What’s Fair is FAIR: A Decentralised Future for WordPress Distribution

Slide 1

Slide 1 text

© 2025 Ryan McCue, CC-BY-NC fair.pm What’s Fair is FAIR: A Decentralised Future for WordPress Distribution Reinventing WordPress package management for plugins and themes – with transparent governance and open to all. fair.pm

Slide 2

Slide 2 text

© 2025 Ryan McCue, CC-BY-NC fair.pm ● VP of Product Human Made & Altis ● TSC Co-Chair FAIR Project ● WordPress Core committer, security team member Ryan McCue Formerly ● Creator & Co-Lead WordPress REST API ● Creator & Maintainer Requests for PHP ● Project Lead SimplePie

Slide 3

Slide 3 text

Slide 4

Slide 4 text

Slide 5

Slide 5 text

Slide 6

Slide 6 text

Slide 7

Slide 7 text

© 2025 Ryan McCue, CC-BY-NC fair.pm 1) Technical Independence ● A full replacement for WordPress.org ● Improved privacy and updated functionality 2) Package Management ● Plugin and theme installation and updates without central servers ● Freedom for developers to choose their host ● Same focus on usability, improved security Organisation: The FAIR Web Foundation A series of the Linux Foundation. ● “Technical Side”: Technical Steering Committee and Working Groups ● “Business Side”: Board and Technical Advisory Committee Shipped in June Launched this week!

Slide 8

Slide 8 text

Slide 9

Slide 9 text

Slide 10

Slide 10 text

Slide 11

Slide 11 text

Slide 12

Slide 12 text

Slide 13

Slide 13 text

Slide 14

Slide 14 text

Slide 15

Slide 15 text

Slide 16

Slide 16 text

Slide 17

Slide 17 text

Slide 18

Slide 18 text

Slide 19

Slide 19 text

Slide 20

Slide 20 text

Slide 21

Slide 21 text

Slide 22

Slide 22 text

© 2025 Ryan McCue, CC-BY-NC fair.pm Browserslist The modern replacement ● Industry standard Browserslist is used in tools like Webpack, Babel, and many others. ● Checks run entirely on-site No browser data ever leaves your WordPress site, preserving user privacy. ● Actually maintained Browserslist works automatically using browser usage data and official APIs.

Slide 23

Slide 23 text

Slide 24

Slide 24 text

Slide 25

Slide 25 text

Slide 26

Slide 26 text

Slide 27

Slide 27 text

Slide 28

Slide 28 text

© 2025 Ryan McCue, CC-BY-NC fair.pm IndexNow The modern replacement ● Open industry standard Spearheaded by search engines including Bing (whose data also feeds DuckDuckGo and others). ● Decentralised Each IndexNow member accepts pings and forwards them to all the others. ● Actually useful IndexNow is actively supported by real search engines in use today.

Slide 29

Slide 29 text

Slide 30

Slide 30 text

Slide 31

Slide 31 text

Slide 32

Slide 32 text

Slide 33

Slide 33 text

Slide 34

Slide 34 text

Slide 35

Slide 35 text

Slide 36

Slide 36 text

© 2025 Ryan McCue, CC-BY-NC fair.pm Problem #1: Third-party packages can’t be installed. Plugins and themes can only be updated from these third-party sources, not installed directly. The only place new packages can be installed from is WordPress.org. This creates a terrible user experience, since there’s no place you can ﬁnd all of the available plugins/themes at once.

Slide 37

Slide 37 text

© 2025 Ryan McCue, CC-BY-NC fair.pm Problem #2: Every plugin works differently. Every plugin developer has to invent their own solution to this problem by hijacking the WordPress update system. This creates a burden of work for developers to build their own solution, or bundle one of the many, many libraries. It also can hurt site performance with duplicated code doing the same thing.

Slide 38

Slide 38 text

© 2025 Ryan McCue, CC-BY-NC fair.pm Problem #3: It’s hard to stay safe. Plugins and themes from external sources have unclear moderation and safety checks applied to them. While WordPress.org doesn’t catch every problem, it has a moderation team who can monitor and manage plugins. This moderation doesn’t apply anywhere else. Mirrors of WordPress.org could also be unsafe, since there’s no guarantees that packages haven’t been changed.

Slide 39

Slide 39 text

© 2025 Ryan McCue, CC-BY-NC fair.pm Problem #4: Developers can’t offer or use alternatives. Every developer has to use WordPress.org if they want to get access to new users via the plugin install screen. This gives WordPress.org an immense amount of power, going against the goal to Democratize Publishing. As we’ve seen, WordPress.org is apparently not an official WordPress Foundation website, it’s just a personal website. This places control in one person’s hands. There’s no ability for developers to run their own hosting and move off of WordPress.org

Slide 40

Slide 40 text

Slide 41

Slide 41 text

Slide 42

Slide 42 text

Slide 43

Slide 43 text

Slide 44

Slide 44 text

Slide 45

Slide 45 text

Slide 46

Slide 46 text

© 2025 Ryan McCue, CC-BY-NC fair.pm New challenges 1. Analytics & Feedback If packages are hosted anywhere, how do we know what’s popular? How do we get reviews? 2. Moderation & Safety How do we block malicious or vulnerable packages? 3. Provenance How do we make sure users are getting the real package, not a fake one?

Slide 47

Slide 47 text

Slide 48

Slide 48 text

Slide 49

Slide 49 text

Slide 50

Slide 50 text

Slide 51

Slide 51 text

Slide 52

Slide 52 text

Slide 53

Slide 53 text

© 2025 Ryan McCue, CC-BY-NC fair.pm Our Approach: Built-in Moderation & Cautious Federation Problem 2 & 3 1. Moderation by FAIR Turned on for all as a baseline level of protection. 2. Other labelers can be used too Allows an ecosystem to form. 3. Careful choice of which repos to federate with Expanding over time as we add more layers.

Slide 54

Slide 54 text

© 2025 Ryan McCue, CC-BY-NC fair.pm Problem 3 Provenance Making sure users get the “real” package 1. Domain Validation Tie plugins directly to domains, like social media handles 2. Host Information Shows where it’s hosted. 3. Unique IDs Globally unique IDs can be veriﬁed. 4. And more…

Slide 55

Slide 55 text

Slide 56

Slide 56 text

Slide 57

Slide 57 text

Slide 58

Slide 58 text

Slide 59

Slide 59 text

Slide 60

Slide 60 text

© 2025 Ryan McCue, CC-BY-NC fair.pm Technical leadership Frequent contributors are nominated to the Technical Steering Committee (TSC). Every member of the TSC is able to vote in leadership elections and other votes. The TSC elects three co-chairs for staggered terms. Decisions are made with lazy consensus where possible, with co-chairs able to mediate and make a ﬁnal call where needed.

Slide 61

Slide 61 text

© 2025 Ryan McCue, CC-BY-NC fair.pm Governing Board “The Business Side” Paid sponsors through the Linux Foundation comprise the governing board. The governing board advises the project direction, helps to review the roadmap, and directs funds towards project efforts. FAIR is part of

Slide 62

Slide 62 text

Slide 63

Slide 63 text

Slide 64

Slide 64 text

Slide 65

Slide 65 text

© 2025 Ryan McCue, CC-BY-NC fair.pm FAIR Package Manager Projects The components making up the network FAIR Plugin User-installable plugin for your WordPress site, connects to the network Includes technical independence functionality Mini FAIR Repo Self-hostable repository to host your own packages on a WP site. Integrates with Git Updater, others coming soon. github.com/fairpm/fair-plugin github.com/fairpm/mini-fair-repo AspireCloud Mirror of WordPress.org. Transforming into our discovery aggregator. github.com/aspirepress/AspireCloud

Slide 66

Slide 66 text

© 2025 Ryan McCue, CC-BY-NC fair.pm Other Projects & Places to Contribute AspireExplore Public directory for all the packages indexed by AspireCloud. Future: Analytics Service Centralised, neutral analytics service providing data equally to everyone. fair.pm Website Documentation, news, and policies from the FAIR team. Future: Moderation Tool Our built-in moderation service, building off Bluesky’s Ozone labeler project. fair.pm github.com/fairpm chat.fair.pm fair.pm/packages

Slide 67

Slide 67 text

Slide 68

Slide 68 text

© 2025 Ryan McCue, CC-BY-NC fair.pm License These slides and any original materials such as diagrams are licensed under CC BY-NC 4.0. Credits Photo Credits Slide 1: Photo by Markus Spiske on Unsplash Slide 49: Diagrams and screenshots from https://docs.bsky.app/blog/blueskys-moderation-architecture and https://bsky.social/about/blog/03-12-2024-stackable-moderation Slide 53: Photo by Joe Dudeck on Unsplash Photo by NASA on Unsplash Slide 66: Photo by Shane McLendon on Unsplash