Networking

Image: Chorus
The New Zealand Commerce Commission (ComCom) has released a draft decision [PDF] on the value of Chorus’ fibre network for regulatory purposes, pricing the network at NZ$5.4 billion. Under the Telecommunications Act, ComCom is required to establish the value of Chorus’ fibre network, which includes the assets Chorus uses to provide fibre broadband services, as well as a financial loss asset (FLA) to compensate Chorus for losses it incurred when rolling out the network ahead of demand. The official valuation, which must be officially set by the start of 2022, determines the maximum revenue a regulated provider like Chorus can earn from its fibre network. Due to this, the valuation of the network is a “key building block” for determining how much revenues Chorus will be able to earn until 2025, ComCom said.The fibre network was built by Chorus in partnership with government-owned Crown Infrastructure Partners under the Ultra-Fast Broadband program. The NZ$5.4 billion figure, which values Chorus’ core fibre assets at NZ$3.98 billion and its FLA at NZ$1.5 billion, is around NZ$160 million lower than the regulatory asset base (RAB) valuation submitted by Chorus in March. The draft decision took into consideration consultation from external experts and other stakeholders regarding the initial valuation made by Chorus, ComCom said. The dip in valuation was largely due to ComCom not sharing Chorus’ view on certain cost allocations, with the regulator saying non-fixed fibre lines access services should be allocated to the telco’s copper network instead.

“While we mostly agreed with Chorus’ proposed asset valuations, we considered that some infrastructure and overhead costs that have been allocated to its fibre network should more appropriately be allocated to its copper network and other parts of its business,” Telecommunications commissioner Tristan Gilbertson said. “These types of costs should not be passed on to fibre consumers.” This reduction was partially offset by changes made to improve the approach to calculating Chorus’ FLA, however, which adds back around NZ$80 million in value, ComCom explained. Following the draft decision’s release, ComCom is now seeking feedback from Chorus and other stakeholders. Chorus CEO JB Rousselot said Chorus would analyse the draft decision and make submissions based on extensive modelling work. “We welcome this step towards greater certainty for Chorus and our investors.  Our aim is to ensure the final RAB reflects the full costs of structural separation required by the public-private partnership with the Government. We’ve used a lot of our existing infrastructure and spent billions more to rollout the fibre network over the last decade,” Rousselot said. “It’s critical that the true value of our participation in this partnership is recognised so we can keep investing in developing the capability and reliability of fibre broadband for New Zealand.” ComCom is expected to give another network valuation in December, with the regulator set to give the final valuation for Chorus’ fibre network next year when “when all necessary information is available.” As of April, Chorus has 143,000 users on 1Gbps connections, after uptake grew by 7,000 connections during the three months to the end of March. The broadband wholesaler also said that the quarter saw it add another 29,000 customers into its fibre network, with the average monthly data use of fibre rising from 460GB to 491GB.Related Coverage More

Cisco on Wednesday reported fourth quarter financial results slightly ahead of expectations. The networking giant reported double-digit order growth across all customer markets and geographies, including product order growth of 31 percent — its strongest year-over-year growth in over a decade. Cisco’s Q4 non-GAAP earnings per share came to 84 cents on revenue of $13.1 billion up 8% year-over-year. For the full fiscal year, Cisco’s non-GAAP EPS was flat year-over-year. Revenue was $49.8 billion, up 1% year-over-year.Wall Street was expecting fourth quarter earnings of 82 cents per share on revenue of $13.03 billion.”We continue to see great momentum in our business as customers are looking to modernize their organizations for agility and resiliency,” CEO Chuck Robbins said in a statement. “The demand for Cisco technology is strong with our Q4 performance marking the highest product order growth in over a decade. With the power of our portfolio, we are well positioned to help our customers accelerate their digital transformation and thrive in a hybrid world.”The product order growth also coincides with supply chain challenges hitting Cisco and other IT companies, which has prompted Cisco to respond with “strategic price increases.””Looking ahead, we expect the supply challenges and cost impacts to continue through at least the first half of our fiscal year and potentially into the second half,” CEO Chuck Robbins said on a conference call Wednesday. 

That said, the CEO added that there’s no evidence that this is causing customers to order ahead of their needs. “We certainly think customers are placing orders further in advance because of lead times, which is just logical,” Robbins said. “When you see the order growth in Q4 and then you see the forecast pipeline that we see going forward, it would suggest there’s a fair amount of demand out there.”
Cisco
Cisco reported continued momentum in transforming the business to delivering more software and subscriptions. It achieved $4 billion in software revenue in Q4 (an increase of 6% with subscription revenue up 9% year-over-year) and $15 billion for the year (an increase of 7% with subscription revenue up 15% year-over-year). Overall, product revenue in the fourth quarter was up 10% year-over-year, totaling $9.72 billion. Within that category, security revenue was up 1% to $823 million. Revenue from infrastructure platforms 13% to $7.55 billion, while applications revenue was down 1% to $1.34 billion. Revenue from “other products” declined 42% to $4 million.Service revenue in Q4 was up 3% year-over-year, reaching $3.41 billion. Deferred revenue in Q4 was $22.2 billion, up 8% in total, with deferred product revenue up 19%. Deferred service revenue was up 2%.The remaining Performance Obligations came to $30 billion at the end of Q4, up 9%.For the first quarter, Cisco expects revenue growth of 7.5% to 9.5% year-over-year. For the full fiscal 2022, it expects revenue growth of 5% to 7% year-over-year.

Tech Earnings More

Microsoft
In 1994, I’d already been covering the internet for years and I knew it was going to change the world. Microsoft still hadn’t come around to that idea. In the first edition of Bill Gates’s book The Road Ahead, he barely mentions the internet. In the next edition, Gates gave the internet a chapter to itself and by May 1995 he realized that the internet would be a technology tidal wave. Microsoft started rewriting history to make itself an internet pioneer. Recently, Hadi Partovi, CEO of Code.org, revived that tired narrative in a series of tweets in which he claimed Internet Explorer “was the first real salvo in the ‘Browser Wars.'”

I covered the web in those days and I beg to disagree.While Microsoft’s top brass put the internet on the back burner, others realized that Microsoft needed something to offer the numerous users who wanted a web browser. Their quick-fix solution was to adopt a commercial version, Spyglass, of the first widely successful web browser, Mosaic. This was the foundation of Internet Explorer (IE) 1, which rolled out the doors on August 16, 1995, as part of Microsoft Plus for Windows 95, a Windows software add-on package.IE 1 did not do well. It also left a bad taste in Spyglass’s mouth. Spyglass was to receive a percentage of Microsoft’s profits from IE. What actually happened was Microsoft began bundling IE with Windows starting with the next version of Windows 95 for OEMs. Microsoft would eventually settle with Spyglass for $8 million in 1987.This Spyglass/Mosaic codebase would remain part of IE until IE 7 was released. The About window on IE 1 to IE 6 all contained the text “Distributed under a licensing agreement with Spyglass, Inc.”
In the meantime, Marc Andreessen, one of Mosaic’s creators, took the Mosaic code and turned it into the first widely successful web browser, Netscape. Andreessen boasted that Netscape would “reduce Windows to a set of poorly debugged device drivers.” Microsoft returned the “love.” Netscape CEO James Barksdale testified that in a meeting with Microsoft: “I had never been in a meeting in my 33-year business career in which a competitor had so blatantly implied that we should either stop competing with it or the competitor would kill us.”

Partovi says Microsoft did this with technology, not illegal deals. Still, he admits that “we signed partnerships with anybody who would help us, even competitors like Apple and AOL.” At the time, though, Apple was in financial hot water and was even allowing other companies to build Mac clones, e.g. DayStar Digital. America Online (AOL) was trying to jump from being a modem-based online service to a destination website and Internet Service Provider (ISP). Neither were Microsoft rivals. But, they could bring IE to more customers. He claimed that the Internet Explorer team was “the hardest-working team I’ve ever been on. And I’ve worked at multiple start-ups. It was a sprint, not a marathon. We ate every meal at the office. We often held foosball tournaments at 2 am, just to get the team energy back up to continue working!” Partovi added, “Sadly, there were divorces and broken families and bad things that came out of that. But I also learned that even at a 20,000-person company, you can get a team of 100 people to work like their lives depend on it.”He says this as if it were a good thing. It wasn’t. The rise of IE and the fall of Netscape had little to do with all programming death marches and everything to do with Microsoft’s monopoly over the desktop.Since then, Partovi has backed off this last claim. He’s since admitted he “created the misimpression of a toxic culture and then glorified it.” He also confessed that when he founded Code.org, it “started out in an unsustainable ‘crunch mode,’ and as we’ve grown, we’ve intentionally focused on how to achieve our ambitious long-term goals in a way that also offers a healthy work/life balance for our team.”

see also

The best browsers for privacy

If you’re like most people, you’re probably using Google Chrome as your default browser. It’s hard to fault Google’s record on security and patching but privacy is another matter for the online ad giant.

Read More

In his initial tweets he credits IE 3 for starting IE’s run to web browser market share victory. “When IE3 launched 25 years ago, it didn’t win the browser war, but it made a serious dent, and Netscape began to worry. Two years later we shipped IE5, which became the dominant web browser of its time.”Why? Partovi continues: “Tech history explains this to be about Microsoft’s Windows monopoly, which surely played a role. But it wouldn’t have been possible if Microsoft didn’t also learn how to work on ‘Internet time.'”Sorry, I reviewed all those versions of IE and their competition back in the day. I’m sure the IE team worked really hard on its program, but Netscape Communicator was where the real innovation happened. For example, love it or hate it, JavaScript is arguably the most popular language in the world, and JavaScript was a Netscape creation.  Here’s the real reason why IE beat Netscape: Microsoft strong-armed PC vendors into putting the new operating system and its browser on all their PCs. The goal was not so much to kill off other PC operating system vendors. There wasn’t any real competition in the mid-90s. The goal was to destroy Netscape.The courts, in case you’ve forgotten, agreed. The Department of Justice won in its lawsuit against Microsoft on the grounds that its PC monopoly may make it impossible for Netscape to compete with IE. Unfortunately, rather than breaking Microsoft up into separate companies or open-sourcing Microsoft’s code, the government gave Microsoft a slap on the wrist. As former judge Robert Bork, speaking on behalf of trade group ProComp, said at the time, the settlement was “indeed deeply harmful to the public interest” and “is completely deficient.” He described it as “a surrender” on the part of the Justice Department.And, worse still, the deal failed to address one of the most important aspects of the court ruling that found Microsoft had violated U.S. antitrust law: The commingling code. In its decision, the court found that Microsoft’s merging together of the IE and Windows software code constituted an anticompetitive act. “Yet this decree does not deal with it at all…so Microsoft remains free to bolt products together,” Bork stated.So, of course, Microsoft continued to do this. Netscape staggered on to eventually die. Years later, its browser code would live on in the Firefox web browser. For more than a decade, Microsoft would continue to dominate both the desktop and the browser. It was only after Google, a technology business powerhouse in its own right, released the Chrome web browser in 2008 that IE would face a market challenge it couldn’t overcome. Technically, from beginning to end, IE was never the best browser. It won because an illegal monopoly was allowed to continue. Related Stories: More

Looking for a better Wi-Fi solution for a small business, home working, or a heavy-duty home network? Look no further than the new WAX202 and WAX206 desktop WiFi 6 Access Points from Netgear.

These are Netgear’s latest addition to its Business Essentials family of products and combine high performance and professional-grade features with ease of use and a low price tag. Both the WAX202 and WAX206 leverage the latest WiFi 6 wireless standard, which means that you get better coverage and fewer dead spots, all of which translates into a better, faster internet experience. Also: Internet slow? Here are 7 possible reasons why and how to fix them Both the WAX202 and WAX206 have been designed with ease of setting up and configuring in mind, and feature an intuitive web-based interface that provides step-by-step instructions for system configuration. The new WiFi 6 standard is used on both the 5GHz and 2.4GHz bands offered by the access points, future-proofing them for Wi-Fi devices to come. Also, both the WAX202 and WAX206 are backwards compatible with devices using WiFi 5, ensuring broad compatibility. Since not everything is wireless, the access points feature multiple 1Gb Ethernet ports to enable easy connection to PCs, printers, and other wired network devices, freeing up wireless bandwidth for Wi-Fi-only devices. Feature Comparison Chart WAX202 WAX206 WiFi Technology WiFi 6 (802.11ax) WiFi 6 (802.11ax) WiFi Standards Supported 802.11b/g/n/ac/ax 802.11b/g/n/ac/ax Frequencies 2.4GHz, 5.0GHz 2.4GHz, 5.0GHz # of SSIDs 3 3 Speed 1.8Gbps (AX1800) 3.2Gbps (AX3200) Ethernet Port Four 1GbE ports One 2.5GbE port, three 1GbE ports Dimensions (LxWxH) 6.7 x 2.5 x 9.5in(170 x 63 x 242mm) 6.7 x 2.5 x 9.5in(170 x 63 x 242mm) Weight 1.1lb (497g) 1.1lb (504g)

The WAX202 has a recommended price tag of $99.99, while WAX206 will be available later this month and retail for $149. Both also come with a 3-year hardware warranty and 90 days of phone and chat support. More

A dispute broke out on Tuesday after cybersecurity company Rapid7 released a report about a vulnerability in a Fortinet product before the company had time to release a patch addressing the issue.Rapid7 said one of its researchers, William Vu, discovered an OS command injection vulnerability in version 6.3.11 and prior of FortiWeb’s management interface. The vulnerability allows remote, authenticated attackers to execute arbitrary commands on the system through the SAML server configuration page.Rapid7 said the vulnerability was related to CVE-2021-22123, which was addressed in FG-IR-20-120. The company added that in the absence of a patch, users should “disable the FortiWeb device’s management interface from untrusted networks, which would include the internet.” The report included a timeline that said Rapid7 contacted Fortinet about the vulnerability in June and it was acknowledged by Fortinet by June 11. Rapid7 claims they never heard from Fortinet again until they publicly released the report on Tuesday. A Fortinet spokesperson contacted ZDNet after the story on this vulnerability was published to criticize Rapid7 for violating the terms of their disclosure agreement. Fortinet said it has a clear disclosure policy on its PSIRT Policy page which includes “asking incident submitters to maintain strict confidentiality until complete resolutions are available for customers.” “We had expected that Rapid7 hold any findings prior to the end of the our 90-day Responsible disclosure window. We regret that in this instance, individual research was fully disclosed without adequate notification prior to the 90-day window,” the Fortinet spokesperson said, adding that they often work closely with researchers and vendors on cybersecurity.  “We are working to deliver immediate notification of a workaround to customers and a patch released by the end of the week.”

Fortinet did not respond to follow up questions about the patch for the vulnerability. Rapid7 updated their report to say that Fortiweb 6.4.1 will be released at the end of August and will have a fix for the vulnerability.Tod Beardsley, director of research at Rapid7, told ZDNet that their vulnerability disclosure policy outlines a 60-day minimum for disclosing vulnerabilities after initial contact attempts. “In this instance, the initial disclosure was presented to Fortinet on June 10 and a vendor ticket was received on June 11, per our disclosure report. We made several follow-up attempts with Fortinet following that initial communication and unfortunately we received no response back after 66 days,” Beardsley explained. “There was no violation of disclosure policies. Shortly after publishing the disclosure, we were in contact with Fortinet and they indicated they will be releasing a fix. Once that fix is released, we’ll update our disclosure with that link and CVE ID.” Beardsley added that there is no indication the vulnerability has been used, so Rapid7’s disclosure “should be read as a cautionary piece for users of Fortinet’s FortiWeb.” He reiterated that users of FortiWeb should not expose their management interface to the internet in general and should make sure that the people with authentication credentials are picking solid, strong passwords. More

Image: Intel
Amazon Web Services has announced the availability of M6i instances that make use of Intel’s Ice Lake Xeon Scalable processors, and its Total Memory Encryption functionality.The performance bump over M5 instances is said to be an up-to-15% improvement for compute, and twice the networking speed of M5, Amazon said. AWS has created a new instance size, m6i.32xlarge, that consists of 128 vCPUs and 512 GiB of memory, which is a 33% increase on the largest M5 instance, and has 20% higher memory bandwidth per vCPU thanks to Elastic Fabric Adapter. Otherwise, M6i instances are available with 2, 4, 8, 16, 32, 48, 64, or 96 vCPUs. m6i.32xlarge is touted as having 50Gbps of networking speed and 40Gbps of bandwidth to the Amazon Elastic Block Store, and 10Gbps of bandwidth in 2, 4, 8, and 16 vCPU instances. M6 instances are available today in US East, US West, Frankfurt, Ireland, and Singapore regions as on-demand purchases, or with savings plans, reserved instances, spot instances, dedicated instances or dedicated hosts. Last month, AWS warned users to get off EC2-Classic instances ahead of its shutdown. On October 30, AWS will disable EC2-Classic in Regions for AWS accounts that have no active EC2-Classic resources in the region, and the company will not sell one-year and three-year reserved instances. AWS expects migrations to be complete by August 2022. Related Coverage More

(image: WP Engine)
If you’re looking for a web hosting provider, you have a tremendous number of choices. In my web hosting provider comparison guide — Best web hosting providers —  I looked at 15 providers that offer a wide range of plans.In this review, we’re going to dive into WP Engine’s offerings. Normally, to get a better feel for each individual provider, I set up the most basic account possible and performed a series of tests. But WP Engine is a more specialized host, primarily offering managed WordPress hosting.As such, WP Engine’s basic plan starts at $24 per month (when a year is prepaid), where most of the other hosting providers we’ve reviewed offer plans under $5 per month. Note that this isn’t because WP Engine is overpriced. Instead, it’s offering a more advanced level of service for sites that require more resources.As you transition from a site with a few pages to a site like mine with a lot of complexity but still relatively small, to huge sites like ZDNet, the cost of hosting goes up considerably. WP Engine targets small businesses up through enterprise needs, so its pricing reflects the resources those customers need to be able to use. For our review, I’ve chosen the Managed Hosting Plus Startup Plan. The Plus plan is $4 per month different from the basic plan, but it adds automatic plugin updates, tested plugins, auto-rollbacks, and a choice of which plugins are updated. To be clear, the automatic plugin updates feature is no longer much of a selling point, because WordPress now offers that as part of its basic install. But the auto-rollback feature (which when you need it, you really need it) is worth the extra few bucks a month. If you’re springing for managed hosting, you might as well have an “Ah, sh__!” button you can press when you need it. How pricing works

This is normally the place in my hosting reviews where I begin my rant on the scammy bait-and-switch lock-in strategy hosting providers use to get and keep your business. Lower-end hosting services suck you in with offers of a couple of bucks a month. But to get the advertised price, you wind up paying for years of service up front, and then when that contract is up, the renewal fees are anywhere from double to ten times what you originally paid. There are business reasons for this, of course. First, it works. Most people don’t worry about what the renewal cost will be until they’re faced with a whopping bill to keep their site up or incur weeks or months of pain to port it somewhere else. But it’s also because running a hosting service is expensive, and the hosts have to make money somehow. But once you move up a tier, into small business managed hosting and above, most hosting providers make their money from the fees they charge. They don’t have to entice you with a low-ball offer. You know you need more memory, more CPU capacity, more storage, more bandwidth, and more support — and you’re willing to pay for it. So, they don’t need to bait-and-switch. After all, at $30 per month to $40 per month, you’re paying more in a month than many of the low-ball hosting providers make in a year from a given client. Types of plans offered WP Engine’s plans are like that. It has tiers that make sense. First, if you pay for a year up front, you save a bit over paying monthly. Usually, that’s the equivalent of about two months of free service. For every category of plan, it scales based on the number of sites you get with the plan, number of visits per month, amount of storage you use, and bandwidth. Then comes the four plan types the offer. The first is basic managed hosting. This gets you 24/7 support via chat, some themes, free automated migrations, daily backups, free SSL and SSH, and a staging site. All good, especially if you’re doing series work. I opted to test the Managed Hosting Plus plan, which is just a few bucks more. As I mentioned, it adds automatic updates (which is now provided by WordPress), and automatic rollbacks, which is very helpful. When I scoped out the plans, I realized I would never recommend the basic plan given the Plus plan is a few bucks more. So, I’m testing that. If you don’t get the WP Engine eCommerce plan, you’re not prevented from setting up an online store. It’s just that you have to do most of the heavy lifting, finding the software, etc. With the eCommerce plan, WP Engine installs WooCommerce (the top WordPress online store add-on, owned by the company that produces WordPress). It also provides an optimized store theme, some templates, and so on. In the next tier up, it adds store search functionality, which lets customers search for products. Basically, you’re paying a few bucks more for WP Engine to get it working for you. Finally, the company has a Secured Hosting plan. This doesn’t necessarily secure your site from malware. If you’re concerned about malware, you can reach out to WP Engine support, and they’ll help you determine if you’ve been attacked or not. No, what the Secured Hosting plan does is protect you from outside traffic attacks. It offers distributed denial of service attack protection and a security firewall for your traffic (which can help defend against malware flowing into your site). In 2009 (before I wrote for ZDNet), I was on the receiving end of a massive attack. My hosting provider did not have any defense and I wound up writing my own code. It would have been a huge relief to have the Secured Hosting plan when that happened. Installing WordPressWhen you first log into WP Engine’s dashboard, you’re greeted with a survey screen. Presumably, these questions are used for marketing purposes. Once you dig through those screens, you’re given the opportunity to set up other user accounts. These are dashboard users. Setting up your WordPress users will be done in WordPress. And, finally, you’re in the dashboard. Let’s add a new site: This step is actually very interesting and requires some unpacking. When you buy your plan, you’re given a certain number of sites you’re allowed. The plan I’m on allows one site. But…WP Engine has this concept of a “transferable site.” You can’t switch a site from non-transferable to transferable, so decide this upfront. A transferable site is one where you build the site, then you transfer it to a client who also has a WP Engine account. You’re allowed as many transferable sites as you want since the only way outside traffic can get in is via a password-protected portal. Next up comes a grid of four choices. You can start with a (mostly) blank site, get some handholding as you build your site, or transfer sites. I always like to go with as much control as I can, so I’m starting with a basic site. Then I clicked Next. I thought this was kind of interesting. First, you need to name your “environment.” Initially, you can use a subdomain, but you can later move it to a domain of your choosing. It’s this environment thing that’s interesting. In addition to the transferable sites, you can set up three “environment” sites: Development, staging, and testing. This means you can work on your site while your production site is live, and then switch environments. I like that… a lot. I’m going to go straight to production because I’m just running some basic tests. I’m also turning off automatic plugin updates because I like to be aware of when my plugins update. Then I clicked Add Site. At this point, the following Site list shows up. You can’t do much yet, other than delete the site. After about five minutes, I got an email telling me my site was ready. I clicked the URL, and there you go: Next, I configured an admin password. This takes you to the normal WordPress admin reset screen, where you enter your email address and a new password is mailed out. Nothing surprising here. The main WordPress dashboard page was surprisingly crap-free. That’s definitely a breath of fresh air after encountering all the upsells and crapware of previous reviews. There is a “WP Engine has your back” widget, but all it does is point you to some performance management features of the host dashboard. My next stop was Plugins and it was pretty much garbage-free (something of a rarity with WordPress hosting providers): There’s the Akismet Anti-Spam plugin that comes with most sites, and StudioPress (a WP Engine product) Genesis Blocks, a plugin that adds some editor features. The Themes area was equally un-hateful. Yes, WP Engine defaulted to its in-house theme, but Genesis is actually a fine base theme. Beyond that, it just had a few recent default WordPress themes installed. Overall, the WordPress install in WP Engine was clean and without either muss or fuss. It’s definitely workable. The rest of the WP Engine dashboard The first thing I like to do when looking at a new hosting provider is exploring their dashboard. Is it an old friend, like cPanel? Is it some sort of janky, barely configured open source, or homegrown mess? Or is it a carefully crafted custom dashboard? These are often the ones that worry me the most because they almost always hide restrictions that I’m going to have to work around somehow. You don’t really gain access to the WP Engine dashboard until after you install a site/environment: Once you do, a quick click on the site name gives you a more comprehensive tool: Yeah, that’s more like it. There’s a quick access button to PhpMyAdmin for database manipulation, another to launch the WordPress admin interface and quite a lot of setup options. I’m not going to go into them in-depth since this review still has quite a way to go, but I didn’t see (or not see) anything that would make me worry. All told, WP Engine seems to be quite comprehensive in terms of what it allows site operators to do. This might also be a good place to mention that WP Engine produces the Local WordPress hosting environment, for hosting WordPress on your development machine. This product used to be Local by Flywheel before WP Engine acquired it. I can personally attest to the quality of the Local implementation. As I mentioned in my development tools article, I use Local every day for coding and maintenance of the WordPress plugins I manage. It’s a very helpful tool. And, it’s free. Quick security checks Security is one of the biggest issues when it comes to operating a website. You want to make sure your site is safe from hackers, doesn’t flag Google, and can connect securely to payment engines if you’re running an e-commerce site of any kind. While the scope of this article doesn’t allow for exhaustive security testing, there are a few quick checks that can help indicate whether WP Engine is starting with a secure foundation. The first of these is multifactor authentication (MFA). It’s way too easy for hackers to just bang away at a website’s login screen and brute-force a password. One of my sites has been pounded on for weeks by some hacker or another, but because I have some relatively strong protections in place, the bad actor hasn’t been able to get in. WP Engine has a well-considered MFA implementation, allowing you to use SMS, Google Authenticator, or even Okta for enterprise SSO. This is for the main WP Engine dashboard. You, of course, can add a plugin to your WordPress site to put MFA on there as well. Also, the site created by WP Engine has SSL security by default. As you can see, the dashboard (and this also applies to the user-facing content) has a valid certificate and encryption. I didn’t have to set up anything I like to externally test SSL implementations using a test suite provided by SSL Labs. WP Engine passed easily:As my last quick security check, I like to look at the versions of some of the main system components that run web applications. To make things easy, I chose four components necessary to safe WordPress operation. While other apps may use other components, I’ve found that if components are up-to-date for one set of needs, they’re usually up to date across the board. Here are my findings (using the Health Check & Troubleshooting plugin), as of the day I tested, for WP Engine’s Managed Hosting Plus Startup plan: ComponentVersion ProvidedCurrent VersionHow OldPHP7.4.227.4.222CurrentMySQL/MariaDB5.7.34-37-log5.7.35/8.0.264 monthscURL7.58.07.78.042 monthsOpenSSLOpenSSL/1.1.1OpenSSL 1.1.1k34 monthsIn general, these results aren’t bad. You kind of need to know the component to know how to read these results. PHP is pretty much right on track. MySQL currently lives in two tracks, a maintained 5.7 track and an 8.0 track with newer technology. Both are supported by WordPress and as long as the 5.7 track is maintained and updated (particularly for security threats), it’s fine to be running 5.7.34. Oddly enough, Local (the local development environment owned by WP Engine I discussed earlier) defaults to MySQL 8.0.16. So much for consistency. Go figure. cURL is a little disturbingly out of date as is OpenSSL, but as the previous SSL test showed, the actual SSL encryption is solid, which is what we’re really concerned about. The bottom line is that WP Engine is on track for the core WordPress components and a little behind on supporting encryption and data transfer, but testing shows it’s not far enough behind to cause a security threat. Performance testing Next, I wanted to see how the site performed using some online performance testing tools. It’s important not to take these tests too seriously. These are just quick tests on a site with no traffic.That said, it’s nice to have an idea of what to expect. The way I tested was to use the fresh install of WordPress with the default installed theme. I then performance test the “Hello, world” page, which is mostly text, with just an image header. That way, we’re able to focus on the responsiveness of a basic page without being too concerned about media overhead. First, I ran two Pingdom Tools tests, one hitting the site from San Francisco and the second from Germany. Here’s the San Francisco test rating: Then I ran the test from Germany. The results were both quite good: Next, I ran a similar test using the Bitchatcha service: None of the tests showed bad performance, and I found the responsiveness of the WordPress dashboard to be snappy as well. Now, here’s the gotcha. Basic performance is fine, but we don’t have data for how the service will perform under load. Since you’re presumably buying a higher-end managed hosting service, you’re probably expecting some level of traffic. I say this a lot in my reviews, but take advantage of the money-back time period to fully test out results for yourself. You have 60 days with WP Engine. Make sure to use them. And if you run into performance issues, reach out to the company. Managed hosting services are supposed to provide better hands-on support, so use it. Support and money-back guaranteeThe company does have 24/7/365 live chat support. I tried it out at 1am on a Sunday morning (what? I’m a night person) and found the support representative to be both knowledgeable and friendly.WP Engine offers a 60-day money-back guarantee. Here’s a blog post that explains how to cancel the various types of service. Overall conclusion I got no complaints. No, seriously, I have no complaints. Other than a few component versions being out of date (but still within the system requirements for WordPress), I have nothing to ding them over. Setup was straightforward. The hosting dashboard, while not as comprehensive as cPanel, provided all the resources a well-equipped WordPress would require. The addition of development and staging versions, along with the transferable sites provides a lot of flexibility for a 1-site plan. SSL worked and passed my tests, and site responsiveness was good. Support was responsive, helpful, and intelligent in the middle of the night on a weekend. If you’re looking for a super-cheap hosting offering, this isn’t it. But if you’re serious about hosting your site, you could do a lot worse than WP Engine. I don’t do star reviews, but I’d give it a four (out of five). The only reason I wouldn’t give it a five is I’d never give a hosting provider a top rating on just a week or so of evaluation. You don’t really get to know your hosting provider until you’ve worked with them for a few years and resolved a few crisis events. That said, if I had to move my sites to another provider, I’d definitely consider WP Engine. You can follow my day-to-day project updates on social media. Be sure to follow me on Twitter at @DavidGewirtz, on Facebook at Facebook.com/DavidGewirtz, on Instagram at Instagram.com/DavidGewirtz, and on YouTube at YouTube.com/DavidGewirtzTV.

ZDNet Recommends More

I test a lot of USB-C accessories to test, but few end up as part of my equipment. But there’s one accessory that I’ve had for over a year now, and I use it pretty much daily on my MacBook, iPad Pro, and any USB-C equipped Windows 10 laptops I happen to be using.

It’s a hub. A small hub that fits onto a pocket or bag easily. And best of all, it’s only $32.99.It’s the Anker 7-in-1 USB-C hub.On the connectivity front, the hub comes with a single 4K 30Hz HDMI, a 100W Power Delivery USB-C port, a USB-C data port, microSD/SD card reader slots, and two USB 3.0 ports.It also comes with a 20cm USB-C cable attached. Initially, I thought this to be a weak link because if this broke the hub is trash, but after over a year of hard use, it’s still like new.Anker quality shines through.

Must read: Apple releases massive mystery bug fix update for Macs
It also comes with a carry pouch for keeping it scratch-free and any chunks out of the ports.The only port that’s missing is an Ethernet port, but to be honest I can’t remember the last time I needed to use one. If you want a very similar portable hub that has an Ethernet port, then Anker makes an 8-in-1 hub with that feature for $59.99.
I’ve used this hub on dozens of devices and taken it with me on long trips, and it has not let me down once. All Anker hubs come with an 18-month worry-free warranty in the event of something going wrong. There are also many much bigger docks out there. Anker has the amazing PowerExpand Elite 13-in-1 dock, and Plugable has a range of docks and adapters to suit all needs, size constraints, and budget! 

The docks market really has risen to the challenge of professional wanting to make the most of a limited number of USB-C ports.I’m curious to know what must-haves you use. Let me know!

ZDNet Recommends More