#core-privacy Office Hours Minutes – 13 February 2019

Welcome!

The WordPress coreCore Core is the set of software required to run WordPress. The Core Development Team builds WordPress. development team builds WordPress! Follow this site for general updates, status reports, and the occasional code debate. There’s lots of ways to contribute:

Found a bugbug A bug is an error or unexpected result. Performance improvements, code optimization, and are considered enhancements, not defects. After feature freeze, only bugs are dealt with, with regressions (adverse changes from the previous version) being the highest priority.? Create a ticket in the bug tracker.

Want to contribute? Get started quickly with tickets marked as good first bugs for new contributors or join a bug scrub. There’s more on the reports page, like patches needing testing, and on feature projects page.

Other questions? Here is a detailed handbook for contributors, complete with tutorials.

The following is a summary of the weekly coreCore Core is the set of software required to run WordPress. The Core Development Team builds WordPress.-privacy office hours held on 13 February 2019. Weekly privacy office hours are held every Wednesday at 19:00 UTC. A full transcript can be found here in the #core-privacy channel in the Make WordPress SlackSlack Slack is a Collaborative Group Chat Platform https://slack.com/. The WordPress community has its own Slack Channel at https://make.wordpress.org/chat/..

Participants: @desrosj @dejliglama @idea15 @pepe @lakenh @chriscct7 @postphotos

Adminadmin (and super admin) pointers

@desrosj has created a patchpatch A special text file that describes changes to code, by identifying the files and lines which are added, removed, and altered. It may also be referred to as a diff. A patch can be applied to a codebase for testing. (#45999) to remove the admin pointers for the privacy features which were added in 4.9.6. The attendees agreed that the pointers’ usefulness peaked around the GDPR deadline time when the features were new, but they are no longer necessary.

Workplan for 5.2

The team agreed ten tickets to focus on for release 5.2, all of which are bugfixes or enhancements of existing tools.

The bugbug A bug is an error or unexpected result. Performance improvements, code optimization, and are considered enhancements, not defects. After feature freeze, only bugs are dealt with, with regressions (adverse changes from the previous version) being the highest priority. scrub for Monday 25 February will focus on 5.2 tickets, and the bug scrub for Monday 4 March will focus on component tickets marked awaiting review.

Component roadmap

@desrosj and @dejliglama have cleaned up the draft roadmap for the component’s work in 2019. The group will finalise all outstanding issues on the roadmap during office hours on Wednesday 20 February, and will post the final roadmap to Make.

Candidates for feature plugins

The roadmap process has included discussions of which new features would be best delivered as plugins. These include embed privacy controls, WP-CLIWP-CLI WP-CLI is the Command Line Interface for WordPress, used to do administrative and development tasks in a programmatic way. The project page is http://wp-cli.org/ https://make.wordpress.org/cli/ support, multisitemultisite Used to describe a WordPress installation with a network of multiple blogs, grouped by sites. This installation type has shared users tables, and creates separate database tables for each blog (wp_posts becomes wp_0_posts). See also network, blog, site support, and GutenbergGutenberg The Gutenberg project is the new Editor Interface for WordPress. The editor improves the process and experience of creating new content, making writing rich content much simpler. It uses ‘blocks’ to add richness rather than shortcodes, custom HTML etc. https://wordpress.org/gutenberg/ blocks for data export and erasure requests.

Google Fonts

In response to privacy and performance concerns about Google Fonts (#46169, #46170), @pepe is creating a proof of concept patch to add a customizerCustomizer Tool built into WordPress core that hooks into most modern themes. You can use it to preview and modify many of your site’s appearance settings. option to disable Google Fonts for the older (pre-Twenty Nineteen) default themes.

Upcoming WordCampWordCamp WordCamps are casual, locally-organized conferences covering everything related to WordPress. They're one of the places where the WordPress community comes together to teach one another what they’ve learned throughout the year and share the joy. Learn more./conference privacy talks

Rian Kinney at JoomlaDay Florida – February 23
Heather Burns for the core-privacy team at Drupal London – March 3
Chris Wiegman at WordCamp Miami – March 16
Rian Kinney and Chris Teitzel (panel) at WordCamp Miami – March 17

Cross-CMS privacy working group report

The cross-project privacy team is creating a draft workflow to audit project plugins, modules, and extensions for best privacy practice. The workflow is designed to be adapted to each project’s specific needs. Please review and comment on the first draft.

#core-privacy

Tom J Nowell 1:14 pm on February 20, 2019

a proof of concept patchpatch A special text file that describes changes to code, by identifying the files and lines which are added, removed, and altered. It may also be referred to as a diff. A patch can be applied to a codebase for testing. to add a customizerCustomizer Tool built into WordPress core that hooks into most modern themes. You can use it to preview and modify many of your site’s appearance settings. option to disable Google Fonts for the older (pre-Twenty Nineteen) default themes.

Can we not just bundle the fonts? That way no user opt in or out is necessary. Additionally, there’s no mention of this in either of the quoted tickets

Also, are we disregarding the precedent set when the Google Font was removed from MP6 in WP Adminadmin (and super admin)? /cc @pento It seems to me that the TLDR is that a mistake was made adding Noto Serif via Google Fonts probably due to a lack of awareness. Rather than admit it, it’s been swept under the rug so that the decision can be made a second time to save face, or at least that’s how it looks. Honestly it isn’t such a big deal, I suggest sticking to the original decision
- Gary Pendergast 4:24 am on February 21, 2019
  Open Sans was removed from wp-adminadmin (and super admin) in WordPress 4.6, several years after the MP6 redesign released in WordPress 3.8. It was removed because system fonts had reached a point where the admin could be rendered in a consistent manner with good fonts across all platforms (#36753).
  
  I’d like to see more research into the font bundling option, as some translations will use the localised version of the relevant font (for example, Japanese uses Noto Serif JP), while others will choose to use system fonts where no good equivalent font exists (eg, Hebrew). This can vary by font, too, as Hebrew does use Inconsolata loaded from Google Fonts in Twenty Fifteen.
  
  There’s some relevant discussion on GB2798: this was a deliberate decision to use Noto Serif over system fonts, the folks making that decision were clearly aware of the tradeoffs.
  
  There are multiple criteria that need to be met for changes to happen here:
  - A font change would need to be approved by a GutenbergGutenberg The Gutenberg project is the new Editor Interface for WordPress. The editor improves the process and experience of creating new content, making writing rich content much simpler. It uses ‘blocks’ to add richness rather than shortcodes, custom HTML etc. https://wordpress.org/gutenberg/ design lead. @karmatosed, @joen, or @mapk could provide more insight here.
  - Bundling fonts would need to not increase the `wordpress.zip` file size significantly.
  - Bundled fonts would need to be released under a GPL2-compatible license.
  - Bundling fonts would also need the appropriate infrastructure in place to switch font by language.
  I’m fine with this change happening, but folks working on it should be aware that there are significant hurdles to overcome in order to avoid it creating a poor user experience.
- Joen Asmussen 7:41 am on February 21, 2019
  
  We certainly don’t want lumpy rugs!
  
  I can speak to this, as I was part of the decision-making process. As is hopefully clear from the discussion on the ticketticket Created for both bug reports and feature development on the bug tracker., no malice was intended in linking to Google’s servers, and for the past two years of the font being in place the major concerns around the font choice were related to localization challenges and performance.
  
  As you bring it up, I do recall Open Sans being removed for privacy reasons. It’s unfortunate we forgot to bring that up during the discussion, it should have been. I recall the time of discussion being an incredibly challenging phase of the project, for everyone involved, and although in hindsight this should’ve had more thought, so many gears were in motion at the time, that it was perhaps easy for us to forget, or postpone and then forget. I hope that as we try to attract a new generation of WordPress contributors, we can surface past decisions like these in a way that empowers and encourages, as opposed to discourage.
  
  In addition to what is mentioned on the thread, one of the reasons Noto Serif stayed in place (aside from being more pleasant to read than Georgia) was to imply that the blockBlock Block is the abstract term used to describe units of markup that, composed together, form the content or layout of a webpage using the WordPress editor. The idea combines concepts of what in the past may have achieved with shortcodes, custom HTML, and embed discovery into a single consistent API and user experience. editor is more than just a generic post editor; that via editor styles you can make it look the same as the theme itself. Georgia, and to a vastly greater extent Times New Roman, imply “generic” in a way that if you see Times New Roman on a website you might think the CSSCSS Cascading Style Sheets. is still loading. Simply put, the goal of Noto was to suggest that there are styling opportunities here.
  
  This hasn’t worked as well as we intended. In actual practice, and by virtue of being a theme that actually styles the editor, Twenty Nineteen has done far more to get that point across than the vanilla editor style ever could.
  
  In that vein, and as is also hopefully clear from that discussion linked, removing Noto Serif from the editor, or bundling it, is likely not going to meet blocking pushback, even if we might want to pour one out for it.
Garrett Hyder 8:15 pm on February 20, 2019

Thanks @tjnowell we discussed your concept in #coreCore Core is the set of software required to run WordPress. The Core Development Team builds WordPress.-privacy and believe we were all on board for the bundling fonts idea. Full thread;
https://wordpress.slack.com/archives/C9695RJBW/p1550691350011200

Much appreciate the concept and we’ll switch gears in that direction and update tickets when we have a moment.