Yeah, I do tend to write a lot when I've been thinking all day about a particular subject - I try to break it up a bit with short paragraphs, and I try to pack a lot in but, yeah, it must be pretty daunting for readers to encounter such long posts. I hope I haven't scared all your readers away :)

I will, at some point, focus my thoughts on a WordPress-related blog of my own but, for now, I remain a comment terrorist, taking your readers hostage, if that's okay with you Jeff.

Sadly, hot-patching cannot be part of the free WordPress package, because an ongoing monitoring and patching service requires serious resources. This service must be paid for, there's simply no other way to get it done, but my main point is that it doesn't require $300 per year of resources, Automattic could probably make more money and do a lot of good for the wider WordPress eco-system if they could price this service just below the all-important $100 threshold - by all means, charge heavy users more but, really, the vast majority of sites cannot justify $300. I suspect they could make more by charging less.

You are wrong, just plain wrong, if you think that competent webmasters notice the smaller, more professional hacks. C'mon, you're a busy guy - unless you routinely examine all your old posts by hand and compare them against original print-outs, you're not going to notice if someone has quietly linked all your 2008 mentions of the phrase "Web Design" to "Sanjeev's House of Web, Best Prices For Your My Friend" site. That is the whole point, we are all busy guys and an entire link-building industry has built up around that fact.

With regard to your question on the mechanics of VaultPress - yes, I am not privy to any details beyond what we have all read on the VaultPress site and the various tech news sites, but it seems pretty clear, and common sensical, that the hot-patching does not also entail hot-restoration.

The hot-patch merely applies the latest core update as soon as it can, if a site is already compromised that won't help. If your site is a smouldering pile of rubble, you will have to wipe everything and re-install using the most recent back-up - a bit like Apple's excellent Time Machine and, in the same way, you can reach back to earlier versions if you feel that the most recent backups were in some way compromised. It is almost certain that Automattic will use heuristic signatures to detect compromised backups anyway.

Also, with regard to the earlier comments about BuddyPress' migration feature - any backup solution can be used for migration purposes, it's just a question of how easy they make it, whether they provide the UI for it to be presented as a feature. I have no doubt that VaultPress will make migrations a snap.