If Anil is following this then my experience of how Typepad handled a security flaw in their password implemention (reported to them over a year ago) makes me doubt that they take security seriously. They did nothing. At all. And have no plans to.

more here: http://bohanna.typepad.com/pureplay/2008/07/typepad-securit.html

keith

I run several Wordpress.org blogs, both installed on my own server as well as through a host that has 1-click install. I’m also working on some Typepad blogs, which I’ve done in the past.

My issue with Typepad is the lack of metadata customization without going into the custom templates. I LOVE the SEO plugins for Wordpress and the other plugin options.

While the idea of Typepad offering easy hosting is nice I’m worried about being stuck in the mode of having to go deep into editing code myself (which I’m not even sure is possible on a post by post basis) or having subpar SEO.

It’s a known fact that google ranks higher based on the first words in a title tag, and on a post TypePad puts the post title at the END of the title tag. Anil if you’re reading this, case TypePad do a quick fix on that? Even from a bookmarking perspective it’s not user friendly to have blog title: post title

At first, I used Movable Type for my blogs, but I dropped it as many people did when Wordpress came out. Wordpress is GPL, and at the time, this wasn’t particularly important to me, but as time went on, I began to value this more and more. Upgrading Wordpress is a pain, and there are updates too frequent for my liking.

So, I moved to Wordpress.com — adding a domain name to the site was easy, and cheap. I didn’t like the restrictions and the pay structure of Wordpress.com, and when I realised it is run on a proprietary web server, I decided I needed to try and find an alternative.

Should I go back to self hosting? Yes. Should I go back to using Wordpress on my server? No.

Movable Type had gone GPL. Movable Type was free software now! Initially, I had some problems with configuration, getting things set up. But now I’m really happy using Movable Type.

There are some really good features in Movable Type:

* Static HTML — renders your blog as static HTML files on disk. I can’t express how much I love this.
* Multiple Blog by default — Wordpress MU. Meh. No thanks.
* Good set of themes by default — Wordpress needs to ship with some better themes.
* Infrequent upgrades — 150 or so days since the last security update to MT.

Problems with Movable Type for me:

* The name — ‘Movable Type Open Source’ is too long, and too confusing. Movable Type SHOULD be the name for the product. It shouldn’t be a different version, or different name for the free software version. I’ll admit I don’t like the term ‘open source’, which adds to this.
* Not enough themes out there — Wordpress has pwned MT on this.
* Too many confusing editing modes — Markdown, Textile, etc.

I’d like to see Wordpress address some of these. I’d like to see MT address them too.

What annoys me is what feels like name calling. It seems a little weighted on the MT side — far too much Wordpress bashing for my liking. Matt has been better about this, but I’ve seen a fair amount of it from both sides.

I’d like to see a service — Akismet or MT AntiSpam released as GPL, and soon. I want to run my own version for my own blogs. I don’t want to send all my comments to a third party.

I’d also like to see both projects contribute directly to getting good, up-to-date packages of their products into GNU/Linux distributions like Debian and Fedora. They’re already there, sure. Given the number of updates from Wordpress, they should be distributing their own Debian packages. Movable Type should do the same.

Run a repository, do it right.

But security is most decidedly an important issue, which in light of the ever lopsided battle against malware, criminal traders and the resulting (more visible) spam deluge deserves a more serious look than you suggest, in your rebuttal of Anil’s pointing to reported vulnerabilities since 2005.

On the original page what Anil wrote was simply this:

We searched the vulnerability database since 2005 for Movable Type and for WordPress, and included the partial reports for this year. In the chart, a lower bar is better. The results speak for themselves

And the number of reported vulnerabilities in any of the given years for the two platforms are just what they are. There’s no mention of severity, there’s no statement toward turn-around time, and there’s no indication of how many zero-day exploits were among the given numbers.

With an angle as important for any blogger - if only from a liability and reputation point of view - as that of looking at the number of reported vulnerabilities as a yardstick, you can’t simply walk away from Anil’s comparison by merely pointing at the possibility that arcane vulnerabilities in obsolete / deprecated versions are included in those statistics.

Honestly, without looking any further for an explanation (at least in theory, Perl might benefit from its obscurity, compared to PHP’s raging and still increasing popularity) or any possible mitigating factors (e.g. the number of “core code” vulnerabilities versus those arising from plugins or other “popular” modifications) a statement that ninety-one reported security issues were reported since beginning of 2007 for WP, versus all of three for MT, is something that deserves a better riposte than sheer dismissal of the numbers. For me, a valid counter point might perhaps have been that WP is more “accessible” (and therefore more “prone” to unearthing problems) as an open source project, but that’s not the argument you present.

Personally, I’m certainly sympathetic toward - if not in plain agreement with - your other observations on an overall better consistency, coherence and user-concentric presentation of WP’s administration tasks, but let’s not pretend that a demonstrated lesser exposure of security issues is a whimsical argument, just to bypass a valid point, either.

Come on, Matt. Please don’t try your PR spin when it’s easy to prove you wrong.