Last night I tested a few ideas at the DC PHP meetup and got some great feedback from the attendees. Some early reviews:

I’m continuing to conduct a lot of research for this talk. There’s a lot WordPress has learned over the years, so I’ve been searching through the codebase and old commit messages, as well as compiling a ton of data and statistics. If you have anything you think might help, please contact me. Here’s the full talk description:

WordPress is Everywhere: Extreme Portability as a Double-Edged Sword

WordPress has tens of millions of users worldwide and powers over a fifth of new sites. But such a large and diverse user base presents unique challenges, and as it approaches its tenth birthday, the WordPress codebase is showing its age. So why is it so ubiquitous?

The answer lies not in its UI, UX, ecosystem, or community, though those are certainly among its strengths. The answer lies instead in a core philosophy that holds the user above all else.

This user-centric design starts not with the interface, but rather with the code itself. Developers should approach software development with an unwavering promise they will deal with the nonsense instead of passing it off to the user.

Some WordPress positions might seem draconian and inflexible. Backwards compatibility is almost never broken. The technical requirements appeal to lowest common denominators. But because the project maintainers deal with all the pain — technical debt, difficulties with PHP, working on as many server configurations (and misconfigurations) as possible — its users don’t have to. Thanks to the WordPress project’s portability efforts, you can pick a web host or a PHP configuration at random and WordPress will run on it. Because of this, adoption has soared.

The way WordPress operates is not for everyone. But whether your projects are used by 10 users, or 10 million, it may help you to see your code in an entirely new light.

Tickets are still available. Hope to see you there!

New Oversight.House.Gov is built w/ @wordpress, rare for govt sites, to support fast improvements in response to your feedback

— Darrell Issa (@DarrellIssa) March 15, 2012

Government moves at a pace best described as glacially, so for them to recognize that WordPress can help them react quicker, that’s just huge. I’ve learned in D.C. that ease of use and speed of development are very rare things for .gov sites, even those built on open source. Not to mention cost-effectiveness in an age where federal government IT procurement is being upended. Look, they even created cheesy WordPress-in-government infomercial:

The video takes a shot at bad government websites, and while the new site isn’t the prettiest thing in the world, I like the point they’re getting across: Government can excel on the web using the same free publishing software as many of their constituents. It won’t be rare for long.

Related: Ben Balter’s post on WordPress and government from last week is making waves.

Bonus: The Consumer Financial Protection Bureau recently gave their WordPress site a new coat of paint.

Did you know that before you could write crazy shit on Tumblr and WordPress, people had to type their crazy shit up on what was called paper — and distribute it by hand, reaching the few paranoid conspiracists within walking distance.
— Jon Stewart

That was The Daily Show’s Jon Stewart on Tuesday night, referring to Ron Paul’s decades-old newsletters. Just another way to describe democratizing publishing.

Bonus: Ron Paul’s 2012 website runs WordPress. And he’s not the only one.

Double Bonus: Comedy Central’s Indecision site is WordPress too. (I knew thedailyshow.com wasn’t, but it didn’t take long to find one that was.)

Updated with the clip:

The Daily Show with Jon Stewart

When explaining this to developers at conferences, I generally mention the preference panels in Adium, a Mac OS X chat client. It practically has an Advanced tab for the Advanced tab. Stuff everywhere. Problem is, when there are too many options, your users can’t find any of them.

Open source doesn’t need to be this bad. One of the tenets of the WordPress philosophy is Decisions, Not Options:

When making decisions these are the users we consider first. A great example of this consideration is software options. Every time you give a user an option, you are asking them to make a decision. When a user doesn’t care or understand the option this ultimately leads to frustration. As developers we sometimes feel that providing options for everything is a good thing, you can never have too many choices, right? Ultimately these choices end up being technical ones, choices that the average end user has no interest in. It’s our duty as developers to make smart design decisions and avoid putting the weight of technical choices on our end users.

Buried in the annals of WordPress, a release philosophy document was heavily inspired by the writings of GNOME contributor Havoc Pennington. On preferences, he wrote (nearly 10 years ago) —

It turns out that preferences have a cost. Of course, some preferences also have important benefits – and can be crucial interface features. But each one has a price, and you have to carefully consider its value. Many users and developers don’t understand this, and end up with a lot of cost and little value for their preferences dollar.

• Too many preferences means you can’t find any of them.
• Preferences really substantively damage QA and testing.
• Preferences make integration and good UI difficult.
• The point of a good program is to do something specific and do it well.
• Preferences keep people from fixing real bugs.
• Preferences can confuse many users.

I find that if you’re hard-core disciplined about having good defaults that Just Work instead of lazily adding preferences, that naturally leads the overall UI in the right direction. Issues come up via bugzilla or mailing lists or user testing, and you fix them in some way other than adding a preference, and this means you have to think about the right UI and the right way to fix problems. Basically, using preferences as a band-aid is the root of much UI evil.

WordPress is known for its simplicity and usability, but I can still think of a half-dozen options I wouldn’t hesitate to remove under the right circumstances. Many WordPress plugins subject their users to too many options. Don’t add settings screens simply because you know how.

Challenge yourself. Learn to decide.

The WordPress 3.3 credits page was updated today, for likely the final time. In five months, there were nearly 1,200 individual changes to WordPress (and counting).

The credits page lists every individual who contributed to the latest release. A few stood out for their contributions, not just of high quantity, but of tremendous quality: Dominik Schilling (ocean90), Cristi Burcă (scribu), and Sergey Biryukov. The three are listed as contributing developers to 3.3. The core team — including guest committers Jon Cave (duck_) and Daryl Koopersmith — worked with these three daily, and they had a collective hand in nearly every major task this release.*

There were also three individuals added to the ‘Recent Rockstars’ group for their recent contributions to core development. This release we chose Chelsea Otakan (chexee), Helen Hou-Sandi, and John Blackbourn (johnbillion). All together, the six contributing  developers and rockstars we’ve recognized contributed more than a fourth of all Trac comments and two-fifths of all props.

If you want to see the full list, click the WordPress icon in the 3.3 toolbar and head on over to the credits page, or wait for the release post (coming soon!). Maybe I’ll also experiment with a word cloud again as I’ve done in the past.

In WordPress 3.4, we plan to recognize first-time contributors on the page, so if want to see your name in lights on the credits page, contribute to WordPress.

* Fun fact: Average age of the five mentioned in this paragraph: 23.

In preparation for that, I went on a tear yesterday and contributed to six posts for developers on our main development blog. The posts were a mixture of tutorials and API documentation what’s new and what’s changed in 3.3:

• Admin Bar API changes in 3.3. An overview of what changes might break your plugin, how we’ve tweaked the terminology and APIs for 3.3, the new Groups concept, and how to move and modify menu items.
• What to watch for: Javascript and Editor changes. There were quite a bit of changes here. jQuery was updated to 1.7.1, the current version. The full jQuery UI is now included, and was updated to 1.8.16, also the current version. And then there’s an example for wp_editor(). The QuickTags API (the HTML editor toolbar buttons) was rewritten, and we’ve improved both wp_localize_script() and wp_enqueue_script().
• New API: is_main_query(). I introduced this function and WP_Query method during my ‘You Don’t Know Query’ talk in WordCamp Portland in September.
• Do not include wp-admin/includes/template.php to get add_meta_box(). I’m not even sure where to start with this one. When developing 3.3, we found that some plugins were doing something wrong when trying to call add_meta_box(). (Really, really wrong.) So consider this post a protip.
• The admin_user_info_links filter is gone. This needed to happen since we combined the admin bar with the admin header. Not too many plugins were using it. This comes after we dropped favorite actions in 3.2 as the UI continues to be refined.
• Help and screen API changes. This post goes through the process of adding new help tabs, as well as how to use the screen object to determine the context of the current page. I spent a lot of time fleshing out WP_Screen in 3.3, so it was nice to see it all summed up in just a few hundred words.

WordPress 3.3 — coming soon to a site near you.

My best friend Ben Balter wrote a script called When Did Nacin Last Blog (don’t worry, it’s on Github).

My girlfriend planted the “When did you last blog?” question at WordCamp Richmond last month.

My own father called me in October while I was in Seattle to quiz me on when my last blog post was (“April 16,” I knew off the top of my head), after which he pointed out I was also in Seattle then.

My boss recently sent me a friendly reminder letting me know it’s been 229 days since my last post. I wouldn’t be surprised if Matt used Ben’s tool.

It’s not that I don’t post to blogs. In the last 233 days, I’ve posted 19 times to the WordPress development P2, 16 times to our translators blog, and three times to the WordPress Blog.

And it’s not that I don’t write. I use Twitter as a microblogging tool to share links and ideas. And since April 16, I’ve posted more than 2,600 comments on the WordPress bug tracker, and opened 81 tickets. (Exactly one-third remain open.)

I think the problem is two-fold. I don’t make time to blog, even though posting to a personal blog might as well be a job responsibility for me. I truly love blogging and web publishing, it’s just that after spending 60 hours a week on building, testing, and using web publishing software, I typically want to take a break. Second, I find other ways to publish most of the content I would publish, whether it’s on our bug tracker or on Twitter.

I’d like to change both of those things. So I’ve done some things to prepare for a change in routine.

I’ve switched to the Twenty Eleven theme using the one-column layout. I probably prefer Twenty Ten visually, but Twenty Eleven supports a number of post formats that I hope to leverage while microblogging. I have a feeling I’ll continue to tinker with this blog’s appearance — I’ve liked the designs and blogging styles of a few good friends.

Just a month ago, I finally acquired the nacin.com domain, which I’ve wanted for many years. Until this weekend, the site resided at andrewnacin.com, but given that nacin is my identity both online and in real life (I’m called Nacin more than Andy or Andrew), it was symbolically important to me. (Thanks Pete Mall for being my proxy for negotiations.)

I have been keeping a list of potential essays to write, and started to draft a number of future posts. With the final release of WordPress 3.3 is just around the corner, there are a number of tutorials for cool new APIs I could probably cover. There’s a lot more I can write about — in the last nine months, I’ve worked on both coasts to get open source in newsrooms and government agencies. I’ve attended meetups in New York, Seattle, and of course D.C. I’ve evangelized WordPress at nine WordCamps, a PHP conference, and a BBQ festival.

I’ll also be posting links, quotes, and ideas that would normally go straight to Twitter. Lots of WordPress, yes, but you’ll likely see an infusion of non-WordPress things I find interesting, particularly in the areas and intersections of technology, open source, journalism, and politics (based on some of my recent tweets). I last blogged 233 days ago. It’s time this has changed.

First, during my development talk, I was asked for five tips on writing secure code. In return, I pulled up a recent email I wrote where I provided 10 tips:

Never trust the user. You need to assume that all user input is insecure, and that all output is unescaped. The primary points are:

1. Always escape attributes, URLs, and text on output.
2. Always sanitize, scrub and validate input.
3. Always prepare database queries.
4. Never trust the user.
5. Never output anything that is unsanitized or unescaped.
6. Never store anything that is unsanitized.
7. Know the difference between authority and intention.
8. Never trust the user.
9. Always use the many helper functions — we make it easy to write secure code.
10. Never trust the user.

Best Practices for Plugin Development

Ignite Talk: Ask Not What WordPress Can Do For You