"One interesting observation Mullenweg made during podcast is that Automattic is just one of many larger players that make up the the WordPress economy, which he has previously estimated at $10 billion/year"

The last valuation I saw for Automattic alone was tipping over 3B.

deep pockets = deep concerns

I have deep concerns about the direction of WordPress and abuse of power that goes well beyond the antics of the progressive superiority complex we've pop it's head from time to time. Recent discussions about forced major updates to cull efforts away from back-porting doesn't fall on grace so much after one realizes how much money backs this org, especially when they foot lavish bills on what would be considered indulgences like trips around the world to exotic far reaching places for company meetups and such. Don't get me wrong, I think it's great to revel in success, reward good work and celebrate your achievements.

However, the argument to drop back ports due to it being too labor intensive while at the same time needing to force-update sites 3.7 and upward without explicit consent, creates a conflict of ethics when the main argument for forcing the updates is about protecting the rest of the internet from older running versions that could one day become a vulnerable node on the web and used in an attack vector...yet it would seem we have deep enough pockets that can easily foot the bill allowing all do-gooding to proceed as normal (barely making a dent in the coffers) -- if that truly is the concern. Sometimes moral responsibility requires making a sacrifice and paying a price. Not to mention ISPs have skin in this game too...AND the actual authority to boot, so let's not forget that.

Most back port efforts are pretty minor, we can all see this in trac but the security team acts like only 30 people in the world can do this job effectively and/or can be trusted with the task. That doesn't help the situation and I see no efforts to do anything about this perception.

Drop the back ports or don't, I don't really care, the internet will survive, but don't be evil and dip into MY installations without my explicit consent, even if you think you're being a do-good'er. Only me and my ISP have that authority.

In the case of the API, our site's 3.7 and up reach out multiple times a day, every day, exposing the entire structure of what's installed just waiting for a nefarious update package that wipes out 1/3 (or maybe 85%) of the web one day.

From that perspective, sites < 3.7 are impervious to "the big one" pushed down from the API should it ever occur.

It's also worth mentioning WordPress has had a pretty bad rep over the years regarding security specifically (I'd argue more so than any other CMS) and it still blows me away the lack of built-in obfuscation that could help reduce this reputation by making it harder to detect sites are running the CMS in the first place. It would seem efforts in that direction would make more sense too and one of the reasons headless has become so attractive yet one sacrifices the wealth of the WordPress ecosystem unless there is a port, maybe something like what Frontity is doing.

I haven't fallen out of love with this CMS but I really prefer you don't tread on me after freely offering your open source software to me to do as I see fit. Sends a conflicting message especially when considering the WordPress Bill of Rights, where it nowhere states "...unless you are running outdated versions"