In reply to Matt.

@Matt - I can understand you thinking that. However I am quite surprised you would post it without some facts to rebut the things in the article.

My experience with WP has been that the author is well informed about the issues we have been facing in the trenches.

I do not think that xmlrpc needs to be removed from core - but there should certainly be an option to turn it off - and preferably on the next update that rolls out a message that explains to users that they have xmlrpc, if it's turned on, and a blurb about what it does - and give the option to turn it off.

I installed a couple different xmlrpc disabling plugins on a dozen sites, then moved to one of the firewall plugins to disable it.. I am still unsure about which plugin is the safer / better to use. A checkbox to disable in core would be safer and easier.

Speaking of safety - disabling it by default would be safer - and make it easy to turn on if people need it.

A simple note with a link to more info / discussion:
1 – unhcheked – cant post with your phone app, can’t be used to ddos attack other sites, and can’t be used to flood your server with 1000 password guesses per minute, bypassing your limit logins security. Will break jetpack plugin.

2 – checked – now you can post with your phone. now your site can be used to attack other sites and the bots will come and cram a thousand passwords an hour through your system for a couple of days at a time, every few weeks. Now you can use jetpack too. Enjoy.