We didn’t give up! We’ve pivoted efforts - focussing more on the technical part of the project, and expanding into other ecosystems. We’re currently working with the Typo3 community to bring FAIR there, as well as expanding further.
reply(AMA, I’m a co-chair and wrote much of the core protocol.)
For wordpress plugin and chrome/firefox extension,
the most common channel of attack is -- the developer just sold the plugin for money.
replyThey sold the developer key, the domain name, the organization or whatever needed to publish that plugin as updates.
That would be a really interesting platform for an npm alternative. I think the incentives are a little better aligned than in the WordPress ecosystem, but maybe not enough.
replyAssuming that the majority of repositories will be malware with SEO hooks, how would one locate a safe directory using only a search engine (as opposed to whispered tips from coworkers, etc)? I don’t see how proliferation of repositories improves things for users. (Certainly, it does serve up the usual freedom-from-regulation dreams on a silver platter, but that’s value-neutral from a usability perspective.)
replyThe aggregators can choose who to index, and we operate one at fair.pm - the idea being that you only federate repositories that meet requirements, and can defederate those which are bad actors. (End users can install directly from repositories though, and can always switch the aggregator if they find the rules too restrictive - no lock-in.)
replyWhat aggregators? How would I locate fair.fm? Is there a Whole Earth Guide to Repositories that’s human-curated? What is the published malware incidences and non-responses rate for each repository?
replyAn "aggregator" is the thing that discovers and lists repositories - the equivalent of a search engine. Anyone can operate one themselves, and we (the FAIR project) operate a canonical one on our website, which is fair.pm.
reply[dead]
replyIs FAIR wordpress-only?
replyCurrently the reference implementation is for WordPress, but we’re working to bring it to Typo3 and other software at the moment too. The protocol is comprised of a core plus per-software extensions when needed.
replyI see. Are there other similar projects for other ecosystems? I guess more broadly I'm intrigued by the idea of the decentralized supply chain concept, the way you described it sounds like it was more broadly applicable.
replyYou can check out the protocol at https://github.com/fairpm/fair-protocol - anything WordPress or Typo3 specific are in the extensions, and the core protocol is self-contained. We'd love to work with more ecosystems to bring FAIR to them, and we've already had some discussions with others including maintainers of popular (dependency) package managers.
reply