All's FAIR in Love and WordPress  ## Metadata - Author: [[Uncached Podcast]] - Full Title: All's FAIR in Love and WordPress - Category: #podcasts - URL: https://share.snipd.com/episode/d43248bb-ce58-4ed5-b6eb-1200140affe7 ## Document Notes ## Highlights - **WordPress.org As A Single Point Of Failure** - WordPress.org is a technical single point of failure for the wider WordPress ecosystem. - Federating repositories will increase resilience and help WordPress remain the CMS reference for decades. Transcript: Karim Marucchi Today is, depending on which number you pick, 42% of the internet or 65% of the CMS market, blah, blah, blah. It's really important. And it's become sort of mission critical in a lot of enterprise spaces where we work. And WordPress.org today is a technical single point of failure. ([Time 0:02:44](https://share.snipd.com/snip/88cbe87b-b6bd-445e-98af-b31ae4ab1d75)) - **What Federation Actually Means** - Federation means multiple nodes and mirrors that can serve plugins and updates instead of a single central server. - This enables hosts, companies, and institutions to run mirrors and curated services while preserving a shared ecosystem. Transcript: Karim Marucchi Right. Well, think of it this way know a lot of us know that the uh the internet was made in a way that if for some reason one route for data to get through is cut off it finds another route to get there It's self-repairing so to speak um the idea here is that right now wordpress.org is the only place to get all these services and this infrastructure. And what federation means is being able to have multiple nodes, being able to say that university X, major company Y, hosting company Z, all can put up mirrors of the shared resources And also create their own versions for their own customers of add-on services. Right now, we've spent the last 22 years in a world where plugins, there's WordPress.org for the free plugins. And then the ecosystem for paid plugins gets very complex and it's very hard to manage for regular user. It's time to bring those two together. So with a federated system, you can start having what we call aggregators or trusted individual entities that are running the right checks and saying, I trust these plugins. And you can start having it. So there's not only a single point of failure, but you can start to branch out and have a more rich ecosystem. ([Time 0:03:42](https://share.snipd.com/snip/32b5b667-9c21-489f-88d1-198e711f4e99)) - **Require Vetting And Signatures For Nodes** - Don't assume anyone can join the federated network without checks; nodes must apply and meet security and technical requirements. - Enforce signing, provenance, and acceptance protocols to prevent bad-faith mirrors or malicious copies. Transcript: Christos Paloukas Because Linux doesn't work like that. Karim Marucchi Correct. Correct. So exactly what you were saying, and this really is a catch-all answer. Most of the people out there who are going, oh my God, this is going to be a security nightmare, are people who quite literally have only been in the WordPress space. They are sheltered. Oh, okay. And package managers and understanding the idea of um the protocols around um provenance and making sure that things are signed um don't have a problem with this because this has been Being done for lennox for over 30 years yeah decades um on the other hand just because let's say fair was up and running perfectly right now, we're at next week we're launching 0.4. Okay. 1.0 is our goalpost. Let's say we're past 1.0 today. Um, you and I might want to put up our own repositories, might want to put up our own aggregators where we're pointing to repositories, but to do that, you'll have to apply and be accepted And go through a protocol. And there's technical requirements and security requirements. ([Time 0:07:16](https://share.snipd.com/snip/9c011d51-214c-4a1f-84d7-98e9c9cfce7e)) - **Existing Package Practices Reduce New Risks** - Package managers and signed provenance already solve many federation security fears; Linux has used these protocols for decades. - WordPress-only observers often miss this historical context and overestimate novel risks. Transcript: Karim Marucchi Correct. Correct. So exactly what you were saying, and this really is a catch-all answer. Most of the people out there who are going, oh my God, this is going to be a security nightmare, are people who quite literally have only been in the WordPress space. They are sheltered. Oh, okay. And package managers and understanding the idea of um the protocols around um provenance and making sure that things are signed um don't have a problem with this because this has been Being done for lennox for over 30 years yeah decades um on the other hand just because let's say fair was up and running perfectly right now, we're at next week we're launching 0.4. Okay. 1.0 is our goalpost. Let's say we're past 1.0 today. Um, you and I might want ([Time 0:07:18](https://share.snipd.com/snip/51cc843c-878c-4b96-a494-59071a2405ff)) - **Bring Paid Plugins Into Federated Search** - Allow paid plugins to participate via verified vendor repositories so they appear in in-dashboard searches. - Use verification and aggregator trust to make premium plugins discoverable and manageable from WordPress itself. Transcript: Karim Marucchi An example for the the wordpress world most people know that i'm just going to pick a plugin like gravity forms right okay today you can't get gravity forms on word.org because there Is no free version. It's a paid for plugin only. So if the Gravity Forms folks went through the process of putting up their own mini repository with their products, and they went through the process of being verified and the security Getting onto the aggregators, then you could actually search directly from WordPress for form plugins and Gravity Forms would pop up. ([Time 0:10:14](https://share.snipd.com/snip/092edb60-3dd0-431b-9172-910a6d91bc91)) - **Hosts Should Offer Curated Repositories** - Hosting companies should run their own curated repositories or mirrors to surface vetted plugins for their customers. - Use repository filters (e.g., PHP version) to automatically surface compatible plugins and simplify support. Transcript: Karim Marucchi Exactly and you could also put up your own mirror of repositories and there's there's different levels that you could participate in right but let's say then um you have a a specific Service that because of your settings is twice as fast as all of your competitors but it only works with PHP 8 code, right? So you could actually set a filter on your own repository for plugins. For my end customers, only surface plugins that are PHP 8 compatible. Okay. Christos Paloukas Wow, okay. That sounds like it cuts off a layer of support that we have to build into our platform either way, because we do need that granular control per plugin and per version of each plugin basis. But that's all been built in-house, as probably with most managed request providers. Right. Karim Marucchi What if you and your competitors had a shared foundational platform that you didn't have to maintain? Explain. What, so what you've built in house, right? Christos Paloukas Yeah. Karim Marucchi What if all of you and your competitors had a shared foundation that you didn't have to actually spend the resources to maintain that was done by the fair project. ([Time 0:11:22](https://share.snipd.com/snip/e357b8cf-1c67-44e0-8bf9-a5f1e10cd2ac)) - **Shared Foundation Lowers Duplicate Work** - A shared federated foundation saves each company from duplicating complex infrastructure work. - Contributing small amounts to a common project is far cheaper than building and maintaining bespoke solutions. Transcript: Karim Marucchi That's why we're all using WordPress. Yeah, exactly. Christos Paloukas Good point. It is beneficial. Actually, it's amazing as hell. You're just brought to the table. Why? Because we as Presidium, a managed WordPress hosting provider, we would offload having to worry about all of that and the entire process. And we could probably, I don't know, donate, contribute rather, I'm just going to say a random number, 10 hours per week to that project rather than maintaining its own house. Right. Even if it's two hours a week, two hours a week across 20 people. Karim Marucchi You're still cutting down exactly yeah and that's the reason why there seems so interesting to people is everybody's taken for 22 years everybody's taken for granted what wordpress.org Could do and then anything past that they've had to build on their own right it's time to iterate it's time to evolve how we know we need this WordPress ecosystem to move forward. ([Time 0:13:09](https://share.snipd.com/snip/2eb1d175-2cdf-4df1-b63d-dc7425f75a6e)) - **Build On Existing Open Standards** - Leverage existing standards and partners like BlueSky, OpenJS, and CNCF to implement federation and protocol extensions. - Collaborate with proven projects rather than inventing new untested protocols. Transcript: Karim Marucchi Really it so the documents are also being released on the github of the FAIR plugin. The bottom line is that we're putting in a complete idea of how to deal with aggregators and repositories and federation. And really, we've been very lucky to be able to get a lot of good advice from our friends. Once we joined the Linux Foundation, which I know we're going to talk about, OpenJS came and said, how can we help? CNCF came and said, how can we help? We're working with Laravel developers for part of this. On the other hand, BlueSky, the BlueSky protocol, they've been extremely helpful. When we said we want to federate using BlueSky, they've actually added code to their protocol specifically for Pear. ([Time 0:14:36](https://share.snipd.com/snip/e93671f8-77a0-4dbe-ad1f-aca509a970ef)) - **Combine Proven Review Processes With Signatures** - Reuse experienced reviewers and documented processes (like Mika Epstein's work) and add code signing and DID identifiers. - Implement stronger verification, signatures, and modern identifiers to improve repository security and provenance. Transcript: Karim Marucchi Are extremely lucky with a fair project. We have three technical co-chairs. So not one leader, but three leaders of the technical team. And one of them is mika epstein for the for those of your audience who don't know who that is for over 10 years mika ran the plugin repository for dot and she wrote the box too no no go ahead Christos Paloukas Continue i just mentioned that she wrote the document too Exactly. Karim Marucchi And she has years of thoughts and documentation and experience on how it should evolve. This is our chance to implement that. So we are doing everything that.org did. Plus code signatures, plus new ways of verification, plus the DID work replacing slugs and keeping that secure, plus, plus, plus. So not all of it is unfair right now. It's getting there in the next, I think, couple of weeks is going to be even more documentation coming towards 1.0. But this version 0.4 is the first one that has true federation instead of just a mirror. ([Time 0:18:32](https://share.snipd.com/snip/bdd512a6-2e7e-4c7e-9003-c8f1e74b13e4)) - **Linux Foundation Governance For Trust** - Choosing the Linux Foundation for governance brings anti-monopoly policies and neutral oversight. - That governance model helps competitors cooperate on a central infrastructure while competing around the edges. Transcript: Karim Marucchi So we actually, before we started writing code, the first thing that we did as a group is we went to the Lenox Foundation. We spoke to a few, but really we decided early on on the Lennox foundation. And we said, um, basically the concept here is how do we create really a infrastructure that can breed trust? How do we stop any one entity, any one bad actor from being able to manipulate the system through governance, through manipulation. And the answer came by looking, like we were talking about earlier, technically, looking to Lennox for the last 30 years, they've been dealing with this stuff. And the infrastructure that was put up by the Lennox Foundation to create independent projects, the policies and governance bylaws that they've set up ensure anti-monopoly practices. ([Time 0:21:06](https://share.snipd.com/snip/a3aff9ad-cea1-494a-ab70-6eafa7cfff83)) - **How To Contribute To FAIR** - Individuals can contribute code, docs, or community work via the FAIR GitHub and Slack; find public contribution paths and apply for contributor roles. - Companies can engage by contacting [email protected] or contributing staff to the project without necessarily joining the Linux Foundation. Transcript: Karim Marucchi So we've got a few different aspects. Speaking about individuals, if your gift is in writing code, WordPress, Laravel, server infrastructure, anything on go to the GitHub repo, get in touch. Okay. Um, there's a, uh, publicly available plaque now available that you can apply for if you're an individual and you want to contribute code. If you're an individual and wants to work on the infrastructure, the community, the messaging, the documentation, also get in touch with us through, through Slack and through the GitHub repo. I mean, there's an email address there too that you can send, um, per request to, um, we're looking for folks to help us with content on the website that's coming. We still don't have the website up because we've been writing code on the actual system. So any individual who wants to help get in touch, we probably have something you could help with. ([Time 0:24:18](https://share.snipd.com/snip/5ca2c190-d994-49b0-8846-efed70ded813)) - **FAIR Initiative And Package Manager Are Unified** - FAIR (the initiative) and the FAIR package manager (technical project) are the same effort under one umbrella. - The initiative provides governance and community while the package manager provides the technical implementation. Transcript: Christos Paloukas What's the difference between the FAIR as a whole and the current uh project the fair package manager is there something different there there is no difference the technical project Karim Marucchi Is the fair package manager for wordpress and the fair initiative is the entity the foundation that is working on fair awesome sounds fair i had to make that cheesy joke at some point Christos Paloukas I was thinking about it this whole time uh cool i don't have anything else to add do you have anything else to add about uh fair the initiative what's going on uh no it's just i'm really excited Karim Marucchi Because this is the first opportunity we've had to add off where certain infrastructures content management systems cms's have had a problem in relying only on one financial entity This is the first true open source way of applying CMS. ([Time 0:26:41](https://share.snipd.com/snip/43e38c52-26d4-4f1c-9492-428c15ba09ae))