@toderash@mastodon.cloud Freelance Thinker.
Winnipeg
Joined April 2009
- Tweets12.7K
- Following1.1K
- Followers772
- Likes13.6K
I dropped a piece on The Future of the CMS, building on a number of ideas surfacing in multiple #CMS ecosystems including #TYPO3 #Drupal #EmDash #WordPress amid emerging AI realities. Two parts, but not long, give it a read. toderash.net/blog/the-cms-of…
Brent Toderash retweeted
BlackRock’s latest SEC filing values its Automattic shares at $14.33 per share. They originally invested at $85 a share in 2021. That means their market cap has dropped from $7.5 billion to $1.2 billion.
I think that's probably why the CEO lost his job.
therepository.email/automatt…
Curious, why this distro? I've been on a Linux desktop for 20+ years now, usually recommend Mint these days for new users; it's my daily driver as well.
When Open Source is not enough: Redux. Open governance & open access matter, especially in an era where digital sovereignty is becoming the concern it always deserved to be. @jdevalk gets it - read this:
When Dries wrote about License-only versus Stewarded Open Source, I knew I had to write a follow-on to that:
joost.blog/who-can-cut-you-o…
Contrarian take: CMSs should stop making it easier to draft AI-generated content within the CMS. On behalf of the entire internet, we don't want more AI Slop.
I was just about to ask if there was anything from OKF/ARD that would trigger an update to specification.website
Brent Toderash retweeted
Launching specification.website.
A platform-agnostic spec of what a good website does: SEO, accessibility, security, agent-readiness, performance, privacy, i18n.
Every claim cites a source. Ships with a checklist, llms.txt, MCP server, and Agent Skill.
Free. Open Source.
Old enough to not consider this all that old - it has a GUI! I did really like Fireworks though, too bad it was acquisition-killed.
Haven't dug into the code, but have thought about this some. Ideally, the secret can't be in the same location, or is itself encrypted with a passphrase, but that'd require manual input so not realistic for a lot of APIs. Key rotation could perhaps decrease exposure.
Good thought, but unless you're doing something besides the salt, it could be trivial to decrypt on a compromised site. You must assume if they can get the db, they can get everything: iow, always assume that if you're hacked a little bit, you're hacked completely.
Raising a security concern is rarely just FUD. The issue is that AI keys are *worth* the effort, as others have noted. WP has no secrets manager or sandbox, so a compromised plugin roots the site: your API key is as secure as your weakest plugin or theme.
Brent Toderash retweeted
WordPress 7.0 combined with plugin vulnerabilities = free AI tokens. There will be an absolute rush by hackers to steal API keys.
Love this concept, similar to repo-health scoring initiatives elsewhere. Would love to chat about surfacing some of the data in fair.pm for use in assigning a Trust Score with shared objectives in supply chain security. Hit me up via DM if you're open!
