To clarify the split GPL license, Chris Pearson adds, “the PHP is GPLv2 and the CSS, JS, and images are proprietary.” Specifically, this means that Thesis no longer violates the GPL of WordPress and the several plugins that Thesis was based on. Matt Mullenweg was thrilled to hear the news, replying with, “Now, back to work. This has taken a lot of my time over the past few days and was going to consume more if it went forward.”

It is unknown if this will have any affect on Mr. Pearson’s business.  While the split GPL license now allows the core of Thesis be redistributed by a third-party either free or for a fee, the rest of Thesis is still protected and would therefore require extensive work to redistribute anything like it.  In addition to the proprietary portions of Thesis, Mr. Mullenweg mentioned in the original debate that Thesis is “more than just a code and a theme; it is the forums, the support, the community, and all the things around it that make it valuable. That is not something that someone in another country selling it for half-price is going to be able to duplicate because they don’t have you.”

While I am not a big fan of government scrutiny and general “big brother” mentality, I do believe that this will add to the believability and authenticity of the blogging medium. We at Weblog Tools Collection try very hard to keep commercial interests completely out of the content that we generate and only rely on what we consider to be ethical ads to make ends meet. We also follow a strict full disclosure policy.

Bloggers who have regularly received freebies in the past and/or write reviews of products that they then received in lieu of the review (I was approached by a bean bag chair maker a couple of times, occasional reviewers need not care) might want to stay on top of this issue and practice full disclosure if you have not already done so. However in playing devil’s advocate, it would be very difficult to correctly identify the human behind the blogging persona without a criminal complaint and even then it might be in a legal grey area at the least (think DMCA). I am afraid that this level of scrutiny combined with general FUD might also dissuade some casual bloggers from posting reviews and reduce the general alacrity with which weekend bloggers post reviews. My thought is that the companies that offer the freebies (Lexus Automobiles?) and encourage non-disclosure should have to deal with the regulations and not the general blogging public (which is hard to enforce anyways). Techmeme has a bunch of good examples and discussion pieces.

All the transparency and legal issues aside, I think that this might be a good development if well defined and uniformly enforced. Writing reviews is a fun way to get into blogging and I would hate for things to get so formal that the casual reviewers get their hands slapped.

I strongly urge sponsored theme authors to reconsider their means and I laud those who choose to offer their themes to the community without sponsored links.

The beauty of Project Honey Pot is that anyone can contribute : just register an account, download the script and put it somewhere on your blog. It’s been more effective than I would have thought and wished : the day I had my first honeypot installed, it detected a new and before unseen comment spammer.

Contributing to this project is an easy way of making the web a cleaner place, and it will also benefit to another WordPress related spam-fighting project : the almighty Bad Behavior will soon implement the http:BL API.

Using the API itself is fairly easy. I’ve written a short tutorial, Honey Pot & http:BL Simple PHP Script, showing how to use the API to increase protection around your beloved blog. And for those who are not interested in writing their own script, there is already an http:BL WordPress Plugin waiting for you.

For those who are new to the topic, in the past yew years a market has developed around advertisers that pay money to websites to have plain-text links back to their properties so they can rank better in search engines like Google for the text in those links. At some point the people gaming Google realized instead of buying links from dozens of individual sites, they could pay theme authors to bundle their links with their download and get hundreds or thousands of sites with their link for a small fraction of the cost. This is politely referred to as “theme sponsorship.”

Sometimes theme authors do this without telling their users it’s a sponsored theme before download, or use CSS or PHP tricks to hide the links or other ads in the template so most people will either never notice or not know how to remove the ads. I’m not going to talk about these folks, because they’re obviously unethical and should be banned in every way possible.

However there is another class of themes that disclose up front they’re sponsored, and generally appear on the up and up — what about those? I think there are three main issues we need to keep in mind:

1. Google penalizes sites that promote things Google considers spam. Because of the trend of paid links, even on respected sites, Google has publicly stated that they have taken measures to diminish the effect of these links by lessening the value of where they’re coming from. I don’t claim to know their internal rankings, but I believe this is related in some way to Trustrank — if you link to untrustworthy places your Trustrank goes down. (Just like if you kept recommending crappy movies to your friends they’d stop taking your advice.) I’d be the last to recommend any of us should tailor what we do to please Google or any other search engine, but at least on my blog it accounts for 60% or more of my traffic, so I’d rather stay on their good side. Once someone understands the ramifications they are welcome to make a link ad decision for their own site, but it bothers me when theme authors are making the decision for others.
2. Many users of WordPress probably don’t understand the above point or are not able to properly modify their templates to remove the bundled ad if they did. In fact, the economics of theme “sponsorship” depends on most site owners not touching the link. When advertising or something else unwanted is bundled with a desktop application and relies on most users not removing it we have a word for it — adware. (Sometimes malware.) It’s not illegal, and it’s certainly one way for software authors to get paid for their work, but it’s ultimately disrespectful toward the user and reputable download directories like Download.com ban it.
3. Finally many of these themes try to legally disallow you from removing the advertising link by claiming it’s part of the Creative Commons attribution to leave it. This is almost funny, because these themes are on shaky legal ground themselves. WordPress is Free, meaning you’re free to do pretty much anything you like with it. It’s under a license that encourages user freedom called the GPL, which says if you distribute something that links internal functions and data structures of a GPL program (like themes do with WordPress) that also needs to be Free. At best, theme authors claiming you can’t remove the link are ignoring or ignorant of the license issues, at worst they’re actively exploiting the work of thousands of volunteers that have poured their blood, sweat, and tears into WordPress.

There are other issues, such as a proclivity of some ad-bundled theme designers to value quantity over quality, but I don’t think those are as important.

Themes with bundled and embedded advertising will always exist, and it’s perfectly within the rights of the GPL for people to create them and even sell them. I also bear no ill-will toward theme authors who’ve succumbed to the attraction of the money, I disagree with their decision but people make mistakes and it’s not a personal thing. However as a community we should decide whether the slippery slope of bundled advertising is a behaviour we want to encourage and promote on our official resources such as WordPress.org and the Codex, and even on community hubs like Weblog Tools Collection.

I’ve seen some designers claim if we discourage bundled advertising with themes we’re taking away their livelihood and saying they should work for free. (Conveniently ignoring the fact that WordPress was built “for free.”) However just because you can make money from something doesn’t mean you should. Something doesn’t have to be illegal for it to be wrong. There are more important things in life. At every conference I go to I meet dozens of people who make their living with WordPress and manage to do so in a way that doesn’t exploit users or cross ethical lines, so I find it hard to believe that the lack of sponsored themes will hurt the WordPress ecosystem. Authors could also monetize their own sites with ads, instead of putting them on yours.

Finally, no one is forcing these people to make themes. In fact I would posit that it’s better not to release anything at all than to release a sponsored theme. Our design and theme community thrived before themes with embedded ads came along, and it will continue to thrive long after their gone. Embedding ads in themes is disrespectful to users, and creates confusion and uncertainty about which themes people can trust.

Two years ago I made one of the biggest mistakes of my life when I made a decision to accept a “sponsorship” on WordPress.org without considering the ramifications it would have for its users, our community, and the web as a whole. It pains me to see others going down a similar path. We should think about how these people are trying to exploit the WordPress community and good name instead of looking the other way because they’re paying.

Once you’ve had time to mull over the social and ethical issues of ad-bundled themes, I encourage you to vote on this WordPress Idea to remove sponsored themes from WordPress.org, rating it 5 if you agree and 1 if you don’t. Thanks for your time, and happy blogging.

I was watching the server logs while working on some code and noticed that I was getting referer spammed. As I continued to look (and log) in amazement, a handful of machines made a large number of requests to my server, all with the tell tale referer spam clues (there were about 10,000 total requests in that attack). My understanding is that when the spammer requested such a large number of pages in quick succession, the server buried itself in trying to keep up with the dynamic pages being built. Since WordPress does not protect against rapid multiple requests from the same host, the spammer was effectively administering a DoS.

Referer spam is harder to stop at the php level and instead of trying to stop the attacks, I figured I would put a plugin in place that would alleviate the negative effects of a large number of requests. You guessed right, this blog now uses Staticize 2.5 to thwart DoS referer spammers. Since I do not advertise referers anywhere, the only damage sustained is some loss of bandwidth. I could ban their IPs but that would require constant maintenance. I have thought of some other output buffering and filtering, but thats in the works.

So if your server has recently exhibited some of these symptoms, it might be time to take a closer look at referer spamming and adopt some measures to stop them. Thanks Photomatt for Staticize!

It looks as if somewhere around a week and a half ago, something was changed in the algorithm that completely trounced the rank of WordPress blogs, even the really popular ones while others continue to flourish.

Photomatt’s LinkRank
BinaryBonsai’s LinkRank
Dougal’s LinkRank
WordLog’s LinkRank

However, Scoble’s LinkRank continues to grow.

All of these ranks, including the one for this blog, are either askewed or are borked. Is this a result of some sort of a WordPress bug, vendetta against WordPress or a bug on PubSub’s side? Or maybe it was due to an attempt to fix the algorithm that went horribly wrong for WordPress users?

(All of this is really not as serious as I would like to make it sound, so be gentle! ) What do you think?

EDIT: Bob Wyman provides an explanation. Look at comment #3