The FAIR Package Manager

Simon Kraft: Why did you post before Christmas then?

Joost de Valk: Because Matt closed WordPress.org for the holidays. So WordPress.org was suddenly closed and he sat in his post announcing the closure. He didn't know if he would have the funds to reopen it.

Karim Marucchi: We were instantly getting emails from clients asking if that meant that they wouldn't get updates.

Joost de Valk: Yeah. So we did our posts. We got a bit of response from the ecosystem already. People reaching out like, hey, we're all so worried. We have our thoughts. Then there was a post on WordPress.org about us doing a fork, which we weren't doing. And then we got a lot more reach out from people around the ecosystem.

Karim Marucchi: At the time, before, we were speaking about the need for federation and the need for the idea around how do we create an ecosystem that everybody can work with. And as he said, when we first posted, we thought we were relatively alone. But then these other groups all started quietly reaching out. So there was only a few right up until Matt posted the JK Press post. That sort of pushed it over the edge and the outreach became immense.

Joost de Valk: Yeah. And then we started basically looking at, okay, so who's here? What do we have? And how are we going to work together? So we worked together with these groups. These groups became, well, in a way, one group. And we had a lot of prolific people that were building cool stuff. And you've seen now the chairs, Ryan, Mika, and Carrie. And they led their team. And we were building, like, what is it that we need to want to replace the .org ecosystem without replacing WordPress itself? And that's what we built. So that's what FAIR is. It's a replacement for the .org ecosystem. A federated replacement is the idea so that people can run their own repository as if they're a host and not be reliant on mirroring wordpress.org, which is always going to be a problematic approach. It also allows for plugins to be hosted outside of wordpress.org, which has lots of benefits because it means that we are now making all those plugins findable in the backend, which means that you can have commercial plugins be found in the backend of WordPress for the first time. We fixed some other issues in the process, now compatible with the Cyber Resilience Act, so that we can actually do security in a proper way. And even more importantly, it's much more compatible with the GDPR, because it turned out that there were a lot of requests to WordPress.org that actually could be replaced with just simple things on the client side. So there were a lot of requests that were sending data from every WordPress admin user to WordPress.org that didn't need to exist. And we fixed all that. And that is what FAIR is now. So but it is an alternate distribution system for WordPress.

Karim Marucchi: And if I could, it's important to mention that when we, Yost and I say we, we don't mean us two. This is a large group of groups. There's companies, there's individual contributors, there's some very well-known people in the WordPress space. And really, it couldn't have happened this fast without some of the foundational work that the Aspire press team did when they were looking to create a mirror originally. So all these groups coming together were able to create this this quickly. So the we is a very large group, and the reception we've received from the hosts and the folks that we've talked to has been amazing.

Simon Kraft: So you've talked to different companies, you mentioned hosts, I guess there are some others in the mix as well. They're not part of the announcement that we heard tonight, right?

Joost de Valk: No, we did not announce any companies. We will at a later date.

Karim Marucchi: It's no secret that the hosts started looking at risk management the minute this happened between Automatic and WP Engine. Different hosts have tried different things. They've been doing their own thing. So it makes sense to try and bring the community back together rather than let the fragmentation keep happening.

Joost de Valk: What we did announce tonight is that we did all of this and then put it under the Linux Foundation as a project under the Linux Foundation, which means that we arranged for proper governance for all of this. We have a TSC, that is a technical steering committee, that is chosen from the community that leads this project, and then we'll have everything around that that is normal within the Linux Foundation, so member companies, etc. Basically a system like openjs or cncf or any of the other open source foundations that you may know which i think is a huge step for our ecosystem because we've never had that option before.

Simon Kraft: But is that the answer if we're talking about governance because i don't think that's like the holy grail of fixing all governance issues.

Joost de Valk: I don't think there is a holy grail of fixing all governance issues to be honest i wish there was but um it's.

Karim Marucchi: A step in the right direction and it's a model for the rest of the community to look at.

Joost de Valk: Yeah. When we were talking about this, one of the discussions we had is, do we need to reinvent this all ourselves? Because setting up governance is actually a lot of work. Now, I'm happily joined by Karim because he has done a lot of the legal, looking at the legal docs a bit and preparing and fun, like, what would this look like? But that's not something that you do on a whim. And the Linux Foundation has been doing this for decades. So using that, their blueprints, their ideas, is actually very useful and helps us all into looking at how do we do this. If you look at the entire open source ecosystem, there's actually not that many of these large foundations. A lot of the larger open source foundations, as you know, are underneath the Linux Foundation or underneath Apache. And with the GPL that we're pretty much bound to because of all the stuff we're doing, Apache was not an option. So then you end up here.

Simon Kraft: Circling back to the technical side of things, you said it's not a fork.

Joost de Valk: No.

Simon Kraft: What is it then?

Joost de Valk: It's two things. It's a plugin on the one hand that changes where WordPress gets its updates and changes some of these other requests into other things. And it's a server-side component that runs a mirror or no, it's not. Well, it's not a mirror. It's a replacement for WordPress.org. It has all the plugins from WordPress.org, but it also has stuff from outside. Hybrid mirror thing yes and it can also be its own thing so it doesn't have to be a mirror you can just shut that part down if you want to so you could have one of the things that a large corporation might do is say hey we only allow these 40 plugins to be found in our in our ecosystem because these are the 40 plugins that we have vetted for our sites and then they could have an entire system where people could set up their own wordpress sites and could only pick from plugins that they've pre-vetted which in the corporate world could be very useful and actually the fact that you can filter these things and change a bit how these things work it's also very useful for hosts so as i was talking to larger hosts around the world one of the requests that i got a few times was hey we'd like to restrict the plugins that people can install by which php version they support because we want to move away from 7.4 to 8.2 and we'd like to get away from plugins that only work on 7.4 this is very doable but we have never up until now put these things into the hands of hosts as a tool and we can now.

Karim Marucchi: And in the corporate example some of the clients that we work with would love to stop using containerized updates all the time they'd love to be able to quite literally say, There's going to be a period of time between when a non-security release is released for our different teams to vet the software, and then we'll make it automatically available through the standard WordPress system to our corporate tree.

Simon Kraft: What does it take for me as a private person to use all of that? Can I just install the plugin and do something with it?

Joost de Valk: Yes, you could.

Simon Kraft: Even if I'm not at a hoster that...

Joost de Valk: No, so we also have a server running that has all this. I will say that I hope a lot of hosts will just offer this, because I do think that that is better for everyone in many ways, because it makes the ecosystem a lot stronger. And it also divides the cost of running all these servers by all the hosts. So it's one of the things that was mentioned a few times, like there's a high cost to running WordPress at all. There is some optimization that could have been done there that we've already been doing in this process. But this is a much more, much better optimization of that for everyone involved.

Karim Marucchi: And to be clear, this isn't in competition with. As we said on stage, we are inviting Automatic, WP Engine, the other hosts to do this together. The idea was to bring the core, if you will, the beginning concept forward so that the community could move forward together, not as separate independent pieces.

Simon Kraft: Where are we going from here?

Joost de Valk: That's a good question. My hope is that we will be joined by everyone, and I mean very literally everyone, and that we all together will start using this and maybe porting some of it back to WordPress core and bringing some of the governance ideas that we have over to a larger part of our community. That would be my ideal outcome, but there are many possible outcomes, and I honestly will have to see for a part. I expect a lot of hosts to start picking this up because a lot of them are already running their own mirrors or doing their own thing, and this makes that a lot easier. And I expect, interesting for you and I in Europe, a lot of European hosts to say, hey, this is a GDPR friendly version of WordPress. This is actually a step forward for our clients. And we will take advantage of that.

Simon Kraft: Is there anything you're worried about?

Joost de Valk: There are always a lot of things to worry about in this regard. I think that the biggest worry we have is that this will be misconstrued as an attack on WordPress, which it's not. It's our very, very hard try to do something that benefits us all and keeps the community together.

Karim Marucchi: The biggest problem we have is the possibility of a slowdown of where this community and ecosystem is going over the next two years. We're trying to bring folks back to the table.

Joost de Valk: I honestly think that if nothing happens, will have, the question is, do we still have WordPress five or 10 years from now? And I think that that's the biggest risk to all of us.

Simon Kraft: So maybe to wrap this up, a final question. Why are you doing this?

Joost de Valk: It's not for a lack of things to do. I think we came into this for different reasons, but also for the same reason is that we love the community. And honestly, I was looking around me and going like, okay, we need to fix this. Who can do this and who can speak about this openly?

Karim Marucchi: And for me, it's now been more than 30 years that I've been working with content management systems, and almost all of them have had a bell curve of success. This represents the opportunity of taking all the wonderful work that has been done and not losing it. From when Matt started the project to the ecosystem and the community that there is today, there hasn't been a single content management system that I can find that has had a successful break from being maintained mostly only by one commercial entity and still maintained an open source direction successfully. So imagine a world where we can make the WordPress project, the true operating system of the open web because there is also an ecosystem of companies that are invested in maintaining that infrastructure, not just a few.

Simon Kraft: Okay. That sounds really interesting. Where can people go to learn more about all of this? I know there's a domain.

Joost de Valk: Fair.pm, which currently redirects to our GitHub.

Karim Marucchi: Again, the last few months, we've been very focused on the ecosystem side and the code side, with the teams working very hard on both those areas. So we have a little bit of catch-up to do on the community side.

Joost de Valk: And the marketing side.

Karim Marucchi: And the marketing side, right.

Joost de Valk: Yeah.

Karim Marucchi: Because again, this isn't a commercial thing. We are offering this to this community. Everybody knows how to deal with it at a github repository and it doesn't need a website or slack or any of those other things today it just needs to be looked at and contributed to and thought about how it could help this ecosystem.

Simon Kraft: I guess it'll get there we'll finally have a website and stuff cool anything else you would like to share before we wrap things up.

Joost de Valk: No thank you for having us yes.

Simon Kraft: Thank you both so much.

Karim Marucchi: Thank you i'm.

Simon Kraft: Curious to see where this is going.