This is home one and you are in the session for evaluating plugins, strategies to effectively extend WordPress presented by Cathy's Hand. For 20 years, Cathy has built web applications for large Fortune 100 corporations, independent entrepreneurs, and everyone in between. Cathy has worked with a number of technologies that feels most at home working with web-based standard-driven applications such as WordPress. She is passionate about making complex technology easily acceptable for everyone, and Cathy loves WordPress for reasons to numerous to list here. She currently works for WordPress, where she's done everything from operations to site cleanings and focuses on helping enterprise customers manage security. She currently lives in Phoenix, Arizona, but her heart resides in Mount Chesa, California. Please give a good welcome to Cathy's hand. Hi guys, thanks for coming to my talk about evaluating plugins. How many of you have installed a plugin from the repository? How many of you have purchased a plugin from a source other than the repository and installed an on-site? Cool. And how many of you have written a plugin? Awesome. Wow, so we've got a good group here. We're going to talk today a little bit about the power that's behind WordPress and that's plugins. I've been dealing with data-driven websites for a pretty long time. I started blogging and developing data-driven sites about the same time. The original blogging tools that came out didn't use a database, but WordPress came along and was using a database. I said, this is the way to do it because what the other blogging tools were doing were generating all of these HTML files, so managing these sites became very, very difficult. So having a database actually managing the site content behind the site made a lot of sense. At the time, there were no plugins. I had one plugin called Hello Dolly, which I think you guys have all seen on your Russian installs of WordPress. And the idea behind plugins had been planted, but not fully explored the way it is today. I have been working for WordPress for the past few years. I started cleaning sites. I thought that sounded fun. It was a lot of fun. And then moved into doing a number of different things. I've seen some things and from my work there, I've learned a lot about why plugin management is important. And I wanted to share that with Tovalli today. So our goals today are to learn some strategies to really extend WordPress. I mean, what did WordPress start out doing? It was a blogging platform. It was not designed initially to be a data-driven website that was having commerce happen. And all kinds of other things. But with the power of plugins, WordPress really turned into the ability to have small site owners develop data-driven sites that really extended the power of what they can do. So we're going to look at which plugins are right for the job. If a plugin is high quality, if it's actively being developed, will it last? Because once you plug in a plugin into your site, you start entering data into the system. And so extracting that data and bringing it into a new system can be kind of difficult. So it's important to evaluate a plugin before you make a commitment, kind of like getting married. So we'd like to also look and see if plugins are safe. And we'll have some fun with some plugin horror stories. So what is a plugin? Now you've probably seen themes and plugins as ways to customize WordPress. Themes typically deal with the layout of the site and what it looks like to the end user that's visiting your site. Whereas plugins, generally speaking, deal with extending functionality. They can also add to your site's layout, however. So what can a plugin do? There's an added to the WordPress world of there's a plugin for that. Of the most popular plugins, some of the functionality that's added are contact forms, search engine optimization, making your site more friendly for Google, e-commerce, anti-spam, backup plugins, and also security. Those are the top plugins in the repository right now. So plugins, like we said, are something that turned a basic blogging platform into a fully functional data group in the website that supports your business. A plugin brings your site to life, much like Frankenstein's Monster. And of course, with that power comes great responsibility.  So what happens on your site is your responsibility. And so you have to make good decisions based on good data so that what you are installing on your site basically becomes your responsibility. Just because somebody else wrote this code doesn't mean that you're not responsible for your site.  You're going to have to make sure that room is secure. You're going to have to make sure that that room is well taken care of. It's all about performance. What will a plugin do for you? Will it do what it says it's going to do? And will it do no harm? So speaking of monsters, at WordPress, we look at a lot of security issues. And an issue came up, it was about last year, with a man named Mason Soiza. What we started to see in our site cleaning business was that a plugin that was in the repository had not only backboards on it, but it had a number of links to spammy sites. Doing a little bit of research behind what was happening there was all pointing to certain domains. And obviously doing some domain research we figured out that it was all pointing to one person, Mason Soiza. This individual was in the UK, and he had a number of very spammy beach businesses and was making a lot of money. And these plugins were in the repository. So if you went to the repository and you found one of these plugins and you had it on your site, and you updated it after he had purchased that and installed all of his backboards and spammy content, your site was writing Mason Soiza's business. The community is a wonderful thing. And the repository is a wonderful thing because some of the people who had this plugin were noticing oddities happening from their site, and so it was reported to the community as a whole. And at WordPress, we started researching this individual and really started connecting all the dots. Mason has his own problems because he is now part of an investigation. And we have some breaking news today. Aren't you glad you're here? Sorry. And my CEO from WordPress, Mark Monder, is here in the room. And he knows more about what's happening today with the news story that broke with the Times of London.  This illustrates to you some of the importance of looking at the plugins that are on your site and to be a part of this community within WordPress in order to understand what has to impact your business. Mark. The trip working with Kathy, she was amazing. So just to give you some background with Mason, we haven't disclosed this in the past, but when we published our research on him, we were contacted by a person in the UK who had worked with police regarding Mason and some of the things that he was doing, marketing pharmaceuticals online. It's actually a pharmacist. And we ended up reaching out to FBI in Seattle and they referred us to National Cyber Crime in the UK. And they got us to collaborate with West Midlands Police to give them as much data as we could regarding this particular threat actor. And we did that and then kind of left the law enforcement folks to do their job. And nothing came of it, unfortunately. And he's done some pretty bad things. The plugins that he purchased and to ownership of, he was using them to inject ads for payday loans and for escort services in the UK. And one of those ads for the escort agency ended up on a school website in the UK, which is obviously not good. So he's not a good chat, but so that's what happened. And then we kind of left that and we published a pretty extensive research on him. But a professor from UCLA who I've been in contact with in the past from law school over there contacted me today and pointed me to an article in the Times of London that came out, I think it was today, talking about how this guy has been forging Supreme Court orders from the UK, sending them to Google to try to get our research de-indexed among other content, which is very flattering. And I think in the article it says that he claims that it's actually a company that he hired that was doing that. So my guess is law enforcement in the UK is probably already aware of that and if they're not we'll certainly make them aware of it and one of them is probably going to get into a lot of trouble. But that's the update, that's what we learned today and it was kind of interesting. And on my Twitter feed, and I think the wordfenster kind of retweeted it, we've got links to the articles there including the fake Supreme Court order. So that's one of the worst threat actors that I would say we've encountered and I must say it's tremendously gratifying to see the difference that's being made. BBC's Panorama did an investigation into SOEZA and he's pharmaceutical business about a year after we published our research on him. So we're pretty happy about that. So bringing things like this to light I think does good. And as Kathy was pointing out, if you're a plugin author, it's worth considering very carefully who you transfer ownership to if you plan to sell your plugin or give it away. You're giving that new author access to all of the websites that run your plugin. You're essentially giving them remote code access on all of those sites. So with that I'll hand it back to Kathy. Thank you Mark. That really illustrates, you know WordPress powers what? A third of the internet almost? It's a huge target. Your site is a part of that target if you have a WordPress site or multiple WordPress sites. Guys like this who are chomping at the bit, drooling at the exposure that they can gain by just basically exploiting plugins. So that's why it's so important for us to take a look at our plugins, pay attention to what's happening with them, pay attention to our site and evaluate our plugins. Some of the plugins that Mason had over 300,000 installs. So he was driving a lot of traffic towards his sites and is still active, such as something to watch out for.  They are much like the contributors here at WordCamp Seattle. They are working out of the goodness of their hearts to watch the plugin repository and make sure that it's safe, to make sure your sites are safe. And that's one of the reasons that community powers WordPress. I mean, our company does some things. We keep an eye on things as well. Other security companies keep an eye on things too. But it's really the power of the community that helps keep things safe. So you're part of it and that's why we have this presentation. So the types of plugins. The repository is open source. So there's about 56,000 free and open source WordPress plugins. Some samples that you can find and install on your site. Contact form, duplicate post, WP Supercash, or just some of the examples. Some freemium plugins are also available on the repository. These are free plugins, but they also have a premium portion so that plugin authors can, you know, basically keep the lights on. Yoast, Smush, Updraft Plus, which is a backup plugin, and WordFence are all freemium plugins. The majority of the plugin is free to use, but there is a premium unlock code that will unlock additional functionality. There are also premium commercial plugins and they are not in the repository. They're only available after you purchase them. Commercial sources like Theme Forest and Code Canyon are some samples where you can get those plugins. And then there's a plugin type, Nulled Plugins. Has anybody ever seen a Nulled Plugin? Nulled Plugin is a freemium or premium plugin, something that you can get off Code Canyon or a freemium plugin that's available on the repository, but it's unlocked. And these are a trap, because usually when we find these plugins, they have backdoors, spam links. They're compromised, but they've been taken by a threat actor. They've been put on a website in Google for, you know, plugin name, free, unlocked, something like that. You can find these Nulled Plugins, but you need to be extraordinarily careful and I would advise against using those. So do you get what you pay for? Not necessarily. I mean, you've got these plugins from the repository that are open source and completely free that you can install on your site. Paid plugins don't have visibility in the marketplace. They don't have visibility with security researchers. Our security researchers download these plugins all the time and are looking for vulnerabilities within them and we'll talk later about how you can do that too. Not all paid plugins are bad, but you are reliant upon yourself to do the due diligence and investigate whether or not that plugin is safe. So it's really up to you.  You're basically taking someone else's code and taking ownership of it in your house, of your site. So with the repository plugins, you have an entire community behind you in terms of investigating whether or not that plugin is safe and good. But the paid plugins are a little bit different, which leads us to another horror story. So I was doing site cleaning and this site comes in and it's hacked to the teams. It's just really a mess. And one of the things that we do in our site cleaning business is we look for the intrusion vector. So how did they get it basically? So I'm looking through the log files of all these accesses and I see all this malware access happening and then I come to an access called remote tunnel.php. And then before that, there's no malware accesses whatsoever in the log file. So I'm like, better look at this file and see what's going on with this. And it was a paid plugin. And well, developers don't like to talk to end users because then they have to ask difficult questions like what version of PHP are you using? What version of MySQL are you using? You know, parameters about your hosting environment. And then users often don't know the answers to those questions. So this guy, or these guys, wanted to find the answers out themselves. So every one of their plugins had remote tunnel and they had a password in there. But it was the same password on every site. So one app site, God knows where, I think at that password, they found our client site and they used that same password to basically install a backdoor and get into the rest of the site and basically take it over. So now if this plugin was in the repository, what do you think would have happened? Somebody would have found it a lot faster because you can download any plugin, the zip file from the repository, unpack it and look at the files and see what's in there. But with these paid plugins, you have to purchase it before you can actually see what you're getting. So with the paid plugins, and that's not to say that all paid plugins are bad, but it does miss the element of community that WordPress brings to plugins. So when you're researching plugins, there's some search phrases you can use, like plugin name hacked or vulnerability or plugin name broke or broken or slow site performance. If you've ever tried to do this, it's a lot of work. Thankfully, we've got the repository. So this sidebar that you see in the white here is on every single plugin repository page. So on it, you can see things like when it was last updated, the active installations and what version it was tested up to. So this is an older screenshot, but it shows you that this version of this plugin was tested up to version 498 and you can also see what the ratings are. There's also a link here for advanced views so you can look and see additional metrics about that particular plugin. So you can tell a lot of things. You can tell if this plugin is being updated, if it's been tested, if it's being supported and if it's loved by the community. I wouldn't say any one of those factors is the most important thing.  So here's a plugin from the repository Limit Login Attempt. At the top, you can see that the plugin has not been updated for quite some time. So you look further. It's got an alert like a yellow bar. I'm not sure if you can see it on the screen there, but there's a yellow bar that basically tells you it hasn't been updated for the last few versions of WordPress. It says it's been last updated six years ago, but it still has 2 million installs. So is this plugin safe? It's not being actively maintained. It's not being tested. We don't know of any security problems with it. I may have this on a site somewhere. Still, I don't know of any problems with it. WordPress 5 is coming out in a few weeks. Is this going to work with WordPress 5? You just cannot trust that it's going to be forward thinking in terms of how it's going to work for your sites. So if you start seeing things like this, you have to be cautious about what you're installing on your site and see if it's going to work for you long term. Here's another plugin that had a 5-star review, but if you start looking at the support comments here, you see that it's not all the support requests on the forums are not being answered. And people are asking if it's dead, if it's being supported at all and over a year nobody's answered any of these questions. So you see that it's not being supported and it's not being updated. But it's got 5 stars. It's almost like an Amazon review. Another thing to look at is the change log. If you go under development on a plugin page and look for something called the change log, a change log is something that most of the software has so that software is updated with subsequent versions. This was from a plugin called Ultimate Member, which a few months ago had some security problems. And in the change log they're telling you exactly what they're doing. They told you that they fixed a number of security vulnerabilities that were being actively exploited and we've seen a lot of problems with this plugin in the past. But one thing that I really like about this plugin is that they're telling you what's going on. We've got some plugins out there paid plugins and plugins in the repository that are not necessarily being forthright about what's going on with their development process. They may have security problems but they're not telling you about it in the change log. A plugin author that's willing to stand behind their plugin are going to tell you what's happening with the development. So if you see things like this in the change log it means that you can trust that plugin going forward. Reviews Reviews are such a mixed bag, aren't they? You can have five star reviews and might not necessarily mean anything. It's really important to read reviews and look for patterns. If you see a number of different reviews saying the same thing that they're consistently having a similar problem across a number of sites, it's definitely a red flag. But you've got to take everything with a grain of salt. Here's a resource that you can use when you're researching security issues. This is the WordPress Vulnerability Database WPVolmDB and all my slides will be up on Twitter later so you don't have to write all this down. But just because a plugin's here doesn't mean it is currently vulnerable. Again, you're looking for patterns. So if you see a plugin that is consistently having security issues, it's definitely a red flag. Is that something that you want to have on your site if you constantly are seeing a plugin with security problems? Also, just because a plugin is in that database doesn't mean it's currently vulnerable. Obviously you see Yoast version 1.7 had some security issues, but Yoast has been updated subsequently and no longer has that. But if you're running that version and you know, look out. Everybody's updating their plugins, right? Manage WP has a great resource where you can take two plugins that are basically doing the same thing and compare them against each other. So here I took the SEO framework a small up and coming underdog and compared it against Yoast. The comparison will give you the same metrics that are in the repository but it will provide it to you in a view that might help you in a sense when you're evaluating two plugins that do similar things. So it's just another way to take the same information in the repository but see it in one interface. Rips has a site called CodeRisk and they have security, they have an algorithm that analyzes the code on the site or on the plugin and basically tell you they assess a score based on what they think the security risk is with those plugins. So they have a nice little green to red metric that they'll show you here and if you dive deeper into each individual plugin it'll give you some metrics that you probably find on the repository as well but that nice beautiful green with a zero code risk is very heartening when you know that contact form 7 is on 5 million sites. It'll also tell you the trends so if you go back to early versions of contact form 7 they felt that those early versions did have some code risk problems but in subsequent versions you're seeing very low risk. And here's a plugin that is kind of a mass says who they have a code risk of 100 but they're only on 4,000 sites but according to their metrics this is something that you should watch out for. So you can go enter in on that site enter in a plugin that you're evaluating and see what the security risk is according to their code risk score. You can also download the code of a plugin and actually unpack that zip file and look at those files yourself. There's a GitHub link that has some WordPress security testing metrics that you can use in order to evaluate that plugin. You can open up each of the files and look for anomalies. WordPress scans are my favorite I mean I was a customer before I actually started working there. I had WordPress on all of my sites because it helps you manage plugins and obviously the most important thing to do for your security is to keep everything updated but you have lives and maybe children and maybe you want to go out to dinner.  WordPress does it for you. Basically tells you if your plugins need to be updated and it will alert you that if a plugin has a security problem. So I highly advise using WordPress scans to keep on top of your plugins. Well everybody's talking about Gutenberg these days. So there's a resource. It was a database for a while but it's not actively supported anymore. It's a CSV file which is kind of separated values. You can download that CSV file below and you can search for the plugins that you're using or evaluating and look and see whether or not that plugin is Gutenberg ready. Just because it's not determined to not be Gutenberg ready doesn't mean it's not. The plugins are only running on the back end and Gutenberg is only dealing with a small portion of what's showing up on the front of your site. Anything that's going through the editor. So not every plugin is going to need to be Gutenberg ready but if a plugin is dealing with content on the front end of your site this is a handy resource to go look and see if your plugins are ready. There's also a tab that has recently appeared on the repository for Gutenberg ready but there's only a couple of plugins that are actually using that. So resource utilization there is a plugin called the debug bar that's available on the repository as well. And you can you have to turn debugging on and your WP config file but once you do that you can see a number of different resource utilization metrics on your site. So this is just a screenshot that gives you some idea of what it's looking at but it's a handy tool if you're trying to figure out performance problems that are occurring on your site. So another thing that's really important when you're dealing with plugins is how user centric is this? Can you break up with the plugin? Is the data that's being stored in your database related to the functions of that plugin? Say for example a calendar plugin that basically is showing a calendar of events on the front end of your site say that plugin has a serious vulnerability or that plugin is no longer being actively supported by its developer. What are you going to do with that data? Can you pull it out of your WordPress site easily? Or is it going to take feats of superhuman strength in order to extract that data and get it into a plugin that is being supported? That's something that you need to look at before you make that commitment before you are actually going to start storing tons of data. When you're managing your site and you have a new plugin say you've got a site that's got 10 plugins and everything's going a lot of fine but you have a new feature that your boss has said you must have this on your site and you're concerned with how this might affect the functionality that already exists. It's really important to have a staging environment on which you can run tests. So basically take your production website, make a copy of it somewhere else, install the new plugin there and see how things work. One thing that's really important with staging sites from a security perspective if you are using something like a cPanel and you want to do staging.yourdomain.com and oh cPanel lets me do that but this is great, this is going to save me time.  We see a number of hack sites that somebody has a staging site that they just need to test something and then they're off doing something else and somebody will get into that staging site and it will cross contaminate the production site. So if you're doing something like that it's really important to take care. And it's really important to not test things on production.  It is the first thing your customers and your prospects are going to see. So it needs to be taken care of and needs to not have things breaking it. So you're looking for a staging environment on which you can test the effectiveness, addability issues and basically see that everything is going to be copicided before you put it into production. So you've got all of these plugins and say you moved a calendar plugin and so you're just going to deactivate the old one. It's really important to uninstall anything that you are not actively using. If you are just testing a few plugins and then decide you're not going to use them anymore and so you deactivate them and they're not active on the site anymore so they shouldn't be a problem. But if you're not actively maintaining them and there's a security vulnerability that can still be accessed the code is still existent on your site it can still be exploited if there is a vulnerability. It's kind of like digital clutter, porters, WordPress edition to have a number of plugins installed that are not being taken care of. So it's a good practice to take any plugins that you're not actively using and just delete them. Same thing with themes. The less code you have to deal with, the better. And it's really good to audit and review your plugins periodically. You can use all of these tools to manage your plugins but it's also good to every once in a while just a quarterly type of thing. Look and see what's on your sites see if it's still serving your needs see if it's something that is actively serving you. And look at other plugins that may have recently been like the SEO framework. Very light SEO plugin that I've been using Yoast Forever SEO framework was like very simple when doing everything I needed. So I kind of did a plugin audit and looked at both of them and to see the different functionality to see if maybe I wanted to switch and I did switch a few sites. The end result of good plugin management site, happy customers and good performance. Do we have any questions? One of the things that I've been about doing plugins is after I removed them I was cleaning up the database of one of my clients and I noticed for instance WooCommerce left all of us tables behind. And I installed an ad plugin that apparently had been installed on the site several years ago and the tables were still sitting there. And all of the ads populated from three years ago. So is there any other way other than watching my sql go again to know what they're doing? Is that part of getting your data out? Did they publish that information anywhere? You often see that kind of data or that type of experience on the reviews. Going through the trauma of having to clean up an old plugin, somebody else has probably gone through it too. That's one of the user centered coding types of parameters that I would look at to see if that plugins actually break up a little. Do we have a prenuptial agreement here where I can actually get out of this arrangement easily? A number of plugins that have extra database tables will have some kind of setting that will kind of deactivation will clean up after itself so that it's not leaving remnants behind. There's also a plugin called WP Optimize which is really handy for cleaning up database masses. It's really good for getting rid of like duplicate or autosave posts that can clutter up your posts table and other things like that. What about the plugin name? The plugin name? WP Optimize WP Optimize and it's just a database clean up tool. We'll get rid of spam comments and autosaves and things like that. Which is where I discovered the tables. Yeah, definitely. It also optimizes your database tables too which gives you better performance overall as well. Basically when I started Wordpress website I have my five plugins that I always install obviously Wordpress, I've seen enough. WP Optimize is one of them. Contact form very simple one. A lot of people don't like contact form because it's a little difficult to deal with and they like brownie forms and things like that but once you get used to contact form it's so simple and easy to use and stores things well. Yes. Depends on the site obviously. My personal blog I'll just update them all. It's really tempting when you go on that Wordpress update page where it tells you core needs an update your plugins need an update your themes need an update to just click all and update everything. It's really tempting to do that. It's really good practice to not do that and to go one by one and to do it on a staging server too because some plugins and another thing too is if you're updating from a plugin that's like 4.9 to 5.0 it's incredibly important those big number jumps means that there are big changes and you're going to want to run those big changes in an environment that's controlled where you can actually see what's happening you could have issues happen where a plugin updates and it's not taking into consideration which version of PHP you're using and if you're not aware of that you might run that update and get the white screen of death on your site and if you're updating all those plugins at once well which one of them caused that problem so it's really good practice to update one by one and if your site is critically important and most business sites are critically important you want to do it on a staging server that has an environment that is replicated from what you have on production that means the same version of PHP the same version of MySQL is running your production site you want an exact replica of that on your staging server so that when you do make that change if it finds on staging and breaks on production there's something amiss yes yeah I'm going to kick you in streaming I guess the plugin thing like you were talking earlier that you can read all those plugins but they don't pay when they're it's unlocked are you just getting a different plugin or are there parts you can't see like the freemium plugins freemium plugins so the freemium plugins typically the ones that are in the repository the way they work is that you install the free version and there's just probably a bunch of marketing asking you to upgrade because they want to keep the lights on but it's the same code base and all that the premium upgrade is doing is unlocking those features those additional features that aren't in I guess that's what I'm worried about though by unlocking it does that mean that I can't see what's going on and do that parts of it so the majority for most freemium plugins the majority of the functionality is there and then there's other just like additional valves and whistles that you unlock with freemium you know you can download any plugin from the repository freemium or whatever you can download the code on the files and you can see what's in there so it's just you know there's different ways of them doing the unlocking if you're a developer you probably will go in there and see exactly what how they're doing it but all that's really available the cool thing also about the repository is different versions are also available for download so you might be able to download the most current version but you can go into that advanced tab you can go back in time and look at what it looked like a year ago and see you know what's changed yeah um you're in favor of plugins that you have to use for like um building a form or building and so on there are a number of plugins that do that I can tell you that there are some paid plugins that do that that I wouldn't use but there are some in the repository some free plugins that will help you like Ultimate Mumber yeah they had a security issue they patched it but I've seen that that used fairly often that's the other thing is when you've got a plugin that's got a huge install base there's a big issue this week that some of you may have heard of it was a plugin WPGDPR compliance on 100,000 sites some very significant vulnerability vulnerabilities it basically disappeared out of the repository and then the next day came back and whenever something like that happens bells and whistles go off for us and we found some significant vulnerabilities in what was there before that word funds premium protects against but yeah so if it's got a large install base you can bet your bottom dollar that someone with a bot somewhere is going to find that vulnerability and start sending their bot out looking for vulnerable sites almost immediately when you've got anything over 100,000 they're just they're going to exploit it as best they can fast well a word fund well not to sell from the stage but you want to have something that's alerting to you to plugins that need updates and once a vulnerability is disclosed that WPVolmDB has an RSS feed and it's got a mailing list the RSS feed updates much faster than the mailing list does and that will tell you right away if there's a vulnerability that's been discovered and disclosed and it'll tell you the severity of it so you might see something like unauthenticated file upload what does that say unauthenticated file upload unauthenticated that means nobody has to put in credentials unauthenticated means it's anyone file upload it's just one PHP file that has a shell that allows them to do anything on your site basically and they'll find a way and you see something that says authenticated cross-site scripting that one has to be unauthenticated it's a vulnerability but it's a vulnerability that can only be exploited if someone is authenticated so somebody's logged in so those are things that you can look for but if you're keeping everything updated if you're going into your dashboard or using a tool that tells you to update you're going to be okay you just have to actively manage your site over here first I'll be right there that's just our old man that's just our old man you were probably the Mason soys a 300,000 installs when they were still there what mechanism is there to communicate to those people that they have a product installed what exists out there to notify those people and then that's kind of like a double-edged sword because this plugin changed hands right so somebody had it who was very responsible and was taking care of that code base to the point where it grew in reputation so that 300,000 people installed it that plugin developer said enough I'm done managing this code and sold it to someone and went on with their lives and so everybody who then updated after Mason took over control everyone who updated that plugin got Mason's code Mason built a room on their house and Mason was living in the wing so it's kind of a weird thing where there was no security problem with that plugin before so it was just like a normal update and so everybody updated but that's how the community protects you because people noticed hey why is escort services at the top of my site, why is this happening and so they start asking questions in the forums and they start saying hey look this is happening here hey this is I just downloaded the code and it's in the code they're in the house and so the community actually supports the people who are a part of it the community actually supports you because those things are alerted word fonts we have some some systems proprietary systems in place that we are watching when plugins change hands and our researchers who are constantly chomping at the bed for more data and more types of vulnerabilities to research they're looking at that code on a regular basis so you know we support the community we don't make money off of that we do it because we support the community and obviously it's good for our reputation but you have tons of people around the world who are looking at the code base of the repository which is why I think it's important that when you're looking for a plugin for a certain functionality in your site that you go to the repository first instead of looking at paid plugins that you never know what you're going to get until you bite into that chocolate and it's like oh no there's a cherry in there yeah I'm just kind of following up on the previous question if we can say word fonts find a folder will it there's no update on that yeah so when we discover vulnerability there's something in the security community responsible disclosure so we discuss if our researchers find something is a mess there's a couple of channels that we go through first of all we'll contact the author of that plugin and we'll disclose what we found we do something called the proof of concept which basically says this is what we found we thought it was funky so we decided to create this like method and we show how the vulnerability works so it's done behind closed doors it's not sent out to the world because there are ears listening and once that plugin author has been notified it will also notify the plugin team there's a team of volunteers through wordpress.org who are also monitoring these types of things we've seen a lot of times they'll remove the plugin from the repository at that time while things are being updated to kind of mitigate the risk so that some newbie isn't like oh I'm installing everything and accidentally installs the vulnerability and then once that vulnerability has been patched that's when the community has a whole hears about it that's when WP VulnDB publishes the proof of concept or publishes the details about that vulnerability so it's not like oh I found this thing anybody who does that is not doing what they call responsible disclosure anybody who's just like sprays it on twitter that hey this plugin's got a vulnerability a lot of times you'll see chatter of people finding things in the forums and another plugin team monitors that and will remove those types of comments so that a vulnerability disclosure doesn't happen spreading wildfire into the wrong hands so it's another way the community protects you yeah ding ding ding somebody will look at it pretty quickly if it's removed from the last twitter so if you're looking to select the plugin that doesn't have a huge user base but it looks like it's not it doesn't have high risk and it seems like it's well supported currently but it's also assuming that there's going to be kind of integral to your site in terms of functionality how can you judge whether or not or get an idea of whether or not it'll be supported many years into the future yeah so I've taken those risks I've gotten the login in times on the site somewhere yeah so I mean it's a big risk right because a lot of these plugin developers are not being you know they're freely putting their efforts into the community put this code out there and then oh my gosh I have to feed my family I can't support this there's a lot of plugins like that there are 55,000 plugins in the repository a lot of them that are doing basically the same thing but you know there may be like a niche type of activity that's really integral to your business integral to what you're trying to communicate to your customers and I would go through those steps I would plug it into the code risk site and see what kind of score it gets everything that's in the repository is in there so that code risk score is kind of interesting I know WordPress has there's a project called Tide that's kind of in flux right now but they're doing code analysis on the repository as a thing so I'd watch for that project and see what's happening there but I would look for I'd look for for support I'd look for the version number WordPress has been around 15 years so a plugin that's more tried and true has been around for a while and it has a low score in terms of the code risk and you know it's everything that you have in your site you're basically taking a risk but you're taking a calculated risk and also just you know backups because you know you never know what a vulnerability is 100,000 people who had the GDPR compliance plugin on their site that was found to have a vulnerability this week they have that on their site because they believe fully and they are trying to take care of their customers they're here to GDPR compliance issues they're trying to do the right thing they don't realize that there's a vulnerability until somebody discovers it and once that vulnerability is found update your plugins update your plugins yeah one more quick question if you're going to get a plugin and it doesn't have a lot of information you don't know it's going to be around it gets blocked it's not going to stop you from updating your plugin do you want the functionality? oh sure sure you can take any plugin and basically fork it and create your own version of that plugin and modify it I used to do that to Corb but don't tell anyone don't do that because then you know you're going to update things then you fork something and now it's yours right? anything changes WordPress 5 comes along and it's not compatible anymore guess who's responsibility that is yours so the repository is really the best of both worlds because you've got people who are actively watching it people who are actively maintaining it and the community that's watching this was fun you guys I really appreciate you coming to the talk


I have some thoughts on a lot of it, but I do know that it was great seeing Patrick Mahomes sling some beers around. Hell yeah. Patrick Mahomes became America's sweetheart again just yesterday playing golf. Now he was at the beginning of his career because he's so much fun. Incredible football player, grew up in a baseball family. He was making things and doing things on a football field that we hadn't seen in a long time from a young quarterback and having success. Here we go. Everybody loves Patrick Mahomes. It's the next generation. On 12 holes of golf, Patrick Mahomes being the incredibly clever, funny, upbeat, and boozer on a guy who had been hitting incredible shots. Became America's sweetheart yet again. Congratulations to Patrick Mahomes. Nice job, Pat. There's him versus Aaron in a lot of it. Now Tom had a couple of good shots, maybe a couple of putts that fell. Josh Allen was able to find a stick every once in a while, but it was Pat versus Aaron. And Jake from State Farm was there. His name is actually Kevin. That kind of sent us all for a loop. K-fabe, Jake. Your name's f***ing Jake.


I arrived in Perth in 2015. You may wonder what makes me move to the most isolated and arid, populated environment continent. What makes me move in this Australian far west is not gold. It's another kind of richness, plant richness. Western Australia includes what is called a plant biodiversity hotspot. That means that it includes a lot of species. Curiously, current hypotheses explaining these extreme diversity in plants involves adverse conditions, such like aridity, bushfires, or moving dune system, such like the Lanceline dune presented in this slide. We currently think that these small scale disturbance are creating new space that allow species to colonize, that are awaiting plant colonization and promoting plant speciation. So we've recently discovered in Spain 100 million years old analog of the Western Australian hotspot. During that time in Spain, arid vegetation was around and was frequently disturbed by wildfire and moving dune. We describe different floral assemblages for different locations, and we've been able to describe an increase in diversity in different group of plants from the very small moses, relatively bigger fern, and conifers, and flowering plants. So it's a kind of a support of these previous hypotheses. The things, everything does not go all right, and eventually, the desert system gets flooded by sea level rise. It is something that should remind you the high title of current newspaper. That's a present concern. But everything is not black, either, because in Spain, as well as in Western Australia right now, we have the seed of the future vegetation that could come and should give the resources for the next generation. Thank you.


All right. Hello. Welcome to MPEX LA. I'm really psyched to be here. I know a lot of other people in the room are really psyched to be here. First, I want to give it up for all of the speakers so far today. Seriously, raise a round of applause for them. Any bozo can hire a pianist, but it's the talks that really make MPEX what it is. And if you ask me, it's the best little conference going. So thanks for that. My name's Pete, and I am here to talk about docs. So let's talk about what we're trying to get out of this talk today. On a technical note, it's a guide to xDoc, which is the documentation system that's built into Elixir. Having it as a built-in part of the language has a number of advantages. The number one perhaps being that there's a really good system that nobody even has to think about choosing because it's just there. But I'm also sort of, I'm just going to expound on how nice it is to have good documentation for a project. How many people in here write programs? Yeah, we've been hurt before. Bad documentation is a brick wall that we will sometimes climb over if we have to. But it's really nice when you don't put it there anyway. So this talk is essentially about making people happy. Specifically, the people who interact with the software that you write. And I'm giving this talk here today because as it turns out, Elixir has one of the best sets of tools that I've ever seen for generating documentation in a really low friction way. So let's start with a couple of thought exercises. These are tough questions. Do you want to have to fully understand somebody else's code in order to use it? I'm not going to be playing PowerPoint karaoke all night, so don't worry about that. I said understand there. I didn't say read. Reading code is far-fetched enough, but expecting somebody to understand your code, or really anyone's code, that's really asking a lot. That's a big time commitment, depending on the complexity of the project especially. It's a lot to ask. All right, another question. If somebody cannot describe their code in English, do you trust them to have been writing it? This is a valid question. My head works a little bit differently from a lot of people as far as this is concerned, but I personally find if I cannot explain the code that I'm writing, I will roughly never get it right. And if I can't explain the code that I'm writing, it's almost a mechanical process because I've done the hard thinking. So this is a question, again, from the point of view of a coder, a consumer of libraries, as opposed to a project leader. So I'm just going to pivot a little bit there. If you write some code, do you want to restrict your audience to geniuses? Because I bet you don't. If you put up barriers to being able to understand the code that you write, you are excluding all but the most dedicated folks from using it. And I say dedicated, not entirely as a compliment. There are lots of ways to contribute to a project, and being a difficult genius is only one of them. So you really want to open the doors for everyone you possibly can. And here's the big question.  It sounds too good to be true. Who in this room has any open source projects that they've started or contributed to? Do you remember your first contribution?  And somebody across the world fixed it for me. And they just sort of dropped that fix on my doorstep. Or I wrote code that didn't do enough things, and somebody made it do another thing that's very useful to my project, and they just gave it to me for free. It's been a while since my first time, but boy, you never forget it. It's just amazing when you realize that you are part of, you're really part of a community, and a community of people that in many cases you don't even know. You throw a project up onto the internet, and sometimes if you wrote something that other people want to use, sometimes it has reach, and it will find users. Docs are one of the ways to get you there. All right, so we all had a break. We're hopefully a little bit more energetic. I want you to shout at me out of turn, name some docs that you really like. Ecto, Phoenix, both very good examples. I actually really like Ecto's docs. Phoenix, it's all right. But Ecto, I really like their docs. More, doesn't have to be in the Elixir ecosystem at all. Stripe, everyone loves the Stripe API docs. That's arguably what landed Stripe where they are. Is just having an incredibly easy API to use that upon looking at the documentation, you didn't even have to read it very closely. You just gaze at it, and you pretty much get the gestalt of the whole thing. Rails. Rails, Rails has. The guides, I find the guides. Okay, sure, the Rails guides are decent. Yeah, it's a little more pros than kind of more project docs or module docs. All right, so any other, closure and atomic, I've never looked at those. They always have a rationale and they explain what problem they're solving. That sounds fantastic. I'm actually gonna look that up probably tomorrow morning. I'm not gonna do it tonight, I don't think. All right, so I wanna point something out. Nobody in the room mentioned tests. This is because, and I want to be fully clear about this, tests are not documentation.  Docs are there for a reason, tests are there for a reason. Elixir has pretty good systems in both places. I'm here to talk about docs and tests ain't docs. All right, so Elixir has really good docs. Nobody mentioned it because hopefully they were leaving room for me to say it and didn't wanna just stomp on me. They look really good. We've all read them. I think it was, I wanna say Elixir 1.2 is when they redid the style of the documentation, like the HTML page, and it looks very, very modern. A lot of doc systems in other languages tend to look a little bit web 0.9, whereas Elixir did a really good job of just looking like a really handsome reference material. All of the modules that are documented explain their purpose. That's a big thing because if you're a beginner and you see something called enum, maybe you know what that does, maybe you don't, maybe you have a background in C, so you're thinking in enums rather innumerables. The module docs are there to kind of just orient you. Functions are there to explain their semantics and Elixir does a very good job of that as well, and there is sample code everywhere. Can't tell you how much I love that. So let's take a look at the GenServer documentation. I picked GenServer because pretty much all of us have stared at this page a lot, and it's actually describing something that is fairly complex. And so we see the sidebar for the Elixir project docs has now been rearranged so that it's no longer, it's no longer in alphabetical order, it's now grouped by categories, which I gotta say it broke some muscle memory for me, but that's okay. Progress always comes at a bit of a price. So you see a short description of what this module is about. You see an example section, there's code samples, everything's nice, it's syntax highlighted. Now this is the way that most of us consume the docs, but this isn't the only way to get to them. It's not just a web page generator. The docs are written in markdown, which means you can do fun things like from IEX, you can just type H and then the module name that you want the docs for, and it puts it right in front of you. Rendered pretty nicely in text. So it's really, it's Xdoc mostly cranks out HTML and EPUB, but the doc system is kind of a little bit more pervasive in Elixir than that. So right now I'm gonna give you a very whirlwind tour of how to use Xdoc, and it's very simple. You write your docs in markdown. Everyone here written markdown, hopefully. If not, treat yourself. It's really, despite being poorly specified, I'll say that, common things are really easy to do. You indent sample code four spaces in from the rest of what you're writing. That is how you stick sample code in there, and I'll talk a bit more about that in a bit. You add Xdoc to your project dependencies and mix.exe pretty much the same way you would anything. Generally, you will install this only for your dev environment, but it doesn't really hurt to throw it in prod as far as I know. And then you type mixdocs to generate HTML docs locally, and it'll say, I just spit out docs slash index.html, and if you have a hex project, which is, of course, the Elixir package manager, you type hex.publish docs and the docs get pushed to hexdocs.pm, which is where all Elixir and Elixir project docs live. Automatically, it's really nice that you don't have to think about setting up a web server for this, and if you know the name of a project, you just go to hexdocs.pm and then add the project name to that URL, and there you are. So as a little demonstration, I'm gonna use a library I wrote probably about six months ago. It's called Strip.js. I'm gonna use that to demonstrate it. I warn you, Strip.js sounds like a hip new framework for the front end. It's not, it's something I wrote to Strip executable JavaScript from HTML and CSS. Now why would I wanna do that? So writing docs in Markdown, you can see right here, the pretty simple example of a module doc. Now, how many people have seen these at signs within Elixir code? They're called module attributes. I don't fully understand where their functionality ends, but boy, you can really do a lot of stuff with them. I use them for module constants all the time, but it's also used by the Elixir doc system to delimit where you have the documentation. So you simply put at module doc and then open a multi-line string. Start typing. As you can see. Sorry, as you can see, it's Markdown, so you've got your back text to put a code formatting, you've got your bulleted list, you've got your section heading with the double pound sign, you've got some sample installation code that is indented for spaces. Let's see how this looks, even though I'm pretty sure everyone in the room already knows, damn, it looks good. I don't know, it still fills me with glee that I didn't have to design this webpage, because I remember when I did have to design the HTML for every project that I had because there was no better alternative. It's one of the reasons that makes me, it's I'm very happy to be in the Elixir community. We got syntax highlighting, Markdown formatting, it's great. Let's scroll down a little bit to our usage section. Now, I wanna say, I've never actually heard this as a term, I love what I call docs driven development. I like to write the sample code for the module first. That's pretty much like when I'm thinking of something I wanna write, the best way, at least for me to be thinking about it, I write the code, I basically, I write the sample code I want to see in the world. And then it's just a trivial matter of making it compile and execute properly.  I'm gonna rearrange things a little bit.  It's a good time saver for me. Your mileage may vary. So onto a little further description of module docs, explaining the purpose of a module is, to me, the number one thing that you wanna have in a module doc.  What is its raison d'etre? Like, why does it exist? You wanna have sample code that illustrates pretty much the happy path through your library. You don't have to really pollute your module doc with a whole lot of sample code, but you do wanna give people a very top-level introduction to one or two of the most common things that you do with this library and how it looks. I like to stick my installation instructions in module docs. And I'll go over why that is in the next slide. In lesser languages, we would use a read me for it, but all right, here's a little slice of life. I have like a handful of elixir libraries that I treat with varying levels of respect in terms of maintenance. So, imagine you add a feature, or actually, just imagine you fix a bug because that's often what I'm doing. And you increase the version number of your project, but oh man, you forgot to, well, first you forget to update it in the read me. I've done that, I don't know how many times. The read me, I write it, and then it basically sits in a corner and I'm actually working on the module so I see the module doc, but I'm kind of rarely going on the front page of my GitHub or opening up read me.md. So, let's say you forget to change it in the module doc. Well, that kind of sucks because now you republish your docs and you're telling people to install an old and possibly broken version of your software depending on whether you bumped the patch level or the minor or the major version. And so your docs are wrong, they're lying, don't lie. So the solution that I like to this is to use variable interpolation in your module doc. Now, in most of these docs, you'll see the twiddle capital S sigil, which does not interpolate variables. I like to have the module doc use lowercase s so I can interpolate in particular the mix file project version. Now, you don't have your mix file at runtime so you wouldn't be able to write code like that as part of one of your functions. However, this is all evaluated at build time and you do have the mix file there during that. So what that means is that the interpolation happens at build time, you will then just end up with a static string that gets compiled into your module. There are your docs, everything works. And here's how it looks. Yep, that's how it looks. It's really not very complicated at all. And you do this, all of a sudden, your module docs are not out of date in terms of what version you're telling people to install. Pretty nifty, it's really not rocket science. Pretty nifty, though. So on to function documentation. A lot of people go back and forth on this. If I hear the phrase self-documenting code again, I might poke my eyes out. There's stuff that code documents itself and there's stuff that it doesn't. Code is really a great way to describe procedure. In fact, you can't beat it. If you're describing the procedure of something in documentation or in comments and then code, that is arguably redundant. But here is something that the code cannot express and that is intent. What did the human behind the keyboard intend to do when they wrote this code? It might actually be different from what the code is doing. And you want people to have the idea of what it's trying to do and not what it is actually doing because if there's a discrepancy between the two of them, you want them to contribute a patch to your project. So I like the intent and specification. Those are two things that the code can stray from. The code will never stray if you're reading it to figure out exactly what is going on. But why? That's something that's best left to humans. And it's a specification, so be specific. And I especially mean around your input and output argument types. Elixir is a weekly type language or dynamically typed if you will.  So we have to work a little bit harder in order to express our intent in terms of the types that we expect to take in and emit. And much like ModuleDoc where you stick ModuleDoc directly after your DEF module, you stick an app doc before your function definition. So we can look at an example of that. This is the clean CSS function out of Strip.js. And you can see directly before DEF or clean CSS we have an at spec. So this is called a type spec. I'm gonna get into that just a teeny bit later. So you see that code example with the IEX. It's called a doc test. And this is solving another problem where documentation goes stale. Sample code is great. You really wanna present it to people but sometimes your refactor something and your code changes very subtly or maybe you have some extra output that you didn't use to have. It's not that you broke any specifications by doing this but you do want the code sample to reflect what the user is actually gonna see at their terminal if they paste that in. So Elixir solution and there are several other languages that do this too, Rust is a notable example is the concept of a doc test where as part of your test suite you are running these pieces of sample code. Now there's kind of limitations into how clever or how complex your doc test can be. And they generally follow the same limitations of how much work do you really want to do for an illustrative code example. If you're really trying to test a wacky situation rather than illustrate a common thing you put that in your tests. The sample code is there to instruct people and not just to enforce a contract. The rules are really simple. You start with IEX on every line that you're typing into Elixir. You don't start with IEX on the lines that Elixir is typing back to you. No blank lines allowed or rather when you have blank lines what you're doing is starting an entirely separate test with its entirely separate scope. And after that you just put doc test and then your module name in one of your test files. I'm using the word just very deliberately. You will hear more on that in a short while. Might not be for me though. So a tip on doc tests.  I'll write the doc tests and then I will forget to invoke them and I'll think they're running and they're not running at all and the tests will go stale because they're not running at all. So what I try to do is start by adding doc tests. Every time I write a module I try to put the line doc test and then the module name in one of my tests. Even if the module does not have its own test file yet I realize I'm not practicing good TDD there. But it's harmless to have no doc tests. You avoid the situation where you slap yourself in the forehead because you thought you'd been running tests for the last couple of weeks and you haven't. But also and this is something I did not expect. If you're using a code coverage tool and measuring the code coverage of your tests for some reason running doc tests will scoop a few more no op lines than not doing a doc test.  Have you changed anything of import? Not at all. Your code's exactly the same. You're not testing anything real but the number did go up and everyone does like that number to go up. So a bit more on data types. Sometimes you luck out. Sometimes just by visual inspection of the module name, the function name and the arguments you can figure out exactly what's going on. Lots of functions are not in this category and you need to go a little bit out of your way in order to describe exactly what you expect to see and exactly what you are admitting. Like I said before in a static typing language this is, it's just baked right into the language and in general your IDE will complain at you before you ever do something so silly as even hitting save or committing code. We're not in one of those languages so we have to work a little bit harder and Erlang and Elixir have a solution called TypeSpecs. So an example of the TypeSpec is that at spec line and what I'm saying is the first argument is a string in Elixir there is the general convention that if you have a module name that represents a data type you call that data type T. So string.t is a string which I think is technically just a UTF-8 compatible binary. Ops I actually have defined elsewhere I'll show you that in a moment. That's nice because you can specify okay here are the exact options I'm expecting to get. It's a nice piece of documentation just saying these are the ones I support anything else that's not in there I didn't really expect it so you probably shouldn't be passing it. And after the double colon is what it emits. So the clean CSS takes in a string emits a string. Something nice about these TypeSpecs they can kind of be some documentation in and of themselves. It works recursively which is very nice so you can have recursive data structures like for instance this describes a very very simple HTML document. Describes it poorly but it does describe it. I show you Ops. Ops is just a keyword list which we can call keyword T. Something else in here you notice the single pipe that just means it's gonna be this or that. So an HTML tree is one node or an array of nodes a list of nodes I should say. And then once you've got your TypeSpecs in place I think a lot of people in the room I've heard mention this word dialyzer. Erlang's discrepancy analyzer. It's pretty great. Essentially it takes a long time to run the first time because Erlang is building up a lookup table.  It works really well on your own machine it actually works kinda sucky in CI. Like if you wanna have that as part of your testing suite you actually have to jump through some hoops in order to cache those lookup tables but on your own machine it'll generally work out fine.  And it's really good to have a static analyzer be able to say hey you're expecting to take type A or type B here but it looks like type C could also come in here. Or it'll tell you about unreachable sections of code. It's pretty neat. And speaking of code, speaking of lying really the best docs can they can just wallpaper over a huge pack of lies. And sometimes if you wanna be sure you just gotta read the source. No substitute for it if you want to know the procedure. And so you generally would go on to Google get to the project GitHub, go into lib, find the module. No one wants to do that. No one has to do that in Elixir. There is an option that you can pass to mixed docs called dash dash source URL. I have a little illustration of it here. Sorry for the weird vertical part but I noticed sitting down there you don't see the bottom of the screen all that well. So I'm using a MixAlias which by the way I love MixAlias, they're pretty neat. And so every time you run mixed docs it's actually just sticking in this extra argument. And what that has the effect of. You see at the, so you see at the top of the page there is that little kind of like empty HTML tag looking thing. You click on that tag and like magic you get to your source code. There's kind of nothing to it there. That is something that you will find and you'll find that alongside types and functions and really like everything that you have specifically documented in your docs you'll be able to get to on GitHub. Which is, I mean I use it with some of my own projects even when I have the source code in front of me just because it's often the easiest way to get from a description to the actual code that implements it. So I described a lot of stuff over the last few minutes taking a step back from that, what happened? We have good docs too. We just like, most of what I just told you is kind of a mechanical process other than writing the docs in the first place which is something you want to do but it's really just typing the right thing in the right place. And suddenly you have module docs that explain purpose. You have functions that explain really what they are doing. All of this is organized very nicely. They have code examples that you can trust. Dializer if you're running that will add another layer of trust to the whole thing. And it all looks really good. It makes me feel good that any Joe Schmo can publish an Elixir project and they are on equal footing with the Elixir docs themselves which I consider to be very high quality. A few resources if you want to read more about this stuff. X docs, X docs has a pretty good doc site. Elixir has a good page on type specs if you want to dig deeper into that. I recommend it, if it's not, I'll just put it this way. It's a really good tool to have in your bill. Even when I'm not running Dializer all the time I generally type specs as just a way to remember what the hell I was thinking three weeks later. That's about all I got. I definitely will love to take some questions. The executable specs, can you execute anything that is not Elixir? I don't believe so unless you implement that thing in Elixir. Yeah, I believe it is only useful for Elixir stuff. Something that I've had pretty good luck with if I want to express tests in a way that is kind of like more agnostic. Documenting a CLI, that's not something that I've done in Elixir. Honestly, I personally steer away from Elixir for command line projects, if that makes me a bad person. Don't know what to say about that. In that, okay, so the question was this doc stuff makes a lot of sense for external projects, public projects, but how can you guide the process of documentation internally on a team? I personally, I'm leading an engineering team. I try to lead by example there.  And generally, I don't know, I'm lucky because I have the people who are contributing to the Elixir projects I have at work are kind of conscientious in that way. In general, it just so happens that we have some of the more senior developers working on Elixir stuff. And I think one of the identifying marks of a senior developer is just having good discipline around that sort of stuff because we get old and our mind goes and we don't know what we did a couple of weeks ago. I got that young because I used to be a Pearl developer. I wrote Pearl and Fortran in kind of a weird yin and yang formation for a while. And in either of those languages, if you are not documenting the bejesus out of what you're doing, you are sunk a few months from then. So the question is, I put installation instructions in my module docs. Do I also echo that information in the readme? What I try to do with readmes is make them as short as possible and have an extremely prominent link to the docs on hexdocs.pm.  I'll have a sample code snippet so people can look and say, okay, well, that's what it looks like to use it. And then I will say full documentation is available on hexdocs.pm. Do I know of any open source projects seeking contributions to their documentation? I would venture a guess that a lot of open source projects would love documentation help, even if they haven't mentioned it. There are open source projects that have a very high emphasis on documentation and just developer experience in general. I think that's one of the hallmarks of a lot of the new languages coming out. I'll mention Rust again, because they take their documentation very, very seriously.  But yeah, I can't think of any offhand, I'm sure there are some, but I can't think of any offhand that are just outwardly begging for docs. The question is some code is self-documenting. Do I document every function I write? The answer to that is I document every public function that I write. Sometimes there is, I'll have helper functions that I'm calling from the internal function. And in those situations, often the name will be enough because you know the greater context in which it's operating. But yeah, usually. And again, often it's to help me. Well, thank you everybody. Thanks a lot, Pete Kamesh everybody.


Thank you for coming on So Dave's very tight on time. He's running to a appointment, but we wanted to get him here just to get his take We heard a great analysis from him yesterday He's he published this because great piece on carbon. I don't know if you saw the car Peter gammon comes in and tells us the yeah, what's going on in baseball? So give us the inside baseball Dave What have you seen today? What's interesting Peter gammons of the analyst industry? Come on tell us any new disruptions that you see or calls that you want to make Zynga the Zynga you wrote a piece And that growth phase that those guys are in it worked perfectly for them and going from commodity Right. Yeah commodity based cloud was really the point. You know, yeah And then the most interesting point there is they built a commodity cloud in the enterprise not an enterprise cloud in the enterprise And I think that's a huge bifurcation In cloud today as you got enterprise guys backing existing business models into what they're calling a cloud. We're cloud Yeah, yeah, we're cloud. Hey, we do cloud And then you've got you know, the the guys that clean slight view of the world how would you build this thing and and The answer is much more along the lines of what is Zynga's doing then maybe what a you know The legacy vendors would have you believe meaning layering services on top of the commodity cloud Yeah, starting with that base level and then layering services on top I mean, it's very much, you know The complexity is much more in the application than it is in a proprietary hardware layer And that's I mean that that type of mindset is proliferating everywhere That's kind of the app dev You know dev ops versus the dinosaur, right? We talked about that too, right? I mean, it's a mindset thing and I think that that's across all gets across storage is across cloud It's across big data. There's a lot of that going on and that's a clear, you know beyond technology We were just talking about this offline is is it's a Massive inertia from those two camps and how those evolve. Yes, so do you think the enterprise guys? Or eventually gonna get this do they acquire companies to get it or do they just get slammed? I mean How long does it take these cycles to our 15 or 20 years? Maybe we're 10 years in if if you know If sales force was was the first start. I mean, I think You know, they want to get it that doesn't mean they can get there There's a lot that gets in the way from them, you know getting from a to b But I don't think I don't think the market's quite ready for it yet broadly and for now the enterprise guys will just You know do gateways or get on cloud as they can and then over time they get to cloud You know, and I don't think it's enabled by the enterprise guys because one of the cool things Simon said today was you're not in The cloud if you have to pay for it before you use it And that if you use that determination that eliminates practically everyone that says they're in in the cloud That's like the heat that Ellison got from Benny offer on saying cloud in the box Right cloud doesn't come in a box right of course Ellison. What's the what's the most exciting thing that you've seen here at Citrix synergy? I like the I Like what these receivers pretty cool to me I mean if you think of an abstraction layer that that kind of bridges a bit of what you're doing personally with what you're Doing professionally and also from an IT perspective eliminates the concern So no longer it's you know, you're no longer concerned about managing devices. You're managing users And so if you can kind of abstract that layer between or that relationship between the two all you care about now is Is the users you care less about what type of devices they're using and the defense and tell it the DIA? They're his keynote was basically that is that I want to get away from managing devices right now They can't in the government. They can't you can't walk out of a trusted zone with a device You just can't do it. He wants to get out of that business and care less about the device and more about the user and the data Data apps. Yeah, and so you know Citrix is doing I think a lot there and it abstracting that that data in user profile Independent of any device and right and so use whatever device you want that stuff's pretty cool And and I think that you know that that allows them to Enable a lot more things Mobility what do you think about the go-to-manage stuff around that the Citrix online folks are doing around collaboration I've been following that at all the sass-based IT services for small medium-sized businesses that just The bumper sticker for them. Is it just a placeholder? Are they actually doing anything there? I think it's it's kind of like the redheaded stepchild business for them. I mean it does a lot It's a big sass business on its own, but it gets no attention. I mean since Citrix is interesting because they have Four really interesting business lines and in terms of kind of brand attention I mean everyone knows who go-to-meeting is but in terms of kind of real contribution It always falls towards the bottom and the funny thing is on earnings calls if you listen to a Citrix earnings call No one ever asks about go-to-meeting, but it's a it's a legit sass business And it's a good point. That's a good point. I mean it really on its own I mean, you know Citrix broadly what's cool about the company is it's for legit Businesses by themselves. I mean Zen server is more legit by the day validated by public cloud Zen desktop on its own is a legit business net scaler From an F you know from a from a networking standpoint is F5 is a legit You know app delivery controller, and then you have the sass component with Webex With what they're doing there, you know relative to Webex, right? And so those are for standalone businesses. They're trying to tell a cohesive story, but the funny point You know to your original question go to make go to meeting is Always falls to the bottom because it's just there's better stories Why does no one care about it just because it's not interesting. It's I don't know It's more tactical and boring starting to become meaningful from a Contribution standpoint though. Well, the good news is they'd care if it didn't work So repeat the four lines again net scaler. So it's a does a scaler Zen server Zen desktop sass and sass collaboration And then and it compete with different people right Zen server. That's really VMware. Yeah. Well on the private cloud side VMware public cloud side You know these guys have pretty good momentum there would be VMware too, right?  Yeah So, you know, we were talking about acquisitions yesterday, you know, and you made the point that there's pretty diverse businesses there They don't necessarily Fit all together in terms of a package that somebody would necessarily want to buy and then you pointed out other reasons that they might be acquisition proof, but that that's a That's a bit of complexity to an acquirer potentially. It's not a it's certainly not a pure play Yeah, right and and so you have to you have to marry those businesses This is something without the acquiring organization as it gets harder, but I mean they're all strategic components by themselves, right? All right, Dave. I know you were rushing off to see this next key note. So This is Lionsgate. I think coming up now right now. No, I know after that for three o'clock. All right good All right. Well, thanks for stopping by real quick. I'd appreciate it. Thanks guys. We'll see you around see you back at the ranch Dave Cahill We talk about smart nodes Michael. He went from Boston.


I'm currently using something called PasteBot. There's a million things like this on Windows. You don't even need a fancy application. This is actually built in. I don't remember the name of it, but basically it is the idea of having. When you go cut and paste, you keep one thing in the memory of the system.  And so if you're like me and you're going between other Windows copying three things and pasting three other things and getting my email, instead of having back and forth and back and forth between two different applications, where you really just say, oh, I just want to get these five pieces of text mentioned here is this thing. I'm like, oh, it's the right utility that also wanted to get this thing in the list and junk. So let me just, you just really start working through this. It's also really cool because you can search. So you feel like, oh, I know I cut and pasted something yesterday, but what was the name? I think it was like PH in it. You can type and there it is. So it also gives you just like a little bit of a, I know I cut and paste something a while ago and you can actually search on it and then paste it in. If you are a little bit more programery and fancy, you can even run filters through this. You could do something called sequential paste where you can say, like, I'm going to paste seven things and then they'd be cut seven things and then get pasted all of them in order without having to go back and forth. So you can get extra fancy, but even if you're unfancy, I find this to be so useful. It's up there with text expansion, which Brian will show later in a thing, which is if you spend your life on one of our computer, these are just so indispensable because all we do is move text around. And if we can make our lives slightly easier, it's the huge win. And as they say, this is built into Windows or Macintosh people have to find third-party applications to basically build in a similar kind of functionality. But that is Pastebot.