More FAIR  ## Metadata - Author: [[Crossword]] - Full Title: More FAIR - Category: #podcasts - URL: https://share.snipd.com/episode/b5db70d8-3665-4964-967e-32561fdd8ec2 ## Document Notes ## Highlights - **Local Checks Improve Privacy** - FAIR reduces external privacy risks by running checks locally instead of pinging Automattic services. - Luke realized many historic WordPress checks unnecessarily sent browser data offsite and FAIR avoids that. Transcript: Luke But no, but Ryan McHugh, LoopConf, that happened. And I really, really enjoyed Ryan McHugh's talk about fair and how fair works. He got into the technical nitty gritty and all of that sort of thing. Jonathan Interesting. Uh, I, I still remain, uh, pretty like, I feel like somewhat in the dark and an unimpressed like by it. So I'm curious, like what stood out to you? Like what, uh, what, is there anything in particular that, that stood out to you? Luke I am completely, uh, what's the right word? I'm a convert. I'm a fair convert. I'm going to install the fair plugin on all my websites. Oh, wow. Okay. Mainly, one of the big reasons is privacy. I didn't realize. I've been working, Jonathan, in WordPress for a very long time. I didn't realize this. ([Time 0:01:08](https://share.snipd.com/snip/2f7e9fd6-6c4b-41ad-9403-43d4e47f276b)) - **Missing Policies Create Uncertainty** - Lack of clear policies about external pings raises privacy and data-use concerns for WordPress admins. - Jonathan worries simple checks could accumulate sensitive usage data if undisclosed or stored centrally. Transcript: Jonathan And I don't know how much you've looked into this. This is the first that I'm hearing about it. But like all sorts of questions come to mind, like, is that data being stored? Is there a clear policy about how that data is being used? Luke It, there doesn't seem to be much of a policy at all. And the thing is, I don't really know where I would go to get that policy because it's my WordPress website, maybe inside of the WordPress admin somewhere, but there's no privacy policy Page in the WordPress admin. Like it's a bit bizarre. Maybe WordPress.org. I haven't checked out the privacy policy there, but Ryan McEwen, his talk said, you know, he wasn't making any bold statements, but he said, well, maybe you should check out the privacy Policy on because it might be that this isn't even mentioned. So that's kind of scary. And then pinging, you know, the pinging mechanism inside of WordPress. ([Time 0:02:56](https://share.snipd.com/snip/d214d3a2-b32e-4f00-8815-85f71a457318)) - **Centralization Concentrates Power** - Centralized services remaining under a single owner concentrate potential power and data control. - Jonathan and Luke note many ping services shut down leaving one owned by Automattic, which is concerning. Transcript: Luke It used to be that there was like a few different services that supported this and it sort of worked via a number of different players in the ping back space well they've all shut down except Jonathan For one and that one is owned by automatic interesting so let's come back to this in a moment quick uh one of the other stories that did catch my attention is the the internet archive plugin And the partnership between automatic and the internet archive and at first glance uh and i understand that you actually were involved in reviewing this one and your duties on the plugin Review team but at first glance i looked at that and i'm like oh cool i don't know much about it i really like the internet Archive. And I found it to be so useful on so many occasions. I have occasionally asked myself questions like, what do they, how do they do this? Like, how does this work? What's the catch occasionally occurs to me? But at first blush, when I saw that announcement, I was like, oh, cool. And at least as I'm listening to you describe this, what I'm hearing is like, oh, man, this seems kind of sketchy. This is kind of, I think to me, one other side of that coin is, oh, could this project, maybe it's not that big of a deal, but I'm like, this feels like the type of thing that Automatic is well-positioned To be investing in projects like this Internet Archive thing. Right. ([Time 0:04:02](https://share.snipd.com/snip/963c98a7-211d-4fbe-8222-56f060d98764)) - **Telemetry Could Reveal WP Usage** - If Automattic could collect site-level telemetry, it could derive reliable metrics like WordPress daily active users. - Both hosts find such undisclosed internal data collection plausible but concerning without transparency. Transcript: Luke Actual statistical reliable data showing how many daily active users WordPress has. Ah, interesting. Interesting. That would be fast. I'd love to see that. I'd love to know, you know, and then we get to compare it to the results of other apps and other ecosystem things. Maybe we see oh the daily active user has been falling for the past six months or uh we see a growth or maybe we can compare it to squarespace and go oh look at that like we're um catching up To them or we're way ahead or you know it's like but we just don't have any of that data. Why not? I'd love to see it. So my hunch is that Automatic doesn't have that. Jonathan But it's interesting that it might be actually, to your point, maybe technically possible to have that. I think I would be concerned as an outsider if that data was actively being cultivated and maintained and utilized internally and that not be disclosed. Because you're right, it could be useful. It could be interesting. It could tell a number of different stories about actual utilization. But to have that and for the method of having that not be disclosed, my don't, my bet is that it's not there, even if it would be technically possible to do it. ([Time 0:07:00](https://share.snipd.com/snip/f96b83fa-c335-4924-bff8-9b958a978ec4)) - **Replace External Calls With FAIR** - Install FAIR to replace external Automattic-dependent services with privacy-preserving local or neutral alternatives. - Luke recommends FAIR for browser checks, emoji CDN changes, PHP checks, and ping handling to reduce reliance on Automattic. Transcript: Luke For one, it sort of just replaces a lot of those services that hit automatic for no good reason. In fact, it replaces them with things that are even better. So for example, if I want to know if I've got an outdated browser, well, the Fair plugin just has that built in so that it can all run locally in the browser using data from can I use and things Like that. Do you know what I mean? So that can all be local, can all be completely private. There's no reason for that data to go offsite. So that's maybe like the main reason in the short term. Jonathan If I were to install FAIR on my instance, like what changes in practice? Do the featured plugins suddenly change? I don't actually know. And if they do, or is it like Yoast that shows up and human-made plugins? Like that's the, perhaps the cynic in me is like, if that swaps it out, if it's not just Jetpack and Akismet, like what is there? Is it just gone? Luke Yeah, that's a good question. I don't know what it would be or how that would be fair. But that's interesting. So rather than pulling from, I don't know, WordPress News or whatever, it pulls from the wp.world, which is a funded community-run events, big events list, which is cool. Interesting. Jonathan Okay. All right. So I'm gonna have to check this out myself. Um, that's, uh, yeah, that's an interesting, like, uh, bifurcation of tradition, right? Uh, for better or for worse, right? Cause when I think about the, uh, the.org, I remember when, um, like do the woo started showing up there and there's like a like matt himself i think if last time recall him personally Curates like which rss feeds are pulled from that include are included and in theory you can have this similar type of experience but you also have an opportunity for someone else to Make other editorial decisions like i i'm guessing the you know is matt's blog are going to be included in that so so okay let me just come back to the question like what do you get when you Luke Install fair you get browser version checks running locally on your site you don't have to use gravatar i all of the wordpress news and meetups that comes from the wp.world and stuff Like that. Your PHP version checks, instead of going to automatic for a PHP version check, it just uses php.net. Your emoji CDN, instead of going to automatic to load all your emoji, it goes through JS Deliver. ([Time 0:10:03](https://share.snipd.com/snip/a7a936f4-e056-44f5-bf71-7fcbadceeec0)) - **Core Updates Still Use WordPress.org** - FAIR intentionally leaves plugin/theme updates and translations sourced from WordPress.org unchanged. - The project focuses on replacing ancillary services while respecting core update mechanisms. Transcript: Luke Your PHP version checks, instead of going to automatic for a PHP version check, it just uses php.net. Your emoji CDN, instead of going to automatic to load all your emoji, it goes through JS Deliver. Instead of doing your pings through like that automatic ping thing it just goes directly to index now which is like a industry standard thing for telling search engines about you know New things to index so it's just like all of these layers where WordPress depends on WordPress.org and automatic, it takes that away. And then one thing that it doesn't do is change your plugin directory, theme directory, translations and updates. That still happens from WordPress.org. ([Time 0:12:30](https://share.snipd.com/snip/cd649429-7139-45de-b3bf-a30814b5f9e1)) - **Adoption, Not Tech, Will Decide Impact** - FAIR can shift editorial and service control from WordPress.org to community-run sources like wp.world. - Jonathan sees adoption by major hosts as the key inflection point that would make FAIR consequential at scale. Transcript: Jonathan New ones. So one thing I'm going to be curious about is to see how this goes is, as I'm recalling it, one of Matt's like stated contentions was basically like, hey, there's a lot of stuff that we do For you on.org that most of y'all don't appreciate or don't know about and sort of don't appreciate. And WPN is not willing to pay for it. And it's objectively true. And part of what I'm seeing as a response in the FAIR project here is like, hey, we didn't ask you to do all that. You're doing things above and beyond what you needed to do. And there's some benefits and tradeoffs that we're becoming more aware of. And you're not being super open about it. Right. So now there's this replacement. I think what I'm going to be interested to see is what does adoption look like? Because I think the moment this gets really interesting is, does one or two big hosts make the switch and say like, hey, we're going to now use this. And that, because to me, this goes nowhere in practice if it's just based on whether folks like yourself install this manually. ([Time 0:13:40](https://share.snipd.com/snip/de5df36c-cc42-4d1a-b76a-78e3a701eeb9))