Sometimes the title of this post is true. Often it is a stack of thrown together parts with nobody responsible for the complete full working service.
An AI-discovered security release is not a suggestion
WordPress 7.1.1 landed with 17 core bug fixes, editor fixes, and 11 security fixes. WordPress told people to update ASAP. (WordPress 7.1.1 announcement)
There are people in our industry who still treat “update immediately” as “optional”, because the last time someone updated something, a lead gen form broke on a Friday afternoon.
Leaving a security release just sitting there because you have no staging, no recovery point and no idea who owns the plugins is how things get broken quickly.
Also, blindly and automatically applying every update with no checks or tests on the journeys that actually make money is how you create a different kind of problem.
Hosts like Pantheon treated 7.1.1 as a major security event, because this is a new breed of AI-discovered issues that can’t be ignored, they need action immediately (Pantheon release note) and although managed WordPress hosts generally have these things handled there are going to be millions of sites out there left with these gaping holes in them.
How about some physical AWS damage?
Regardless of your stack when AWS messes up, you’ll probably notice. This happened back in mid-September when AWS messed up and was unable to restore access to cloud infrastructure! This wasn’t some intern fudging a command though, this was real physical damage in Bahrain and UAE directly related to the ongoing regional conflict. Pretty serious stuff.
Multiple AWS zones were affected and data that customers had not moved was in some cases way beyond recovery options. (Reuters)
This is obviously an extreme case. Most clients are not planning for armed conflict to mess up their recovery plans.
The recent Automattic drama is not a platform crisis
Remember when Automattic’s board put Matt Mullenweg on leave, appointed an interim CEO, then reinstated him a few days later. That followed the existing row with WP Engine. It is a real governance story. It is not, by itself, a reason to rip out an independently hosted WordPress site. (TechCrunch on the leave, TechCrunch on his return)
Clients mix up WordPress the software, WordPress.org, WordPress.com, and Automattic the company so open source and data ownership still matter but only if the project was built so you actually control the code. WordPress still wins in this situation, in fact, it proves it’s worth every time Matt and the Automattic board try to make it look bad!
That is the work I am interested in at Make Do. Not a rebuild for the sake of it. Ownership of the full platform and security for the service we provide.
Leave a Reply