@George Stephanis:

This is in response to [this comment](https://wptavern.com/how-important-is-jetpack-on-wordpress-road-to-50-market-share#comment-63403) and a few previous remarks by @trentlapinski who expressed his concern with not being able to run a theme marketplace through wordpress.org repo plugin/theme.

> So you can’t use code in the repository to install code that is not in the repository — be it from GitHub or a private commercial server. It’s a security precaution.

I know that you do not make WordPress.org policies, but you seem to agree with them and I am going to ask this as a developer to developer, and a WordPress user to a WordPress user.

The justification for the [guideline](https://wordpress.org/plugins/about/guidelines/) in question (#8) should in an ideal world be that every plugin that comes from the repository is secure, and that is why you do not want to allow them to install 3rd party code that is not coming from the repository. Being in the repository equals being secure and we want to keep things tight and secure.

However this isn't ideal world. I recently [estimated](http://managewp.com/solve-wordpress-security) that around 800 plugins in the WordPress.org repo are a ticking bomb from the security standpoint.

Statistically even, you might be better off installing third party code through a reputable plugin, then installing one from the WordPress.org repository itself.

Note also that WordPress code itself allows you to install code that is not in the repository - simply by using the upload plugin/theme functionality.

So if WordPress core is allowed to do that why a plugin wouldn't be?

> By the user connecting their WordPress.org site to their WordPress.com account, they’ve expressed their informed consent for the two to communicate with each other.

I think that is really the key. Guideline #8 should be simply changed to indicate 'unless the user expressed informed consent'. That would allow for marketplaces to be run from .org repo. And if I want to install a third party plugin/theme through a marketplace, that should be my personal matter as I am expressing my own direct will to do so, exactly the same as when I am uploading a plugin through the WordPress core functionality.

Let the free market rules then take care of any marketplaces that are 'bad' 'misbehaving' or whatever. Otherwise this seems to be an artificial ban that is among other things (and I just noted this) advantageous to Jetpack and its philosophy of bundling all code within one plugin then turning mre and more features into a paid service etc. Btw Jetpack 's code is already larger than entire WordPress, and purely from a developer standpoint this is somehow wrong.