Meta tags:

Headings (most frequently used words):

me, smarter, call, it, nacin, about, find, algorithms, defaults, ve, joined, the, white, house, digital, service, you, can, congestion, or, throttling, unacceptable, security, is, nuanced, my, talk, proposals, for, open, source, bridge, extreme, software, portability, as, an, art, form, trust, community, and, automatic, updates, posts, navigation,

Text of the page (most frequently used words):
the (98), and (57), for (35), wordpress (34), you (29), that (29), this (25), but (20), was (17), government (16), have (15), with (15), not (15), open (14), they (14), are (14), can (14), from (12), cookie (11), most (10), service (10), #digital (10), source (9), also (9), how (9), some (9), just (9), more (9), software (8), don (8), security (8), when (8), users (7), all (7), issues (7), disclosure (7), who (7), there (7), every (7), comcast (7), proposals (6), 2014 (6), posted (6), what (6), our (6), them (6), now (6), any (6), because (6), years (6), their (6), user (6), ssl (6), your (6), change (6), time (6), tell (6), day (6), page (5), tags (5), would (5), community (5), even (5), need (5), make (5), works (5), call (5), comments (5), these (5), could (5), here (5), may (5), com (5), issue (5), been (5), vulnerability (5), like (5), please (5), mbps (5), posts (4), bridge (4), way (4), team (4), really (4), were (4), see (4), nuanced (4), work (4), since (4), trying (4), after (4), other (4), full (4), internet (4), well (4), disclosed (4), settings (4), dashboard (4), one (4), support (4), out (4), report (4), while (4), over (4), correct (4), many (4), working (4), vendor (4), take (4), help (4), about (4), people (4), lead (4), developer (4), nacin (4), comment (3), april (3), design (3), its (3), ever (3), background (3), turn (3), hard (3), worse (3), anyone (3), seen (3), want (3), researcher (3), case (3), able (3), quickly (3), course (3), probably (3), better (3), everyone (3), being (3), responsible (3), has (3), secure (3), hours (3), might (3), only (3), logged (3), decisions (3), reporter (3), made (3), patchy (3), anything (3), will (3), going (3), yet (3), patch (3), incomplete (3), thought (3), than (3), doing (3), opportunity (3), invalid (3), reports (3), joined (3), white (3), house (3), 2015 (3), high (3), effective (3), gov (3), smarter (3), powered (2), next (2), talk (2), both (2), submitted (2), automatic (2), updates (2), default (2), easy (2), learn (2), through (2), trust (2), core (2), bad (2), decade (2), changes (2), doesn (2), get (2), continuing (2), two (2), conference (2), portland (2), closed (2), leave (2), looking (2), react (2), mitigate (2), situation (2), especially (2), set (2), happened (2), blog (2), facebook (2), those (2), handled (2), involved (2), think (2), should (2), making (2), automattic (2), wasn (2), until (2), fix (2), lot (2), outside (2), new (2), auth (2), number (2), very (2), real (2), isn (2), authentication (2), wontfix (2), things (2), use (2), account (2), email (2), used (2), knowing (2), site (2), asking (2), expire (2), three (2), right (2), where (2), remember (2), days (2), cookies (2), invalidated (2), though (2), last (2), concept (2), issued (2), changing (2), major (2), already (2), force (2), front (2), plain (2), http (2), aren (2), using (2), she (2), response (2), stated (2), mailing (2), list (2), proposed (2), makes (2), respond (2), always (2), everything (2), great (2), good (2), haven (2), recent (2), during (2), far (2), too (2), send (2), again (2), prevented (2), countless (2), simply (2), often (2), important (2), congestion (2), throttling (2), unacceptable (2), net (2), neutrality (2), june (2), charge (2), blast (2), 105 (2), evening (2), had (2), knew (2), stories (2), look (2), problems (2), solve (2), millions (2), lives (2), few (2), movement (2), life (2), play (2), role (2), american (2), dedicated (2), helped (2), healthcare (2), projects (2), heard (2), launch (2), services (2), felt (2), federal (2), chrome (2), instead (2), maybe (2), proudly, navigation, speaking, contributors, mel, choyce, aaron, jorbin, modernizing, stagnant, toolbox, journey, into, shipped, october, perhaps, polarizing, feature, self, hosted, web, off, communities, cause, revolt, communication, steadfast, commitment, philosophies, convinced, skeptical, along, meant, giving, control, writing, portable, throw, thousands, shared, hosting, configurations, technical, debt, cater, sprawling, ecosystem, php, found, breaking, harm, unfairly, punish, mean, innovate, evolve, forced, clever, adoption, soar, extreme, portability, art, form, annual, oregon, citizens, papers, let, private, organizers, feedback, speak, before, awesome, excited, share, accepted, soon, update, linked, previous, criticism, writer, related, happening, holes, easily, exacerbated, confusing, confusion, understand, roots, record, straight, keep, seeing, confused, tweets, chatter, favorite, brief, explanation, did, nesting, doll, layers, discover, belly, empty, point, primary, addressed, requires, post, mortem, side, fud, debate, versus, certainly, questioning, spent, dedicating, herself, intentioned, within, enough, identify, actual, request, got, place, however, managed, guessed, requiring, true, critical, came, together, latent, reported, familiar, intricacies, internals, nor, expect, rather, assumption, decision, due, normally, wouldn, harmless, allows, presentational, toolbar, edit, links, theme, such, manage, particularly, crazy, fact, separate, admin, amazon, six, months, log, start, check, relatively, didn, gets, bit, weird, love, remembered, 365, wait, ago, configured, session, management, authenticated, automatically, upon, logout, without, password, architectural, planning, why, designed, limited, expiration, click, yes, absolutely, coincidentally, fixing, slated, release, forcing, end, trivial, plugin, sadly, went, state, lifetime, mess, factor, followed, notified, waited, 24hrs, none, guessing, week, identifies, does, logs, sure, times, responded, saying, his, realizes, individuals, fully, arguments, sway, thing, interest, possibly, providing, steps, ensure, missed, offer, study, discovered, internally, effect, same, thoroughly, investigate, follow, plan, action, investigation, learned, problem, severe, originally, identified, initial, jetpack, another, angle, sometimes, scrambling, starting, given, straighten, sees, headlines, notices, published, first, otherwise, left, scramble, expert, neither, wrong, privately, disclosing, allowing, reasons, prefer, reason, less, obvious, different, status, quo, stifle, innovation, discourage, investing, infrastructure, technician, business, fine, blame, netflix, put, sizable, hole, wallet, month, upgraded, recently, each, performance, starter, actually, close, speeds, night, running, speed, tests, weeks, looks, pay, downstream, july, 2016, march, witnessed, history, future, kids, grandkids, beginning, saw, nature, hardest, big, challenges, spend, ounce, energy, believe, stakes, matter, challenge, know, deal, astounded, impact, recruited, word, video, below, noticed, come, brightest, best, approached, admit, nervous, step, back, buzz, invested, much, stepped, cases, beauty, fantastic, particular, continues, encouragement, taking, away, audrey, worked, 2010, still, actively, project, matt, mullenweg, january, age, public, policy, must, backed, technology, succeed, asked, serve, doers, makers, creative, thinkers, specialized, technologists, untangling, rewiring, redesigning, then, formed, tackling, pressing, ones, directly, affect, formula, simple, around, priority, across, apply, rescue, long, admired, teammates, tenacity, inside, sorts, red, tape, hiring, procurement, between, difficult, itself, wanted, fewer, horror, helping, haley, van, dyck, gray, brooks, erie, meyer, five, counting, honor, privilege, large, incredible, democratize, publishing, home, closely, watched, transparent, efficient, boosted, small, part, feel, strongly, efforts, data, presented, transform, say, rising, confidence, ability, deliver, dropping, interactions, systems, arrive, late, budget, others, abandoned, failures, count, class, americans, moment, whitehouse, options, google, interviewed, refinery29, badass, women, rebecca, rolfe, showing, alert, something, build, algorithm, choice, smart, demand, customization, algorithms, defaults, org, twitter, find, andrew, living, washington, previously, menu, widgets, skip, content,

Text of the page (random words):
nacin wordpress lead developer skip to content nacin wordpress lead developer menu and widgets about me hi i m andrew nacin a lead developer of wordpress living in washington d c and previously working for the u s digital service at the white house more find me nacin on twitter on wordpress org smarter algorithms smarter defaults instead of showing the user an alert that something might not work maybe we can build a smarter algorithm instead of asking the user to make a choice up front maybe we can set a smart default and see if there is high demand after launch for more customization rebecca rolfe on the google chrome team interviewed in the badass women of chrome s security team in refinery29 more on making decisions not options posted on may 24 2015 may 24 2015 tags decisions design wordpress i ve joined the white house s u s digital service the need for effective government services is rising while confidence in our ability to deliver them is dropping more than ever day to day interactions with government are powered by digital systems and yet far too many federal it projects arrive late or over budget others are simply abandoned these failures are often felt by those who count on it most working class americans and people who turn to government in a moment of need the u s digital service on whitehouse gov when you re presented with an opportunity to help transform how the federal government works for the american people it s really hard to say no for five years and counting i ve had the honor and privilege as a lead developer of wordpress to play a role in a large incredible movement to democratize publishing from my home in d c i ve closely watched open data and open government efforts i feel very strongly about an open transparent and efficient government boosted in no small part by wordpress and open source i ve long admired a number of my new teammates especially erie meyer gray brooks and haley van dyck for years of tenacity and hard work trying to change government from the inside out i ve always felt i could be more effective helping government from the outside by continuing to work on wordpress after all we ve all heard horror stories of all sorts of red tape from hiring to procurement and everything in between and we ve all heard how difficult government itself makes it to launch good government digital services while many of us may have have wanted to help few thought they could fewer knew how but then the u s digital service was formed from the team that helped rescue healthcare gov it s dedicated to tackling some of government s most pressing problems ones that directly affect millions of people s lives the formula is simple take what helped turn around healthcare gov and apply it to other high priority projects across government in this day and age public policy must be backed by effective technology to succeed the american people need our help and our government has asked us to serve as doers and makers creative thinkers and specialized technologists dedicated to untangling rewiring and redesigning our government in january i joined the u s digital service when i was approached i have to admit that i was nervous to step back from the day to day buzz of wordpress because i ve invested so much but the community stepped up in most cases not even knowing about my life change that s the beauty of open source and the fantastic wordpress community in particular wordpress continues to play an important role in my life with matt mullenweg s support and encouragement i m taking time away from audrey where i ve worked since 2010 i m still actively involved in the project just not full time the u s digital service is the real deal i ve been astounded by the impact we ve already made we ve recruited some of the best and brightest don t just take my word for it do what you can to learn more about this movement and come help us make government better if you haven t seen the video below yet take a look a few of you have noticed me in the background it s my nature to look for the hardest problems to solve i like to take on big challenges and spend every ounce of energy working to solve them i believe in what we re doing here the stakes are high no matter the challenge i know what we re doing will change millions of lives i thought i had made the most of my decade in d c i ve witnessed a lot of history i knew i d have some great stories to tell my future kids and grandkids i was there i saw it that was only the beginning posted on march 29 2015 july 1 2016 tags government u s digital service wordpress 8 comments on i ve joined the white house s u s digital service you can call it congestion or throttling i call it unacceptable i pay for 105 mbps of downstream internet from comcast and i get just 6 mbps every evening i ve been running speed tests for weeks now it looks like this every time every day every night i put a sizable hole in my wallet every month for blast internet comcast even upgraded blast from 50 mbps to 105 mbps recently but each evening i might as well be using their 6 mbps performance starter when i actually want to use anything close to the speeds they charge me for i can t please comcast tell me how you re going to blame netflix for this one please comcast tell me again you can send a technician but only during business hours when my internet works fine please comcast tell me how you re going to charge me more please comcast tell me how net neutrality would stifle innovation and discourage you from investing in infrastructure and please comcast tell me how that would be any different from the status quo posted on june 12 2014 june 12 2014 tags net neutrality 3 comments on you can call it congestion or throttling i call it unacceptable security is nuanced as a software vendor there are many reasons to prefer responsible disclosure of security issues but the most important reason is also less obvious vulnerability reports need to be correct i ve seen countless full disclosure reports that are wrong and invalid most of these could have been prevented by privately disclosing it to the vendor and allowing them the opportunity to respond everyone sees wordpress in the headlines over and over again but no one ever notices the this report is invalid response we ve prevented countless invalid reports from being published simply because they were disclosed to us first this is better for the software s users who are otherwise left to scramble every time they see a report they are not an expert and often neither is the reporter there s another angle here though sometimes the vulnerability report is correct but incomplete this too can send everyone scrambling starting with the vendor who was not given the opportunity to straighten things out when responsible disclosure works it works really well i offer jetpack s recent vulnerability as a recent case study while this was discovered internally at automattic the effect is the same they were able to quickly and thoroughly investigate the issues and follow through with a plan of action during their investigation they learned the problem was far more severe than they originally identified and that their initial proposed fix was incomplete there will always be individuals who want everything to be fully disclosed and there are some great arguments for that i m not trying to sway you one way or the other but if you re trying to do the right thing you re doing full disclosure in the interest of users possibly even providing a patch or steps to mitigate working with the vendor is a good way to ensure you haven t missed anything i m not sure how many times now i ve responded to a mailing list saying well this isn t a vulnerability or your proposed patch is incomplete or your patch makes it worse or when i don t respond to the mailing list because my thought is t his is worse than the reporter realizes security is nuanced last week a security researcher disclosed some issues with wordpress they stated that wordpress issues a cookie in plain http that identifies the user correct they also stated that this cookie does not expire when the user logs out also correct she went on to state that the cookie has a lifetime of 3 years that it can be used to mess with the account s two factor authentication settings and change their email and other settings she followed that up with have notified them and waited 24hrs for response none yet guessing it s a wontfix for now since their ssl support is patchy yes absolutely ssl support in wordpress is patchy coincidentally fixing all of this was already slated for the next major release while you can force ssl for the dashboard we don t have the concept of forcing ssl for the front end of the site so that logged in cookie is issued over plain http it s trivial in a plugin to force that cookie to be secure but of course most users aren t going to do that of course most users also aren t using ssl sadly wordpress also doesn t have any concept of session management the user is authenticated and a cookie is issued but there s no way for it to be automatically invalidated upon logout without you changing your password changing this is a major architectural change we ve been planning for some time but this is also why cookies are designed with a limited expiration just 48 hours or 14 days if you click remember me but the report was that it didn t expire for three years right this is where it gets a bit weird i d love it if remember me remembered you for 30 90 or even 365 days but wordpress will wait to make any changes until cookies can be invalidated some time ago though wordpress com configured this cookie to last for three years normally this wouldn t be that bad you see the logged in cookie is relatively harmless it allows presentational things like the toolbar edit links in your theme and such but you can t use it to manage your account change your email or do anything particularly crazy in fact wordpress issues a separate secure auth cookie used for the wp admin dashboard it s like amazon knowing who you are after six months of not being on the site but asking you to log in when you start to check out on wordpress com however a lot of settings can be managed outside of the dashboard on their new dashboard at wordpress com settings as you might have guessed by now they were not requiring the auth cookie on this page only the logged in cookie that is the true critical vulnerability here a number of decisions came together to make a latent issue a very real one the issue wasn t reported like this because the reporter isn t familiar with the intricacies of user authentication internals in wordpress nor should anyone expect them to rather an assumption was made it was a design decision that would probably just be a wontfix due to patchy ssl support the disclosure was well intentioned but because it happened within just 24 hours automattic wasn t able to react quickly enough to identify the actual issue and request that it not be disclosed until they got a fix in place i m just trying to set the record straight on what happened since i keep seeing confused tweets blog posts comments and facebook chatter favorite facebook comment after i posted a brief explanation did we just open all those nesting doll layers to discover the belly was empty this situation probably could have been handled better by everyone involved but that s not really the point the primary issue is now handled and other issues are also being addressed i don t think this requires post mortem blog posts with a side of fud i m not looking for a debate on full disclosure versus responsible disclosure and i certainly don t think anyone should be questioning the researcher who has spent years dedicating herself to making the internet more secure in this case wordpress com the service was able to react quickly to mitigate this issue for all of its users of course with software holes can t be closed so easily and in this case the situation was probably exacerbated by confusing wordpress com the service with wordpress the software that confusion is easy to understand especially since some of these issues have roots in the core software security is nuanced i ve not linked to any previous posts because i don t want this to be a criticism of any researcher or writer but if you re looking for background 1 2 3 also related work for wordpress 4 0 is happening here posted on may 30 2014 may 30 2014 tags security wordpress 5 comments on security is nuanced my talk proposals for open source bridge update april 29 i m excited to share that both of these proposals were accepted see you soon portland i submitted two proposals to open source bridge an annual conference in portland oregon for open source citizens the call for papers is now closed but they let anyone leave comments on proposals that are private to the conference organizers if you have any feedback on these or have seen me speak before it would be awesome if you could leave a comment here they are extreme software portability as an art form writing portable software is hard throw in thousands of bad and worse shared hosting configurations a decade of technical debt the need to cater to a sprawling ecosystem and php and you have wordpress we ve found breaking changes harm our community and unfairly punish our users so we don t make them but that doesn t mean we don t innovate or evolve we re just forced to get really clever and it works with adoption continuing to soar trust community and automatic updates wordpress shipped in october what is perhaps its most polarizing feature ever automatic updates in the background of self hosted web software on by default and no easy way to turn it off in most open source communities this would be cause for open revolt learn how through trust communication and a steadfast commitment to its philosophies the wordpress core team convinced a skeptical community to go along even if it meant users giving up some control wordpress contributors mel choyce and aaron jorbin also both submitted proposals my journey into open source design and modernizing a stagnant toolbox posted on april 15 2014 april 29 2014 tags open source bridge speaking wordpress 1 comment on my talk proposals for open source bridge posts navigation page 1 page 2 page 17 next page proudly powered by wordpress