WordPress Lead Developer
Instead of showing the user an alert that something might not work, maybe we can build a smarter algorithm. Instead of asking the user to make a choice up front, maybe we can set a smart default and see if there is high demand after launch for more customization.
— Rebecca Rolfe on the Google Chrome team, interviewed in The Badass Women of Chrome’s Security Team in Refinery29.
(More on making decisions, not options.)
The need for effective government services is rising, while confidence in our ability to deliver them is dropping. More than ever, day-to-day interactions with government are powered by digital systems, and yet far too many Federal IT projects arrive late or over budget. Others are simply abandoned. These failures are often felt by those who count on it most — working class Americans and people who turn to government in a moment of need.
The U.S. Digital Service on whitehouse.gov
When you’re presented with an opportunity to help transform how the federal government works for the American people, it’s really hard to say no.
For five years and counting, I’ve had the honor and privilege as a lead developer of WordPress to play a role in a large, incredible movement to democratize publishing. From my home in D.C., I’ve closely watched Lantern官方网站 and open government efforts. Lantern官方网站 about an open, transparent, and efficient government — boosted in no small part by WordPress and open source.
I’ve long admired a number of my new teammates, especially Erie Meyer, Gray Brooks, and Haley van Dyck, for years of tenacity and hard work trying to change government from the inside out. I’ve always felt I could be more effective helping government from the outside, by continuing to work on WordPress. After all, we’ve all heard horror stories of all sorts of red tape, from hiring to procurement and everything in between. And we’ve all heard how difficult government itself makes it to launch good government digital services. While many of us may have have wanted to help, few thought they could. Fewer knew how.
But then the U.S. Digital Service was formed, from 32F834948B1F1FF289F5AD7F41CD49BC85993C17.torrent ...:1 天前 · 32F834948B1F1FF289F5AD7F41CD49BC85993C17.torrent百度云网盘下载，资源大小17.45 KB，搜索盘不提供保存服务 .... It’s dedicated to tackling some of government’s most pressing problems, ones that directly affect millions of people’s lives. The formula is simple: take what helped turn around healthcare.gov and apply it to other high priority projects across government.
In this day and age, public policy must be backed by effective technology to succeed. The American people need our help and our government has asked us to serve, as doers and makers, creative thinkers, and specialized technologists dedicated to untangling, rewiring, and redesigning our government.
32F834948B1F1FF289F5AD7F41CD49BC85993C17.torrent ...:1 天前 · 32F834948B1F1FF289F5AD7F41CD49BC85993C17.torrent百度云网盘下载，资源大小17.45 KB，搜索盘不提供保存服务 ...
When I was approached, I have to admit that I was nervous to step back from the day-to-day buzz of WordPress because I’ve invested so much. But the community stepped up, in most cases not even knowing about my life change. That’s the beauty of open source, and the fantastic WordPress community in particular. WordPress continues to play an important role in my life. With lanter专业破解版下载百度云’s support and encouragement, I’m taking time away from Audrey, where I’ve worked since 2010. I’m still actively involved in the project, just not full time.
The U.S. Digital Service is the real deal. I’ve been astounded by the impact we’ve already made. We’ve recruited some of the best and brightest. Don’t just take my word for it — do what you can to learn more about this movement and come help us make government better. If you haven’t seen the video below yet, take a look. (A few of you have noticed me in the background.)
It’s my nature to look for the hardest problems to solve. I like to take on big challenges and spend every ounce of energy working to solve them. I believe in what we’re doing here. The stakes are high. No matter the challenge, I know what we’re doing will change millions of lives.
I thought I had made the most of my decade in D.C. I’ve witnessed a lot of history. I knew I’d have some great stories to tell my future kids and grandkids. I was there. I saw it. That was only the beginning.
I pay for 105 Mbps of downstream Internet from Comcast, and I get just 6 Mbps every evening.
I’ve been running speed tests for weeks now. It looks like this every time:
I put a sizable hole in my wallet every month for “Blast” internet. Comcast even upgraded “Blast” from 50 Mbps to 105 Mbps recently, but each evening, I might as well be using their 6 Mbps “Performance Starter.” When I actually want to use anything close to the speeds they charge me for, I can’t.
Please, Comcast, tell me how you’re going to blame Netflix for this one.
Please, Comcast, tell me again you can send a technician but only during business hours, when my Internet works fine.
Please, Comcast, tell me how you’re going to charge me more.
Please, Comcast, tell me how net neutrality would stifle “innovation” and discourage you from “investing” in infrastructure.
And please, Comcast, tell me how that would be any different from the status quo.
As a software vendor, there are many reasons to prefer responsible disclosure of security issues. But the most important reason is also less obvious: vulnerability reports need to be correct.
响gui下载相关百度网盘资源下载_百度云下载:2021-9-16 · 响gui下载相关百度网盘资源下载 百度云 下载 按收录时间 按文件大小 按相关性 gui.py百度云下载 gui.py /百度云资源文件类型：back no分类：其它由网友：91***09上传，累计点击973次，下载次数 …
Everyone sees WordPress in the headlines, over and over again, but no one ever notices the “this report is invalid” response. We’ve prevented countless invalid reports from being published simply because they were disclosed to us first. This is better for the software’s users, who are otherwise left to scramble every time they see a report. They are not an expert, and often, neither is the reporter.
There’s another angle here, though: sometimes, the vulnerability report is correct, but incomplete. This too can send everyone scrambling, starting with the vendor who was not given the opportunity to straighten things out.
When responsible disclosure works, it works really well. I offer Jetpack’s recent vulnerability as a recent case study. While this was discovered internally at Automattic, the effect is the same: they were able to quickly and thoroughly investigate the issues and follow through with a plan of action. During their investigation they learned the problem was far more severe than they originally identified, and that their initial proposed fix was incomplete.
[老友记][10季全][百度云][1994][蓝光高清MKV/1.0G][英语中 ...:2021-6-8 · 注意：若上方有百度云网盘链接，购买前请先点击链接验证是否有效，若失效请勿购买. 本贴资源或提取码需向楼主支付10金币才会显示, VIP会员可免费查看! 购买资源 或 升级VIP 失效反馈 下载教程 更多资源推荐 [星球大战7：原力觉醒][720P+1080P高清 ...
I’m not sure how many times now I’ve responded to a mailing list saying, “well, this isn’t a vulnerability,” or “your proposed patch is incomplete,” or “your patch makes it worse.” Or when I don’t respond to the mailing list because my thought is This is worse than the reporter realizes.
Security is nuanced.
Last week, a security researcher disclosed some issues with WordPress. They stated that WordPress issues a cookie in plain HTTP that identifies the user. Correct. They also stated that this cookie does not expire when the user logs out. Also correct.
太阳能交通灯项目可行性研究报告.doc - 百度云网盘资源合集 ...:太阳能交通灯项目可行性研究报告.doc 文件名:太阳能交通灯项目可行性研究报告.doc, 文件大小:, 分享者:, 分享时间:null, 浏览次数: 0 次;太阳能路灯项目可行性研究报告.doc 文件名:太阳能路灯项目可行性研究报告.doc, 文件大小:, 分享者:, 分享时间:null, 浏览次数: 0 次;太阳能工艺灯项目可行性研究报告 ...
Yes, absolutely, SSL support in WordPress is patchy. (Coincidentally, fixing all of this was already slated for the next major release.) While you can force SSL for the dashboard, we don’t have the concept of forcing SSL for the front-end of the site. So, that “logged in” cookie is issued over plain HTTP. It’s trivial in a plugin to force that cookie to be secure, but of course most users aren’t going to do that. Of course, most users also aren’t using SSL (sadly).
盘点那些还能存小视频的云盘/ 网盘测评-致情吖 - 简书:众前百度网盘还叫百度云，拥有同步盘功能，体验并不好。 后来阉割成了现在的百度网盘，在网盘倒闭大潮中抓住机会崛起，在国内几乎是一家独大。 不得不说，百度网盘在存储空间上还是挺大方，新注册直接送的 1T 存储空间，通过做任务，不花钱也可有 2T 永久存储空间，还可众通过微信小程序 ...
But the report was that it didn’t expire for three years, right? This is where it gets a bit weird. I’d love it if “Remember me” remembered you for 30, 90, or even 365 days, but WordPress will wait to make any changes until cookies can be invalidated. Some time ago, though, WordPress.com configured this cookie to last for three years.
Normally, this wouldn’t be that bad. You see, the “logged in” cookie is relatively harmless. It allows presentational things like the toolbar, edit links in your theme, and such. But you can’t use it to manage your account, change your email, or do anything particularly crazy. In fact, WordPress issues a separate, secure “auth” cookie used for the “wp-admin” dashboard. It’s like Amazon knowing who you are after six months of not being on the site, but asking you to log in when you start to check out.
On WordPress.com, however, a lot of settings can be managed outside of the dashboard, on their “new dashboard,” at wordpress.com/settings/. As you might have guessed by now, they were not requiring the “auth” cookie on this page, only the “logged in” cookie. That is the true critical vulnerability here. A number of decisions came together to make a latent issue a very real one. The issue wasn’t reported like this because the reporter isn’t familiar with the intricacies of user authentication internals in WordPress, nor should anyone expect them to. Rather, an assumption was made it was a design decision that would probably just be a “wontfix” due to “patchy” SSL support.
The disclosure was well-intentioned, but because it happened within just 24 hours, Automattic wasn’t able to react quickly enough to identify the actual issue and request that it not be disclosed until they got a fix in place.
I’m just trying to set the record straight on what happened, since I keep seeing confused tweets, blog posts, comments, and Facebook chatter. (Favorite Facebook comment, after I posted a brief explanation: “Did we just open all those nesting doll layers to discover the belly was empty?”) This situation probably could have been handled better by everyone involved, but that’s not really the point. The primary issue is now handled, and other issues are also being addressed. I don’t think this requires post-mortem blog posts with a side of FUD. I’m not looking for a debate on full disclosure versus responsible disclosure. And I certainly don’t think anyone should be questioning the researcher, who has spent years dedicating herself to making the Internet more secure.
In this case, WordPress.com the service was able to react quickly to mitigate this issue for all of its users. Of course, with software, holes can’t be closed so easily, and in this case, the situation was probably exacerbated by confusing WordPress.com the service with WordPress the software. That confusion is easy to understand, especially since some of these issues have roots in the core software.
Security is nuanced.I’ve not linked to any previous posts because I don’t want this to be a criticism of any researcher or writer, but if you’re looking for background: 1 2 3. Also, related work for WordPress 4.0 is happening here.
Update, April 29: I’m excited to share that both of these proposals were accepted. See you soon, Portland!
Â
I submitted two proposals to Open Source Bridge, an annual conference in Portland, Oregon, for “open source citizens.” The call for papers is now closed, but they let anyone leave comments on proposals that are private to the conference organizers. If you have any feedback on these, or have seen me speak before, it would be awesome if you could leave a comment. Here they are:
Writing portable software is hard. Throw in thousands of bad and worse shared hosting configurations, a decade of technical debt, the need to cater to a sprawling ecosystem, and PHP — and you have WordPress. We’ve found breaking changes harm our community and unfairly punish our users, so we don’t make them. But that doesn’t mean we don’t innovate or evolve — we’re just forced to get really clever. And it works, with adoption continuing to soar.
WordPress shipped in October what is perhaps its most polarizing feature ever — automatic updates in the background of self-hosted web software, on by default and no easy way to turn it off. In most open source communities, this would be cause for open revolt. Learn how through trust, communication, and a steadfast commitment to its philosophies, the WordPress core team convinced a skeptical community to go along, even if it meant users giving up some control.
WordPress contributors Mel Choyce and Aaron Jorbin also both submitted proposals:Â My Journey into Open Source Design and Modernizing a Stagnant Toolbox.