Author: Paul Gilzow

This is part 2 of my recap. Be sure to checkout part 1.

One thing I forgot to mention about Chris Lema‘s presentation from part 1 that stuck with me is:

If there is something new you want to start doing, attach it to a good habit you already have.
— Chris Lema

The thought is that by attaching the new action to your previously established habit, you’re more likely to integrate the two items together and adopt it.  As someone who is fairly regimented, with several established habits, I’m excited to test out this theory.

Day 2 started off with, in my opinion, one of the best presentations of the conference: WordPress & SEO in 2016 by Joost de Valk.  I had the pleasure of meeting Joost Thursday night.  Incredibly funny, nice guy. And he was full of remarkable advice. Canonical links are extremely important, and should be added to core.  He busted some myths: @google will not find everything by itself. Link to your content! From inside and outside your site.  Luckily, Joost said that sitemap.xml are going to be built into WordPress core.  

“Not having a mobile friendly site is like taking a knife to a gunfight”
— Joost de Valk

#wcus "if a mobile version exists, it will become the canonical version that is indexed [with google]"

— Gilzow – @[email protected] (@gilzow) December 3, 2016

He went on to say that you should not use more tags than articles; it just doesn’t work for SEO, and that fewer tags/category/taxonomy terms is better than too many.  In addition, you should have a post or page for each topic.  He left us with two last bits of advice. First, find good, old content on your site, update it, making sure it’s content and information is up-to-date and then change the publication date. Second, think of your most important keyword, determine which page on your site should match and then test via ‘keyword site:yourdomain‘.  For example wpdirauth site:gilzow.com.

Next up was Blogging – The Best Thing I’ve Done as a Developer by Sal Ferrarello, and a major reason why I’m writing these posts.  The major focus of the talk was any time you have a problem and need to research it, take a moment and write about it.  Specifically,

"If you spend more than 20 minutes trying to figure something out, blog it." #wcus

— Gilzow – @[email protected] (@gilzow) December 3, 2016

It doesn’t have to be a major undertaking, take a problem, write a solution. Keep a tight focus and make it short.  If people are rude, or overly critical, just delete their comments.  Don’t let the fear of trolls prevent you from writing. By writing up the solutions, you’ll make yourself more efficient. How is that? How many times have you ended up researching the same problem more than once? Yeah, we all have.  By writing up a post with the solution, you can now go back to your own write-up for the solution, instead of searching stackoverflow again.  Additionally, when you write it out, you begin to solidify the solution into long-term memory.

Target the keywords you used when researching the problem and use them in your post to make them easier to find later. In fact, if you do it right, the next time you search for the solution, your write-up might be the top match in your search! In addition, you’ll get the added benefit of increasing your own brand.  And when you increase your personal brand, by extension you increase your company’s brand. Win Win Win!

It was about this time that I came to realization that there weren’t going to be any security-related talks or presentations at WordCamp. Given WordPress’ history with security and the abundance of security issues surrounding WordPress, particularly in the area of plugins and themes, I was shocked that the confernce organizers had elected to not include at least one talk on security or how to secure your WordPress install.

I'm *really* shocked there are ZERO security-related presentations at @WordCampUS 2016. #wcus. we need more security education in #WordPress

— Gilzow – @[email protected] (@gilzow) December 3, 2016

I had people respond asking if I had missed the Let’s Encrypt presentation by Nancy Thank. Now, I had originally planned to go to it instead of Sal’s talk, thinking it was going to cover encrypting the database behind WordPress, or perhaps encrypting sensitive files.  Instead, it covered the Let’s Encrypt SSL initiative, and how to use it. Now don’t get me wrong, SSL is very important for protecting your credentials while logging in, and your session IDs while logged in, but unfortunately, many people mistakenly believe that having SSL on a site equates to having a secure site.  Nothing could be farther from the truth.  Great minds must think alike because Tony Perez wrote up a post about this exact topic.

THIS. SSL is important, & U should do it, but it does *not* protect your site. it protects the communication between your site & user #wcus https://t.co/8UTwz5ebjD

— Gilzow – @[email protected] (@gilzow) December 3, 2016

The discussion of the lack of security presentations and the SSL debate continued over lunch with the rest of the Sucuri team. We all agreed that more security-related education in the WordPress community is desperately needed.  After lunch, I went to A view from Google: The latest in Search and mobile by Maile Ohye.  Wow, so much incredible, useful information during this session. So much, that it’s too much to try and write out and instead I’m just going to do bullet points:

• Globally, mobile queries have surpassed desktop
• China and india has a huge population of people who are not online yet
• 864 million users in India
• English makes up 54% of the languages used on websites
• Data connectivity is a significant portion of their [india] income
• Voice recognition makes up 20% of queries now
• 53% of visitors will abandon a mobile site if it doesn’t load within 3 seconds
• Google has Search Lite in India and Indonesia, which has decreased load times ten fold
• 60% of mobile data is 2G (!!!)
• AMP is a constrained format, to keep things fast; Many predicting that in two years we’ll all be designing in AMP
• If a mobile version exists, it will become the canonical version that is indexed [with google]
• As of January 2017, Google will warn users about non-ssl sites that appear to be asking for passwords or credit card numbers

Like I said, so much good information in that session.  Last up for the regular sessions was Computational Design and Inclusion by John Maeda. He discussed how design can be used for inclusions or exclusion, and how the changing technology landscape needs to adjust to be eve more inclusive. I learned that pedestrian phone lanes are now a real thing in China and that 20% of Americans have some hearing loss, due to exposure to loud noises, illness, or aging.  You can count me in that 20% unfortunately.  And I worry that number is going to increase even more due to the prevalence of in-ear headphone use, especially among the younger generations.  But my biggest takeaway was

"Diversity is inviting someone to the party. Inclusion is asking them to dance." #wcus

— Gilzow – @[email protected] (@gilzow) December 3, 2016

Rounding out the conference was Matt Mullenweg‘s State-of-the-Word address. I didn’t take any notes as it was pretty crowded (no room for the surface), but luckily the staff at WordCamp US did a fantastic storify: WordCamp US 2016: State of the Word. Big takeaways for me were:

 

 

 

 

• WordPress now makes up 27% of the entire web
• WordPress foundation will help fund Black Girls Code in 2017
• Only 11.45% of WordPress sites are using SSL
• Everything associated with desktop usage is going down, everything associated with the mobile app and browser is going up
• WordPress 4.7 now includes content endpoints in the REST API
• There will be no set releases for core in 2017; design will lead the way, more user research

Once he was done he opened it up to Q&A of which I had been waiting for since he first addressed the crowd.  Hopped up and waited my turn (see the picture at the very top).  I first thanked him for supporting Black Girls Code. I then questioned him on why there were no security-related presentations, and what his plans are for educating the WordPress community on security (video available). He acknowledged that security is important and that the lack of presentations was an oversight.  I found the rest of his answer about educating the community to be lacking.  I fear that those of the community, those of us who are passionate about security are going to have to take up that mantle and educate our colleagues.

Last I want to thank Tony, Dre, Krystle, Renu, WarHammer, Val, Alycia and Kiko and the rest of the Sucuri team for letting me hang out with them.  We had some amazing discussions and I thoroughly enjoyed my time with all of you.  I sincerely hope our paths cross again.

 

Above photo by Val Vesa. 

This is part 1 of 2.

I met Tony Perez at WPCampus back in July. Given how I discuss WPScan ( a tool sponsored by Sucuri) in my presentation, he had a vested interest in seeing what I had to say.  Luckily for me, he was impressed and we discussed in length the state of security on the web and the challenges HigherEd faces in trying to secure their online assets.  Tony and I met up again at HighEdWeb 2016 where I was honored to win Best-of-Conference for my presentation.  Again, we discussed the need for more security education among developers, especially in the WordPress community.  Shortly after HighEdWeb Tony contacted me and asked if I’d be willing to go to WordCamp US and help spread the word about web app security. Considering I’d never had an opportunity to attend a WordCamp, I enthusiastically accepted the invitation.

I arrived in Philadelphia on Thursday and hooked up with Dre Armeda and Krystle Herbrandson from the Sucuri team.  Later that evening I had the pleasure to meet WarHammer (who has no online presence; and i thought *I* was paranoid!) and Kiko. The next morning, I met Renu Hermon, Alycia Mitchell and Val Vesa (the powerhouse from Romania!), which rounded out the rest of the Sucuri team. With everyone together, we headed over to WordCamp.

The first session I attended was Cory Miller’s Managing Your Iceberg with Renu, Krystle and Alycia.  Not at all what I was expecting; he discussed his depression and how everyone only shows the 5% of themselves, the successful, happy PR-side of your life.  He advocated that depression and loneliness in our industry is a big challenge that needs to be acknowledged and addressed.  That everyone has insecurities, everyone has the same problems, just different names and that ego, pride and shame hold us back from living the human experience at max level.  You need to surround yourself with WYSIWYG people. We all agreed we didn’t know we were going to begin WordCamp crying.

From there I went to A Dash Through a WordPress Release and Code Review: Keeping Things Secure, Clean, and Performant. My big take away from these two sessions is that even people working on WordPress use Git. Someone asked the question I wanted to ask: if even the WordPress core team (and Automattic employees) use Git, will WordPress finally move away from subversion over to Git? The short answer: no, subversion is to integrated into the workflow for WordPress. I had a difficult time with this answer.  Just because something is currently integrated, and you have time invested, doesn’t mean it’s the best or most efficient solution. You should always reevaluate your processes and see if there are new technique/tools that can make your work more efficient.  I hope the WordPress team reconsiders in the future.

Next up was Answers By Pippin. It was focused on those people who are developing plugins/themes for a fee, which isn’t necessarily relevant to my situation. However, I did still come away with a couple of things: If you are a plugin developer, you have a responsibility to build your plugin with an API that other devs can use. To be honest, I had never thought about that when developing either wpDirAuth or MizzouMVC.  I’m now dedicated to building in hooks for other developers to extend and adapt my plugins.  The second take-away was: have a passion project, preferably something that isn’t the same as work.  Don’t burn yourself out working 24/7/365.   This was a common refrain at WordCamp, to take a break and not work yourself to death.  It was at this point I realized the conference was heavy on the human-side of WordPress and much less on the technology side.  Not that the human-side is bad, I had just anticipated a WordCamp to be more tech-focused.

I want to mention how incredibly inclusive WordCamp was. From gender-neutral restrooms, to nursing pods, to live transcriptions in the presentations, to their code-of-conduct, WordCamp staff went above and beyond to make sure all attendees felt welcome.

After lunch I went to check out the Contributor panel.  It was interesting to get a glimpse into how contribution works for WordPress core. The big take-away was that the accessibility team needs more accessibility advocates on every team. I started to wonder if the same things could be said about security.  Having now contributed to the Training team (which I’ll discuss in part 2), I can confirm that there is definitely a need for more security advocates on the other teams.

From there I went over to The Back End Is Dead: A New Paradigm for Assessing Talent & Creating Great Applications since I consider myself a back-end dev and figured I better find out why the back-end is dev.  Mostly it had to do with no longer thinking of hiring in terms of back, front and full-stack developers but instead hire for the data layer, business layer, presentation layer and operations layer.

After that I went to Lessons in New User Experience and then to How to Speak “Conversational Developer”.  Both excellent presentations and I wish I had taken better notes.  User Experience was about the VIP team at Automattic had tested variations in the UI/UX for new users and getting them to set up their first team.  They discovered that if you do the hard parts for people (in this case, pre-populating and setting up the initial parts of a site), they’re more likely to come back. Conversational Developer revolved around terms that developers commonly use and explaining them in an easy-to-understand way for non-techies.  It has inspired me to come up with a new presentation for HighEdWeb 2017. 😉

I finished up the day with Finding your voice by blogging. WOW. If you ever have an opportunity to see Chris Lema speak, do not miss it. Seriously. He is a fantastic speaker. And funny.  Absolutely love this quote:

“How many of you in here are punctuation nazis? Raise your hands because I’m going to pray for you right now.” — @chrislema

I work with a bunch of punctuation nazis which made me think of them.  But Chris’ presentation was truly inspirational.  A big chunk of why I’m writing this post is because of his presentation.  I hung on every word of his presentation so I don’t really have any additional quotes, but the gist was that you should just start writing, and keep writing. Don’t listen to that inner voice that tells you you can’t do it. Ignore the haters and trolls.  Don’t hesitate to delete negative comments; it’s your website, you don’t have to put up with that.  Just keep writing until you find your voice.

That’s it for day one.  Check out part 2.