# All's FAIR in Love and WordPress  ## Episode metadata - Episode title: All's FAIR in Love and WordPress - Show: Uncached Podcast - Owner / Host: Pressidium - Guests: [Karim Marucchi](https://share.snipd.com/person/9c18f6d2-a78c-4fd2-b49c-ec663226514a) - Episode publish date: 2025-09-04 - Episode AI description: Karim Marucchi, CEO of Crowd Favorite, dives deep into the FAIR initiative aimed at revolutionizing WordPress by decentralizing software distribution. He discusses the critical issues around security and governance, highlighting how a federated system can prevent vulnerabilities. The conversation also touches on collaboration within the community, innovative plugin verification measures, and the transformative potential of breaking down walled gardens. With nearly 300 contributors involved, this movement seeks to enhance the resilience and integrity of the WordPress ecosystem. - Duration: 28:23 - Episode URL: [Open in Snipd](https://share.snipd.com/episode/d43248bb-ce58-4ed5-b6eb-1200140affe7) - Show URL: [Open in Snipd](https://share.snipd.com/show/4df3c307-64fe-4bdc-a172-41c82e3a3114) - Export date: 2026-02-17T23:34:52 ## Snips ### [WordPress.org As A Single Point Of Failure](https://share.snipd.com/snip/b5db71b3-3ecb-49e2-972e-c65e962cf18a) 🎧 02:44 - 03:10 (00:26) <iframe src="https://share.snipd.com/embed/obsidian-player/snip/88cbe87b-b6bd-445e-98af-b31ae4ab1d75" width="100%" height="100" style="border: none; border-radius: 12px;" sandbox="allow-scripts allow-same-origin allow-forms allow-popups allow-clipboard-write" ></iframe> - WordPress.org is a technical single point of failure for the wider WordPress ecosystem. - Federating repositories will increase resilience and help WordPress remain the CMS reference for decades. #### 💬 Quote > WordPress.org today is a technical single point of failure. > — Karim Marucchi Karim Marucchi on why federation is needed for WordPress resilience #### 📚 Transcript **Karim Marucchi:** today is, depending on which number you pick, 42% of the internet or 65% of the CMS market, blah, blah, blah. It's really important. And it's become sort of mission critical in a lot of enterprise spaces where we work. And WordPress.org today is a technical single point of failure. --- ### [What Federation Actually Means](https://share.snipd.com/snip/9731c13e-3cb7-4c28-8113-457d17c93426) 🎧 03:42 - 05:20 (01:38) <iframe src="https://share.snipd.com/embed/obsidian-player/snip/32b5b667-9c21-489f-88d1-198e711f4e99" width="100%" height="100" style="border: none; border-radius: 12px;" sandbox="allow-scripts allow-same-origin allow-forms allow-popups allow-clipboard-write" ></iframe> - Federation means multiple nodes and mirrors that can serve plugins and updates instead of a single central server. - This enables hosts, companies, and institutions to run mirrors and curated services while preserving a shared ecosystem. #### 💬 Quote > What federation means is being able to have multiple nodes, being able to say that X, university major company Y, hosting company Z, all can put up mirrors of the shared resources and also create their own versions for their own customers of add-on services. > — Karim Marucchi Karim Marucchi explaining federation versus centralization #### 📚 Transcript **Karim Marucchi:** Right. Well, think of it this way know a lot of us know that the uh the internet was made in a way that if for some reason one route for data to get through is cut off it finds another route to get there it's self-repairing so to speak um the idea here is that right now wordpress.org is the only place to get all these services and this infrastructure. And what federation means is being able to have multiple nodes, being able to say that university major company Y, hosting company Z, all can put up mirrors of the shared resources and also create their own versions for their own customers of add-on services. Right now, we've spent the last 22 years in a world where plugins, there's WordPress.org for the free plugins. And then the ecosystem for paid plugins gets very complex and it's very hard to manage for regular user. It's time to bring those two together. So with a federated system, you can start having what we call aggregators or trusted individual entities that are running the right checks and saying, I trust these plugins. And you can start having it. So there's not only a single point of failure, but you can start to branch out and have a more rich ecosystem. --- ### [Require Vetting And Signatures For Nodes](https://share.snipd.com/snip/f18b14ba-3c02-45c9-8f7f-7a327fd60598) 🎧 07:16 - 08:41 (01:25) <iframe src="https://share.snipd.com/embed/obsidian-player/snip/9c011d51-214c-4a1f-84d7-98e9c9cfce7e" width="100%" height="100" style="border: none; border-radius: 12px;" sandbox="allow-scripts allow-same-origin allow-forms allow-popups allow-clipboard-write" ></iframe> - Don't assume anyone can join the federated network without checks; nodes must apply and meet security and technical requirements. - Enforce signing, provenance, and acceptance protocols to prevent bad-faith mirrors or malicious copies. #### 💬 Quote > You'll have to apply and be accepted and go through a protocol. And there's technical requirements and security requirements. > — Karim Marucchi Karim Marucchi on access controls and security for FAIR nodes #### 📚 Transcript **Christos Paloukas:** Because doesn't work like that. **Karim Marucchi:** Correct. Correct. So what you were saying, and this really is a catch-all answer. Most of the people out there who are going, oh my God, this is going to be a security nightmare, are people who quite literally have only been in the WordPress space. They are sheltered. Oh, **Christos Paloukas:** okay. **Karim Marucchi:** and package managers and understanding the idea of um the protocols around um provenance and making sure that things are signed um don't have a problem with this because this has been being done for lennox for over 30 years yeah decades um on the other hand just because let's say fair was up and running perfectly right now, we're at next week we're launching 0.4. Okay. **Christos Paloukas:** 1.0 **Karim Marucchi:** is our goalpost. Let's say we're past 1.0 today. Um, you and I might want to put up our own repositories, might want to put up our own aggregators where we're pointing to repositories, but to do that, you'll have to apply and be accepted and go through a protocol. And there's technical requirements and security requirements. --- ### [Existing Package Practices Reduce New Risks](https://share.snipd.com/snip/4c01dfdf-3386-48e6-a7b9-3470cff21d5d) 🎧 07:18 - 08:23 (01:04) <iframe src="https://share.snipd.com/embed/obsidian-player/snip/51cc843c-878c-4b96-a494-59071a2405ff" width="100%" height="100" style="border: none; border-radius: 12px;" sandbox="allow-scripts allow-same-origin allow-forms allow-popups allow-clipboard-write" ></iframe> - Package managers and signed provenance already solve many federation security fears; Linux has used these protocols for decades. - WordPress-only observers often miss this historical context and overestimate novel risks. #### 💬 Quote > Most of the people out there who are going, oh my God, this is going to be a security nightmare, are people who quite literally have only been in the WordPress space. They are sheltered. > — Karim Marucchi Karim Marucchi contrasting WordPress familiarity with broader package manager experience #### 📚 Transcript **Karim Marucchi:** Correct. Correct. So what you were saying, and this really is a catch-all answer. Most of the people out there who are going, oh my God, this is going to be a security nightmare, are people who quite literally have only been in the WordPress space. They are sheltered. Oh, **Christos Paloukas:** okay. **Karim Marucchi:** and package managers and understanding the idea of um the protocols around um provenance and making sure that things are signed um don't have a problem with this because this has been being done for lennox for over 30 years yeah decades um on the other hand just because let's say fair was up and running perfectly right now, we're at next week we're launching 0.4. Okay. **Christos Paloukas:** 1.0 **Karim Marucchi:** is our goalpost. Let's say we're past 1.0 today. Um, you and I might want --- ### [Bring Paid Plugins Into Federated Search](https://share.snipd.com/snip/46d511ac-a045-4c50-96a9-0ebaa93a729c) 🎧 10:14 - 10:57 (00:43) <iframe src="https://share.snipd.com/embed/obsidian-player/snip/092edb60-3dd0-431b-9172-910a6d91bc91" width="100%" height="100" style="border: none; border-radius: 12px;" sandbox="allow-scripts allow-same-origin allow-forms allow-popups allow-clipboard-write" ></iframe> - Allow paid plugins to participate via verified vendor repositories so they appear in in-dashboard searches. - Use verification and aggregator trust to make premium plugins discoverable and manageable from WordPress itself. #### 💬 Quote > If the Gravity Forms folks went through the process of putting up their own mini repository with their products, and they went through the process of being verified and the security getting onto the aggregators, then you could actually search directly from WordPress for form plugins and Gravity Forms would pop up. > — Karim Marucchi Karim Marucchi on integrating premium plugins into FAIR #### 📚 Transcript **Karim Marucchi:** an example for the the wordpress world most people know that i'm just going to pick a plugin like gravity forms right okay today you can't get gravity forms on word.org because there is no free version. It's a paid for plugin only. So if the Gravity Forms folks went through the process of putting up their own mini repository with their products, and they went through the process of being verified and the security getting onto the aggregators, then you could actually search directly from WordPress for form plugins and Gravity Forms would pop up. --- ### [Hosts Should Offer Curated Repositories](https://share.snipd.com/snip/c7d4395b-905f-48b2-b790-b68c03b09b3b) 🎧 11:22 - 12:41 (01:19) <iframe src="https://share.snipd.com/embed/obsidian-player/snip/e357b8cf-1c67-44e0-8bf9-a5f1e10cd2ac" width="100%" height="100" style="border: none; border-radius: 12px;" sandbox="allow-scripts allow-same-origin allow-forms allow-popups allow-clipboard-write" ></iframe> - Hosting companies should run their own curated repositories or mirrors to surface vetted plugins for their customers. - Use repository filters (e.g., PHP version) to automatically surface compatible plugins and simplify support. #### 💬 Quote > You could actually set a filter on your own repository for plugins. For my end customers, only surface plugins that are PHP 8 compatible. > — Karim Marucchi Karim Marucchi describing host-specific curated repositories and filters #### 📚 Transcript **Karim Marucchi:** exactly and you could also put up your own mirror of repositories and there's there's different levels that you could participate in right but let's say then um you have a a specific service that because of your settings is twice as fast as all of your competitors but it only works with PHP 8 code, right? So you could actually set a filter on your own repository for plugins. For my end customers, only surface plugins that are PHP 8 compatible. Okay. **Christos Paloukas:** Wow, okay. That sounds like it cuts off a layer of support that we have to build into our platform either way, because we do need that granular control per plugin and per version of each plugin basis. But that's all been built in-house, as probably with most managed request providers. Right. What **Karim Marucchi:** if you and your competitors had a shared foundational platform that you didn't have to maintain? Explain. what, so what you've built in house, right? **Christos Paloukas:** Yeah. **Karim Marucchi:** What if all of you and your competitors had a shared foundation that you didn't have to actually spend the resources to maintain that was done by the fair project. --- ### [Shared Foundation Lowers Duplicate Work](https://share.snipd.com/snip/99793485-79df-475d-81ac-aaa55a628c14) 🎧 13:09 - 14:12 (01:02) <iframe src="https://share.snipd.com/embed/obsidian-player/snip/2eb1d175-2cdf-4df1-b63d-dc7425f75a6e" width="100%" height="100" style="border: none; border-radius: 12px;" sandbox="allow-scripts allow-same-origin allow-forms allow-popups allow-clipboard-write" ></iframe> - A shared federated foundation saves each company from duplicating complex infrastructure work. - Contributing small amounts to a common project is far cheaper than building and maintaining bespoke solutions. #### 💬 Quote > What if all of you and your competitors had a shared foundational platform that you didn't have to actually spend the resources to maintain that was done by the fair project. > — Karim Marucchi Karim Marucchi on cost savings from a shared FAIR infrastructure #### 📚 Transcript **Karim Marucchi:** That's why we're all using WordPress. Yeah, **Christos Paloukas:** exactly. Good point. It is beneficial. Actually, it's amazing as hell. You're just brought to the table. Why? Because we as Presidium, a managed WordPress hosting provider, we would offload having to worry about all of that and the entire process. And we could probably, I don't know, donate, contribute rather, I'm just going to say a random number, 10 hours per week to that project rather than maintaining its own house. Right. Even if it's two hours a week, two hours a week across 20 people. You're still cutting **Karim Marucchi:** down exactly yeah and that's the reason why there seems so interesting to people is everybody's taken for 22 years everybody's taken for granted what wordpress.org could do and then anything past that they've had to build on their own right it's time to iterate it's time to evolve how we know we need this WordPress ecosystem to move forward. --- ### [Build On Existing Open Standards](https://share.snipd.com/snip/c2da2871-d6a0-4695-bdda-f7d13f46b42b) 🎧 14:36 - 15:34 (00:57) <iframe src="https://share.snipd.com/embed/obsidian-player/snip/e93671f8-77a0-4dbe-ad1f-aca509a970ef" width="100%" height="100" style="border: none; border-radius: 12px;" sandbox="allow-scripts allow-same-origin allow-forms allow-popups allow-clipboard-write" ></iframe> - Leverage existing standards and partners like BlueSky, OpenJS, and CNCF to implement federation and protocol extensions. - Collaborate with proven projects rather than inventing new untested protocols. #### 💬 Quote > Once we joined the Linux Foundation, which I know we're going to talk about, OpenJS came and said, how can we help? CNCF came and said, how can we help? ... BlueSky... added code to their protocol specifically for FAIR. > — Karim Marucchi Karim Marucchi on partnerships with OpenJS, CNCF, and BlueSky #### 📚 Transcript **Karim Marucchi:** Really it so the documents are also being released on the github of the FAIR plugin. The bottom line is that we're putting in a complete idea of how to deal with aggregators and repositories and federation. And really, we've been very lucky to be able to get a lot of good advice from our friends. Once we joined the Linux Foundation, which I know we're going to talk about, OpenJS came and said, how can we help? CNCF came and said, how can we help? We're working with Laravel developers for part of this. On the other hand, BlueSky, the BlueSky protocol, they've been extremely helpful. When we said we want to federate using BlueSky, they've actually added code to their protocol specifically for Pear. --- ### [Combine Proven Review Processes With Signatures](https://share.snipd.com/snip/3c1b4610-e7ae-427b-a09d-c94c295494c6) 🎧 18:32 - 19:55 (01:23) <iframe src="https://share.snipd.com/embed/obsidian-player/snip/bdd512a6-2e7e-4c7e-9003-c8f1e74b13e4" width="100%" height="100" style="border: none; border-radius: 12px;" sandbox="allow-scripts allow-same-origin allow-forms allow-popups allow-clipboard-write" ></iframe> - Reuse experienced reviewers and documented processes (like Mika Epstein's work) and add code signing and DID identifiers. - Implement stronger verification, signatures, and modern identifiers to improve repository security and provenance. #### 💬 Quote > We are doing everything that .org did. Plus code signatures, plus new ways of verification, plus the DID work replacing slugs and keeping that secure, plus, plus, plus. > — Karim Marucchi Karim Marucchi on improving verification and provenance beyond the current repo #### 📚 Transcript **Karim Marucchi:** are extremely lucky with a fair project. We have three technical co-chairs. So not one leader, but three leaders of the technical team. And one of them is mika epstein for the for those of your audience who don't know who that is for over 10 years mika ran the plugin repository for dot and she wrote the box too no **Christos Paloukas:** no go ahead continue i just mentioned that she wrote the document too Exactly. **Karim Marucchi:** And she has years of thoughts and documentation and experience on how it should evolve. This is our chance to implement that. So we are doing everything that.org did. Plus code signatures, plus new ways of verification, plus the DID work replacing slugs and keeping that secure, plus, plus, plus. So not all of it is unfair right now. It's getting there in the next, I think, couple of weeks is going to be even more documentation coming towards 1.0. But this version 0.4 is the first one that has true federation instead of just a mirror. --- ### [Linux Foundation Governance For Trust](https://share.snipd.com/snip/c78b5460-72c3-4e49-ae4a-27bb80f5d55d) 🎧 21:06 - 22:21 (01:14) <iframe src="https://share.snipd.com/embed/obsidian-player/snip/a3aff9ad-cea1-494a-ab70-6eafa7cfff83" width="100%" height="100" style="border: none; border-radius: 12px;" sandbox="allow-scripts allow-same-origin allow-forms allow-popups allow-clipboard-write" ></iframe> - Choosing the Linux Foundation for governance brings anti-monopoly policies and neutral oversight. - That governance model helps competitors cooperate on a central infrastructure while competing around the edges. #### 💬 Quote > The infrastructure that was put up by the Linux Foundation to create independent projects, the policies and governance bylaws that they've set up ensure anti-monopoly practices. > — Karim Marucchi Karim Marucchi explaining why FAIR joined the Linux Foundation #### 📚 Transcript **Karim Marucchi:** So we actually, before we started writing code, the first thing that we did as a group is we went to the Lenox Foundation. We spoke to a few, but really we decided early on on the Lennox foundation. And we said, um, basically the concept here is how do we create really a infrastructure that can breed trust? How do we stop any one entity, any one bad actor from being able to manipulate the system through governance, through manipulation. And the answer came by looking, like we were talking about earlier, technically, looking to Lennox for the last 30 years, they've been dealing with this stuff. And the infrastructure that was put up by the Lennox Foundation to create independent projects, the policies and governance bylaws that they've set up ensure anti-monopoly practices. --- ### [How To Contribute To FAIR](https://share.snipd.com/snip/1a6ed878-5783-4733-b4a3-b5b8153192f6) 🎧 24:18 - 25:17 (00:59) <iframe src="https://share.snipd.com/embed/obsidian-player/snip/5ca2c190-d994-49b0-8846-efed70ded813" width="100%" height="100" style="border: none; border-radius: 12px;" sandbox="allow-scripts allow-same-origin allow-forms allow-popups allow-clipboard-write" ></iframe> - Individuals can contribute code, docs, or community work via the FAIR GitHub and Slack; find public contribution paths and apply for contributor roles. - Companies can engage by contacting [email protected] or contributing staff to the project without necessarily joining the Linux Foundation. #### 💬 Quote > If your gift is in writing code, WordPress, Laravel, server infrastructure, anything on go to the GitHub repo, get in touch. ... As a company ... get in touch directly with us at info at fair.pm. > — Karim Marucchi Karim Marucchi on ways individuals and companies can get involved with FAIR #### 📚 Transcript **Karim Marucchi:** So we've got a few different aspects. Speaking about individuals, if your gift is in writing code, WordPress, Laravel, server infrastructure, anything on go to the GitHub repo, get in touch. Okay. Um, there's a, uh, publicly available plaque now available that you can apply for if you're an individual and you want to contribute code. If you're an individual and wants to work on the infrastructure, the community, the messaging, the documentation, also get in touch with us through, through Slack and through the GitHub repo. I mean, there's an email address there too that you can send, um, per request to, um, we're looking for folks to help us with content on the website that's coming. We still don't have the website up because we've been writing code on the actual system. So any individual who wants to help get in touch, we probably have something you could help with. --- ### [FAIR Initiative And Package Manager Are Unified](https://share.snipd.com/snip/17739e06-227c-487c-8910-cb6a85b37416) 🎧 26:41 - 27:49 (01:07) <iframe src="https://share.snipd.com/embed/obsidian-player/snip/43e38c52-26d4-4f1c-9492-428c15ba09ae" width="100%" height="100" style="border: none; border-radius: 12px;" sandbox="allow-scripts allow-same-origin allow-forms allow-popups allow-clipboard-write" ></iframe> - FAIR (the initiative) and the FAIR package manager (technical project) are the same effort under one umbrella. - The initiative provides governance and community while the package manager provides the technical implementation. #### 💬 Quote > There is no difference the technical project is the fair package manager for wordpress and the fair initiative is the entity the foundation that is working on fair. > — Karim Marucchi Karim Marucchi clarifying FAIR project naming and scope #### 📚 Transcript **Christos Paloukas:** What's the difference between the FAIR as a whole and the current uh project the fair package manager is **Karim Marucchi:** there something different there there is no difference the technical project is the fair package manager for wordpress and the fair initiative is the entity the foundation that is working on fair awesome **Christos Paloukas:** sounds fair **Karim Marucchi:** i **Christos Paloukas:** had to make that cheesy joke at some point i was thinking about it this whole time **Karim Marucchi:** uh **Christos Paloukas:** cool i don't have anything else to add do you have anything else to add about uh fair the initiative what's going on uh **Karim Marucchi:** no it's just i'm really excited because this is the first opportunity we've had to add off where certain infrastructures content management systems cms's have had a problem in relying only on one financial entity this is the first true open source way of applying CMS. --- Created with [Snipd](https://www.snipd.com) | Highlight & Take Notes from Podcasts