What's Fair is FAIR 🔗 **Source:** [What's Fair is FAIR](https://www.youtube.com/watch?v=zOtOy3oIuXE) > [!note]+ Document Notes > tags: [WordPress, Open Source Governance, Package Management] > author: [MISSING] > source: YouTube > reference: [https://www.youtube.com/watch?v=zOtOy3oIuXE] > date created: {{date:YYYY-MM-DD}} {{time:HH:mm}} > > # 🏷️ Title: What's Fair is FAIR > <!-- deep-read:sections start --> ## 🧰 Action Inbox - [H1] Publish FAIR overview for GoDaddy OSPO — context/https://www.youtube.com/watch?v=zOtOy3oIuXE #articleseed - [H2] Map WordPress.org touchpoints to FAIR replacements — context/https://fair.pm #xref - [H3] Draft privacy note on dashboard UA telemetry — context/https://browsehappy.com #addendum - [H4] Propose Browserslist-based checks for wp-admin — context/https://github.com/browserslist/browserslist #articleseed - [H5] Replace Ping-O-Matic pings with IndexNow — context/https://www.indexnow.org/ #articleseed - [H6] Write “decentralized discovery” explainer for devs — context/https://fair.pm #share - [H7] Define labeler policy for moderation layers — context/https://docs.bsky.app/blog/moderation-service #articleseed - [H8] Start FAIR composer-integration RFC outline — context/https://github.com/FAIRpm #xref - [H9] Prep The WPCC microgrant brief for FAIR pilots — context/https://fair.pm #share #articleseed - [H10] Candidate KPIs for OSPO adoption dashboard — context/https://fair.pm #xref ## 🧭 Table of Contents - [📝 Summary](#-summary) - [📖 Main Content](#-main-content) - [🗒️ Notes](#️-notes) - [📚 References](#-references) - [🗣️ Paraphrase](#️-paraphrase) - [📰 Newsletter](#-newsletter) - [✅ Action Items](#-action-items) - [🧪 Hypotheses](#-hypotheses) - [📊 Methodology](#-methodology) - [❓ Questions](#-questions) - [🔮 Future Research](#-future-research) - [💡 Implications](#-implications) - [🧠 Learning Styles Assessment](#-learning-styles-assessment) - [📊 Accessibility Assessment](#-accessibility-assessment) - [🌍 DEIB Assessment](#-deib-assessment) - [✅ Logical Validity](#-logical-validity) - [🛡️ DARVO Analysis](#-darvo-analysis) - [🎯 Conclusion](#-conclusion) ### 🔗 References - FAIR project home: https://fair.pm - FAIR GitHub org: https://github.com/FAIRpm - IndexNow protocol: https://www.indexnow.org/ - Browserslist docs: https://github.com/browserslist/browserslist - caniuse-db (usage data): https://www.npmjs.com/package/caniuse-db - Ping-O-Matic: https://pingomatic.com - Blo.gs transfer note: https://blog.apievangelist.com/2014/04/25/the-transfer-of-blog-from-yahoo-to-automattic/ - Chrome UX Report overview: https://developer.chrome.com/docs/crux/ *(If blocked, use web.dev summary.)* - Verge reporting on wordpress.org ownership claim: https://www.theverge.com/2024/10/9/24243509/wordpress-automattic-jonathan-bossenger-matt-mullenweg-lawsuit - Bluesky moderation service/labelers: https://docs.bsky.app/blog/moderation-service ## 📝 Summary - Ryan McCue presents FAIR at LoopConf. - FAIR targets secure, decentralized WordPress package distribution. - The plan removes single-entity control in key supply-chain steps. - It proposes privacy-preserving checks and modern discovery. - The bottom line: safer installs, plural governance, and user choice. ## 📖 Main Content - FAIR stands for Federated And Independent Repositories. It proposes discovery, moderation, analytics, and repos as separable nodes. The architecture reduces central chokepoints and vendor capture risk. See FAIR materials. (https://fair.pm) - Technical independence replaces wordpress.org dependencies with site-local checks and open standards. For browser checks, use Browserslist and caniuse usage data. This removes unnecessary telemetry. (https://github.com/browserslist/browserslist, https://www.npmjs.com/package/caniuse-db) - Content pings move from Ping-O-Matic’s defunct targets toward IndexNow. IndexNow is an open submission protocol backed by search engines. (https://www.indexnow.org/, https://pingomatic.com) - Discovery becomes a search-like aggregator rather than a gatekeeper. Users can find packages, then update directly from origin repos. (https://fair.pm) - Safety uses stackable labelers, inspired by Bluesky moderation services. Labelers add attestations for security, copyright, and compatibility. (https://docs.bsky.app/blog/moderation-service) - Analytics live off-path, like Chrome UX Report’s model for the web. Participation stays optional to preserve privacy. (https://developer.chrome.com/docs/crux/) - Governance follows Linux Foundation patterns. Technical and business tracks stay separate to balance influence. (https://github.com/FAIRpm) - McCue notes controversy around wordpress.org control claims. Reporting indicates ownership ties to an individual, raising governance concerns. Treat this as reported, not adjudicated. (https://www.theverge.com/2024/10/9/24243509/wordpress-automattic-jonathan-bossenger-matt-mullenweg-lawsuit) ### 🗒️ Notes #### ⏱️ [00:00:28](https://www.youtube.com/watch?v=zOtOy3oIuXE&t=28) FAIR intro and goals ### [H1] FAIR targets secure decentralized distribution > [!quote] [What's Fair is FAIR](https://www.youtube.com/watch?v=zOtOy3oIuXE) by [an unnamed author] via [[YouTube]]. Published [MISSING]. Accessed {{date:YYYY-MM-DD}}. > “Our goal with FAIR is to improve security in software distribution.” - Security and decentralization sit at the core. - Emphasis on independence from single entities. #### ⏱️ [00:03:11](https://www.youtube.com/watch?v=zOtOy3oIuXE&t=191) No single controller ### [H2] No single entity controls supply chain > [!quote] [What's Fair is FAIR](https://www.youtube.com/watch?v=zOtOy3oIuXE) > “Establish a model where no single entity controls the entire supply chain.” - Aligns with LF norms and OSS resilience. - Reduces systemic risk. #### ⏱️ [00:09:06](https://www.youtube.com/watch?v=zOtOy3oIuXE&t=546) Version checks critique ### [H3] WordPress dashboard sends browser UA telemetry > [!quote] [What's Fair is FAIR](https://www.youtube.com/watch?v=zOtOy3oIuXE) > “Every time you load the dashboard, your browser user agent gets sent.” - McCue argues Browse Happy’s checks lagged. - Proposes site-local checks using industry data. #### ⏱️ [00:12:12](https://www.youtube.com/watch?v=zOtOy3oIuXE&t=732) Browserslist swap ### [H4] Browserslist enables private, current checks > [!quote] [What's Fair is FAIR](https://www.youtube.com/watch?v=zOtOy3oIuXE) > “We can build a regex from Browserslist and run it locally.” - Use caniuse-backed data, not hardcoded lists. - Improves accuracy and privacy. #### ⏱️ [00:13:35](https://www.youtube.com/watch?v=zOtOy3oIuXE&t=815) Pings and search ### [H5] Legacy ping targets no longer help indexing > [!quote] [What's Fair is FAIR](https://www.youtube.com/watch?v=zOtOy3oIuXE) > “FeedBurner APIs don’t work properly anymore and never influence search data.” - Replace with IndexNow for real indexing. - Remove unnecessary data flows. #### ⏱️ [00:16:01](https://www.youtube.com/watch?v=zOtOy3oIuXE&t=961) Data flows to third parties ### [H6] Pings reveal site activity to third parties > [!quote] [What's Fair is FAIR](https://www.youtube.com/watch?v=zOtOy3oIuXE) > “They now have a map of every WordPress site and all the content.” - Privacy risk and competitive data leakage. - FAIR favors minimal disclosure. #### ⏱️ [00:18:52](https://www.youtube.com/watch?v=zOtOy3oIuXE&t=1132) Package reality ### [H7] Real installs already come from many sources > [!quote] [What's Fair is FAIR](https://www.youtube.com/watch?v=zOtOy3oIuXE) > “The reality really looks something like this…multiple sources.” - Mirrors, GitHub, and vendors already exist. - Policy must match reality. #### ⏱️ [00:25:25](https://www.youtube.com/watch?v=zOtOy3oIuXE&t=1525) Discovery aggregator ### [H8] Discovery acts like a search engine > [!quote] [What's Fair is FAIR](https://www.youtube.com/watch?v=zOtOy3oIuXE) > “Introduce a discovery aggregator to find packages.” - First-time find via discovery. - Updates flow directly from origin. #### ⏱️ [00:30:02](https://www.youtube.com/watch?v=zOtOy3oIuXE&t=1802) Stackable moderation ### [H9] Labelers add independent safety signals > [!quote] [What's Fair is FAIR](https://www.youtube.com/watch?v=zOtOy3oIuXE) > “We can have multiple labelers…security, copyright, compatibility.” - Inspired by Bluesky’s model. - Users choose strictness. #### ⏱️ [00:34:16](https://www.youtube.com/watch?v=zOtOy3oIuXE&t=2056) Provenance basics ### [H10] Domains and IDs strengthen provenance > [!quote] [What's Fair is FAIR](https://www.youtube.com/watch?v=zOtOy3oIuXE) > “Give everything a globally unique ID…use DNS verification.” - Show host and origin domains. - Build stronger trust layers. #### ⏱️ [00:38:36](https://www.youtube.com/watch?v=zOtOy3oIuXE&t=2316) Shipping v1.0 ### [H11] FAIR plugin 1.0 ships this week > [!quote] [What's Fair is FAIR](https://www.youtube.com/watch?v=zOtOy3oIuXE) > “You can download version 1.0 which just came out this week.” - Mini-repo and explorer join plugin. - Discovery runs as AspireCloud. #### ⏱️ [00:40:29](https://www.youtube.com/watch?v=zOtOy3oIuXE&t=2429) Composer Q&A ### [H12] Composer integration sits on the roadmap > [!quote] [What's Fair is FAIR](https://www.youtube.com/watch?v=zOtOy3oIuXE) > “We haven’t built it yet…but the system is modeled on Composer.” - RFC and bridge design needed. - Aim for two-way compatibility. #### ⏱️ [00:41:46](https://www.youtube.com/watch?v=zOtOy3oIuXE&t=2506) Where help is needed ### [H13] Moderation, docs, and core protocol need help > [!quote] [What's Fair is FAIR](https://www.youtube.com/watch?v=zOtOy3oIuXE) > “We need more documentation…and more help building out the plugin.” - Contributors welcome across tracks. - Long-horizon effort. ## 📚 References - FAIR project: https://fair.pm - FAIR GitHub: https://github.com/FAIRpm - IndexNow protocol: https://www.indexnow.org/ - Browserslist: https://github.com/browserslist/browserslist - caniuse-db: https://www.npmjs.com/package/caniuse-db - Ping-O-Matic: https://pingomatic.com - Blo.gs background: https://blog.apievangelist.com/2014/04/25/the-transfer-of-blog-from-yahoo-to-automattic/ - Chrome UX Report: https://developer.chrome.com/docs/crux/ - Bluesky moderation service: https://docs.bsky.app/blog/moderation-service - Verge reporting on wordpress.org claim: https://www.theverge.com/2024/10/9/24243509/wordpress-automattic-jonathan-bossenger-matt-mullenweg-lawsuit ## 🗣️ Paraphrase - FAIR proposes a decentralized, standards-first package ecosystem for WordPress. It replaces brittle central dependencies, adds discovery, and layers independent moderation. - The approach improves privacy, provenance, and competition. It ships a plugin and tooling now, with labelers and analytics coming next. ## 📰 Newsletter - FAIR 1.0 lands with a privacy-first, decentralized model for plugins and themes. It brings a discovery layer and future labelers, echoing Bluesky’s approach. WordPress builders should explore IndexNow for pings, Browserslist for checks, and keep an eye on FAIR’s composer plans. Links: FAIR (fair.pm), IndexNow, Browserslist, and the GitHub org. ## ✅ Action Items #### DevRel - Publish a “FAIR for plugin authors” quickstart with examples. - Run office hours on discovery and labelers. - Add demos: IndexNow swap, Browserslist checks, provenance badges. #### OSPO - Define contribution policy for FAIR repos and labelers. - Propose SBOM requirements and signature attestations. - Document governance separation and escalation paths. #### Community - Host roadmap clinics for maintainers adopting FAIR. - Launch pairing sessions for first FAIR repos. - Share budget templates for sustainable ops. #### WordPress - Core: evaluate optional discovery endpoints and UI hooks. - Core Performance: track telemetry removal performance wins. - Core AI: set guardrails for labeler automation and audits. - **Core Program Team:** schedule cross-team syncs on supply chain features. - Playground: create FAIR integration labs and repro scripts. - Documentation: write examples-first patterns for provenance checks. - Plugins: define policy for external update endpoints and labelers. #### The WPCC - Seed microgrants for FAIR moderation pilots. - Fund documentation sprints and onboarding workshops. - Publish transparent impact reports on adoption. ### FAIR - Technical independence: complete API swaps with tested fallbacks. - Policies and covenants: publish trust and federation criteria. - Productized governance: ship operator agreements and scorecards. ## 🧪 Hypotheses - FAIR reduces plugin supply-chain compromise rates. - Browserslist-based checks lower support tickets for admin access. - IndexNow increases crawling freshness for WordPress sites. - Labelers reduce harmful installs without stalling innovation. ### 📊 Methodology - Run A/B across hosts: FAIR vs. status quo. - Track security advisories and block events per 1,000 installs. - Measure crawl latency before and after IndexNow adoption. - Evaluate user satisfaction via controlled surveys. ### ❓ Questions - Which labeler signals do admins trust most? - How do we prevent labeler capture by large vendors? - What provenance UI communicates risk without alarm fatigue? ### 🔮 Future Research - Study federated discovery ranking fairness and spam resistance. - Explore cryptographic transparency logs for package provenance. - Define portability between FAIR and Composer ecosystems. ### 💡 Implications - Practice: simpler, safer updates across diverse repos. - Policy: clearer decision rights and consented telemetry. - Education: modernize WordPress onboarding with supply-chain literacy. - Funding: target labeler operations and documentation. ### 🧠 Learning Styles Assessment - Reading level estimate: Grade 10, Flesch–Kincaid method. #### 👀 Visual learners - Present: architecture diagrams would help. - Improve: show data flows and labeler stacks. #### 🔊 Aural learners - Present: talk recording supports listening. - Improve: add a 3-minute audio summary. #### 🗣️ Verbal learners - Present: clear definitions and examples. - Improve: add a glossary for new terms. #### 🧩 Kinesthetic learners - Present: repo setup steps. - Improve: sandbox labs and reproducible tasks. #### 🧠 Logical learners - Present: modular architecture and layers. - Improve: decision trees for labeler policies. #### 🧑‍🤝‍🧑 Social learners - Present: Slack and open meetings. - Improve: cohort-based onboarding. #### 🧘‍♀️ Solitary learners - Present: docs and repos for self-study. - Improve: reflection prompts and checklists. #### 🌿 Naturalistic learners - Present: ecosystem analogies. - Improve: lifecycle and sustainability framing. ### 📊 Accessibility Assessment #### Screen reader semantics - Present: headings help navigation. - Improve: alt text and captions in slides. #### Keyboard navigation - Present: n/a for talk recording. - Improve: ensure player supports full keyboard use. #### Contrast and readability - Present: unknown for slides. - Improve: enforce 4.5:1 contrast minimum. #### Text resizing and reflow - Present: n/a for video content. - Improve: responsive slide deck exports. #### Media and captions - Present: video has transcript here. - Improve: add accurate captions and audio descriptions. #### Forms and interactions - Present: n/a. - Improve: accessible contact forms for contributors. #### Standards reference - Map gaps to WCAG 2.2 AA criteria. ### 🌍 DEIB Assessment #### Cultural breadth - Present: global OSS governance relevance. - Improve: multilingual materials and case studies. #### Inclusive language - Present: neutral terms, defined jargon. - Improve: plain-language summaries. #### Neurodiversity support - Present: structured sections. - Improve: predictable icon+text labels in docs. #### Representation - Present: contributors across roles. - Improve: highlight diverse maintainers in examples. #### Psychological safety - Present: open governance channels. - Improve: clear CoC ops and escalation. ### ✅ Logical Validity #### Strong reasoning - Decentralization reduces single-point failure risk ([H2], [H8]). This follows robust systems theory. - Site-local checks reduce data exposure ([H4]). This strengthens privacy by design. - Labeler layers separate powers ([H9]). This enables user choice and external audit. #### Fallacies - Possible overgeneralization on legacy pings impact ([H5]). Fix: cite updated engine guidance. - Potential false dichotomy: centralized vs nothing ([H7]). Fix: acknowledge partial central services. #### Tone of voice - Pragmatic and technical. Occasional urgency regarding privacy and governance. ### 🛡️ DARVO Analysis - Deny: none explicit. - Attack: none; critiques target systems, not people. - Reverse victim/offender: none observed. ## 🎯 Conclusion - FAIR proposes a pragmatic, decentralized supply-chain for WordPress. It swaps brittle dependencies for open standards, discovery, and labeler-driven safety. The next steps: pilot IndexNow, ship Browserslist checks, draft composer bridges, and fund moderation work through The WPCC and partners. ## 🧱 Refactor Appendix (append after 🎯 Conclusion) ### 📚 Literature Split Pad - Purpose: Stage Konik CEE units that become per-source Literature notes. - Split level: **H3**. - Include verbatim quotes under 25 words and a [view highlight] link. ### [H1] FAIR targets secure decentralized distribution > [!quote] [What's Fair is FAIR](https://www.youtube.com/watch?v=zOtOy3oIuXE) by [an unnamed author] via [[YouTube]]. Published [MISSING]. Accessed {{date:YYYY-MM-DD}}. > “Our goal with FAIR is to improve security in software distribution.” Two lines: FAIR reduces central risk and improves privacy. [view highlight](https://www.youtube.com/watch?v=zOtOy3oIuXE&t=28) #xref #articleseed ID:rw_[MISSING] ### [H2] No single entity controls supply chain > [!quote] [What's Fair is FAIR](https://www.youtube.com/watch?v=zOtOy3oIuXE) > “No single entity controls the entire supply chain.” Two lines: aligns with LF governance and OSS norms. [view highlight](https://www.youtube.com/watch?v=zOtOy3oIuXE&t=191) #xref ID:rw_[MISSING] --- ### 🔖 Atomic Split Pad (Zettel Candidates) - Purpose: Promote reusable claims into Atomic notes. - Split level: **H4**. - Each item: one idea, present tense, specific, testable. #### [Z1] Browserslist enables private, current checks - Site-local rules reduce telemetry. - Pointer: 00:12:12. - Links: [[Privacy-by-design]] [[Admin-UX]] #### [Z2] IndexNow replaces legacy pings effectively - Standardized submissions improve freshness. - Pointer: 00:13:35. - Links: [[Search-Indexing]] [[Open-Standards]] #### [Z3] Labelers add layered safety signals - Independent services rate packages. - Pointer: 00:30:02. - Links: [[Moderation]] [[Supply-Chain]] #### [Z4] Discovery mirrors web search behavior - Find once, update from origin. - Pointer: 00:25:25. - Links: [[Decentralization]] [[DX]] #### [Z5] Unique IDs and DNS verify provenance - Users verify origin quickly. - Pointer: 00:34:16. - Links: [[Provenance]] [[Trust]] --- ### ✏️ Fleeting Queue (Extract by Selection) - [F1] Draft composer bridge proposal — context/https://github.com/FAIRpm #fleeting #inbox - [F2] Write user-facing privacy explainer — context/https://fair.pm #fleeting #inbox - [F3] Plan The WPCC labeler pilot — context/https://fair.pm #fleeting #inbox ## 🏷️ Tag Coverage #articleseed: 5 • #xref: 4 • #share: 2 • #bmf: 0 • #addendum: 1 <!-- deep-read:sections end --> ## 📺 Video ![](https://www.youtube.com/watch?v=zOtOy3oIuXE) --- # 📄 Full Transcript *Auto-generated from YouTube captions · timestamps roughly every 30 seconds · [watch on YouTube](https://www.youtube.com/watch?v=zOtOy3oIuXE)* **[00:00]** Thank you very much. Uh hopefully you can all hear me fairly well. Uh I will try and project but microphone should help. Uh so yeah, thanks for thanks for being here. Uh as Brian mentioned, uh I kind of helped more initiate uh than organize uh the event to be honest, but uh it is so exciting to be here back at Loop Comp again. Uh I love Loop Comp. I loved all the previous iterations and this one in particular uh I think is going to be fantastic. So, uh I'm here today, uh going to talk about the fair **[00:31]** project. Uh quite a few have heard of it, which is great. Uh so, um you might have heard maybe the name, you might not know all the details. Today, we're going to go in and have a look at what fair is in general. Uh and have a look at some of the details, how it works technically, how it works organizationally, kind of impacts that it might have on the things that you all do. Uh apologies for this not being in full screen. Google uh slides is terrible but it's the tool that I had so uh we are gonna stick with it. Uh so uh **[01:01]** as Brian already mentioned uh I am the VP of product at Hummade and Altus. We are an enterprise WordPress services agency uh and hosting company um or just entirely working with the enterprise. Um I'm also the co-chair uh of the technical steering committee for the fair project uh which is what I'm talking about today. also a core committer uh to WordPress or though I think it's a memeritus uh committer these days. Haven't really committed in a while. I'm a member of the security team for WordPress as well. Um I created **[01:34]** and co-led the WordPress REST API uh project through kind of initiation as a kind of standalone project and then merging into WordPress core itself. I created and originally maintained uh requests for PHP. Uh I was also the project lead for simple pie for a while and I actually just ran out of room on this slide. There were a few other things I couldn't include but I have been working uh with or on or contributing to WordPress now for I think about 21 years something like that. Uh it has been like twothirds of **[02:06]** my life or more than that. U so I've been around in the WordPress space quite a while now. Uh you know is is my life and I care a lot about the the WordPress project about making it successful. So uh that was really uh you know where I started getting into this project called fair. So you might have heard of fair uh already. Um certainly it seems like plenty of you have. You might not know the details. We announced fair in June uh at work camp Europe. Uh actually a side event called alt control conference. Uh and uh fair if you don't **[02:38]** know stands for federated and independent repositories. Right. So it's about uh this concept of sort of decentralization and you know a few other kind of things around that around you know how do we how do we kind of create this ecosystem of you know independent parts that kind of talk to each other kind of like John's uh you know ecosystem with with ghosts at the the center or the ghost foundation at the center uh and then this ecosystem around it um and our goal uh with fairy **[03:08]** is to improve security in software distribution and establish a model where no single entity controls the entire supply chain. Um, so this is really, you know, you might know some of the history of why this kind of project came about. I'll talk about that a little bit, but not too much. It's not not really the the kind of point. Um, but this is our goal is is to improve the security and and kind of remove any central control. We are part of the Linux Foundation, uh, which you might have heard of. Um, we have 40 plus organizers. Uh so those are **[03:40]** voting members of the technical steering committee. That includes people that you think of as kind of code committers uh as well as contributors in other technical aspects. So people who write documentation or you know help maintain the website or all of those sorts of things. You know all of that uh is uh kind of technical uh and so we give people the ability to vote uh and uh be part of the organization uh of the project. In terms of technically how the project kind of breaks down. Um so we have two **[04:11]** kind of key components uh to the project. The first one of those is what we call technical independence. Uh and that is a full replacement for WordPress.org. Um so you might already know this. WordPress depends on WordPress.org. Uh and it's kind of key part of how things are delivered uh in WordPress. Um we want to make sure that WordPress can exist independently of WordPress.org. Um and so we have our project for technical independence. And then a big part of that as well is how plugins and themes get distributed. Um so you know how you install those uh all **[04:44]** of those sorts of things. That's what we call our package management uh side of things. Um and then overarching all of that is the organization which is the fair web foundation that is part of the Linux foundation as I mentioned and that has both a technical side and a business side. So we're going to dive deep into what all of these things mean uh and uh you know how they all kind of fit together as well. But before we do that, let's talk about why Fair exists. Um, so some of you might already know, you know, some of the background uh for this. Uh, as I **[05:16]** mentioned, WordPress uh depends on WordPress.org. You know, if you've used WordPress, if you open it up right now, uh, it will be talking to WordPress.org and using things from there. Uh, and it needs those uh, in order to run. You might already know that when you go to install plugins and themes, for example, it's pulling those from WordPress.org from the repository, right? Um, but there's also some other things and uh, you know, we kind of had this idea and I think people maybe generally know that WordPress does some other stuff with WordPress.org, but how much actually is there that talks to WordPress.org? So, **[05:48]** part of our project uh was diving deep and finding out all of these places where WordPress relies on WordPress.org. Um, you know, we knew about the plugins, the themes, the core updates, but what are all these other bits? And so we found quite a few other places, you know, places where maybe we're pulling in news or events or things like that. You know, we kind of already knew about a lot of those, but uh there were uh things in here that, you know, even I didn't know about and I've been contributing for 20 years. So I suspect a lot of people don't know about these uh all of these pieces. So you know, a **[06:19]** lot of this relies on WordPress.org. You may uh have seen uh that uh as of September uh last year uh a bunch of kind of controversial stuff has started happening with WordPress.org. I think the the key kind of piece of that is really this realization that WordPress is Matt Mullenweg's personal website, right? It is not a project or uh part of the WordPress foundation. Uh this is specifically from a legal uh case that **[06:50]** is ongoing. Um, and as you can see here, separate from the WordPress software from automatic and from the foundation is a website that Matt supports called WordPress.org. It is not part of the official WordPress project. Now, WordPress.org is great. It has given us very many things uh over the past, you know, 20 years. Um, but it's very clear that this is a personal website and we are a massive project, right? WordPress runs 40 something% of the web. We are at **[07:22]** a point where we need to be taking ourselves seriously and we need to have alternatives to depending on a single person uh and on any single entity uh in order for you know our our kind of software to exist and to thrive. So we're very grateful uh for this service that's being provided but you know it's time to grow up because not only does WordPress uh depend on WordPress.org but we all depend on WordPress.org. And this ecosystem is too important to leave to any one particular entity. **[07:54]** So how do we go about fixing this? This is where fair starts to come in. As I mentioned, we have a project called technical independence. And this uh is a group that we started uh basically at the start of the year. We've been talking kind of, you know, over the holidays, you know, since September last year really uh about kind of doing something about this. uh and we started working on this technical independence project to work out you know what are all the pieces of WordPress.org uh that we need to go and fix that we might need to replace uh you know that **[08:26]** we need to come up with alternatives to um obviously as part of this we discovered brand new things as well uh like I mentioned even I didn't know all of the things uh in here and in fact I think I missed out a couple of things on this slide uh I think that I forgot the the block patterns for example um yeah those are those are not in here so there's a huge amount of functionality and it's really difficult to keep track of all of this But let's dive in and and see actually you know what do all these things do right how critical are they to **[08:56]** the operation of WordPress uh and what are they actually doing on the back end as well. So if we have a look at two uh kind of parts of this we have version checks uh that WordPress uh kind of does. So the first one of these is the PHP version checks basically saying hey are you running a supported version of PHP is it secure you know all of those sorts of things. Um, that seems pretty straightforward, right? We want people to be running the latest and greatest version of PHP, we want them to be nice and secure, you know, all of those sorts of things. We also have browser version **[09:28]** checks as well. So, every time you load up the WordPress dashboard, uh, your browser user agent uh, is being checked to see, hey, are you up to date? You know, are you staying safe on the web? And this is a really noble goal. It comes from a project called uh, Browseappy, um, which is brought to you by WordPress. Which WordPress, I don't know. Uh it is hosted on WordPress.org. So this is part of you know Matt's personal website. You might have heard of this project before. Uh it has been around a really long time. It kind of comes from before we had auto updates in browsers. In fact, **[10:00]** uh when this was much more a concern, right? You know, you actually had to think about when you updated uh your software. Um and if you're ever running a version of your browser uh that's out of date, you see this big notice in your WordPress admin. Uh has anybody in the audience seen this notice in their admin kind of popup one? So so if you have you must have been uh using WordPress for a while because the versions in here have not been updated in almost 10 years. Uh these versions uh **[10:33]** were released in 2017 2016 and were discontinued about the same time you know only a few months later. This is the source code for browseappy. This is what runs every single time. So this is clearly not protecting users, right? This is not actually checking anything practical. These versions are hard-coded. They are not tied to usage data. They're not tied to any kind of real world uh usage or anything like that. But that said, the data still gets sent anyway. So every time you load up your dashboard, your browser user agent gets sent to WordPress.org **[11:06]** and this gets collected as analytics on WordPress.org. Uh there is no other purpose for this data to be sent to WordPress.org. As we just saw, the version checks are not being used for anything just uh the user agent getting collected for analytics data by WordPress.org, which again is one person's personal website. Now, many people probably don't know that this data gets collected. I certainly did not realize when I loaded up my WordPress uh dashboard, my browser user agent was **[11:38]** getting sent off to WordPress.org. uh and we have no idea how long this data is retained for. We don't know, you know, the details of how it's stored. This source code could even be wrong, right? You know, this might not be the source code that's actually running on the server. Um, so we have no guarantees about any of this. I'm not sure that this is even disclosed in the privacy policy for WordPress.org. It's not really considered, you know, user data. Um, and you know, it's possible that it might even breach GDPR. So, this was something that we identified. We absolutely need to replace this. The **[12:09]** good thing is we have solutions for this. So you might already have heard of browsers list. It's a tool that gets used by things like Webpack, uh, Babel, all those sorts of kind of development tools. And it works using real world data from can I use and, uh, from the browser vendors themselves to work out what are the latest versions of browsers, what's actually in use, uh, kind of across, you know, uh, the the kind of deployed web, uh, I guess. Um and so this data is kept up to date and it's industry standard. Now we can take **[12:41]** that uh kind of data we can take the information uh that browsers list gives us and build a regular expression uh and build that into your site so that when you load up your site the checks for you know is your browser up to date run entirely on that site which you're already accessing anyway and don't get sent anywhere else. So this preserves privacy uh we're not sending data off to a random third party. Um but also it fixes the user behavior. Right now we actually have something that is useful. Uh and in fact we have uh started **[13:12]** getting some issues coming in people saying oh actually like it's kind of annoying right like now it's actually telling me to update because I haven't restarted Chrome in like 3 years right uh so this is a case where we can not just you know protest something or say we're going to build you know a onetoone alternative but we can actually make things better for users uh throughout the fair project. Let's take a look at a different feature. Uh so this is uh one that you might have heard of as well. Uh this is the pinging system uh in WordPress. So **[13:42]** every time you publish a piece of content uh on any WordPress site, uh your WordPress site will send off pings. And the idea of pings is that they tell external services like search engines, hey, I published something. Come and index me. Make sure that you're up to date with all of this data. Now again, this is a great sort of uh idea for a project. These days, you know, search engines tend to index things very rapidly. So, you know, maybe it's it's not used quite as much, right? Um this is a WordPress foundation uh project, as **[14:12]** you can see in the footer uh there. WordPress foundation brainchild, whatever that means. Um and uh you know that that sounds great, but it turns out this is hosted on.org as well. So, this is also on Matt's personal website. Um but what does this service actually do? Right? We can see down here we have some common services. Uh we have blogs, feed burner, uh spinner and super feeder. Now you might have heard of at least one of these uh in particular feed burner, right? Feed burner was a service for uh **[14:42]** updating RSS feeds, indexing those, making sure that they get out to people. Uh and it was acquired by Google, right? So surely that data uh is kind of feeding into the Google search engine. It's helping, you know, Google stay up to date with your site, all those sorts of things. Well, we spoke to some people at Google, uh, and they confirmed feed burner data is never used anywhere. It's a discontinued product by Google. The APIs don't work properly anymore, and it never influences any kind of search data. So, this is actually just defunct, **[15:12]** right? It's not used anymore at all. But, it turns out that's actually not the only one. If we have a look at the other services here, you might not have heard of these. And that's because uh at least two more of them have also been discontinued. Uh Spinner's website no longer works at all. So I don't even know where that data gets sent. Uh and super feeder I think was also acquired by somebody kind of shut down. Kind of doesn't really work uh either. So that leaves us with one service left over that we're pinging uh which is called blogs or below.js. Uh, so every time you **[15:43]** know you're publishing a piece of content, you know, pings are getting sent by your site to, uh, Pingmatic, those go off to blogs. Does anybody want to guess who owns blogs? That's right. It's automatic, uh, which is Matt's company. So, every time you publish a piece of content on your site, it sends a ping off to WordPress.com and to automatic that says, "Hey, I've published a piece of content." This is extremely valuable data, right? they now have a map of every WordPress site and all the content that's getting posted **[16:13]** everywhere. Uh that is not good for privacy and it's also not achieving the user aim here. This is not actually helping any search engines kind of keep their index up to date. So again, let's replace it. Let's not just replace it with our own kind of system. Let's replace it with something better. And it turns out there is a something better for this. It's called index now. It's an open standard that was created by search engines uh themselves including Microsoft Bing uh which feeds data into a lot of other search engines, right? They make their index available. Um and this is a kind of decentralized uh sort **[16:45]** of protocol. So a bunch of search engines join in on this uh you send a ping off to one uh and it it kind of copies that out uh to all the others as well. This is an actual standard that gets used by actual search engines and so it's actually useful. Um and this is again fixing that kind of user uh issue as well. So we're actually improving the functionality that we have not just protesting or you know uh replacing it for the sake of it. So this again is just one of those other pieces. So if we have a look at all of these services uh **[17:17]** that are getting sent uh to WordPress.org and you'll also note as well there's uh Gravitar is in here as well. Gravitar is a great service but it is run by automatic. It's worth noting that um we can start thinking about the replacements for all of these services uh and come up with something that looks a little like this. Now I recognize this is not the most readable slide in the world um but you can see on the left hand side uh there's a few items that now run entirely on your site so data never gets sent anywhere else. We preserve privacy. We kind of keep all of that stuff within your site. And then **[17:48]** for the other kind of aspects we use the industry standard uh kind of best technology that exists. ideally things that we don't have to run ourselves. You know, like John said, it is a pain kind of running actual services uh and having to keep things up. Um certainly I get annoyed when I get pinged on my phone that the site has gone down. So we want to run as little as possible. Now we do have to run some in particular the news and the community events, we have to run APIs for that because no one else has that data. But for things like PHP version checks, well what if we talk to PHP.NET directly, right? They have an **[18:19]** API. uh for things like emoji for example, rather than using who knows what, we can actually use a common CDN that people might actually have cached uh in their browser. So this is all of our kind of technical independence work and we launched this back in June as part of our kind of first uh public version that we released which was 0.3. Um, but let's zoom in on one part of this that I haven't kind of touched on, which I guess is a kind of very big part of this, uh, which is plugins, uh, and **[18:51]** themes. So, in this diagram, uh, you you might be able to read at the top, maybe not, it's a little small, sorry. Um, we swap this out, uh, for a service called Aspireress, which is a mirror of WordPress.org's packages. Um, but, you know, we kind of want to get a little bit more complex than that. We don't just want to kind of copy what was there before. We want to actually improve the ecosystem. So this is where the second kind of half of fair comes from. This is package management. So every time you think packages that means plugins and themes. They're kind of the same. Um and **[19:24]** so we call them packages just to kind of make that a little more simple. So in this diagram in in kind of your brain you might be thinking okay yeah when I get plugins and themes I download those from the WordPress.org repository. I install those. you know, maybe I open up the WordPress dashboard, I hit, you know, add plugin, those sorts of things. You know, packages come from WordPress.org right now, particularly since September and since, you know, people have started realizing that depending on.org, it's maybe not the best thing in the world. Um, a lot of hosts have started running mirrors of **[19:54]** this. And so, actually, your sites might be getting it from a mirror of WordPress.org instead, right? Not actually going to WordPress.org, but practically speaking, that is still controlled, you know, the same way, right? it's all part of this one uh you know big entity. But this mental model of thinking about you know we download our packages from.org is wrong right? You know I'm sure that everybody here has downloaded at least one plugin from GitHub right you might have premium plugins that you're you know buying from a third party installing those etc. Uh you might have private code as well. So **[20:25]** the reality really looks something like this, right? So we have multiple sources, uh, multiple repositories that we're getting all of our packages from. Once you install those, uh, you know, maybe you're only installing it once, then you have to go download it again each time. But in a lot of cases, these packages now start to include their own self updater, right? So they might update directly from GitHub. Uh, they might uh, you know, talk to the premium plug-in API, check your license key, and also see, you know, are there any updates available? So um in practice **[20:56]** what this means is uh a lot of our sites are talking to a lot of these sources a lot of these repositories uh all the time but this model has some problems. So the first one is that third party packages can't be installed right when you go and find something for the first time you have to go find it somewhere else. You can use Google, you can go check GitHub, you know, maybe you use something like WP Beginner to find out uh you know what uh kind of great plugins are available. Uh but you have **[21:26]** to go get those from somewhere else and then bring them into WordPress. That is really not a great user experience, right? The best user experience would be I open up the plug-in screen, it shows me all the plugins that are available, I search for, you know, SEO or something like that, uh and I go and install that. Great. That's uh that's solved my problem. So this is a bad user experience uh more than anything else, right? It's also terrible for developers because uh you know you have to kind of think about how that whole system is **[21:56]** going to work. Uh and everyone is going to build a solution to that differently, right? You might include a self-updator kind of library in your your code. uh you might include something like uh ed software licensing or GitHub data uh or or those sorts of libraries or you might go build something yourself. So this is you know really inefficient for us as developers but it's also really inefficient for your site right because now it's got you know if I have 20 plugins installed it might have 20 different update kind of processes that **[22:27]** are built in uh all talking in different ways to these kind of external services. It's also hard to stay safe, right? Uh we want to make sure that users are protected against malware, against, you know, bad uh kind of plugins that might be masquerading to be something else. Um you know, we know WordPress doesn't always have the greatest kind of security reputation and a lot of that comes from the entire ecosystem, right? Um the the WordPress ecosystem is massive. Uh you know, we talk about, oh, there's 60,000 plugins. Well, that's just on WordPress.org, right? you know, **[22:59]** there are probably the same number again, if not more, posted elsewhere. Um, but everything that's not on WordPress.org, we can't kind of keep users safe from that, right? There's no there's no kind of middle ground here. It's either fully moderated on WordPress.org where, you know, there's a team that kind of looks at these things or there's nothing, right? There is just whatever guarantees some random website has kind of told you. Uh, that's no human uh review, uh, no automated scanning, no vulnerability checking, all of those sorts of things. And even the mirrors that I mentioned before could **[23:30]** also be unsafe as well. Right now, mostly you tend to trust your host, but you know there's nothing that says that they couldn't, you know, change a package for example um uh without you knowing about it. And the fourth problem is that developers can't even offer a solution to this, right? The WordPress.org policies say you can't go and get updates from somewhere else. Uh you can't, you know, actually build a another kind of store or something into WordPress itself. So there's not even a a good kind of solution to this that **[24:01]** users can kind of uh go and use. Um and there's some good reasons for that, right? Like some of the safety issues, right? We don't want people installing things outside of.org. Um you know, because they could be unsafe. But the reality is users are already installing these things anyway. Um and so, you know, how how could we actually keep them safe recognizing the reality of the situation? So if we go back to this kind of world view, you know, this is how the system already works, right? This is not a a system that we're trying to create. This **[24:32]** is what you know, your sites uh what the ecosystem already looks like. So we already have a bit of an idea of this alternative of, you know, not.org, right? Some sort of decentralized thing. So what if we could like adapt this into some sort of system? What if we could standardize this? Uh all of these parts here, you know, they have different names, but fundamentally they're the same, right? they are repositories. They are places where we go to get these packages from. Um, now does this system already exist? Is there something similar to this? Uh, you know, maybe not **[25:04]** even in packages. Maybe there's just uh, I don't know, some sort of analogous system elsewhere. And it turns out that this system is kind of like the web itself, right? You open up your browser, you go to a website, that browser talks to that website. There's no other third party involved. you know, you don't need to uh go ask for permission to go view a website. You just open it up, type the URL in and and you're good. But this also kind of, you know, reveals a part of the same problem that we have as well, right? How do I find a website in the first place? You know, if I don't **[25:34]** know that the facebook.com exists, how do I go and find the Facebook? Um, turns out we kind of solved this problem for the web already, right? We invented search engines, uh, which allow us to say, I've got a vague idea of what I'm looking for. um you know, go and show me all the solutions for this. And that's great. That's exactly what users are looking for. And we also, you know, if you're very old school web, you might think about like a web index or a web directory, right? Um that might even point the way for I don't know what I'm looking for yet. I just want to see what's available. So, uh we've kind of **[26:07]** solved this concept uh to some degree. We use a search engine the first time to discover brand new things. And then once we know about those, once we've found out, hey, these exist, we can just go directly to them uh from then onwards. So we can take that model and we apply it to the system that we have, right? We have the repositories uh that are hosting all of these uh packages. We can introduce a new kind of search engine or what we call a discovery aggregator. Um now this is a way for users to find **[26:37]** these packages, right? This can go out and it can kind of index the web uh in a way, right? you can go and find all the repos that exist. Um, and users can use this discovery aggregator to find out uh about new packages. Um, now again just like that web analogy, once the sites have found these packages, they can still do updates uh and they can talk directly to the repositories which again is the system we already have. The great thing about this though in particular is that there can be multiple of these **[27:08]** discovery aggregators, right? Just like there are multiple search engines, right? You might use Google and Bing and uh is it pronounced Kaggi? I have no idea how you pronounce it. Um but there are all these sorts of alternatives that are available and that is one of the beauties of the web, right? Is that there is no central authority over the web. There is, you know, this ability for things to exist next to each other, right? We can have a WordPress and a ghost. We can have a Google and a Bing. Um and this allows for competition between these, right? We can see which of these is the best. users can pick, **[27:40]** hey, I like this one better. You know, maybe the search results on this engine are worse, but there are other benefits, right? Maybe it's an eco search engine or something like that. So, you know, this sort of decentralized system is something that we're already used to with the web. But this system also has some challenges of its own. The first of these is analytics and feedback, right? We rely on things like how many installs does a plug-in have uh or what is the rating on that? And that gives us a kind of idea of you know is this a safe **[28:10]** plugin? Is it a good plugin? Right? How do we keep track of that in a decentralized world where there's no kind of you know central authority telling us uh what to think about these things. The second is moderation and safety. So already kind of mentioned that you know the the safety of these sorts of things can be quite difficult uh when we're looking at uh you know things that are hosted elsewhere. How do we still kind of retain that and how do we keep that you know over time basically um and in a decentralized system as well how do we make sure that users are getting the right package **[28:40]** right the one that they intended to get and not someone that is just pretending to be someone else right the web does have this problem right you know we we all hear about fishing attacks all the time um how can we go about solving those sorts of things so if we take a look at the first of these problems um part of the issue with with getting analytics uh and finding ing out what things are used is that there's no kind of central place that knows about the entire system, right? Uh there's no one kind of entity that we can ask for all of this data. But what if we introduce **[29:14]** something like this, right? You know, we can have a decentralized system but have this analytics kind of central piece off to the side. Now, if we do that, we need to make sure that it's critical that that is not a key part of this. The whole system can work without it. Um but it allows us to kind of learn some things about it. And this is quite similar to say on the web, you know, we have the Chrome user experience report, right? That tells us about how Chrome users are using the web. It's not a critical part of the web. Uh it's not necessary for any any parts of the web to actually function. Uh but it gives us **[29:44]** really interesting and useful data about the web by being this kind of side service. Um by having this as a a kind of independent third party as well, it can be kind of neutral, right? it can collect this data uh and it can give that out to uh you know anybody who asks for any of that data. Um that also makes it really easy uh for users to opt out uh of any uh kind of data collection if they want to. So then secondly, how do we tackle the problems of moderation and safety, right? Uh how do we keep users **[30:17]** safe no matter where they are kind of pulling packages from? Turns out a lot of smart people have already been thinking about this. uh and in particular, Blue Sky uh has uh created this what they call a stackable approach or what we can kind of think of as layers of of moderation where you can have multiple services that you subscribe to that each give you different information about you know the things that you're looking at or or etc. Um they call this a labeler because it basically says hey here is uh you know a user account or here's a post or something like that uh and here's some **[30:48]** labels that we might apply. So that could be like oh this violates copyright or this is unsafe or you know it can also be positive things right you know this has been verified to be true or something like that. So we can take that same kind of system and apply it uh to ours. So again we can have a service off to the side called a labeler um which you know tells us about all the packages that might exist. Now to do that we have to have unique ids for all the packages that we have. Um but once we have that then any uh kind of labeler can exist and in fact we can also have multiple of **[31:19]** these labelers right we might have one that checks for security scanning right um or we might have something that checks for copyright violation we might even have human moderation involved in here as well you know your web host could offer a labeler that says hey this is compatible with our platform or it's not. Um, and an important point here as well is none of this goes to the repositories, right? You can't control how people are talking about you. You can't control, you know, uh, if you're a hotel, you can't control, uh, you know, how people talk about you on Trip Adviser, right? These are independent **[31:50]** parties that are checking, verifying, and labeling. Um, so this system allows us to introduce this concept of moderation and safety into a decentralized system. And we can also give users the choice on how to handle some of these things, right? You know, you might want to say, "Hey, look, I don't want to install anything that's unsafe or insecure. Um, but if it's just incompatible with the platform, well, I can probably work around that. So, I'll ignore those warnings." Right? Again, borrowing from the blue sky concept here of this **[32:20]** decentralized labeling. Um, so this offers users a even better experience. So, this is the approach that we are taking with fair. It is built-in moderation. So we are going to offer a moderation service of our own uh with some sort of human review uh and allow additional layers of that kind of labeling to be built on top. Um we're going to uh kind of make this available to the ecosystem uh and users can kind of pick exactly what they want to use, how they want to build their experience. **[32:50]** Um and part of this as well is that we can also make a choice on who we federate with, right? You can have a fully open network. Um, but particularly when you're a small network, you might want to keep that controlled. This is something Blue Sky did as they kind of built out the decentralized aspects. Uh, and it's something that we're doing as well. So, we're taking a cautious approach to federation. We're only going to bring in repositories that we know are kind of trusted as we start up. Um, and then expand that to a fully open system over time once we build additional trust layers on top. So, this approach helps us solve both the kind of **[33:21]** moderation problem and the provenence problem uh, as well. making sure that users have the right package. But we need some additional kind of solves for the provenence problem, right? Making sure people have the right package. So one of these that we can take again from that same social media concept where you know this is a very common thing uh is to use uh domain validation right users already have a concept of a domain being correct or something like that. Um and so we can build on top of that with DNS verification. Um we can also show the **[33:52]** host information, right? we can show where is this coming from and is that something that I as a user might want to trust. Now, not all users are going to care about this. That's fine. We need to make sure that we're kind of giving them the information though so that they can make a decision. Um, and by giving everything a completely globally unique ID, we can make sure that no matter where this moves, uh, you know, we're always kind of keeping it the same. We know exactly uh that it's the same package. Um, and this is something where we can expand this over time. So we have a working group that is working specifically on trust uh to try and **[34:23]** build out additional layers and additional systems on top of this. So if we put the whole system together, this is how this kind of looks. We now have our discovery, we have our labeler, we have our analytics service, and we have a bunch of repositories as well. And our sites talk to all of these all the time. So it's a very decentralized system. Practically speaking, we are going to run one of each of these uh kind of nodes as well. So we'll run a discovery service. We'll run a moderation service. We will run a repository. So you don't have to go and **[34:54]** you know run all the infrastructure yourself. And we'll also run the analytics service. But anybody can go and run a repository. And there's nothing that says that you can't run any of these as well yourself, right? You would just set them up next to ours instead. So this is how we build this decentralized system. But if we're going to run these services, you know, we have to prove that we are kind of worthy of this trust as well. So you know that's where we then get into our organization and the structure how the project kind of comes together basically. So how do we make sure that we are trustworthy if **[35:25]** we're going to run these things? How do we create open transparent governance which supports and balances both the community uh and the commercial with structures to make clear consensus decisions? Well, we start out just like any other open source project. You know we maybe have a couple of of groups of people who are working on different things. you know a couple of repositories some releases of code within those and the contributors as well. But then we take the best practices that the ecosystem uh and uh the kind of community have already been thinking about right we are **[35:56]** not alone in this uh you know just like uh the concept of drees kind of reaching out to make sure that nothing is an island we should have a look at what's happening in open source it turns out there are models for this uh there is a particular model uh where we have a technical steering committee so this is people who are common contributors who are well-known contributors to the project uh get the ability to become organizers, you know, you can kind of think of them as kind of the committers, right, in WordPress. Um, but this includes things like documentation, etc. **[36:27]** as well, uh, where, you know, they're not necessarily writing code, but they're still technical contributions. These then form the technical steering committee, which is, you know, the group of older contributors, and they get to vote on who leads that group. So, we have three co-chairs, that's myself, uh, Mika Epstein, and Carrie Dills. Uh, we were elected a couple months ago, uh, onto our second term. um to kind of lead this body. Um for the most part, we still make decisions just like any other open source project uh where it is all consensus based. Um but then the **[36:58]** co-chairs can kind of break any ties if needed. We introduce the business side of things as well. Um so we can have corporate sponsorships uh through a governing board and this is all handled as part of the Linux foundation. Um where we kind of keep the the business side, you know, a little separate to the technical, right? We don't want any one party to have any you know strong control over the technical side. Uh and we want to make sure that uh you know this is this is all kind of handled nicely or still providing us feedback and and you know money at the end of the day right these things cost money to **[37:30]** run. So we want to have this sort of corporate structure. So that governing board can fund the project. They can provide guidance and they can also do things like outreach right. So that includes marketing efforts or running events or uh you know PR or things like that. But they don't have to handle that all themselves. We can still have our kind of volunteer teams uh as part of that as well. So we kind of can build everything together uh in that way. So if we put all those pieces together, it's going to look a little complex. Uh we have this big diagram. Um and this is **[38:02]** a bit complex, right? But this is what you know kind of mature large projects look like. And that complexity is there for a reason, right? We're separating out the business side from the technical side to make sure that we keep that kind of independence. This is a model that is used by Linux Foundation projects. Uh and it's used very widely throughout the ecosystem. Um so this is something that you know there's a lot of experience kind of doing. So how kind of does it practically come together? We have several different projects and loads of contributors. We **[38:34]** have three primary projects in the fair project. We have the plugin which you can go and install on your site. Uh we strongly recommend doing so. Uh you can go and uh download version 1.0 uh which just came out this week. Um there's also the mini fair repo. So if you are publishing uh plugins or themes, you can run that yourself to kind of make them available in the fair ecosystem. And then we have our discovery aggregator uh which is Aspire cloud. So they kind of join forces with us and we're all working together as part of the fair project. All of these are obviously open **[39:05]** source. You can download them, you can run them yourself and try them out. We have some other projects uh kind of around as well. Aspire Explorer uh allows us to browse that uh kind of just on the web fair.pm/packages. Uh we have a website and we have uh those other aspects that I mentioned the labeling or moderation service and the analytics service coming soon as well. So you can find us on GitHub uh github.com/fairpm uh or you can find uh us on Slack at uh **[39:35]** chat.fair.pm open Slack. Anybody can kind of join in and we would love to see anybody and everybody there uh as contributors. So thanks very much. Amazing. Thank you, Ryan. Uh, we do have a couple of minutes. Do you want to take a couple of questions? >> I'm happy to take questions. Yes. >> Okay. Another dangerous moment. Who's got some awesome questions? I saw this hand first. Oh, we got a lot of **[40:05]** questions for this one. Okay. Here. Thanks. Thanks, Ryan. That's really clear. Help me think about how the fair project works. Uh, one thing not mentioned that's quite a dependency in the WordPress ecosystem is W packages. Uh, you know, uh, I'm a developer. I install most things through composer and never touch the plug-in install screen. So is there going to be a way for the discovery aggregators to expose that to composer? >> Yeah, absolutely. So it's something that we've been thinking about. There's uh I didn't mention but on our GitHub there's a whole discussion section. There's actually already a discussion about the **[40:36]** integration with composer. Um certainly for you know a lot of developers including myself composer is the way that we install packages. So something that we're very very kind of focused on thinking about. um we haven't built anything to integrate with it yet, but the way that the system works is actually partially modeled on composer. Um so including things like requirements for other packages and things like that. So we hope to be able to bridge those in the future and make it available both ways effectively. Um and that would still give you you know all the benefits of the fair system, the fully decentralized system. It's worth noting **[41:07]** as well actually composer is not really decentralized by default. So it relies on a service called packagist um which is uh you know a great service but it is a central service um and so there are ways actually that we can potentially benefit the composer ecosystem out of this as well. Now we don't have the technical solution for all of this yet but I think we have an idea of how we want to head there. So, you know, if you're interested in uh you know, seeing how that might work, we encourage you to contribute and come join us. And, you know, even if that is just discussing ways that it might work and and thinking about possibilities, we are open to all **[41:37]** contributions. You know, we would love any help uh that you might be able to offer. >> Amazing. All right. Perfect. Courtney >> Courtney Robertson at GoDaddy. Um as a contributor to fair one, can we ask those that participated to stand for just a >> Yeah. If if you're in the fair project, please stand up. I think I know who you are in this room. It includes Courtney who's asking the question. Uh so it's a bit of a plan. >> Come come talk to us later. That'd be great. Uh other question. Uh now that version one has been deployed. Um and **[42:11]** we're going to probably see an uptick in organizations that are testing this and plug-in theme companies getting out there. There's a lot of work to be done. Could you share maybe any specific areas that we're seeking contributors in? Not just come contribute whatever you could contribute, but like what are the big needs that we have right now? >> Yeah, good question. Uh I mean to be honest uh I'd almost throw the question back to you cuz uh uh cuz I feel like maybe you have things in mind, but uh we have a huge amount of work to do. You **[42:41]** know, we are building an ecosystem from the ground up here. Um and we're designing this not just for WordPress, by the way. This is usable by any CMS. I'm looking at a couple people in particular. Um, we are designing a very big system here and so there's a lot to do, right? We have not started on the the labeling services yet. We know kind of how we're going to head that direction. Blue Sky is open source so there's a lot that we can take from them, but there are things that we'll need to solve ourselves as well. So around moderation and trust, there's a huge amount of work uh yet to be done there. Um, and as well with the kind of policy aspects, right? You know, what do **[43:12]** we trust? How do we kind of think about that? So that that is a big area we could use contribution. Um we need more documentation right we have been heads down focused on actually building a lot of this and documentation is something that we have been working on but it still very much needs help and you know with all documentation uh you know the the kind of more you know eyes that you have on that the more aspects that you can consider uh you know the better that that is um so there are certain people in the audience uh who are on the documentation working group I'm looking **[43:43]** at Courtney and Taco uh you you can both uh kind of help So that is something that that we very much do still need help with and a lot of the core protocol itself, right? We're we're going very rapidly through building this and we still need more help building out the plug-in and Aspire Cloud and Aspire Explore. We only launched 1.0 this week. Uh right, I thank you. Thank you again. Plant clap. But uh uh yeah, we only tagged 1.0 on Tuesday. So you know, we are just starting this long journey. As I **[44:14]** mentioned, I've been around WordPress for more than 20 years at this point, right? I am very invested in this ecosystem and I don't want to see it, you know, uh, go anywhere bad, right? I don't want to I don't want it to collapse or anything like that. So, you know, I'm very invested in making sure that this is a project for the long term. And I think all of the contributors, you know, many of whom are, you know, long-term contributors as well, are all very invested in this ecosystem. So, we see a long journey ahead of us. uh and we're looking for loads of contributors and we want to grow this over time and uh yeah we we **[44:45]** think that we have the right structures in place but we also think that we haven't got everything perfect so you know we'll have to iterate on that as well. >> Amazing. Okay. Uh another round of applause for Ryan. >> Thank you.