>Add `-Dreview-only=INCLUDE` when building drafts.This note won’t appear otherwise.</aside>]]> XML only retained CDATA sections from SGML, while HTML never included them. They are useful because they are so easy to parse. All characters inside of them are to be treated as literal text, up until the first occurrence of the terminating ]]>. Unlike elements, the marked sections do not nest. There are no CDATA sections in HTML The Internet is full of discussions about the use of CDATA sections in HTML,
Gutenberg Times: WordPress 7.0.1 Fixes Registration Spam, wp_kses() CSS Corruption, and 7.0 Admin Design Glitches
WordPress 7.0.1 is now available. As the first maintenance release of the 7.0 cycle, it’s strictly a bug-fix release: every included ticket addresses either a regression introduced during 7.0 development or an issue intentionally deferred at the end of the cycle. The release ships fixes for 17 core Trac tickets and 14 Gutenberg PRs. Because this is a maintenance release, sites with automatic background updates enabled will update to 7.0.1 automatically — everyone else should update as soon as possible. Here’s what stands out for each audience. Kudos to release lead Aaron Jorbin and his team for pushing this release over the finish line and getting it into hands of WordPress users quickly. The most important fixes for end users Registration page spam is shut down (#63085). The account registration page could be abused to send “Login details” spam emails from your site. This is arguably the most impactful fix in the release for anyone running a site with open registration — it protects both your users’ inboxes and your domain’s email reputation. The 7.0 admin reskin gets its rough edges sanded off. WordPress 7.0’s refreshed admin design shipped with a handful of visual glitches that this release cleans up: Form elements are now standardized in the mobile viewport (#64999) The image editor’s scale and crop inputs no longer mismatch in size, and the info icon uses the new color scheme (#64937, #65428) The publish settings panel no longer crowds its primary action buttons together (#65286) The Media Library’s loading spinner is properly aligned in the modal filter toolbar, and the search bar no longer jumps position after a search (#65275, #65296) A “black flash” that briefly appeared on wp-admin pages before the interface finished loading is gone (Gutenberg #78493) Emoji behave correctly again. Two related fixes: the emoji detection script is once more printed in the admin (#65310), and certain characters are no longer incorrectly replaced by Twemoji images (#64318). Accessibility improvements to the new revisions experience. The Visual History / Revisions feature introduced in 7.0 receives several accessibility fixes: focus now moves to the revisions slider when entering revisions mode, and changed blocks are marked with a CSS outline as a secondary, non-color indicator — important for users with low vision or color blindness (#65122, Gutenberg #77530, #78393, #79691). The most important fixes for developers wp_kses() no longer corrupts valid CSS (#65270). Since 7.0 RC4, wp_kses() could mangle legitimate background-image: url(…) declarations into a broken style=”)” attribute. If your theme or plugin outputs inline background images through KSES-filtered content, 7.0.1 restores expected behavior — any workarounds you shipped can now be removed. global-styles-inline-css can be dequeued again (#65336). Since 7.0, developers were unable to remove the global styles inline stylesheet. If your build pipeline or performance optimization strips this and re-serves it another way, that control is back. PHP 8.5 compatibility fix in wp_get_attachment_image_src() (#64742). An incorrect array access triggered issues under PHP 8.5. If you’re testing sites on newer PHP versions, this removes one blocker. A removed Navigation function returns as a deprecated shim (Gutenberg #78484). block_core_navigation_submenu_render_submenu_icon() was removed in 7.0, breaking themes and plugins that called it directly. It’s restored as a deprecated shim — but treat this as your migration notice, not a reprieve. Update any code that references it. Editor state management fixes reduce false “unsaved changes” warnings. Two Gutenberg fixes matter here: controlled/mode block changes are now marked non-persistent (#79350), and related navigation entities are no longer dirtied during passive renders (#79000). Together these should mean fewer spurious dirty states and a cleaner undo history — a quality-of-life improvement if you build with template parts and navigation blocks. Block Visibility: “hide everywhere” keeps working after a block opts out of visibility support (#65389). If you register blocks that disable visibility support, previously hidden instances now stay hidden as expected. How to update You can update directly from Dashboard → Updates in your site’s admin, run wp core update with WP-CLI, or download WordPress 7.0.1 from WordPress.org and install it manually. Sites that support automatic background updates for minor releases will begin updating on their own shortly. The full ticket list is available in the release candidate announcement, Trac report 4, and the 7.0.x editor tasks board on GitHub. What’s next: WordPress 7.1 With 7.0.1 out the door, attention turns to the next major release: WordPress 7.1 is scheduled for August 19, 2026. To see what’s planned for the release, check out the Roadmap to 7.1 on the Make WordPress Core blog.
WordPress.org blog: WordPress 7.0.1 Maintenance Release
WordPress 7.0.1 is now available! This minor release includes fixes for 31 bugs throughout Core and the Block Editor, addressing issues affecting multiple areas of WordPress including the block editor, admin ui, and media. For a full list of bug fixes, please refer to the release candidate announcement. WordPress 7.0.1 is a short-cycle maintenance release. The next major version of WordPress will be 7.1; it is scheduled for release on 19 August 2026 at WordCamp US. If you have sites that support automatic background updates, the update process will begin automatically. You can download WordPress 7.0.1 from WordPress.org, or visit your WordPress Dashboard, click “Updates”, and then click “Update Now”. For more information on this release, please visit the HelpHub site. Thank you to these WordPress contributors This release was led by Aaron Jorbin, Brian Haas, Carlos Bravo and Estela Rueda. WordPress 7.0.1 would not have been possible without the contributions of the following people. Their asynchronous coordination to deliver maintenance fixes into a stable release is a testament to the power and capability of the WordPress community. Aaron Jorbin, Abdur Rahman Emon, Abhishek Kumar, Adam Silverstein, Adam Zieliński, Aditya Singh, Aki Hamano, Andrea Fercia, Andrei Draganescu, Andrew Serong, annezazu, Ben Dwyer, Brian Coords, Brian Haas, Carlos Bravo, cogdesign, Dan Luu, Daniel Richards, Darshit Rajyaguru, David Baumwald, Dennis Snell, Dhruvang21, Ella Van Durpe, Erick Wambua, Esteban, Estela Rueda, George Mamadashvili, Greg Ziółkowski, Himanshu Pathak, Hit Bhalodia, Huzaifa Al Mesbah, iflairwebtechnologies, James, Jarda Snajdr, Jb Audras, Joe Dolson, Joen Asmussen, Jon Surrell, Jonathan Desrosiers, Karthikeya Bethu, Khokan Sardar, Lucian R., luismulinari, Mahammad Darvishov, Manhar Barot, Marco Ciampini, Marin Atanasov, Maryam Sultana, Masum, Miguel Fonseca, Miroku, Mohammed Noumaan Ahamed, Mukesh Panchal, Mustafa Bharmal, Nik Tsekouras, Noruzzaman, Ozgur Sar, Peter Wilson, Presskopp, Rahul Kumar, ramonopoly, Riad Benguella, Rishabh Gupta, Roshni Ahuja, Sainath Poojary, Saksham Sharma, SAndrew, Scott Reilly, Sergey Biryukov, siliconforks, Stephen Bernhardt, Swanand M, Takashi Kitajima, Terence Eden, threadi, Tushar Patel, Umesh Nevase, WebMan Design | Oliver Juhas, Weston Ruter, Yogesh Bhutkar, Yusuf Mudagal How to contribute To get involved in WordPress core development, head over to Trac, choose a ticket, and join the conversation in the #core channel. Need help? Check out the Core Contributor Handbook. Props to @jorbin for proofreading.
Open Channels FM: The Paradox of Empowerment in a Disruptive Era
Tech feels wild and unpredictable, yet super empowering. Success now hinges on broad awareness and curiosity, not just deep specialization. Embrace the chaos.
Jonathan Desrosiers: 13 Years Contributing to WordPress
Thirteen years ago today, I received my very first props for contributing to WordPress Core. If my WordPress contribution journey were a person, it would now be a teenager. It’s pretty wild to think about, but I’ve now been contributing to the WordPress project in some way for a third of my life! What is a “prop”? In the WordPress open source project, community participants receive credit for contributing to a given change or deliverable by receiving “props.” Props should be given to all those who contributed to the final commit, whether through patches, refreshed patches, code suggested otherwise, design, writing, user testing, or other significant investments of time and effort. Usernames are parsed for the credits list and WordPress.org profiles. WordPress Core Handbook The names of all the contributors who helped make a specific release possible are collected in the weeks leading up and added to the Credits API, which powers the Credits page in the WordPress dashboard. To date, I have been listed on the Credits page for 24 consecutive releases starting with 4.7, and 29 of the 35 releases overall since my first credited contribution in WordPress 3.6 “Oscar”, alongside 224 other contributors. Every year is a bit different than the last, but I can confidently say that this past year has been significantly different. What it means to develop software or contribute to open source is changing rapidly with advanced AI innovations seemingly every day combined with these tools being accessible to more people than ever before. But throughout all this, one truth holds strong: open source software is more important than ever. Looking Back It seemed only fitting for me to instruct AI to analyze my contribution activity over the last 365 days to try and find anything interesting! Prompt Today is the 13th Anniversary of my first credited contribution to the WordPress project. I try to write a blog post each year to mark the occasion. I’m looking for ideas for this years edition. Please go and read all of my past posts (accessible here at this category feed https://jonathandesrosiers.com/category/contributing-anniversaries/feed) and give me 10-12 ideas for what to focus on this year. You can also look through the other content on my site for other ideas. After you do that, I want you to look at the git history for the wordpress-develop and gutenberg repositories between July 8, 2025 and yesterday (July 7, 2026). I want you to parse the logs to summarize my activity and find some particular ways to analyze the data that are interesting. Be creative! These posts are the most fun when I am able to find some unique insight into a year’s worth of contributions. Results Your year 13 in numbers (Jul 8 2025 → Jul 7 2026) Metric Value Core commits authored & committed 119 (~7% of all 1,707 core commits this cycle) Additional commits crediting you (props received) 97 → ~216 credited touch points in core alone Lines changed +41,746 / −21,940 across 656 file-changes Unique Trac tickets 69 Gutenberg PRs authored 24 (+108 co-authored/credited) Reverts you committed 6 The headline: 80 of your 119 core commits (67%) are “Build/Test Tools.” Add Tests + General and it’s ~80%. You spent year 13 as the plumber of WordPress — CI, build pipeline, dependency stewardship, release infrastructure. The most interesting angles the data surfaced The nocturnal committer. ~50 of your commits land between midnight and 4am. Tuesday (37) and Thursday (31) are your peak days; Saturday is nearly dead (3). The month that didn’t exist. January 2026: zero commits. March 2026: 40. Your cadence is a heartbeat synced to the 6.9 and 7.0 release cycles, not the calendar. The June 30th ritual. You bumped Gutenberg’s pinned hash seven times in a single day (v22.8.0 → v23.4.0) — a whole quarter of catching-up compressed into one sitting. Supply-chain quiet work. Pinning full-length action SHAs, replacing abandoned third-party actions, migrating release logic to a GitHub App, ca-bundle updates — you spent the year hardening the software supply chain nobody thanks you for. Keeping the ancient libraries breathing. lodash, underscore, backbone, getID3, Twemoji — you’re the caretaker of WordPress’s legacy vendored code. Future-proofing the matrix. MySQL 9.5/9.6/9.7, MariaDB 12.1, PHP 8.5 (HEIF/HEIC) — you test tomorrow’s platforms today. A first, quietly historic commit: “Include example for disclosing AI usage” — you helped write core’s early AI-disclosure norms. 10–12 ideas for the year-13 post “The Plumber’s Year: 67% of My Commits Were Infrastructure.” Own the unglamorous. A love letter to build/test/CI work — the contributions that never show up in a release announcement but without which nothing ships. This is your strongest, most authentic angle. “Confessions of a Nocturnal Committer.” Fun, human, data-driven: your midnight-to-4am commit cluster, Tuesday/Thursday peaks, the dead January. Chart your year as a heartbeat and reflect on what it says about maintainer rhythms (and sustainability/burnout). “216 Times.” Companion to your 2024 props post, flipped: this year you received credit ~216 times in core (119 committed + 97 propped). Explore the two halves of a committer’s fingerprint — the work you land yourself vs. the work you shepherd for others. “The Boring Commits That Keep 40% of the Web Safe.” The supply-chain security angle: pinned SHAs, abandoned-action replacement, the GitHub App migration, ca-bundle. Frame maintenance-as-security — timely and underappreciated. “I Test the Future So You Don’t Break in It.” MySQL 9.7, MariaDB 12.1, PHP 8.5 — a piece on being the person who runs tomorrow’s platforms against today’s code, and why the test matrix is a form of care. “The Commit I’m Proudest Of Was One Line About AI.” Use “Include example for disclosing AI usage” as a springboard into how WordPress (and you) navigated AI’s arrival in the contribution workflow in 2025–26. Very of-the-moment. “Anatomy of a Revert.” Six times this year you reverted your own or others’ work. A candid, senior-contributor essay on why reverting is a feature not a failure — iteration, humility, and trunk stability. “A Year in Dependencies.” The stewardship story — lodash/underscore/backbone/getID3/Twemoji. What
Matt: Code for the People
Lights! Camera! Action! Todd Spangler at Variety writes: Automattic’s ‘Code for the People’ Documentary Is a Rallying Cry for Users to Fight for the Open Internet, from the NYC premiere last week. I’m looking forward to the San Francisco premiere of the documentary, and then tomorrow everyone can stream it for free on codeforthepeople.com! Appearances by Anne McCarthy, Beau Lebens, Eric Binnion, Ian Stewart, Marjorie Asturias, Mary Hubbard, Matías Ventura, Matthew Miller, Paolo Belcastro, and Paul Maiorana. We need to tell the story of Open Source in as many ways and places as possible. It’s never been more critical. Film is new to us, and it’s funny how quickly things change: There’s a segment with a few “OpenAI not open” sound bites, but to their credit, they have been releasing open-weight models (Safeguard is particularly interesting). That said, the top open-weight models are all from China, save for Nvidia’s Nemotron, in ~12th place. When I went to the first WordCamps in Beijing and Shanghai in 2009, it was a very different time. They were the biggest in the world at the time! I don’t think you could take photos in Tiananmen Square as freely as I did then; now to visit I think you need an appointment, ID checks, and security checks. Even during WordCamp, it felt like the freedom of Open Source was in high demand, but it also created a lot of fear. I found out later that one of the student volunteers who helped their professor organize everything had been taken in for hours of questioning following the event. On that trip, I saw how fine-grained the Great Firewall could be when individual posts (IIRC, about bad milk from a factory harming babies) wouldn’t load, but the rest of the site would. WordPress.com had been totally blocked, taking about a quarter of our traffic at the time, but behind the Firewall, Open Source continued to thrive and grow, and now the frontier open models are being driven by China in a way I never would have predicted! Once you’ve had a taste of freedom, it’s hard to go back.
WPTavern: #224 – David Snead on Building Trust and Collaboration in the Hosting Industry With the Secure Hosting Alliance
Transcript [00:00:19] Nathan Wrigley: Welcome to the Jukebox Podcast from WP Tavern. My name is Nathan Wrigley. Jukebox is a podcast which is dedicated to all things WordPress. The people, the events, the plugins, the blocks, the themes, and in this case, building trust and collaboration in the hosting industry with the Secure Hosting Alliance. If you’d like to subscribe to the podcast, you can do that by searching for WP Tavern in your podcast player of choice, or by going to wptavern.com/feed/podcast, and you can copy that URL into most podcast players. If you have a topic that you’d like us to feature on the podcast, I’m keen to hear from you, and hopefully get you, or your idea, featured on the show. Head to wptavern.com/contact/jukebox, and use the form there. So on the podcast today, we have David Snead. David has been involved in the hosting industry since 1999, starting out as legal counsel for one of the earliest shared hosting companies, and going on to work with over 50 others. He helped found the i2Coalition, serve as in-house counsel for cPanel and WebPros, and now leads the Secure Hosting Alliance. If you’re listening to this podcast, I’m sure that many of you will have worked closely with hosting companies. Perhaps you run an agency, or business, that depends on the reliability, ethics, and security of hosting providers. David is here to talk about cross-industry collaboration in the hosting world, specifically around improving security, professionalism, and communication between hosts. The conversation focused on why, and how, the Internet Infrastructure Forum, or IIF, is building a framework for real-time intelligence sharing and abuse reporting, aiming to help the entire ecosystem detect and prevent attacks faster than adversaries can adapt. David talks about the challenges hosting companies face, especially smaller ones, in keeping up with security, and how this evolving project hopes to ease this by sharing actionable, non-proprietary abuse information across registrars, hosting providers, DNS services, and more. He discusses the growth of both the Secure Hosting Alliance and the IIF, the business case for collaboration, and the nuances of legal and technical information sharing across borders. If you’re in hosting, run a web agency, or just want to know how the backbone of the web is working to stay more secure and connected, this episode is for you. If you’re interested in finding out more, you can find all of the links in the show notes by heading to wptavern.com/podcast, where you’ll find all the other episodes as well. And so, without further delay, I bring you David Snead. I am joined on the podcast by David Snead. Hello David. [00:03:20] David Snead: Hello. [00:03:21] Nathan Wrigley: Very nice to have you with us. David’s got a really interesting background, and a really interesting, I’m going to use the word project. I don’t know if that’s the right word. It feels like it’s got more solidity and it’s got a lot more history than that. It’s something which is, I think going, but we’ll find out a little bit more about it. It’s all about the hosting industry and trying to get hosts to, I guess communicate with each other in ways going forwards. [00:03:44] David Snead: That is a part of it. There are really two goals and one is to level up the ethics and professionalism in the hosting industry. And the second is to facilitate more comradery and interaction among hosts. Something that folks felt occurred in the early 2000s, and with all the consolidation that occurred went away. And so that’s something that we’re also trying to facilitate. [00:04:16] Nathan Wrigley: Okay. So given that we’re going to be talking about hosting, I guess it’s a good idea to paint your credentials and find out a little bit more about you. So a short opportunity to just tell us a little about you and your background in WordPress and hosting specifically, I suppose. [00:04:29] David Snead: Sure. So I have been working in the hosting industry since 1999. As I often say, I was working in the hosting industry when hosting was cool. It is not so cool anymore. In fact most people don’t really pay attention to it. You know, and I started as a lawyer for a hosting company, and I was in-house counsel for a company that actually owned a hosting company and was one of the earliest hosting companies that specialised in shared hosting. And so I was their general counsel. And for some reason it stuck, and I’ve just kind of turned it into a career. So after that I had a private practise as a lawyer and I worked with probably 50 different hosting companies, mostly writing policies that nobody ever reads, which makes me super fun at parties. And then from there, my friend Christian Dawson and I formed the i2Coalition as a response to some legislation in the US that would’ve been kind of the death nail for internet providers. So we started the i2Coalition. I then went in-house for cPanel and worked at cPanel and WebPros for 10 years, and then started the Secure Hosting Alliance. [00:05:52] Nathan Wrigley: Okay. So you’ve got all all the history. That’s pretty good. You know, if we’re going to talk about hosting. [00:05:57] David Snead: All the hosting history in one person. That’s kind of a very scary idea, no? [00:06:02] Nathan Wrigley: But that’s excellent. So do you still offer counsel? Is that still, so you haven’t sort of sidestepped and do half of the week on a sort of more technical basis? It’s still the legal side that you’re involved in. [00:06:13] David Snead: I do. Right now I’m doing mostly M&A work for, it’s weird. So I don’t know if anybody has ever said this to you before, but web hosting is kind of like the Hotel California. It’s like, once you start in the web hosting industry, you never leave. And so I