YouTube Video eWP0Rk4e0CU ![rw-book-cover](https://img.youtube.com/vi/eWP0Rk4e0CU/maxresdefault.jpg) ## Metadata - Author: [[YouTube]] - Full Title: YouTube Video eWP0Rk4e0CU - Category: #articles - Document Tags: [[community]] [[devops]] [[evaluation]] [[testing]] [[wordpress]] - Summary: YouTube Video eWP0Rk4e0CU - URL: https://www.youtube.com/watch?v=eWP0Rk4e0CU Do you remember that thing back in October of 2024? That whole stuff about SCF, secure custom fields and advanced custom fields and all that jazz. Essentially, what happened was there was a blog post that Matt Mullenwig said on behalf of the security team they were going to fork ACF and all this stuff. And I'm not really sure if it was a fork. A lot of people were saying they took over the plugin because the slug of the plugin when you're looking at it architecturally in the WordPress repo, you know, you could if because it's centralized, you can kind of just like change out the code and the information pretty much at will. And that's effectively what happened. People were updating ACF and it was turning into SCF. So, it wasn't just like took the code and like made your own thing. It was kind of a little bit more like overwriting what was there for a lot of people. Now, I bring this example up not because I want to go back to that time. I don't want to talk about that. I don't want to talk about the ethics of that. I mean, it's in the past again. and was it deceptive? Seems like it on the surface, but I don't have all the details. So, let's just set that right there and just mark it as something that happened. Let's fast forward to June of 2025 at Word Camp Europe where there was an alternate event called Alt Control org where the fair package manager project was initially announced. Fair is an acronym for fair and independent repositories. You may have heard some stuff. There was some great content by Matt Maduros on the WP Minute, an article about it from Ray over at the repository. I'll leave links to everything in the description and we got a lot to cover. So, there's going to be a lot of links down there, but essentially the main goal of Fair is to decentralize the WordPress.org or services and it's backed by the Linux Foundation. Now, at this point, you might be like, "Mark, you are a few months late to this party. Why the hell are you even talking about this?" That is a great question. The answer is because I was just at CloudFest USA in Miami. I was a media partner there. And I was covering the hackathon. I posted a bunch of other content about that. You can go check it out. It was a great event overall, but specifically that first day was the hackathon. And there was only one project and it involved the fair package manager. So, not just as a media partner, but also as a WordPress power user, I felt obligated to do my due diligence on fair that I've been putting off for several months now. And plus, there was no greater opportunity because the people that are making fair happen, the brains behind it, were all in that room and I could ask them pretty much any question that I wanted. So, my main goal with this video is to report back to you with what I learned. I want to tell you how the hackathon went and I want to answer the question, should you care about fair? Stick around and we'll dive right into it. So based on my research, there are two highlevel problems that fair is looking to solve. The first one is a supply chain style issue that we talked about with the SCF ACF situation. There's currently only one source of control and that's the WordPress repository. If you want to put a plugin in WordPress, you have to submit it and then it goes through a process and then it gets put into the WordPress repo. Obviously, it works up until a point, but the idea of centralizing all of that could lead to these supply chain issues for whatever reason. And that one singular place to get plugins or themes, etc. from WordPress is objectively suboptimal. There's some other reasons as well. The actual WordPress plug-in repository doesn't really have great filtering. The search can be a little eh at times and all that. So, there's definitely other things that could be improved with a solution like fair. So, with those main highle problems in mind, let's talk about like what actually is fair. The way I learned things best is to break them down into smaller pieces. So, as I was getting answers to all my questions, I'm thinking there's a lot of terms here that I just do not know what they are exactly. There's some diagrams in the beginning slides that they were talking about, and then there's this glossery of terms that I just don't know the answer to, and I will drop a link to the knowledge base in the description down below. Let me go over some of the basics with you. As we said, fair stands for federated and independent repositories. Relatively self-explanatory. It's decentralizing and making a bunch of different repositories that could ultimately all link together. That's not going to make any sense right now, but it will soon. You might be wondering what packages are when you hear fair package manager. A package is just a piece of software. It's more of like a ubiquitous name for plugins or themes. As of recording this, there's really only plugins in the mix, so to speak, with this project right now, but longer vision is that just using the word package instead of independent things on at least on the technical side is going to be better just because it's going to treat everything the same way. There's also this concept of a decentralized identifier, better known as a DID. It's a universally unique identifier specified by the W3C specification. In layman's terms, as I understand it, this is like the primary ID for every single one of the packages. So, a key call out here is if we go back to our earlier example of the secure custom fields, the identifier is not the slug in the fair architecture. The identifier is an actual ID like a string of letters and numbers. So, each package can only have one DID. Seems like it makes more sense to me. Another quick note though that kind of confused me for a little bit is that you could still have multiple packages and not have like one source of truth. That relationship between package and DID is only kind of like one way in the sense of a DID can only belong to one package. So one unique DID only one package. However, you could technically have two packages that you know via the code and visually look exactly the same but they have two separate DIDs, two unique DIDs when you think about it. also does make sense, just hard to wrap your head around at first. I hope you're not confused yet. I know I was when I was in the room chatting with everyone. It's about to get a little more complex, but hopefully at the end of it, it all makes sense. Where the rubber meets the road on all this is understanding the concept of repositories and aggregators. In order to try to explain this to you, I'm going to use the current WordPress.org architecture as an example, and then we'll talk about how fair works. And I'm going to try to keep this at a surface level from a technical standpoint. There's a link in the description to fair.pm PM if you want to find out more, get involved and all that. All right. So, in the way that you currently experience installing plugins in WordPress, you either go into WordPress or you go to the plug-in repo on WordPress.org and you see a big list of plugins. Every single one of those one is free because right now premium plugins are not supported in that WordPress plug-in repository. That's one thing to note. And then from a technical architecture perspective, the WordPress plug-in repo was created a very long time ago, allegedly before Git was even a thing. So it's in an SVN style repository. That's where all of the code and the actual like plugins are served from. So it's a great time to point out that according to fair a repository is a server that hosts one or more packages and their DIDIDs and that in the fair architecture you can set up a repository with the mini fair repo plugin. So we need to pause and we need to talk about what I feel is kind of a little bit of a misnomer or at least like a new way of thinking about the semantics of this architecture. In the current WordPress or architecture, there's only one repo because there's only one source of truth and one singular lane of a supply chain. Fair introduces this concept of an aggregator. And I'm not making a claim that they came up with that concept. I'm not sure of that. But if you're a lay person trying to understand this, there could be a bunch of repos now, not just the one singular one. And then any amount or any amalgamation of the things that are hosted on repos could be aggregated into an aggregator and then served. And the definition of an aggregator is any server which aggregates or collects package data. This can be done from repositories and/or other aggregators. So when we get to the example of how this actually works in practice, you're going to see that the current WordPress repo feels like how an aggregator would feel because there's only one place to get all of your stuff from right now. It effectively is an aggregator of one repo, aka the only repo. Now with all that context in mind, let's go back to the morning of the hackathon, November 4th, 2025. Prior to that, everything that I've talked about was already established and accomplished. There's a proof of concept aggregator called the Aspire Cloud Aggregator that has over 70,000 packages in it. I'll show you what the user experience of that is like in just a minute. And there's also the mini fair repo which is a plugin that transforms your site into a fair repository that allows you to serve packages directly from your own infrastructure into the fair system. So all of this was done before the hackathon. You could already do all this. So the next layer of this project is to implement some sort of trust and security services and that's where patch stack comes in. So you can imagine if you have all these different packages in these different repos aggregated into all these different aggregators it would be really nice and secure to know if any of them have vulnerabilities. Patchack has the largest CVE database in the world. So they open up their API to the team at the hackathon and help them start implementing some pretty cool stuff at an extremely high level. The goal of this implementation is to be able to grab CVE data for each one of these packages based off of the DID and label each package appropriately based on that data. It gets a lot more complex than that. Obviously, I'm not the one doing the development, but the DID concept is incredibly crucial. And just know there are some key differences in how WordPress.org checks for vulnerabilities versus how far is implementing this check. Also important to point out that Patch Stack is just the current partner and the proof of concept for this, not necessarily the exclusive partner for CVE data. So, what were the results of the hackathon? Well, in regards to that, I had a full 20-minute interview with Brent Toddash, Carrie Dills, and Elliot Taylor. That's posted over on my second channel. I'll leave a link in the description if you want to check that out, and they can give you their full perspective on that high level. It was literally one day of work, and they made a ton of progress. So, to this point in the video, I've talked a lot about context of like what fair is and how the hackathon went and everything, but what you haven't seen is what it actually does, like what it actually is currently. So, if you want to play around with it right now, let me show you exactly how to do so. There's a link to fair.pm in the description. Just go ahead and click that and then you come to the website. Great information on here. I would highly recommend you go through it. For now, if you click the download button right here, it should actually prompt you directly to download the zip, which I will note during the hackathon, it went to GitHub and then it was kind of confusing to download if you were not familiar with this. We told the team about that and they updated it to make it idiotproof. So, I'm super happy about that. So, you click that, you download the zip file and then you head over to your WordPress dashboard. You go to plugins, add plugin, and then you can upload it just like any other plugin. Once you do that, you'll have it in your installed plugins. You'll see it right here, fair, federated and independent repositories. I want to stop for a moment to make a point. We need to go back to add plugin. You can open that up in a new tab if you want. This is a very familiar experience right here. You can kind of see your plugins. You can obviously search. You can do everything. The reason I brought this back up, it's very hard to see the difference right now. Once we activate the fair plugin, this experience is technically going to change in the back end, but you're barely going to notice it. To prove it to you, I'm going to type in git updater right here. I'm going to search and we're not going to see the plugin that I'm looking for. Just keep that in your mind as we go back over to plugins and we click activate. And then we come back over to add plugins and we refresh. And look at that. We're still at the add plugins screen. We had Git Updater in there and now we have Git Updater right here. Interesting. Why wasn't that there before? Well, the reason is because this plugin right here is not in the WordPress repository. You can see it has this little by line hosted on fair.get-updator.com. As far as I understand, remember we're talking about the mini repo. This is a mini repo that Andy Fraan set up. And then that repo is aggregated by the Aspire Cloud Aggregator. And then what you're seeing here is technically being served from the Aspire cloud aggregator. So important to note this is pretty fresh still. There's a lot of interesting use cases for this that you need to use some imagination right now to fully comprehend. Imagine if there were a ton of different aggregators like that you could customize or you could create your own or something like that. I could see a world where you're searching up here and you're filtering by only certain aggregators that you want to get packages from. One other example I thought of while I was in the room with everyone was like maybe you're an agency and you only use like the same 30 plugins. So you want to combat against the idea of your team or your clients or whatever installing random plugins to do different things. You can control that a little bit by only having one aggregator subscribe to on that site. Obviously what I'm saying here is still theoretical. So you know your mileage may vary on that but the concepts are still pretty intact. There's one other note on this as well. We can obviously see that this is different because it has git updater in this you know test case that I gave you. But when you have the fair package manager plugin installed and you go to the very bottom right hand of your WordPress installation on the admin here, you can see updates are served from the fair package manager and aspires. So as of now that tells you that your packages and your updates are coming from there. So uh that was a lot of information. Hopefully uh it made sense. If you're like me, you enjoy the technical pieces. You like understanding how everything fits together. But at the end of the day, I still have some questions. So the first one I did ask directly to some of the team members and I got a little bit of an answer. What is the incentive to create something like this? Obviously there's a ton of reasons like you know securing the supply chain and things like that and just the general nature of open-source contribution but that's still an open-ended question that I have. What's the incentive overall? What are the bigger goals long term? Obviously we have a lot of good proof of concepts here. Just want to see kind of where that continues to go. The much larger burning question for me as I love to ask what about the controversial and political angle of all this? There's some quotes from Matt Mullenwig like basically the day after it was announced. He didn't really comment on it too much at the time. He's kind of just like, "Oh, it just came out, you know, you know, we'll have to look into it and such." But I would be kind of shocked if Matt Mullenwig or the WordPress.org apparatus praised or encouraged the fair package manager project. And I have no actual information on this. I would love to ask the questions cuz that's kind of what I do. But pure speculation and assumption based off of human psychology and business, I would have to assume that you do not want to relinquish control of anything, not just this, just in general. Right? So, I'm not making any assertions there. I'm just wondering literally, will Matt Mullenwig or will WordPress.org adopt something like this? Would they see it as like, wow, that's an incredible technical innovation. Let's bring that in. And I feel like adoption is probably the best case scenario, obviously, but there's alternatives to that. adoption being the best one, being completely blasze to it and ignoring it being kind of like so so and then worst case scenario completely denouncing, ostracizing, etc. the project and anybody dealing with it. Again, not saying that any three of those are happening necessarily, but those are the three potential realities that I could see. Regardless of what happens there, I'm very grateful to have been able to be in the room for the hackathon, meet a lot of great people, and learn more about this project that is objectively very interesting from the technical aspect. If you made it to this point in the video, you're probably a host, a developer, agency owner, or even like a freelancer that enjoys this topic. So, I'm going to tell you how to get involved. There's a bunch of links in the description down below for everything that I talked about, but the main resources are fair. PM, that's the website that we looked at. A lot of really good information on there. You can go to chat.fair.pm. That'll take you to the Slack for fair if you want to ask questions or get involved in that way. And then you can take a look at all the code and the commits and all that good stuff over on GitHub. And the very last thing I want to leave you with is the answer to our question from earlier. Should you care about fair? As a WordPress user, I think the answer is yes. But you let me know what you think in the comments down below. Thank you so much for watching., YouTube Video eWP0Rk4e0CU, YouTube, 01kabvqwnwcfgae7cpar125pze.