Hello, I have to dissent with some of the recommendations. The only one I can agree, is the fact that possibly now is time for XML RPC to say good bye to WP.

JETPACK STATS AND COMMENTS ARENT DAMAGED IF YOU DISABLE XML RPC.

XML RPC is only needed in a number of scenarios, and since this attack is being drived from any kind of WP websites, big and small ones, there are lots of cases where XML RPC is absolutely no needed. i.e.: when you use WP to build a site with a set of webpages, with no posts, or even no RSS, nor updates. Also when you won't allow people to make comments, or if the comments are managed by Facebook/Disqus/JetPack/whatever and you won't want to see pingbacks/trackbacks.

I disabled the feature using the Disable XML-RPC plugin in a lot of websites (23) and can confirm that no damage has been done to JetPack Stats, nor the publishing to social networks have been effected. Also, I use plugins that retrieve a bunch of remote things, like InfiniteWP to remotely manage sites, Shareaholic and nRelate for Related Content and sharing, and no difference have been noticed.

And please note, I didn't experienced auth problems with JetPack.

The only reason to keep XML RPC enabled is if you use to publish remotely to your site via third party apps. And that's probably the way 10% of sites are using worldwide.

Probably XML RPC should come disabled by default and have a wp-config switch to enable it only when you really need it.