I'm the founder/CTO of Defiant Inc. We make Wordfence, the most widely used WordPress firewall and malware scanner. We protect over 5 million websites.
The new normal for the next decade: You must protect the public from us and all others, and we are your closest ally so we make your rules for us and our competition. This wasn’t a lucky outcome. They laid the groundwork years ago with the AI “ethics” movement and this was the play all along.
Amazing how the dev community is suffering from a similar inability to approach the subject of real world AI efficiencies and business benefits. I don’t think it’s helpful to accuse the other side of psychosis. It disqualifies any data or experience they bring to the conversation.
Metrics would help others who may want to rescue the project consider the options. Eg user base would make it clear if there’s an immediate opportunity to work with the author to launch a paid backup service around the project, funding continued work on it.
If creating OSS is this low effort, the right question is: What high effort assets, that are valuable to other builders, should open communities be working on? And I think the answer is open source models with open training and open training data.
The generous take is that this is someone's pet project that marketing got too excited about, and that the leadership haven't applied their minds to. GPL provides a moat for the community, who are contributing their time and energy into a project. It ensures that, even if a commercial company grabs your software, extends it, and commercializes it, that you can fold those improvements back into your original distribution. While the commercial entity benefits from your free labor, you benefit back from theirs.
Re-implementing WordPress (their words, not mine) as MIT licensed, while legally questionable, breaks that virtuous cycle and removes the community's moat. They've taken WordPress's roles and menus and borrowed its Gutenberg code (which is GPL), and launched it as an MIT licensed product, which breaks that virtuous cycle. It means e.g. a hosting company can take the product closed source if they want to, and never have to contribute any of what they build on top of the community's work, back to the community.
Emdash uses WP's RBAC roles. Also uses their menus. Also depends on @wordpress/block-serialization-default-parser which I think might (??) be able to be used by an MIT project even though WordPress is GPL.
They used Claude Code it seems because the first commit has a CLAUDE.md file which became an AGENTS.md.
https://www.wordfence.com/
We are usually hiring so please check:
https://www.defiant.com/
Email me at:
mark at defiant·com