Wordpress Update Causes Privacy Controversy

WordPress has rolled out an upgrade to the popular blogging tool adding native tagging support, plugin update notification, URL handling improvements and more. Version 2.3 of WordPress can be downloaded from WordPress.org. Perhaps the most welcome news for WordPress users is the native tagging support which allows allows you to use tags in addition to […]

wordpresslogo.jpgWordPress has rolled out an upgrade to the popular blogging tool adding native tagging support, plugin update notification, URL handling improvements and more. Version 2.3 of Wordpress can be downloaded from Wordpress.org.

Perhaps the most welcome news for Wordpress users is the native tagging support which allows allows you to use tags in addition to the existing “categories” function (which many used as a tags replacement). Included in the new version are importers for a number of third party plugins so, if you?ve been using a plugin for tags, you can easily fold your data into the new system.

A more controversial new feature is the update notification which lets you know when there is a new release of WordPress and when any of the plugins you use has an update available.

There’s a long thread on the Wordpress Google Group about this tidbit: “It works by sending your blog URL, plugins, and version information to our new api.wordpress.org service which then compares it to the plugin database and tells you what’s the latest and greatest you can use.”

A number of people in the Wordpress Group thread have decried the new update feature as an invasion of privacy. Founder Matt Mullenweg responded to the criticisms saying, “The only new information being sent by the update checker is PHP version and a list of plugins. If you don’t like that feature, please install a plugin to disable it.”

The plugins Mullenweg recommends are Disable WordPress Core Update and Disable WordPress Plugin Updates.

Reading through the whole thread it seems that perhaps Wordpress ought to look into sending token values rather than URLs since there is, however slight, the chance that the combination of plugin data, URL and PHP version could be used against you.

Mullenweg is probably correct in arguing that there are far more egregious privacy issues you could concern yourself with, but since changing the details of the update mechanism wouldn’t affect its function (at least as far as I can tell, correct me if I’m wrong), doing so might help to mitigate the controversy and ease user’s privacy concerns.

See Also: