Communication problems
I have, sadly, been thinking more about WordPress’s enshittification.
Automattic’s own goal is partially just a comms problem, but it’s also (to mix sports metaphors) a forced error.
For a while, my dashboard has been offering me the option to use AI tools when drafting posts and as recently as last month there was a blog post about exciting AI courses.1 This was presented as a feature, a good thing, WordPress jumping on the latest tech bandwagon.
Yesterday’s official “More Control Over the Content You Share” post (comments are closed) takes the opposite position. An opt-out is a feature, a good thing, WordPress going above and beyond because they’re a company that cares about their customers’ privacy.
If this had been an opt-in scenario, fine.2 Better than fine! I would like an extra helping of bot-be-gone! But it’s not an opt-in, it’s an opt-out. I didn’t click the opt-out box until last night, so I assume everything on this site at that time has already been sold off.3 I’m not naive; I assume this site has already been scraped. We’ve long known that bots disrespect robots.txt and other wards. But it’s one thing for a company to say “we’ll do what we can to discourage bots from scraping your site, but we can’t guarantee other companies will behave ethically” and quite another to say “if you hear about this box and click it, we won’t specifically sell your data to a company we’re working with.”
Automattic can’t decide if !AI is the next new thing, or another security threat. This mixed messaging left them in an exceptionally poor position to inform users about upcoming changes. (It’s not at all clear to me that they wanted an informed user base. But if they did, then they went about it poorly.) And it also leaves me unclear as to their future plans. Have they made the strategic decision to kill the golden goose and try to monetize all the data now? Are they going to proceed with, essentially, two different user bases, one with modest security needs and more monetization options and the other with tighter security and lower discoverability (because that opt-out also opts out of Reader)? This was an internally divisive decision; will there be backtracking, or re-tracking? None of these thoughts fill me with confidence.
Branding problems
Since I saw news of the data selloff yesterday, I have also seen a fair number of people pointing out that WordPress.org is not the same as WordPress.com. This is quite true. WordPress is an open source product that can be downloaded and self-hosted. Automattic owns WordPress.com and Tumblr. Automattic is the immediate problem.
But it’s a little trickier than that. Since WordPress is an open source project, it has a lot of contributors, and there’s a lot of overlap with Automattic. Speculation is already swirling about which plug-ins may or may not be safe to use on self-hosted WP installs. There is also the question of whether the core product will remain safe to use. I’ve seen a number of folks on Mastodon pointing out that the dev community would fork WP if anything untoward happens…but that is less than encouraging from my perspective. It still points to a future vulnerability.4
I may end up deciding that the correct answer for me is to move to self-hosted WordPress with judicious use of plug-ins. That certainly is an option that works for folks with needs similar to mine. It’ll also mean more work on my end, and a need to continually keep up on who is contributing what to WP and various plug-ins and avoiding anything by Automattic.
I know something about open source development and something about the split between the .com/.org.5 A lot of people don’t—and that is at least partly due to an intentional branding decision. It’s going to backfire now. There was a lot of goodwill—even if much of it was passive—toward WordPress and, therefore, Automattic. I’m not sure how long that will last, despite the considerable inertia involved.
Even if you’re paying for the product, you are the product
One of the things I find most upsetting about this situation is that we (the generalized we, but also me in particular) have largely accepted “if you’re not paying for the product, you are the product” as a way to navigate the array of shiny offerings laid before us. But in this case, paying doesn’t help.
Note that I don’t think Automattic should be selling anybody’s data, whether they’re on Tumblr, a free WordPress plan, or a VIP Enterprise plan.6 But again, I think there’s more of an expectation that this might happen if you’re using a service for free (this has certainly always been my attitude about Gmail, but it was worth sucking up because of the spam filters; that attitude is changing, however. But still, it’s a trade-off I made up front, and I’d be way more upset if Proton started shenanigans with my paid account). And Tumblr especially…well, Tumblr is practically defined by a cycle of poor moderation decisions and sales to companies that don’t know what to do with it and eventually throw up their hands in despair.7
But. I assume companies that sell a service are setting prices where they want it to be. I assume my hosting fees more than cover whatever advertising Automattic would otherwise make off a free site; I similarly assume that the storage and WP maintenance (both being done at scale) are also covered. Thus I am particularly displeased that my data is also up for grabs.
Because that’s basically what I’m paying for: data management. I’m not paying a lot, but I’m paying what’s asked. I’m also not looking for a lot of security. I don’t need uptime guarantees and I’m not dealing with financial data, medical data, information requiring a security clearance, or anything like that.8 The literal bar is “please hold onto this data and do backups sometimes.” I thought “and this is my stuff I’m paying to you hold, please don’t sell it” was implied, but I guess not.
This is not me, a middle-aged, middle-class white lady, being a Karen. I don’t want to speak to the manager. I don’t need to speak to a manager. Companies are made up of adult people who make decisions, and as a fellow adult person I will make the decision to stop doing business with them.9 The only question is what non-Automattic option is least enshittified? And when will I have the spoons to make the shift?
https://aphowell.com/2024/02/28/trust-issues-with-wordpress/

