Discrediting the detailed post packed with valid points as "rant" in the title is crappy journalism. Obviously biased towards Mullenweg who owns this site. The fact that he deleted that post does not make it a rant. Yes the #mullware heading sounds like it, the posts text did not! And its correctly called a "post" just right below the heading.

I have seen a former wp core contributer call out Nacin or WP core for security flaws before and his points where stunning and showed how far core got away from understanding/caring about the basic every day user.

I think its always very annoying when people with massive power consider security low priority. And calling this "Important but not a priority" is exactly that.

So you can imagine my shock yesterday when Dion Hulse informed me that Matt Mullenweg, CEO of Automattic and lead WordPress developer, ordered him to not do any work on package signing, because it wasn’t one of Matt’s goals for 2017 (which consists entirely of: Customizer, Editor, and REST API).

Mullenweg stubbornly stays by this goals as if they are written in stone. Probably because he has some kind of philosophy that this is the way to go. He is not willing to change the goals for security. Thats just the wrong decision. And it may very well be that not updating or even using certain themes/plugins are way riskier but he cant do anything about it so listing all the stuff that is riskier does not make a great point for not doing code signing.

I get that this would not immediately benefit anyone but as someone who run my own VPS I would for sure make sure to do any steps needed on server side that seem to be needed if I get this correctly.

What about a 3rd party solution, what if the wp releases would be signed with PGP (I am just guessing that they don't) and one would just use some script that runs every few hour, check for a new version, if any, download, check, install or delete+alarm.

I don't know why he deleted that post, he should just change the title, and funny enough thats also true for this very article ;)

Note to self: Probably do some PGP signing yourself first, then criticize. Well I don' effect 27% of the Internet so there is a excuse ^^