A directory is a distribution channel with a policy

What the Directory Actually Was

When Joomla separated from Mambo in August 2005, it inherited not only a codebase but an ecology of third-party software built around that codebase. Extensions — components, modules, plugins — were already circulating, and their developers needed somewhere to be found. The Joomla Extensions Directory, known almost universally as the JED, became that place. It was never a repository in the sense of hosting files: it listed extensions and pointed users toward the developer's own download location. That distinction matters. The JED held no binaries, but it held something more durable — visibility. If your extension was not listed, it effectively did not exist for the majority of Joomla users, who had no other practical way to discover third-party software.

That asymmetry gave the directory's operators a structural form of power. Every policy decision about what could or could not be listed was, in practice, a decision about who could participate in the extension economy. The JED was never described as a legislative body, but it functioned as one for anyone trying to build a business on Joomla.

The GPL Requirement as a Listing Condition

The sharpest expression of the directory's governance role came through its licence policy. The question of whether Joomla extensions were legally required to be released under the GNU General Public License had been contested for years. The GPL's terms spread to derivative works, and the project's position — eventually supported by an opinion from the Software Freedom Law Center ↗ — was that extensions running inside Joomla were derivative works and therefore had to carry GPL-compatible licences. That position, however, took time to harden into a listing requirement.

While the legal argument was being made and the community was arguing about it, the JED continued to list encoded extensions — software shipped through ionCube or Zend Guard in a form users could not read or modify. This was not an oversight; it reflected genuine disagreement within the project about whether the licence requirement was enforceable, or whether it was commercially realistic to demand it. The directory's tolerance of encoded code was itself a policy position, even if it was experienced as an absence of one.

When the project eventually moved to require GPL-compatible licensing as a condition of JED listing, the effect was immediate and structural. Vendors who had built businesses on proprietary Joomla extensions faced a binary choice: relicence, or lose their primary distribution channel. Some relicenced. Some left. Some relicenced the PHP while keeping template assets under separate commercial terms — the "split licence" approach that the project accepted as compliant, a compromise that itself required the directory to decide what it would and would not count as sufficient. Each of those decisions was governance, made by the people running the JED review process.

Review, Enforcement, and the Limits of Volunteer Labour

The JED's review process was operated by volunteers, which shaped what it could realistically police. A submitted extension was checked against listing criteria — licence declaration, category accuracy, whether the extension functioned as described — but the JED could not audit code for security, could not verify that a declared GPL licence was being honoured in practice, and could not monitor extensions after listing. An extension that passed review in 2009 might, by 2013, be abandoned, unpatched, and running on thousands of sites without the directory reflecting any of that.

This was not a failure unique to Joomla. The WordPress plugin directory ↗ operates under comparable structural constraints: volunteer review, post-listing monitoring that is reactive rather than systematic, and removal as the primary enforcement tool. What made the JED's situation distinct was the explicit claim that listing implied a licence check. That claim raised user expectations that the directory could only partially meet, and the gap between the claim and the reality became visible whenever a listed extension turned out to be shipping proprietary code under a false GPL declaration.

The enforcement mechanism was removal. A developer found to be violating listing conditions could be delisted, which was meaningful punishment — losing JED visibility was commercially serious — but it was not a legal remedy, and it was not applied with anything like systematic auditing. The JED relied heavily on community reports, which meant enforcement was uneven: well-watched extensions in popular categories faced more scrutiny than obscure ones.

That asymmetry gave the directory's operators a structural form of power.

Commercial Tiers and the Question of Paid Listings

The directory also made decisions about commercial extensions and paid-listing arrangements that complicated its identity as a neutral discovery tool. For a period, the JED offered featured or highlighted placement for a fee — a common practice across software directories but one that introduced a visible tension between the directory as a public good and the directory as a revenue mechanism for Open Source Matters, the nonprofit that held Joomla's assets.

Whether paid placement distorted what users found is a reasonable question without a clean answer. Featured extensions appeared more prominently, and there was no systematic evidence that featured status tracked quality or security. The arrangement reflected a real problem — the JED needed resources to operate and improve — but it also made the directory's governance legible in a way that pure volunteer operation did not: money was being exchanged for visibility, and that is a policy choice with consequences for the extension economy.

What the Directory Made Possible and What It Could Not See

Over the years since 2005, the JED catalogued thousands of extensions across an enormous range of categories — e-commerce, forms, access control, migration tools, SEO, social components. This variety was one of Joomla's genuine competitive strengths during its peak adoption years; the extension economy made the CMS adaptable to use cases its core team had never anticipated. W3Techs has tracked Joomla's share of CMS-powered websites over time, and the correlation between directory growth and adoption growth in the platform's early years is visible even in rough terms.

The directory also made decisions about commercial extensions and paid-listing arrangements that complicated its identity as a neutral discovery tool.

What the directory could not see — and therefore could not govern — was the long tail of installed extensions on live sites. Once an extension left the JED and landed in an installation, the directory had no reach. When a vulnerability was found in a listed extension, the JED could delist it, but delisting did not update any existing installation. The security implications of that boundary are documented in the CVE database ↗, where Joomla extension vulnerabilities appear regularly, sometimes in software that had been removed from the directory years earlier and was still running on production sites.

The JED was, in the end, a gate, not a fence. It controlled entry into a visible distribution channel, and that control was real enough to shape the extension economy, the licence debate, and the commercial structure of third-party development around Joomla. It could not control what happened after the gate. That limitation is not a design flaw — it is an inherent property of a directory that lists rather than hosts. But it is worth being precise about what kind of governance the JED actually exercised, because the two are easily confused, and the confusion has costs.