Trust, Community, and Automatic Updates
summary
WordPress implements automatic updates for only patch releases, using a staged API rollout, package checksums, copy-and-verify file replacement, VCS detection to skip managed sites, and rollback on critical failure. The launch pushes 2.7 million updates in 24 hours and yields a 0.4% critical failure rate (about 99 problematic sites) with average update time ~4.5 seconds. Plugin security fixes also auto-deploy, reaching ~80% of affected installs within 12 hours.
AI-written summary · about
chapters (11)
- 0:00Start
- 2:58Striving for Simplicity
- 10:39Will My Site Have Downtime
- 20:19Instructions File
- 24:24Disabling Auto Updates
- 26:19Rollback
- 26:43Critical Failure Email
- 31:55Lessons
- 32:51Data Analysis
- 40:15Portability of Wordpress
- 44:35Security Concerns
related talks
36mHow the WordPress Ecosystem Handles Security and What You Can Learn from It
11mKeynote: Rebuilding Trust: A FAIR Path Forward for WordPress and O...
19m"Hackers automate but the Drupal Community still downloads updates [...]"
01h 06mFireside chat with Ma.tt Mullenweg
39mSponsored BoF: Cultivating Quality in Open Source: Modern Strategies for Shared Res...
37mAMA: The Future of WordPress
17mBuilding Bridges: Fostering Open Source Community and Collaboration in the WordPress Ecosystem
21mKeepers of the Machines: Examining How System Administrators Manage Software Updates