tierra
commented
10 years ago As you pointed out, there's many reasons a plugin could be de-listed from WordPress.org that may have nothing to do with copyright or licensing issues. Just assuming they are all infringing without any report of having done so would be unfair to those plugins. If a plugin really was infringing without question, WordPress.org would be liable for removing that plugin entirely (not just de-listing it), and when they do, it is in fact impossible for the PluginMirror to clone those plugins.
Of course, as it is user-generated content, it is possible for the PluginMirror to clone a plugin that has infringed upon copyright before it has been reported to WordPress.org and removed, however, we do work with GitHub to remove such plugins from the mirror when they are reported, as required by law (also note this comment).
The warning published for de-listed plugins is still fair from our point of view, especially since de-listed plugins are also frequently no longer maintained, there's no official location to provide patches upstream, and there's no support for such plugins. Perhaps this warning could be improved on wording? We're still open to suggestions on that.
chriscct7
tedivm
havahula
MikeHansenMe
One extremely annoying problem with pluginmirror.com is that it assumes plugins which are not published currently but are present in the repository have "licensing issues or security problems". For alot of plugins this simply isn't the case.
There's many reasons a plugin could be in the repo that has nothing to do with licensing or security problems, for example, an author asking for their plugin to be removed from wp.org keeps the plugin in the repository, but disables the public view.
In such instances, it looks really bad for the plugin author, because pluginmirror is basically stating that the plugins are either unsafe or not licensed correctly, which in many cases is simple not true at all.
Either pluginmirror.com should come up with a better system for managing cases like this, or better yet, pluginmirror shouldn't show plugins that aren't listed.
Let's say I went out and made a plugin called Bad Security which is approved for the repo. 3 months later, Bad Security is pulled from wp.org for a huge security risk. Meanwhile pluginmirror not only continues showing the plugin on its site, but in additition the GitHub repo pluginmirror makes then gains SEO ranking from Google since its the only front facing website now with that plugin. Users who then search for Bad Security now end up on pluginmirror's GitHub repo, and download the plugin, completely unaware that there's a gigantic security vulnerability.
Now, there are also legitimate reasons for pulling a plugin from WordPress.org. Maybe it doesn't work with newer WordPress versions, or perhaps, and more likely, maybe it integrates with a service that either no longer exists or no longer supports the API that the plugin was built on.
Another consequence of doing such a thing, is licensing. Lets say a plugin was submitted to the repository, and that plugin is just a copy of a commercial non-GPL compatible program. Since pluginmirror automatically forks non-listed plugins, doing so could get you guys in a heck of alot of trouble if say you're making a commercially licensed (non-GPL compatible) item available on GitHub. Avoiding the whole what license do WP plugins have to be debate, a plugin could be unlisted because they used a commercial Javascript graphing library. By showing that code publically on your site, Bluehost is risking getting into a license lawsuit or discussion, when it could simply avoid it.
By listing plugins that aren't publically displayed, and by forking the code on GitHub, pluginmirror encourages usage of insecure and/or non-GPL compatible and/or legitimate reason for removal plugins. The simple solution is don't show and don't fork non listed ones.