Open Source Summit NA 2025 | Karim Marucchi & Joost de Valk

Clips
News
More from Open Source Summit NA 2025

Karim Marucchi

CEO

Crowd Favorite

Joost de Valk

Partner

Emilia Capital

Code, community and the future: 13 takeaways from Open Source Summit NA

Beyond uniting developers under shared ideologies, goals and pain points, Open Source Summit North America ignited conversations at the intersection of code, community and change.TheCUBE goes live with insights at Open Source Summit NA

play_circle_outline The FAIR Package Manager is introduced as a solution for WordPress supply chain security issues.

play_circle_outline FAIR stands for Federated and Independent Repositories, fostering innovation in the WordPress ecosystem.

play_circle_outline The significance of open governance and collaboration within the WordPress community.

play_circle_outline Future goals for FAIR include becoming a standard for WordPress and other CMSs.

Info
Transcript

Karim Marucchi & Joost de Valk

Karim Marucchi

CEO Crowd Favorite

Joost de Valk

Partner Emilia Capital

In this Open Source Summit North America 2025 segment, Karim Marucchi, CEO of Crowd Favorite, and Joost de Valk, founder of Yoast and open source advocate, join theCUBE Research’s Paul Nashawaty to explore a new chapter for the WordPress ecosystem through the FAIR Package Manager initiative. Designed in response to growing concerns around software supply chain security and centralized control, FAIR [Federated and Independent Repositories] aims to decentralize WordPress plugin and theme distribution while preserving the community’s collaborative spirit.
<... Read more

explore Keep Exploring

What is the purpose of the FAIR Package Manager in relation to WordPress? add

What is the purpose of the FAIR Package Manager and how does it improve the hosting and availability of WordPress resources? add

What is the reception and future outlook of the open source content management system mentioned in the text? add

What is the ideal future vision for the FAIR (Framework for the Assessment of Information Risk) project within the WordPress ecosystem? add

bolt Powered by CUBE AI

Karim Marucchi & Joost de Valk

search

Paul Nashawaty

>> Welcome to Open Source Summit North America 2025. My name is Paul Nashawaty and I'm covering the application development space and all things open source. I'm joined today by Karim and Joost. How you doing, guys?

Karim Marucchi

>> Good.

Paul Nashawaty

>> Good to see you.

Karim Marucchi

>> Thank you.

Paul Nashawaty

>> Why don't you guys introduce yourself to the audience?

Joost de Valk

>> I'm Joost. A couple of years ago, well, more than a decade ago, founded a company called Joost, which I sold in 2021, which was focused on the WordPress space. So I'm an SEO plugin, and I've been an investor in that WordPress space ever since. I'm doing all sorts of things.

Paul Nashawaty

>> It's used very, very frequently. It's very awesome.

Joost de Valk

>> It has been used by quite a lot of websites.

Paul Nashawaty

>> Yes, it has. Yes, it has. Karim?

Karim Marucchi

>> And I'm Karim Marucchi, CEO of Crowd Favorite. I've spent 30 years installing and managing teams that install content management systems in the enterprise. In the last 15 years I've been doing it with open source.

Paul Nashawaty

>> Nice. Nice. Well, this is the best place to be at, Open Source Summit. It's open source. You can see the excitement here is just amazing. But let's start, jump right into this because we are talking about different projects and different initiatives here. The keynotes were exploding with a lot of just announcements and things that are happening. And so when we're looking at the FAIR Package Manager, let's start there and talk about, what was the impetus to drive this project?

Joost de Valk

>> So the FAIR Package Manager is a package manager for WordPress. It's meant as a replacement for wordpress.org for the reason that we've had a couple of incidents over the last couple of years and more recently, the end of last year, where it was made very clear that we had a supply chain security problem in the WordPress space. And unfortunately, that problem came from within and we were looking at, how do we solve for that? So we had a big host being cut off from wordpress.org access, basically disallowing all of their clients to get plug-ins and themes and updates to WordPress itself at that point. And then later on we had a plug-in, it was on a piece of open source software being taken over and replaced by something else on WordPress.org. And we were looking at, how do we fix that without breaking up the entire community because we didn't want to do that, we wanted to keep the WordPress community the way it is, but just change how it's distributed. And that's how we came up with the FAIR Package Manager, FAIR stands for Federated and Independent Repositories. So the idea is that a lot of hosts when this happened, started putting up their own mirrors of wordpress.org, but you still had this central problem, this central point of, well, a point of failure in many ways. And what we're doing with FAIR is we're making all those mirrors that actually become repositories at that point, making them federate with each other so that if one of the lines is cut, we just route around it and we work just like the internet itself. Which has some added benefits because we can now also host plugins and themes outside of wordpress.org and still make them findable within the WordPress admin, so you can make premium plugins and themes findable in the admin and have an entire ecosystem around that, which we hope will foster innovation in the space a bit more and allow people to build profitable products-

Paul Nashawaty

>> Sure, that makes sense....

Joost de Valk

>> on top of WordPress.

Karim Marucchi

>> And what a lot of people don't realize is that WordPress powers more than 40% of the web today.

Paul Nashawaty

>> Right. Right, no, I realize that.

Karim Marucchi

>> It's a giant single point of failure and it's time for an evolution of how we distribute and how we update and how we create an ecosystem of products around the biggest, most successful content management system that's ever happened.

Paul Nashawaty

>> Right. Well, I mean dependencies and security concerns is incredibly important, especially when you're talking about 40% of the population using, and the ecosystem, the ecosystem's quite large. And when we start looking at, you touched on a little bit here about the federated and independent repositories and what this means. Can we just double-click a little bit down? Karim, I'm going to start with you. When we look at the Federated work models and how this is all coming together, what benefit does that offer to developers, hosts, and end users, when you think about it?

Karim Marucchi

>> So in my day job, I spend all my time with Fortune 50, Fortune 500 companies, and the cost of ownership of open source is already really the reason to come to open source as the beginning of it. But then in today's content management system, even something as simple as WordPress, we're using literally packages and containers to even do updates because it hasn't been reliable and it hasn't been something that you could actually just say, "This is going to be 100% the way we do it," even behind the corporate firewall. So with the FAIR Package Manager, large organizations are actually going to be able to put up their own nodes in front of the firewall, they could share with the entire world, if you're an open organization that wants to help or behind the firewall, if you have only a subset of things that you want to make available to your organization, you can actually do that. But also we're going to be able to actually integrate more of the commercial plugins and modules that have helped this open source ecosystem grow and be so successful over the last 22 years.

Paul Nashawaty

>> I mean, that makes a lot of sense though, because it is an open community and you have all these different plugins, you want it to grow and you want innovation to occur. So when we talk about this ecosystem, is it being well received by the ecosystem or is it-

Joost de Valk

>> I think the community was very welcoming to it. Yeah, no, the response has been very overwhelmingly positive with lots of people reaching out. And well, I mean there's been this system where basically one entity has been control of the ecosystem for a very long time, and a lot of people wanted that to change. And I think this is a good step towards us actually setting up proper governance and a system where we can all benefit a bit more from each other's knowledge and work together and also decide together where this goes instead of one person or company deciding, "Hey, we're going that way." So it's been very well received. People are very happy. We've been testing with quite a few of the distribution hosts when we started working on this, and I expect for a lot of them to roll this out over time.

Karim Marucchi

>> I'd like to add, also, think of it this way, as an open source content management system, we're competing with SaaS and closed source systems that are spending tens of millions of dollars on ease of use and onboarding. And the ecosystem, all the modules and plugins around WordPress, for the last 22 years, it's been an ongoing fight to try and make it easier and easier for the end users. So with FAIR, we're able to actually have an evolution of how this happens now.

Paul Nashawaty

>> Well, and you also meet in the development community, but their clients, where they are in their own journey. You don't have to say like, "This is a prepackaged proprietary way of doing it, do it our way or no way." It's like now you can build it the way the client wants it to be built and they can either be very mature or just starting out. So it's kind of like... I like that evolution. The one thing that I was very much interested in when I was reading through the press release was the GDPR impacts, the data-

Karim Marucchi

>> .

Paul Nashawaty

>> And also the telemetry pieces, the data. So Karim, let's start with you. What are your thoughts there on that?

Karim Marucchi

>> So GDPR has already been a big concern of how we're going to address that and really with the upcoming CRA and eventually what's going to come to the United States, as its own version of that, if we don't do something about that, WordPress is going to be left behind because as it stands today the agency installing it, the contractors installing it, the hosts themselves would all be liable for the software. So we need to have an evolution of how this works so that way we can comply.

Paul Nashawaty

>> Well, yeah, well, reporting has to occur by September 2026, I believe, and then everything needs to be complied by December of 2027 for CRA, right? But it's interesting when I have these conversations about in development world, organizations are like, "Well, that doesn't apply to us. We don't really do a lot in Europe." But it's like, "No, but you do worldwide." We don't have boundaries anymore of which space you're working in, compliance is the compliance and regulations are the regulations so you're going to box out just customers if you don't have the applications working in a certain way.

Joost de Valk

>> Yeah, and it's quite, being European, it's quite a large market.

Paul Nashawaty

>> Of course it is.

Joost de Valk

>> And as Karim said, a lot of this is coming to the US and other places in the world in maybe a slightly adapted form, but the basic underlying ideas of what this legislation does, especially if you look at GDPR, you've seen that already happen with the CCPA, and this is going to happen to these other things as well. We will have these security rules because honestly we need them because a lot of the WordPress sites are also... Well, WordPress has a pretty bad name in some ways in terms of security, not because WordPress itself is insecure, but because how it's being dealt with is sometimes very insecure. And getting better practices in that and getting more ways of figuring out like, hey, this could be vulnerable, you could do things about that, is actually very important.

Karim Marucchi

>> And coming back around to telemetry and GDPR and that data and analytics side, it's time that we practice what we preach in open source and make that data also available to the rest of the ecosystem that's creating products around. Steven on stage earlier was talking about, "Collaborate on core and compete on the edges." The only way we're going to be able to really compete on the edges and collaborate on core to truly compete with the closed source systems is if we understand those analytics and are open about it and complying with GDPR.

Paul Nashawaty

>> Yeah, there's no question. But it's not just GDPR, it's not just one location. I agree with you, I think this is a global impact. I mean, we see this with executive orders for in software development. I mean, this is happening across the world, so we have to be aware of it. And I think that the adaptability and scalability is key, especially when we start looking at AI. AI is going to just continue to make the project a bigger project if we look at it. So one final thing I want to kind of talk through is the... When we looked at the press release, we talked about the share packet repository and how that's working. What are the next steps for FAIR? How is it moving forward in terms of community engagement, sustainability, and then the ecosystem overall, what are your next steps? What are you thinking? Where does this go?

Karim Marucchi

>> Do you want to talk about the team?

Joost de Valk

>> Yeah, so we have a big team of people already, which we'd like to expand of course, because who says no to more people, but we need to give that team and the wider community, the governance and the home, which is why we came to the Linux Foundation in the first place. Like, "Hey, we've done all this in the WordPress world, we are not really good about at this whole governance stuff because we've never done this before, let's find a partner that we can do this with." And the Linux Foundation has actually been great at helping us figure out, how do we set this up and how do we make this work for everyone? So part of it is setting up that governance, which we're literally doing right now and in part have already done. Today is us going out and funding funders that fund this foundation.

Karim Marucchi

>> So today we announced the open call for Linux Foundation members to be able to join and help us found a foundation to have a direct fund to expand FAIR. So we are asking Linux Foundation Company members to join us on the governing board and to come and help us have open transparency governance to guarantee what hopefully will create the best open source CMS for the next generations.

Paul Nashawaty

>> So we're sitting here a year from now in Minneapolis, and we're having a conversation of what's happening at the next OSS. You kind of gave a roadmap of where you want it to go, what would be the ideal goal of saying, "Hey, these are the things we accomplished," a year from now?

Joost de Valk

>> So I think part of this is a bit of a political question in our ecosystem. It depends a bit on who joins and who doesn't join, and whether we get to do this with all of us together or there are parties that remain separate and we have to do this outside of that a bit. My ideal situation is where we all come together and do this together and FAIR becomes the de facto standard for the WordPress ecosystem, and then maybe other ecosystems after that because we've set it up to be compatible with other CMSs if possible in the future. I would love for us to all be together and say, hey, we've actually gotten to a next step in the supply chain security of our project, we've added all these things that modern projects require, code signing and all these things that WordPress right now doesn't have. We've made the project CRA compatible and we've actually made it better for everyone in doing so. That's the future we strive for.

Karim Marucchi

>> And I'm going to take the tactical side of that. I'm going to say I'd like to see the hosts adopt this and help us expand it. I'd like to see, we're talking to some major American universities to put up publicly available nodes. We are getting help from Bluesky with the AT protocol for the Federation. We'd really like to work with, there's a package management project here at Linux Foundation, we'd like to work with other projects. So we're hoping that in a year we've created such a rich ecosystem around what needs to be the next open source content management system that we're able to say, "Here's an open place for these small businesses that are doing these modules for these large hosting companies," for the enterprise that's using WordPress to save massive amounts on licensing, to actually understand that there's a 20-year future in it without worrying about what the next company cycle is.

Paul Nashawaty

>> Yeah. And I like it because growing with them, that's really, really great. I really think that this is the right direction. It sounds like you set up the foundation for this to happen, the roads are already paved, you're going through this paved thing, it's following those paved roads is going to be the key.

Joost de Valk

>> It is. And I think what really is important for the WordPress community is also to become part of the larger open source ecosystem, because we've definitely not been a very good player in that wider ecosystem and I think this is an opportunity to do that.

Paul Nashawaty

>> Absolutely. Joost, Karim, thank you for your time today. This has been really great. I know you're busy, you have a lot in front of you, a lot of work to do here so I won't keep you much longer for this.

Joost de Valk

>> Thank you.

Paul Nashawaty

>> But thank you again for being on the show with me today. And thank you for joining me today. My name is Paul Nashawaty and I'm coming to you live from the show floor at Open Source Summit North America 2025. And thank you to the audience for watching theCUBE, the leading source in tech news.