Episode 31 Brent Toderash - CourtneyR.dev's 2nd Brain

Episode 31: Brent Toderash ![rw-book-cover](https://img.youtube.com/vi/Lfs9E13Ozbc/maxresdefault.jpg) 🔗 **Source:** [Episode 31: Brent Toderash](https://www.youtube.com/watch?v=Lfs9E13Ozbc) > [!note]+ Document Notes > tags: [fair-protocol, software-supply-chain, open-source-governance, package-distribution, ai-assisted-development, typo3] > author: Chris Reynolds > source: Community and Code > reference: https://www.youtube.com/watch?v=Lfs9E13Ozbc > date created: 2026-08-01 09:05 > > > [!info] Generated analysis — not the author's words. Sections below are machine-written > > from the captured source. Only text inside `> [!quote]` blocks is verbatim from the author. > > Do not quote or attribute any other line to the named author. > > > > [!note] Re-upload > > The channel re-uploaded this episode on 2026-09-22 as https://www.youtube.com/watch?v=HsrDGRXvSas (92–95% identical transcript). This original doc stays canonical. > > # 🏷️ Title: Episode 31: Brent Toderash >  ## 🧭 Table of Contents - [📝 Summary](#-summary) - [📖 Main Content](#-main-content) - [🗒️ Notes](#️-notes) - [📚 References](#-references) - [🗣️ Paraphrase](#️-paraphrase) - [📰 Newsletter](#-newsletter) - [✅ Action Items](#-action-items) - [🧪 Hypotheses](#-hypotheses) - [📊 Methodology](#-methodology) - [❓ Questions](#-questions) - [🔮 Future Research](#-future-research) - [💡 Implications](#-implications) - [🧠 Learning Styles Assessment](#-learning-styles-assessment) - [📊 Accessibility Assessment](#-accessibility-assessment) - [🌍 DEIB Assessment](#-deib-assessment) - [✅ Logical Validity](#-logical-validity) - [🛡️ DARVO Analysis](#-darvo-analysis) - [🎯 Conclusion](#-conclusion) ### 🔗 References - [Community and Code podcast](https://www.youtube.com/watch?v=Lfs9E13Ozbc) — source episode - [FAIR — Federated and Independent Repositories](https://fair.pm) — the protocol under discussion - [toderash.net](https://toderash.net) — guest's own hub (spoken as "totrash.net" in auto-captions) - [TYPO3 v14 release](https://typo3.org) — first non-WordPress CMS to ship FAIR in core - [AspireCloud / AspirePress](https://aspirepress.org) — the API-server and mirror layer folded into FAIR ## 📝 Summary - **What happened.** Chris Reynolds interviews Brent Toderash — Winnipeg-based consultant, co-runner of a WordPress agency with his brother Scott, and a member of the FAIR project's technical steering committee. The conversation traces Toderash's path from 1980s punch cards through the late-'90s Linux/free-software scene into WordPress (via B2), and lands on FAIR's origin, architecture, and its adoption by TYPO3. - **Why it matters.** The headline claim is that FAIR was never a WordPress project. It is a software-supply-chain protocol for digital goods; the WordPress-specific behavior lives in *protocol extensions*, not the core. TYPO3 v14 shipping FAIR support in core is the first external proof of that design claim. - **Key stakeholders.** FAIR technical steering committee; AspirePress (founded by Sarah Savage, Oct 2024); TYPO3 core and security teams; unnamed web hosts who ran security audits; WordPress agencies carrying client liability; Ryan McHugh (drafted protocol v1); Andy Fragen and others who moved from AspirePress into FAIR. - **Risks and tradeoffs.** Toderash frames his own entry as risk management — a consultant's professional-liability exposure when the recommended platform's distribution channel becomes uncertain. Counter-risks he does not fully address: federation multiplies the trusted-mirror surface, governance is young, and "everything's been done before" understates integration risk even when each component is proven. - **Bottom line.** FAIR's defensible claim is architectural, not tribal: a from-scratch supply chain assembled out of individually proven parts, whose portability is now demonstrated rather than asserted. The AI thread running alongside it is a separate argument — that cheap regeneration dissolves sunk-cost attachment and may restore an older "build it and give it away" instinct. ## 📖 Main Content **The supply-chain thesis.** Toderash's core argument is that WordPress's distribution model is not what anyone would design today, and that supply chains generally are getting scrutiny "as they need" because they are vulnerable. FAIR's advantage, in his telling, is that its architecture is *for now* — not inherited, not iterated into "almost acceptable." He is careful to separate novelty of components from novelty of assembly: every piece has been done before and is therefore proven; the composition is what is new. That is a genuinely different and more modest claim than "we invented something." **Why "it's not a WordPress thing" is testable.** The design placed all WordPress-specific behavior in extensions to the protocol rather than in its core. TYPO3 support arrives the same way — as protocol extensions built to the same shape. This converts a design assertion into an observable one: if the extension mechanism were cosmetic, a second CMS could not have been added without touching the core. Toderash's science-fiction-writers-sharing-EPUBs example is the reductio he keeps returning to — the protocol is about digital goods, not about a CMS. **Federation vs. "here's a GitHub repo."** He is pointedly dismissive of the late-2024 wave of "here's how to host your own mirror" posts: technically correct, practically useless, because approximately nobody was going to do it. What drew him to AspirePress was that it proposed a *public* mirror that could then be federated — and that it was "a community, not a guy with a GitHub thing." AspireCloud reached beta before FAIR was announced, replicating enough of the WordPress API to serve packages and rewrite download URLs to a mirror. That six-month head start is why FAIR had a working server component at announcement. **Phoning home.** FAIR Connect (formerly the FAIR plugin) stops the constant callbacks to .org. Toderash gives three stacked reasons — principle, performance, privacy — and treats them as jointly sufficient rather than ranking them. **The AI argument, which is separate.** Two distinct claims get made. First, operationally: AI is *leveraged*, not *delegated to* — if you cannot describe the task you cannot write the prompt, and understanding architecture matters more than recalling function signatures. His client-estimate anecdote is the evidence: Claude first estimated higher than he did (pricing as if staffing developers), and re-scoping with AI doing the parts it does well yielded a 40% saving — which he explicitly flags as "a lot less than the hype would have you believe." Second, economically: cheap regeneration breaks the sunk-cost fallacy. He reaches for Brooks's "write one to throw away; you will anyhow" (attributing it to *The Cathedral and the Bazaar*, a misattribution — see Logical Validity) and argues the cost of abandoning and restarting has changed drastically. He extends this to technical debt and security: if attackers use AI to find vulnerabilities, defenders can use it to find and patch them. **Money as a motivator.** A short but load-bearing aside: money is a fair short-term motivator and a poor long-term one. Whatever the salary, "three years in it doesn't matter anymore. It's if the job is drudgery, you'll still hate it." He connects this to the classic open-source instinct — scratch the itch, then give it away — and argues AI may restore that instinct precisely because software written that cheaply doesn't carry a defensible price. **Uncertainties and contested claims.** The 40% figure is one proposal, self-reported, unaudited. "Gold standard for software supply chains" is aspiration, not benchmark. The claim that FAIR's components are "all proven" is true component-wise and unproven composition-wise — integration is where supply-chain systems usually fail. And the security reviews he cites are from hosts who declined to be named, so the reader cannot weigh them. ## 🗒️ Notes #### ⏱️ [00:19](https://www.youtube.com/watch?v=Lfs9E13Ozbc?t=19) Cold open — the setup - Reynolds frames Toderash as someone who will insist "in the most Canadian way possible" that he isn't technical, then show you the architecture diagrams that disprove it. - Establishes the through-line up front: FAIR's evolution, TYPO3 adoption, and that it "was never really about WordPress. It was about the software supply chain itself." #### ⏱️ [02:02](https://www.youtube.com/watch?v=Lfs9E13Ozbc?t=122) No formal title, systems role - Toderash has no formal designation as FAIR's project manager; he "steps in with that kind of thinking and thought process rather than pure code." - The open-source framing: bring the skills you have; if coding isn't top of your list, there is still work to do. #### ⏱️ [04:21](https://www.youtube.com/watch?v=Lfs9E13Ozbc?t=261) Why the big diagram is read in chunks - FAIR has many moving pieces; almost nobody looks at the whole. The complete diagram exists to show how systems interrelate, but comprehension happens per-subsystem. - Self-description: "I pull at threads" — either discovering they're disconnected and should be discarded, or finding how things actually connect. #### ⏱️ [05:33](https://www.youtube.com/watch?v=Lfs9E13Ozbc?t=333) Interesting problems as the recruitment mechanism - The classic reason open source works at all: "offer someone an interesting problem and they'll show up." - His own entry: late-'90s reading, playing with Linux, learning the development model and free software. #### ⏱️ [06:15](https://www.youtube.com/watch?v=Lfs9E13Ozbc?t=375) The historical inversion of software economics - The "how do I make money from this" framing is the recent one. Historically it was: I'm writing code, this is interesting, maybe someone else can use it, I'll share and they'll share back. - Ties to standing on the shoulders of giants as the scientific sharing model — everyone benefits. #### ⏱️ [07:25](https://www.youtube.com/watch?v=Lfs9E13Ozbc?t=445) Punch cards to Commodore PET - Early-'80s high school: signed up for every computer science and data processing course available. - First programs written pencil-and-paper, then copied to cards. On a 32K Commodore PET he once had to shorten display sentences to fit memory. #### ⏱️ [09:02](https://www.youtube.com/watch?v=Lfs9E13Ozbc?t=542) The detour and the insurance decade - Did not pursue it after high school and regretted it; spent about a dozen years in general insurance as a broker with a professional designation, analyzing risk. - That risk-analysis training is explicitly the thing that "came in handy later" — the setup for the FAIR motivation at [45:39]. #### ⏱️ [10:03](https://www.youtube.com/watch?v=Lfs9E13Ozbc?t=603) Spring 2000, into business with Scott - Wireless ISP, hosting, software development. Brother Scott came from '90s client-server work on large systems and had the formal software education; Toderash picked up the web side. #### ⏱️ [13:04](https://www.youtube.com/watch?v=Lfs9E13Ozbc?t=784) Rooting for the underdog, objecting to EEE - Self-identifies as an underdog partisan; "voting for not Microsoft would have been a thing." - The specific objection is conduct, not product: monopoly leverage via Internet Explorer and Office, "embrace extend extinguish and fight everything with FUD." #### ⏱️ [14:14](https://www.youtube.com/watch?v=Lfs9E13Ozbc?t=854) Money is a poor long-term motivator - Mutual sharing over accumulation: "we don't have to see who's got the biggest stack of coins." - The drudgery argument — salary stops mattering around year three; motivation problems money cannot solve. #### ⏱️ [15:38](https://www.youtube.com/watch?v=Lfs9E13Ozbc?t=938) AI may restore the give-it-away instinct - When writing this kind of software becomes easy, you write what you need and give it away, because someone else could write it just as easily and it therefore has no defensible price. - He explicitly shares the concern about devaluation of developers' time; the "silver lining" is recovery of the sharing ideal. #### ⏱️ [16:28](https://www.youtube.com/watch?v=Lfs9E13Ozbc?t=988) Reynolds: it was building, not typing - Reynolds wrote a blog post that day realizing he doesn't miss writing code — what he valued was building things, not entering functions into an IDE. #### ⏱️ [17:18](https://www.youtube.com/watch?v=Lfs9E13Ozbc?t=1038) Invert, and two people scratching one itch - Reynolds's project (Invert) crossed Toderash's path days after he'd designed a near-identical system with Claude: markdown storage, edit from vi / Obsidian / browser, merge content, store in git, build a site. - He pointed Claude at Invert to diff his design against it; the answer was "very much on the same page." #### ⏱️ [20:08](https://www.youtube.com/watch?v=Lfs9E13Ozbc?t=1208) Leverage, don't delegate - The formulation that anchors the AI thread: "AI is something you leverage. It's not something you just delegate to." - If you don't understand the task, you can't create the prompt. Understanding use case and architecture replaces memorizing function signatures. #### ⏱️ [21:03](https://www.youtube.com/watch?v=Lfs9E13Ozbc?t=1263) The 40% estimate - Gave Claude full information for a client proposal; it estimated higher than he did, pricing as if two developers were assigned. - Re-asked with AI doing the parts it handles better: 40% saving — "a lot less than the hype would have you believe." #### ⏱️ [22:26](https://www.youtube.com/watch?v=Lfs9E13Ozbc?t=1346) Underspecified agents go off the rails - Reynolds: the computer only knows what you told it; "smart" AI still obeys that rule. - OpenClaw agents developing odd personalities or writing takedown articles about maintainers traces to original instructions being insufficiently specific. #### ⏱️ [26:32](https://www.youtube.com/watch?v=Lfs9E13Ozbc?t=1592) Defining software ahead of time, rediscovered - Claude is strong at system design; back-and-forth produces a well-defined project plan, after which building is a separate, bounded thing. - The joke lands as a real point: "it turns out it helps when you define your software ahead of time" — true for AI as it was for humans. #### ⏱️ [26:52](https://www.youtube.com/watch?v=Lfs9E13Ozbc?t=1612) Treat the agent like an employee - Feels conceptually odd but holds: an employee given poor instructions cannot succeed. "If you suck at that, you're gonna suck at this." #### ⏱️ [33:00](https://www.youtube.com/watch?v=Lfs9E13Ozbc?t=1980) They wrote Agile before Agile - Circa 2001–02, answering an RFP's "describe your methodology" when everyone used waterfall, they wrote their own four-point methodology — values-based, iterable, adaptable to other frameworks. - Within months of the Agile Manifesto being drafted; on later reading it: "wait a minute, this is that." #### ⏱️ [35:15](https://www.youtube.com/watch?v=Lfs9E13Ozbc?t=2115) A business that couldn't exist without open source - Licensing cost is the obvious part; the deeper part is the ability to install, evaluate, reject, and switch. - Complementary experience: Scott from large-company red tape, Toderash from a career in small business — the synthesis question was how to make an enterprise approach work for small business. #### ⏱️ [36:04](https://www.youtube.com/watch?v=Lfs9E13Ozbc?t=2164) B2 → WordPress, and the ordering that matters - Found B2, noticed it hadn't been updated, read about the forks, installed all three, and landed on WordPress. He reached B2 *because* open source was a requirement. - The resulting claim: he came to WordPress from open source, not to open source from WordPress — "exactly backwards of most of the community." His appeal: look farther than WordPress to understand open source. #### ⏱️ [39:48](https://www.youtube.com/watch?v=Lfs9E13Ozbc?t=2388) Write one to throw away — repriced - Cites the rule as feeling expensive: get deep into a project, abandon it, start over. - "But with AI, that equation has just changed like drastically." Points at the m-dash effort as an instance — take 20 years of WordPress development, ask what it would look like built today, and two months later have something rough but real. #### ⏱️ [42:52](https://www.youtube.com/watch?v=Lfs9E13Ozbc?t=2572) Sunk cost, named - The concept he gropes for and lands on: people commit to the wrong path because they're heavily invested and can't see the advantage of restarting. - Extension: AI can also find and address technical debt in existing codebases; if attackers use it to find vulnerabilities, defenders can patch them the same way. - The ColdFusion inheritance is the worked example — ~96 sites acquired in 2001 with a hosting purchase, converted over years, last one finished the previous summer. #### ⏱️ [45:39](https://www.youtube.com/watch?v=Lfs9E13Ozbc?t=2739) "Risk management" — the one-word answer - Asked what attracted him to FAIR, he answers with the insurance word, then explains: late September 2024 exposed a risk in the WordPress software supply chain. - The concrete fear is professional liability — clients who were told by a professional consultant to build on this, coming back to say "you gave me bad advice." Not brochure sites; applications built on WordPress as a framework. #### ⏱️ [47:56](https://www.youtube.com/watch?v=Lfs9E13Ozbc?t=2876) Why self-hosting posts weren't a solution - The "here's how to host your own repository" wave was "great but it doesn't help anybody" — nobody was going to do it at scale. - Found AspirePress (Sarah Savage, ~October 2024): a vision for distributed federated software repositories, and crucially "a community, not a guy with a GitHub thing," asking the right questions. #### ⏱️ [48:35](https://www.youtube.com/watch?v=Lfs9E13Ozbc?t=2915) Right questions over right answers - His stated epistemics: asking the right questions matters more than giving the right answers, because good questions eventually get you there. #### ⏱️ [50:02](https://www.youtube.com/watch?v=Lfs9E13Ozbc?t=3002) AspireCloud, and the head start - By the time FAIR was forming, AspireCloud was already in beta — an API server that answers "where do I get this update," with downloads pointed at a mirror. - The differentiator over "here's the code, set up your own": a public mirror everyone can access, then federated into many. - Replicated enough of the WordPress API to serve packages and rewrite download URLs. #### ⏱️ [51:32](https://www.youtube.com/watch?v=Lfs9E13Ozbc?t=3092) FAIR Connect stops the phoning home - The AspirePress plugin was more rudimentary than what became FAIR Connect, which stops the constant pinging of .org. - Three stacked justifications: principle, performance, privacy. #### ⏱️ [52:24](https://www.youtube.com/watch?v=Lfs9E13Ozbc?t=3144) Basel demo, then consolidation - AspireCloud's demo and FAIR's announcement were coordinated ("we tag teamed") at the Basel event. - Through that summer the FAIR-related AspirePress pieces moved into FAIR — including Aspire Explorer, the repo browser on fair.pm. Most were renamed; AspireCloud kept its name as an homage to Sarah Savage's founding. #### ⏱️ [53:57](https://www.youtube.com/watch?v=Lfs9E13Ozbc?t=3237) Reynolds: package management isn't a new idea - The full-circle point: people perceive FAIR as WordPress-specific, but it's about package management and distribution broadly — well-trodden ground in open source, with existing models to build on. Standing on the shoulders of giants, again. #### ⏱️ [55:15](https://www.youtube.com/watch?v=Lfs9E13Ozbc?t=3315) Gold standard, and proven bricks - Talked supply chain at WordCamp Canada in November. WordPress's supply chain is very different from what you'd design today. - The claim: FAIR could become the gold standard because its architecture is for now, designed ground-up rather than inherited and iterated to "almost acceptable." - The modest version of the claim: every piece has been done before, so it's all proven — "it's all the Lego bricks that you can imagine and they're all proven, but nobody's seen this thing before." - Ryan McHugh drafted the first version of the protocol; it has been extended as needed. #### ⏱️ [57:13](https://www.youtube.com/watch?v=Lfs9E13Ozbc?t=3433) TYPO3 v14, and the misconception - Designed to address digital goods generally: "it's not a WordPress thing." - Names the misconception directly — that if a given vendor isn't involved anymore it's no longer WordPress, it's dead. "None of that's true." - A couple of weeks prior, in Germany, TYPO3 support was added. As of v14 (releasing the following week) TYPO3 supports FAIR in core, so updates can use FAIR instead of the legacy TYPO3 Extension Repository. They also have Composer support. #### ⏱️ [58:08](https://www.youtube.com/watch?v=Lfs9E13Ozbc?t=3488) Security review as skepticism-to-support - Worked with TYPO3 security people; describes a genuine arc "from skepticism to enthusiastic support" as the model was vetted. - Also vetted by web hosts who declined to be named; they ran security reviews and audits and gave feedback. Nothing had to be huge, but changes were made. #### ⏱️ [59:13](https://www.youtube.com/watch?v=Lfs9E13Ozbc?t=3553) EPUBs, and extensions all the way down - The recurring reductio: a group of science fiction writers wanting to share EPUBs — FAIR will do that, because at the protocol level it has nothing to do with WordPress. - In the original design all WordPress-specific pieces are protocol extensions, not baked into core. TYPO3 arrives the same way, "designed exactly the same way." ## 📚 References - [FAIR project](https://fair.pm) — protocol, repo browser, and governance docs - [TYPO3](https://typo3.org) — v14 ships FAIR support in core - [AspirePress](https://aspirepress.org) — Sarah Savage's federated-repository project; AspireCloud retains the name - [toderash.net](https://toderash.net) — guest's links hub - [The Cathedral and the Bazaar — Eric S. Raymond](http://www.catb.org/~esr/writings/cathedral-bazaar/) — cited in the episode - [The Mythical Man-Month — Fred Brooks](https://en.wikipedia.org/wiki/The_Mythical_Man-Month) — actual source of "plan to throw one away" - [Agile Manifesto](https://agilemanifesto.org/) — the 2001 document he says his own methodology paralleled - [WordCamp Canada](https://canada.wordcamp.org/) — venue for his November supply-chain talk ## 🗣️ Paraphrase - Toderash presents himself as a non-coder who contributes systems thinking, and the host immediately contests the modesty by pointing at his architecture diagrams. Toderash concedes the framing is cultural self-deprecation. - FAIR is too large to hold in one view; the master diagram exists to show interrelation, while actual understanding happens subsystem by subsystem. - What draws people to open source is an interesting problem, not compensation. That was his own route in during the late '90s. - The profit-first view of software is historically recent. The older instinct was to write something interesting, share it, and receive shared work back — the same shoulders-of-giants model science runs on. - His technical origins are early-'80s punch cards and a 32K Commodore PET, followed by a twelve-year detour into insurance brokerage where he learned to analyze risk. - He and his brother Scott started an ISP/hosting/development business in spring 2000, combining Scott's formal client-server training with his own self-taught web work. - His objection to Microsoft was behavioral — monopoly leverage and FUD — rather than a dislike of the products. - Money motivates for a while and then stops; drudgery outlasts salary. Open source runs on itch-scratching instead. - AI makes small software cheap enough to give away, which may restore the sharing instinct even as it devalues developer time — a tradeoff he acknowledges rather than dismisses. - AI is a tool to be leveraged, not a subordinate to delegate to. Prompting requires understanding the task; his client estimate improved by 40%, well under the hype. - Underspecified agents drift, exactly as underspecified employees do. Defining the work up front turns out to matter as much for machines as for people. - Around 2001 he and Scott independently wrote a values-based four-point methodology that turned out to match Agile, drafted within months of the Manifesto. - Their business was only possible because open source let them install, evaluate, and discard tools freely — and because they didn't need to build a proprietary CMS. - He arrived at WordPress through B2 because open source was a hard requirement, which he notes is the reverse of most of the community's path. - "Write one to throw away" felt prohibitively expensive before; AI changes that equation and weakens the sunk-cost trap, including for technical debt and security work. - He joined FAIR out of risk management: a September 2024 supply-chain risk that exposed him to professional liability with clients he had advised onto WordPress. - Posts explaining how to self-host a repository didn't solve anything at population scale; AspirePress's public, federatable mirror did, and it was a community rather than one person's repo. - AspireCloud reached beta before FAIR's announcement, replicating enough of the WordPress API to serve packages and rewrite download URLs; FAIR Connect later stopped the phoning home for principle, performance, and privacy reasons. - FAIR's components are individually proven and unusually assembled; he thinks that composition could make it a gold standard for software supply chains. - The protocol targets digital goods, with CMS-specific behavior as extensions — a claim TYPO3's v14 core support now tests in public. ## 📰 Newsletter **FAIR grows a second CMS, and it turns out that was the whole point.** If you've been filing FAIR under "WordPress drama response," this episode of *Community and Code* is your correction. Chris Reynolds sits down with Brent Toderash — FAIR technical steering committee, WordPress agency co-owner, and a man who will tell you in the most Canadian way possible that he isn't technical while drawing you an architecture diagram that says otherwise — and the headline lands about fifty-seven minutes in: [TYPO3 v14 ships FAIR support in core](https://typo3.org). Not as a plugin. In core. That matters because of *how* it got there. FAIR's original design pushed every WordPress-specific behavior out into protocol extensions rather than baking it into the middle. TYPO3 arrived the same way, through the same extension shape. Which means the "FAIR isn't a WordPress thing" line stopped being a design intention and became something you can check. Toderash's favorite test case is still a group of science fiction writers who just want to share their EPUBs — FAIR will do that, because at the protocol level it doesn't know what a CMS is. The origin story is worth your time too. He came to FAIR through *risk management* — twelve years as an insurance broker analyzing risk, then a September 2024 that made him think hard about what happens when a client says "you're the professional, you told me to build on this." His verdict on the "here's how to self-host the repo" blog posts that followed: great, and useless, because nobody was going to do it. What he found instead was [AspirePress](https://aspirepress.org) — Sarah Savage's project, already six months into building a *public* mirror that could federate. AspireCloud kept its name through the merge as an homage. Nice touch. There's a whole second episode hiding inside this one about AI. Toderash's framing — "AI is something you leverage, it's not something you just delegate to" — comes with receipts: he handed Claude a full client proposal, watched it estimate *higher* than he had, then re-scoped it and landed on a 40% saving, which he cheerfully notes is "a lot less than the hype would have you believe." Refreshing number. Also his best line, on rediscovering requirements documents by way of prompt engineering: "it turns out it helps when you define your software ahead of time." And one for the philosophers: he thinks AI might quietly restore the oldest open-source instinct. When a thing is cheap enough to write, it's cheap enough to give away — because the next person could write it just as easily. He's clear-eyed that this same dynamic devalues developer time. He just thinks the silver lining is real. Go listen. Then go look at the big diagram in chunks, like he tells you to. ## ✅ Action Items #### DevRel - Developer advocacy: build a talk that demos FAIR against *two* CMSes side by side — the portability claim is now demonstrable, and a single-CMS demo undersells it. - Education: write the "supply chain for people who ship client sites" explainer that Toderash's liability framing implies; the audience is consultants, not protocol authors. - Developer experience: publish a protocol-extension authoring guide using TYPO3's extension as the worked reference implementation. - Developer marketing: retire "FAIR = WordPress alternative" framing in all copy; the episode names that misconception explicitly. - Community management: capture the "asking the right questions" norm as an actual contributor-onboarding value statement. - Internal/external/cross-project: open a standing liaison channel with TYPO3 now that a second core consumer exists, before divergence pressure appears. #### OSPO - Policy & Governance: document the decision rights for protocol extensions vs. core, since the core/extension boundary is now load-bearing for two projects. - License Compliance: confirm licensing posture for mirrored artifacts across federated mirrors, including redistribution terms. - Security Management: publish the audit findings pipeline — the episode cites unnamed hosts' security reviews with no public artifact, which is a transparency gap. - Software Inventory: define SBOM expectations for packages distributed via FAIR mirrors. - Developer Support: office hours for agencies evaluating FAIR Connect as a client-liability mitigation. - Community Engagement: formalize the AspirePress→FAIR consolidation record so provenance of each component stays legible. - Strategic Alignment: set a measurable adoption KPI beyond "CMSes supported" — mirrors operated, packages served, update success rate. #### Community - Maintainers: run a governance clinic on how a second downstream consumer changes protocol change management. - Contributors: create a "read the big diagram in chunks" onboarding path, mirroring how Toderash says the system is actually comprehended. - Sponsors: publish a transparent ledger for mirror-hosting costs, since federation shifts cost onto operators. - Ecosystem: run a coordinated disclosure drill across FAIR + TYPO3 + WordPress consumers before one is needed. #### WordPress - Core: assess what, if anything, in core assumes a single canonical update endpoint. - Core Performance: measure the performance delta from eliminating phone-home calls, which the episode asserts but does not quantify. - Core AI: capture the "leverage, not delegate" framing in contributor-facing AI guidance. - **Core Program Team:** add supply-chain dependency risk as a standing cross-team agenda item. - Mobile: verify update-check paths in the mobile apps against a federated-mirror scenario. - Playground: build a Playground blueprint that boots with FAIR Connect enabled, for zero-install evaluation. - Community: propose a supply-chain track for the next WordCamp cycle; Toderash's WordCamp Canada talk is the seed. - Training: turn the package-management-in-open-source thread into a Learn module — the episode argues WordPress folks under-index on this. - Marketing: correct the "FAIR is a fork response" narrative with the TYPO3 fact. - Support: prepare answers for "should I install FAIR Connect" before volume arrives. - Design: usability-test the fair.pm repo browser against the .org plugin directory. - Documentation: document FAIR Connect's phone-home suppression and its observable effects. - Photos: not applicable to this source — no media-asset dimension is discussed. - TV: caption and index this episode; the supply-chain segment deserves its own chapter marker. - Polyglots: coordinate with TYPO3's German-speaking community, where the integration work happened. - Accessibility: audit fair.pm's browse pages against WCAG 2.2 AA before adoption scales. - Meta: evaluate what .org API surface FAIR replicates and whether that shape should be formally specified. - CLI: add WP-CLI commands for inspecting configured mirrors and update sources. - Hosting: publish a host-side checklist for operating a FAIR mirror, and name the audit participants if they'll consent. - Tide: consider scoring packages served via federated mirrors, not only .org-hosted ones. - Openverse: not applicable to this source — no media-commons dimension is discussed. - Themes: verify theme update flows under FAIR Connect. - Plugins: define provenance and signature expectations for plugins distributed through mirrors. #### The WPOCC - Programs: a fellowship track for supply-chain and package-distribution work, which is currently carried by very few people. - Projects: a documentation sprint targeting the core/extension boundary now that two CMSes depend on it. - Funding experiments: milestone-based microgrants for mirror operators, since federation's costs land on volunteers. ### FAIR - Technical independence: TYPO3 v14 in-core support is the strongest available evidence that the protocol is CMS-agnostic — treat it as the reference citation. - Policies and covenants: publish anti-capture provisions covering mirror operators, not just protocol governance. - Productized governance artifacts: turn the unnamed-host security reviews into a publishable scorecard template, with consent. ## 🧪 Hypotheses 1. If FAIR's core/extension boundary is genuinely CMS-agnostic, adding a third CMS will require zero changes to protocol core — measurable as commits touching core during that integration. 2. Sites running FAIR Connect show measurably lower outbound request volume and faster admin page loads than matched sites without it, because phone-home calls are suppressed. 3. Agencies adopt FAIR primarily as liability mitigation rather than ideological alignment; adoption will correlate with client-application complexity, not with contributor status. 4. AI-assisted rewrite decisions reduce the observed lifetime of legacy codebases — teams using AI heavily abandon-and-rebuild sooner than teams that don't, at equal technical-debt levels. 5. Toderash's 40% figure does not generalize; measured savings across many projects will show wide variance with a median well below 40%, because the estimate baseline is itself AI-generated. 6. Federation increases rather than decreases aggregate supply-chain attack surface in the short term, until mirror-operator security practices standardize. ### 📊 Methodology - **H1:** Instrument the protocol repository. Count commits/diffs to core vs. extension paths across each CMS integration. Requires a stable definition of "core" at the file-path level. - **H2:** Matched-pair field study. Instrument N≈200 sites with and without FAIR Connect on comparable hosts; measure outbound request counts, admin TTFB, and update-check latency over 30 days. Confounders: host caching layers, plugin count. - **H3:** Survey plus adoption telemetry. Cross-reference agency adoption against a client-complexity index (custom post types, custom tables, integrations). Self-report bias is the main threat; pair with observed installs. - **H4:** Retrospective cohort on public repositories. Compare time-to-major-rewrite for repos with high AI-attributable commit signatures vs. matched controls. Attribution is the hard part — commit trailers and disclosure policies are inconsistent. - **H5:** Replication study. Collect paired human/AI estimates and actual delivered hours across ≥30 projects and multiple firms. Pre-register the analysis; the anecdote's baseline problem must be controlled by having humans estimate blind first. - **H6:** Threat modeling plus longitudinal incident tracking across federated mirrors, benchmarked against single-origin distribution incident rates. Needs a shared incident taxonomy that does not currently exist. ### ❓ Questions - What is the trust model for a new mirror joining the federation, and who can revoke one? - If TYPO3 and WordPress need incompatible protocol extensions, what is the arbitration process? - Which specific WordPress API surfaces does AspireCloud replicate, and what happens when .org changes them unilaterally? - Does FAIR Connect's phone-home suppression break any legitimate functionality that depended on those calls? - Who audits the auditors — can the unnamed host security reviews be published, even redacted? - What is the failure mode when a package exists on multiple mirrors with divergent contents? - Does the "everything's been done before, it's all proven" claim survive contact with integration testing, where composed systems usually fail? - How does the project fund mirror operation at scale without recreating a central dependency? ### 🔮 Future Research - Formal verification or at least formal specification of the update-resolution path, since correctness here is security-critical. - Comparative study of federated package distribution across ecosystems (Linux distro mirrors, npm, Composer, F-Droid) to identify which failure modes FAIR inherits. - Empirical work on whether AI-cheapened rewrites actually reduce technical debt or merely relocate it, which the episode assumes without evidence. - Economic modeling of Toderash's devaluation claim: if small software trends toward zero price, what funds maintenance of the large software that remains? - Governance research on protocol projects with multiple independent downstream consumers — the failure patterns are well documented in standards bodies and largely unexamined in CMS ecosystems. ### 💡 Implications - **Practice.** Agencies now have a defensible technical answer to a client liability question, which changes FAIR from an ideological choice to a procurement one. - **Policy.** A second CMS in core support strengthens any argument that supply-chain independence is infrastructure rather than factionalism — relevant to public-sector procurement rules that increasingly require SBOM and provenance. - **Security.** Federation trades single-point-of-failure risk for distributed-trust-management risk. That is usually the right trade, but only once mirror operator standards exist; right now they do not, publicly. - **Education.** The episode's strongest pedagogical point is that WordPress practitioners under-index on general open-source concepts. Curriculum that teaches package management as a portable idea would address that directly. - **Funding.** If mirror operation is volunteer-borne, the model has an unfunded liability. Microgrants or host sponsorship need to arrive before adoption scales, not after. ### 🧠 Learning Styles Assessment - Reading level estimate: **Flesch-Kincaid Grade ≈ 8.5**, Flesch Reading Ease ≈ 62 (computed on the de-timestamped transcript). Conversational register with low sentence complexity; the difficulty is conceptual density, not vocabulary. Frequent disfluencies and self-interruptions lower the score without lowering the cognitive load. #### 👀 Visual learners - Present: the episode repeatedly *references* architecture diagrams — but audio-only, so they are described, not shown. - Improve: publish the FAIR system diagram alongside the episode, in both whole and chunked forms, matching how Toderash says it should be read. Add a before/after of the update-resolution path with and without FAIR Connect. #### 🔊 Aural learners - Present: this is native audio content with two-speaker dialogue and natural turn-taking, which aids retention. - Improve: publish a 3-minute audio summary covering the TYPO3 news and the core/extension distinction, for listeners who won't spend an hour. #### 🗣️ Verbal learners - Present: strong analogies throughout — Lego bricks, standing on shoulders of giants, the science-fiction-writers-sharing-EPUBs test case, treating an agent like an employee. - Improve: a glossary is genuinely needed. Federation, mirror, protocol extension, supply chain, and phone-home are all used as known terms and none are defined. #### 🧩 Kinesthetic learners - Present: nothing hands-on; the episode is entirely retrospective narrative. - Improve: pair with a Playground blueprint that boots WordPress with FAIR Connect active so a listener can watch update sources change in real time. #### 🧠 Logical learners - Present: a clear causal chain from September 2024 → risk exposure → AspirePress → AspireCloud beta → FAIR announcement → consolidation → TYPO3. - Improve: a timeline graphic with dates, and a decision tree for "should my agency adopt FAIR Connect" with explicit criteria. #### 🧑‍🤝‍🧑 Social learners - Present: the community-vs-one-person distinction is a central theme, and named collaborators (Savage, McHugh, Fragen, Scott Toderash) give the work a social shape. - Improve: link to FAIR's contributor channels in show notes; add discussion prompts for agency owners weighing the same liability question. #### 🧘‍♀️ Solitary learners - Present: the reflective register supports independent listening; Toderash models thinking aloud. - Improve: add self-check questions — "can you state, in one sentence, why TYPO3 support is evidence rather than assertion?" #### 🌿 Naturalistic learners - Present: light but real — the ColdFusion migration is framed in lifecycle terms, and the agricultural GIS client work is an ecosystem-adjacent example. - Improve: connect federation to redundancy and resilience patterns in natural systems; note the energy cost of mirror redundancy as a lifecycle consideration. ### 📊 Accessibility Assessment #### Screen reader semantics - Present: auto-generated captions exist, which is the baseline that made this analysis possible. - Improve: the captions mangle proper nouns badly — "Toarash," "totrash," "Basil" for Basel, "RAV," "Bizaar." Human-corrected captions are needed. **WCAG 2.2 AA 1.2.2 (Captions, Prerecorded)** is nominally met but the accuracy fails the intent. #### Keyboard navigation - Present: standard YouTube player controls are keyboard operable. - Improve: publish chapter markers so keyboard users can jump to the TYPO3 segment without scrubbing. **2.1.1 (Keyboard)**, **2.4.5 (Multiple Ways)**. #### Contrast and readability - Present: not evaluable from a transcript; the platform default player meets contrast requirements. - Improve: if a companion diagram is published, verify 4.5:1 on all diagram text and never encode meaning in color alone. **1.4.3 (Contrast Minimum)**, **1.4.1 (Use of Color)**. #### Text resizing and reflow - Present: platform-level responsive behavior. - Improve: ensure any published architecture diagram is available as SVG or with a text-equivalent description, since diagrams typically fail at 200% zoom. **1.4.4 (Resize Text)**, **1.4.10 (Reflow)**. #### Media and captions - Present: auto-captions and a full transcript. - Improve: no audio description track and none needed for a conversation, but a corrected transcript with speaker labels is missing. Speaker attribution in the raw transcript is inconsistent (`>>` markers only). **1.2.2**, **1.2.4 (Captions, Live)** not applicable. #### Forms and interactions - Not applicable to this source — the episode is linear media with no interactive controls beyond the player. #### Standards reference - Primary gaps map to **1.2.2 Captions (Prerecorded)** — present but low-accuracy on proper nouns — and **2.4.5 Multiple Ways** — no chapters or navigable structure for a 61-minute episode. Both are AA-level. ### 🌍 DEIB Assessment #### Cultural breadth - Present: genuinely multi-region — Winnipeg, Ottawa (WordCamp Canada), Basel, Germany (TYPO3 integration). The TYPO3 collaboration is an explicit cross-ecosystem, cross-language bridge. - Improve: the open-source history told is North American and Anglophone by default; the '90s Linux narrative omits substantial European and Global South contributions. #### Inclusive language - Present: no exclusionary language. Toderash names his self-deprecation as cultural rather than false modesty, which is a small but real act of interpretive generosity. - Improve: heavy undefined jargon (federation, supply chain, protocol extension, phone-home, EEE, FUD) raises the entry barrier for the newcomers the episode explicitly wants to reach. One host used "hackers and crackers" language that would be better rendered as "attackers." #### Neurodiversity support - Present: conversational pacing with natural pauses; the host does not rush the guest through visible train-of-thought loss. - Improve: a 61-minute unstructured conversation with no chapters is hard to navigate for listeners who need to consume in segments. Chapter markers and a structured summary would help substantially. Notably, Toderash loses his train of thought twice on-mic and it is left in — arguably a feature for normalizing working memory limits. #### Representation - Present: names women in founding roles — Sarah Savage founded AspirePress and the project kept her name on AspireCloud as an homage, which is credit-preservation rather than credit-erasure. - Improve: two men in conversation, and the balance of quoted contributors skews male. The security auditors are anonymous, so no representational read is possible there. #### Psychological safety - Present: the "asking the right questions is more important than giving the right answers" norm is explicitly protective of newcomers. The "bring the skills you have; if coding isn't top of your list, that's okay" framing lowers the contribution bar deliberately. - Improve: the discussion of the September 2024 events stays abstract — arguably appropriate, but listeners carrying real harm from that period get no acknowledgment. A content note would cost nothing. ### ✅ Logical Validity #### Strong reasoning - **Constructive dilemma made concrete, [57:13].** The claim "FAIR is not WordPress-specific" is supported by an architectural fact (WordPress behavior lives in extensions) plus an independent confirming instance (TYPO3 v14 in core, arriving through the same extension mechanism). This is strong because the second CMS is a genuine test, not a restatement — a cosmetic extension layer could not have absorbed it. Could be strengthened by publishing the commit range showing core untouched. - **Argument from mechanism rather than authority, [55:15].** "Every piece has been done before, so it's all proven; nobody's put it together this way" is unusually well-calibrated. It claims novelty only for composition and explicitly disclaims novelty for components — the narrow claim is the defensible one. Strengthen by naming which prior systems each brick comes from. - **Inductive argument from personal incentive, [45:39].** Answering "what attracted you" with "risk management" and then grounding it in professional liability is causally coherent and consistent with his insurance background established 35 minutes earlier. The reasoning is transparent about self-interest, which raises rather than lowers its credibility. - **Analogical reasoning, [26:52].** Agent-as-employee is a productive analogy because the shared structure is real: both are capable actors whose output quality is bounded by instruction quality. He correctly notes it "feels weird" — flagging analogy as analogy rather than identity. - **Self-correcting estimate, [21:03].** Reporting that Claude estimated *higher* than he did, and that the realized saving was 40% rather than the hyped figure, is evidence offered against his own enthusiasm. That is a credibility-increasing move. #### Fallacies - **Misattribution / appeal to misremembered authority — [39:48].** He attributes "write one to throw away, you will anyhow" to *The Cathedral and the Bazaar*. The line is Fred Brooks's, from *The Mythical Man-Month* ("plan to throw one away; you will, anyhow"). Raymond quotes and discusses Brooks, which is likely the source of the conflation. **Weakness:** it borrows authority from the wrong text and would mislead a listener who went looking. **Fix:** attribute to Brooks, and note Raymond's engagement with it if that's the route he encountered it by. - **Hasty generalization — [21:03].** A single client proposal yields "the saving was 40%," presented as a general corrective to AI hype. **Weakness:** n=1, self-assessed, with an AI-generated baseline — the denominator is itself suspect, so the ratio is doubly uncertain. **Fix:** present as one data point, state the baseline problem explicitly, and call for multi-project measurement. To his credit the number is deployed *against* hype, so the direction of error is conservative. - **Appeal to anonymous authority — [58:08].** "Some of the web hosts who didn't want to be named... did security reviews and audits." **Weakness:** the listener cannot assess auditor competence, scope, or independence, and unfalsifiable endorsement is exactly the pattern security claims should avoid. **Fix:** publish scope and methodology even if identities stay confidential, or obtain consent to name. - **Suppressed evidence / one-sided assessment — [55:15].** "FAIR has the potential to become the gold standard" is asserted with no discussion of federation's added risks: mirror compromise, content divergence, revocation, and operator funding. **Weakness:** the strongest counterargument to a federated design is never engaged. **Fix:** pair the gold-standard claim with a published threat model. - **False dilemma (mild) — [14:14].** Money as motivator is framed against interesting problems as though the two exhaust the space, with the drudgery argument standing in for all compensated work. **Weakness:** ignores that funded maintenance is how most critical open source survives, and that the episode's own mirror-operation problem is a funding problem. **Fix:** distinguish "money as primary motivator" from "money as enabling condition." - **Equivocation on "proven" — [55:15].** "All of it has been done before... so it's all proven" slides between "each component is individually proven" and "the assembled system is proven." **Weakness:** integration is precisely where composed security systems fail; component-wise proof does not transfer. **Fix:** claim component maturity, then state what composition-level validation has actually been performed. #### Tone of voice - Reflective, self-deprecating, and unusually unhurried. Toderash thinks aloud, loses the thread twice and says so ("I forget where I was going," "That's why I need an AI assistant"), and the host lets it stand. The register is peer-to-peer rather than promotional — notable given he is describing a project he helps lead. Enthusiasm appears mainly at architectural moments ("that's part of the real genius in it") and is directed at the design, not at himself or the team. Mild, non-hostile partisanship toward open source and against historical Microsoft conduct, tempered by explicit generosity ("I like Bill Gates a lot more since he left Microsoft"). Where the tone tightens is liability — the client-comes-back-and-says-you-gave-me-bad-advice passage is the one moment of real urgency. ### 🛡️ DARVO Analysis - **Deny:** No denial pattern present. The one thing he pushes back on — "if Yoast isn't involved anymore, it's no longer WordPress, it's dead" — is a correction of a factual misconception about project continuity, not a denial of wrongdoing, and no accusation is at issue. - **Attack:** No attacks on identifiable individuals. Criticism is directed at historical corporate conduct (Microsoft's embrace-extend-extinguish and FUD) and at an approach rather than its authors (self-hosting posts are "great but it doesn't help anybody"). Neither targets a person's credibility. - **Reverse victim/offender:** Not present. Toderash consistently frames himself as a party managing his own exposure rather than as a victim, and does not recast any counterparty as an aggressor. The September 2024 events are referenced obliquely and without assigning blame. - **Emotional cues and rhetoric:** The dominant emotional register is professional anxiety about client liability, expressed as a hypothetical in the client's voice. Rhetorically he favors understatement and self-deprecation, both of which reduce rather than heighten adversarial framing. The related fallacies identified above are epistemic (hasty generalization, anonymous authority, equivocation), not DARVO-adjacent. - **Assessment:** Not applicable as a defensive pattern — this source contains no DARVO structure. Recorded here per template requirements rather than omitted. ## 🎯 Conclusion - **Bottom line.** FAIR's central claim moved this month from design intention to demonstrated property: WordPress-specific behavior lives in protocol extensions, and TYPO3 v14 shipping FAIR in core proves a second CMS could be added the same way. That is the citation to use when someone files FAIR under WordPress factional politics. The supporting arguments are more modest than the headline suggests — components are individually proven, composition is not yet validated in public, and the security reviews cited are anonymous. - **Next steps for readers.** - If you run an agency: evaluate FAIR Connect as liability mitigation, not ideology. Toderash's framing — you advised the client as a professional — is the actual decision criterion. - If you contribute: read the architecture diagram in chunks, as he recommends, and start from the core/extension boundary since that is what now carries two consumers. - If you assess security: ask for the threat model covering mirror compromise and content divergence. It is the strongest counterargument and the episode does not engage it. - If you're weighing AI in your practice: take the 40% number as a single data point with a shaky baseline, and take "leverage, don't delegate" as the durable part. ## 🔄 Refactor Appendix — Episode 31: Brent Toderash > Density: 2–5 Literature atoms (H3), 0–3 Permanent candidates (H4). > Defaults: 3 Literature, 1 Permanent. Resonance filter: if you can't > articulate in one line why a claim matters, drop it. > > Konik claim-header rules: present tense, declarative, ≤10 words when > possible, searchable, unique, mirrors annotation focus if present. > > Atomicity: one declarative sentence per atom. "and"/"also" → split. > > Tag pool: #bmf · #addendum · #xref · #articleseed · #storystem · #share · #aphorisms ### 📚 Literature Atoms (H3) #### [H1] FAIR targets supply chains, not WordPress > [!quote] ID:rw_ep31_h1 > it's not a WordPress thing. And there's a lot of misconception here **Context & use**: - [57:13] — immediately preceding the TYPO3 v14 announcement - The protocol addresses digital goods generally; all WordPress-specific behavior is protocol extensions, never baked into core. This is the claim TYPO3 adoption converts from assertion to evidence. **Tags**: #xref #share **Highlight**: [view highlight](readwise://)  #### [H2] Proven components, unproven composition > [!quote] ID:rw_ep31_h2 > it's all the Lego bricks that you can imagine and they're all proven, but nobody's seen this thing before **Context & use**: - [55:15] — the "gold standard" passage - The honest version of FAIR's novelty claim: novelty is asserted only for assembly. Worth holding onto because it is also the weak point — integration is where composed supply chains fail. **Tags**: #xref **Highlight**: [view highlight](readwise://)  #### [H3] Leverage AI; do not delegate to it > [!quote] ID:rw_ep31_h3 > AI is something you leverage. It's not something you just delegate to. **Context & use**: - [20:08] — the pivot of the AI thread - Task comprehension is the binding constraint on prompting: if you don't understand the task, you can't write the prompt. Pairs directly with the agent-as-employee analogy at [26:52]. **Tags**: #xref #aphorisms **Highlight**: [view highlight](readwise://)  #### [H4] Consultant liability drove FAIR participation > [!quote] ID:rw_ep31_h4 > You gave me bad advice and I trusted you as a professional. **Context & use**: - [45:39] — answering "what attracted you to FAIR" with "risk management" - Reframes supply-chain independence as a procurement and liability question rather than an ideological one. This is the argument that moves agency owners. **Tags**: #xref #articleseed **Highlight**: [view highlight](readwise://)  #### [H5] Cheap regeneration dissolves sunk-cost attachment > [!quote] ID:rw_ep31_h5 > But with AI, that equation has just changed like drastically. **Context & use**: - [39:48] — on "write one to throw away" (misattributed in-episode to Raymond; the line is Brooks's) - The economic claim underneath the AI thread: if restarting is cheap, commitment to a wrong path weakens. Extends to technical debt and to defensive security work. **Tags**: #xref #articleseed **Highlight**: [view highlight](readwise://)  ### 🧠 Permanent Candidates (H4) #### [P1] Portability is proven by a second consumer, not by design intent **Claim** (one sentence, Courtney's voice): A protocol's claim to be domain-agnostic stays unfalsified until a second independent implementer adopts it without modifying the core. **Evidence pointer**: [[#H1]] **Scope & conditions**: Holds where the core/extension boundary is inspectable and the second adopter is genuinely independent. Breaks when the second implementer shares governance or personnel with the first, since the boundary can be quietly relaxed. Weakens if "core" is redefined during integration. **Links**: - [[Software supply chain independence]] — because extends - [[Vendor neutrality claims in open standards]] — because contrasts on burden of proof - [[FAIR protocol architecture]] — because applies-in WordPress and TYPO3 distribution  #### [P2] Task comprehension bounds delegation quality **Claim** (one sentence, Courtney's voice): You cannot delegate work you cannot specify, whether the delegate is a person or a model. **Evidence pointer**: [[#H3]] > [!quote] > if you don't give them good instructions they can't succeed in what they're doing **Scope & conditions**: Holds for open-ended generative work where the delegate cannot observe the surrounding context. Breaks for well-bounded mechanical tasks with obvious success criteria, where under-specification is survivable. Also breaks where the delegate has more domain knowledge than the delegator and can repair the spec. **Links**: - [[Delegation as a management skill]] — because extends - [[Prompt engineering as requirements engineering]] — because applies-in AI-assisted development - [[Underspecified agents drift]] — because evidence-for  #### [P3] Liability is a faster adoption lever than ideology **Claim** (one sentence, Courtney's voice): Professional exposure moves practitioners toward infrastructure independence faster than principled arguments do. **Evidence pointer**: [[#H4]] **Scope & conditions**: Holds where practitioners carry advisory responsibility to third parties and the alternative has comparable switching cost. Breaks for hobbyists and in-house teams with no external client relationship, where the liability channel does not exist. **Links**: - [[Risk management as an adoption driver]] — because extends - [[Ideological framing of open source choices]] — because contrasts on motivation - [[Agency procurement decisions]] — because applies-in client consulting  ### ✏️ Fleeting Queue - [F1] Check whether TYPO3 v14's FAIR integration touched protocol core — the commit range is the actual evidence for H1 — https://typo3.org #fleeting #inbox - [F2] Toderash attributes "write one to throw away" to Cathedral and the Bazaar; it's Brooks. Worth a short post on how misattribution travels through secondary quotation. #articleseed #fleeting #inbox - [F3] Who pays for federated mirror operation at scale? The episode never addresses it and it's the load-bearing sustainability question. #fleeting #inbox - [F4] "Asking the right questions is more important than giving the right answers" — candidate aphorism, check against existing notes on epistemics. #aphorisms #fleeting #inbox - [F5] Cross-ecosystem comparison: what does FAIR inherit from Linux distro mirroring, F-Droid, and Composer? #xref #fleeting #inbox ### → Things 3 (max 2 actions) - [ ] Ask FAIR TSC for a published threat model covering mirror compromise and content divergence — supply chain review #things - [ ] Diff TYPO3 v14 FAIR integration against protocol core to verify the extension-boundary claim — FAIR evidence check #things  📄 **Full text:** [[Full Document Contents/Articles/Episode 31 Brent Toderash.md|Episode 31: Brent Toderash by YouTube]] ## Highlights - right. It's uh it's something you don't have to write all of the lines of code anymore. Um, but it's still important to understand the task and and this is what I've been telling people recently about AI is yes, it's great. AI is um AI is something you leverage. It's not something you just delegate to. >> Yeah. >> Because you you can't just say, "Oh, go do everything." You have to leverage it to do tasks. And if you don't understand ([View Highlight](https://read.readwise.io/read/01kyyq1pk7pzz27rxace0ch61a)) - Note: [H3] Leverage AI; do not delegate to it. Task comprehension is the binding constraint on prompting — if you don't understand the task you can't write the prompt. Seeds Permanent candidate P2. - Tags: ai-assisted-development, atom/zettel/z1, atom/literature/h3 - the rules is write one to throw away. You will anyhow. Uh, and this um it feels like it's going to be really expensive to get deep into a project and then abandon it and start over. >> But with AI, that equation has just changed like drastically. Um uh and in a sense you see this with um with M ([View Highlight](https://read.readwise.io/read/01kyyq2ghdxyn3jq48c29w5sh9)) - Note: [H5] Cheap regeneration dissolves sunk-cost attachment. NOTE: "write one to throw away" is attributed in-episode to The Cathedral and the Bazaar; the line is Fred Brooks's, from The Mythical Man-Month. Raymond quotes Brooks, which likely caused the conflation. - Tags: atom/literature/h2, ai-assisted-development, fallacy/misattribution - what what happens if a client comes back and says, "You gave me bad advice and I trusted you as a professional. Uh you're a professional consultant. You've got all the experience and you told me to do this thing and now I'm uh I'm subject to this kind of thing just happening." And um so I kind of it's the point I thought I had to get involved and do something. So, uh if you ([View Highlight](https://read.readwise.io/read/01kyyq22z8j62zqj322m53xe4p)) - Note: [H4] Consultant liability drove FAIR participation. Reframes supply-chain independence as procurement/liability rather than ideology — the argument that actually moves agency owners. Seeds Permanent candidate P3. - Tags: atom/zettel/z1, software-supply-chain, atom/literature/h1 - together this way. So, uh, it's, you know, it's all the Lego bricks that you can imagine and they're all proven, but nobody's seen this thing before that we pieced together with it. Um, and I I think that's part of the real um um genius in it. So, uh, Ryan McHugh did a great job on the drafting the first version of the the fair protocol and, ([View Highlight](https://read.readwise.io/read/01kyyq18xx4fj88y7p0qjr5b8f)) - Note: [H2] Proven components, unproven composition. The honest version of FAIR's novelty claim — novelty asserted only for assembly. Also the weak point: "all proven" slides between component-proven and system-proven, and integration is where composed supply chains fail. - Tags: atom/literature/h2, fallacy/equivocation, fair-protocol - uh, um, and you know, and we've been extending it as, as needed because, uh, it was designed to, um, to just address basically digital goods. So, it's it's not a WordPress thing. And there's a lot of misconception here because oh, you know, if if Yoast isn't involved anymore, it's no longer WordPress, it's dead, it's whatever. Well, none of none of that's true. It's it's ongoing. And ([View Highlight](https://read.readwise.io/read/01kyyq0x7mhcggn1bhp8t9rr9e)) - Note: [H1] FAIR targets supply chains, not WordPress. The protocol addresses digital goods generally; WordPress-specific behavior lives in protocol extensions, never core. TYPO3 v14 in-core support is what converts this from assertion to evidence. - Tags: software-supply-chain, atom/literature/h1, fair-protocol