The FAIR Package Manager: Decentralized WordPress infrastructure

twapi | 161 points

Linux Foundation's announcement here https://www.linuxfoundation.org/press/linux-foundation-annou...

EDIT - HN Discussion about it here https://news.ycombinator.com/item?id=44205865

mastazi | 13 hours ago

After looking at their repos, especially [1], I think it'd probably have been better if they made a soft-fork of Wordpress with its own infrastructure instead of the current setup where they try to hijack core wordpress with alternative implementations. This approach is doomed to fail, as the core Wordpress developers would be forced by executive directives to break said mechanisms.

Also, the jkpress post by Matt Mullenwegg linked in TFA has to be one of the most unprofessional and caustic things I've ever seen someone write, and reflects poorly on his character.

[1] https://github.com/fairpm/fair-plugin

supriyo-biswas | 13 hours ago

Sad to say, but for the meantime Wordpress is a dead end at least for my personal needs.

I wrote about it in my blog [1]. It is an amazing tool with an unstable company behind.

Time will show us if the FAIR Package Manager will be able to improve the overall ecosystem status.

[1]: https://gioorgi.com/2024/liberta-come-aria/

daitangio | 10 hours ago

This is the official website for FAIR: http://fair.pm/ . It currently redirects to https://github.com/fairpm . Here's a description:

> The FAIR Package Manager is a decentralized alternative to the central WordPress.org plugin and theme ecosystem, designed to return control to WordPress hosts and developers. It operates as a drop-in WordPress plugin, seamlessly replacing existing centralized services with a federated, open-source infrastructure.

> There are two core pillars of the FAIR system:

> - API Replacement: It replaces communication with WordPress.org APIs (such as update checks and event feeds) using local or FAIR-governed alternatives. Some features—like browser version checks—are handled entirely within the plugin using embedded logic (e.g., browserslist).

> - Decentralized Package Management: FAIR introduces a new package distribution model for themes and plugins. It supports opt-in packages that use the FAIR protocol and enables hosts to configure their own mirrors for plugin/theme data using AspirePress or their own domains. While stable plugins currently use mirrors of WordPress.org, future versions will fully support FAIR-native packages.

You can try the FAIR plugin at this link: https://github.com/fairpm/fair-plugin/releases

Flimm | 10 hours ago

This is very exciting to see momentum going in this trajectory.

Kudos to all involved behind the scenes to even get to this point. Ideas are cheap, execution is hard, especially across so many disciplines, so major props for the coordination and collaboration.

tobinfekkes | 13 hours ago

Are they going to be able to maintain the volunteer team who curate the catalogue? Currently a fair amount of work goes into making sure that hosted packages do not contain malware and also add value in that they don't replicate the features of existing packages. This workload has increased recently with AI generated submissions.

ollybee | 4 hours ago

Related:

WordPress.org bans WP Engine - https://news.ycombinator.com/item?id=41655967 - Sep 2024 (490 comments)

If WordPress is to survive, Matt Mullenweg must be removed - https://news.ycombinator.com/item?id=41676653 - Sep 2024 (245 comments)

WP Engine is not WordPress - https://news.ycombinator.com/item?id=41613628 - Sep 2024 - (165 comments)

Filed: WP Engine Inc. v Automattic Inc. and Matthew Charles Mullenweg [pdf] - https://news.ycombinator.com/item?id=41726197 - Oct 2024 - (659 comments)

The ACF plugin on the WordPress directory has been taken over by WordPress.org - https://news.ycombinator.com/item?id=41821400 - Oct 2024 (224 comments)

So long WordPress - https://news.ycombinator.com/item?id=41974637 - Oct 2024 (211 comments)

WordPress.org's latest move involves taking control of a WP Engine plugin - https://news.ycombinator.com/item?id=41826082 - Oct 2024 (211 comments)

Is Matt Mullenweg defending WordPress or sabotaging it? - https://news.ycombinator.com/item?id=41872628 - Oct 2024 - (143 comments)

Mullenweg threatens corporate takeover of WP Engine - https://news.ycombinator.com/item?id=41712617 - Oct 2024 - (120 comments)

Matt Mullenweg cries foul and threatens me with legal action - https://news.ycombinator.com/item?id=41727888 - Oct 2024 - (43 comments)

Matt Mullenweg temporarily shuts down some Wordpress.org functions - https://news.ycombinator.com/item?id=42469708 - Dec 2024 - (122 comments)

WordPress Is in Trouble - https://news.ycombinator.com/item?id=42687121 - Jan 2025 (439 comments)

Matt Mullenweg deactivates WordPress accounts of contributors planning a fork - https://news.ycombinator.com/item?id=42667766 - Jan 2025 (236 comments)

Mullenweg Shuts Down WordPress Sustainability Team, Igniting Backlash - https://news.ycombinator.com/item?id=42672675 - Jan 2025 - (172 comments)

Matt Mullenweg, Automattic's CEO, Seems Bound and Determined to Wreck WordPress - https://news.ycombinator.com/item?id=42773311 - Jan 2025 - (57 comments)

JimDabell | 10 hours ago
[deleted]
| 11 hours ago

"What we are doing is adding a new distribution layer and putting our own governance on top of it."

sensahin | 12 hours ago

Any TLDR on how actually use it, from the plugin developer perspective? I was immediately put off by having to run a WP plugin just to obtain a “did”, and having to run WP to host the repository is also far from ideal.

I wish this was an evolution from bedrock, or that it used some composer infrastructure (which works with just static files).

kassner | 7 hours ago

Somewhat unfortunate naming as it may be confusing with the FAIR Principles (Findable, Accessible, Interoperable, Reusable), for which software package managers are emerging as well.

roelj | 13 hours ago

this is awesome, congrats on the launch

samename | 13 hours ago

Connection fail.

hajimuz | 12 hours ago

Hey, look at that: a foundation that offers development time without demanding it back

bravetraveler | 9 hours ago

It's unfortunate that WordPress.org has to be replaced, it requiring plugins to be gplv2 licensed has forced the ecosystem be almost fully open source.

Doubt this is going to be the case if FAIR takes over.

jacooper | 10 hours ago

Kill wordpress please, it's abomination

Coala15 | 3 hours ago

“ a federated and independent repository of trusted plugins and themes for web hosts, commercial plugin and tool developers in the WordPress ecosystem and end users.” The goal of this project is blurred. They want to move away from WP and allow commercial plug-ins. Both are very hard to accomplish. Forking WP and build a community was more transparant and easier to do. Since WP is gpl , there has for a long time been too many violations by commercial plugin sellers. You can sell your plug-in, but you must apply with the gpl terms. So release all the code. Too many plugins are malware, since code is loaded by an api call. No trust, no security and no privacy.

runningmike | 5 hours ago

I currently work for a multi-million dollar company that is completely dependent on this lumbering geriatric. A design from the turn of the century, that limits how we can configure it, modify it, test it, version it, deploy it, roll it back. A rotting piece of fruit with so many bugs and holes we need to constantly look for a newly-announced bug so we can rush to patch it so the rot doesn't spread to our business.

Even the managed hosters have barely adopted modern practices. Do you know it's actually easy to treat the database as an ephemeral, versioned object? Nobody I've talked to does. You just back up the logical database, and rename the database name in the backup to a unique string (including a version, or datestamp, etc). Now you have versioned, uniquely-named database, so you can do immutable infrastructure. Load this backup into a database server (even the "live" database server, as it won't conflict with the old db name). Start a new WordPress container and pass env vars pointing to the new database name. Now you can pair a snapshot of the code with a snapshot of the database. Upgrade or downgrade in seconds, with confidence. (that is, after you've done all the manual work to upgrade, test, and fix in an ephemeral environment)

This simple method makes operations more robust and predictable, makes dev & testing easier, and is used by.... nobody, as far as I'm aware. All the managed hosters I've seen just give you an admin portal, and a "dev", "test", and "live" instance. No ephemeral environments. No snapshots or diffs of configs or databases. Plugin upgrades are largely left to the user, because there's no way to know other than by manual testing if any change breaks everything. There doesn't even seem to be an open source project for containerizing & deploying it immutably (or there wasn't wasn't when I created one 4 years ago). Because everyone's mind is stuck in this box from 2003. Of the bad designs and cloistered practices that were passé 10 years ago.

Organisms can't evolve if they live forever. In order for CMS to evolve, WordPress needs to die. Please just let it die.

0xbadcafebee | 6 hours ago