All right. I'm going to get started. Perfect timing. Hi, everyone. My name is Michael Winser.
And I realize I should have looked at my slides and mirrored like the gentleman said because
I'm not paying attention. Let me see if I can do that. I can't see where I am. With a volume.
So one of the interesting things about package management is there are no packages to go
away. The problem just gets accumulatively bigger. Layers of sedimentation to the end of time,
new versions, new packages, and God help us with AI people writing out new packages even
more is just going to get deeper and deeper and deeper. MPM of course is a special contributor
to this universe. So just to put it in some concrete things, this is not the biggest registry.
And if you look hard, you can figure out this registry rhymes with must or baits or something like that.
There's a lot of data. It's going to be a number that stands out here as kind of like the
odd number on this picture. Anyone? Seven. Seven human beings. Two of which are kind of paid
because alpha mega. The rest are volunteers. Anybody feel comfortable about that?
Right. This is on the order of Google. Do decade or so ago. Let's look at the math here.
So one of the problems that people have is they actually conflate open source software
and open source infrastructure. And package managers and registries are one kind of infrastructure.
Ecosystems is another, right? So critical public good, get every get that freeze and beer,
love it, freeze and speed. Yeah, freeze and poppies. Well, that's actually cost money. You have to
take carry poppies and we have the problem in both cases. But the cost per use for open source
software converges towards zero. The more people using it, it doesn't cost more, the effort to
multiply. A cost per use on packages. It goes up towards infinity, especially as we start
asking more of the package systems. So these are not good pictures. So like that, about per year,
10 trillion dollars. Thank you for helping get the data. For perspective, I want to take a guess at
a large, widely used service. Generally thought it was like one of the biggest things on the
unit, what their traffic is pre year. Say Google is less. Now, this is aggregate across all the
package registries. But I just thought, thank you Mike. This is run by, you know, on the order of
25, 30 people across a bunch of disparate systems, each of which is an annoyingly different
and reinventing the same wheels. So this was it. Like, okay, how many queries? 5.9 trillion.
Okay, so we got some really scary things going on here. So let's play a game. Okay, this is when
Michael remembers to go switch to the cool news slide and can't navigate a keyboard to say this
life. Does anybody remember the game's family feud? All right, so shout out what do, what, what,
what, what are the costs? Where, where does someone the cost come from? Anyone?
Ben with, great. Okay, yeah. I'm going to pretend I can type.
All right, I'm going to stop. Yay, wait a go. Okay. Storage. Storage. Okay, I'm going to save
us time. Oh, wait, it was here. Storage costs. Anyone else? What? Not, they don't do that much, actually.
Okay. But let's go with abuse. Okay. Or Mike's favorite. Sorry, right? Or shall we talk about
malware? Yeah. There we go. We got that. Okay. Um, I'll just work our way down this list. You're
publish support. You know, when people publish, what do they do? Mike, what's the first thing
to do? Lose their goddamn accounts, right? You actually do fix bugs on this stuff, right? Do
you occasionally add features? You do. What comes last? Anyone want to guess what comes
last on this list? What's that? Doc, you don't even know this. Come on. No, that's a
little payment here. What? No, no, that was sort of in the bug fixes. How about we talk about
security? Oh, no, no, no. All right, I think I've made my point. Um, try to go back to this.
Okay. So, um, when we start talking about how we're going to pay for all this, right?
Everybody breaks into ban with jail. We should charge for downloads, right?
Charge for bandwidth. It's costing all that money, right? Some of the graphs show a screen like that.
It'd be great, right? What happens if you start charging for bandwidth?
Everyone's going to cash, right? Not bad. Mike's going to get you.
Sorry, yeah, right? But from my perspective, the gap here is not just a balance problem,
because in fact, Mike, how much do you spend your money from PIPI on bandwidth each year?
It's donate. It's zero. Yeah. Thank you very much to Fastly. Back, let's just have a little
moment of applause to Fastly, right? And Brian here running sonotypes,
Nathan Central doesn't get a penny from Fastly. In fact, he's the other way around. He's actually
subsidizing PIPI with the money he spends on, uh, that he's not really well. It's a circle.
Foundation membership. So, if you donate to the PIPI, Python software foundation or the
REST foundation or become a member of some of these things like that, some of their budget
goes towards this, right? A disturbing large amount of the work that actually keeps these things going
and moving us towards security comes from Alpha Omega and STF, right? Pause rate there. That is
discretionary. Year by year, we're hoping keep going, not built into the model. And so, if I lose the
optics war is one year, Mike is screwed. So, we're point, all right? And then a lot of incondonations
fastly, WS like that, keep the infrastructure going, all right? Tokensia, good luck with that.
So, let's talk about money. Money is awkward, right? In open source, we start charging for this
stop and I'm like, well, it's free. We're supposed to be here for free. We got it this for free.
Great. Good luck with that. It's not ending well, right? Uh, there's some links in this deck to,
a deeper report with all kinds of analysis that Claude produced some incredible charts for and
like that. But the curves look like this, costs income, right? We've already crossed the line,
we're living on borrowed time. So, one of the awkward things is people like, well, we're
a charity. We're not supposed to charge for things. This is a list of charities that charge for things.
Is it reasonable to go to university? Well, some countries here in Europe, I acknowledge,
you can go to university for free. Thank you. It's awesome, right? So, I realize that that message
doesn't always work as well here as it might elsewhere. But at the other day, it is entirely
reasonable to charge for services. In fact, if you don't, people tend to abuse them. Isn't that
what's happening right now? Brian lives a particular joy with some companies that felt that
may even central is a perfect way to publish every single thing that ever happened to your package
a thousand times a day until Brian calls you up and says, what the fuck? So, this is normal.
So, let's talk about how we might start charging for revenue streams. And let's see what could
possibly go wrong. So, let's say we start like the pricing unit was bandwidth. What will happen?
Well, we already established that one. I stole my own words. We'll cash. What if things
are going to happen if you start charging consumers like the iTunes model? You pay per package.
Do the 99 cents per package and you get to use it to the end of time. How's that going to play out?
Well, first of all, the package reviews are going to hear from the package maintainer saying,
well, I get 50% or 70% of that. So, now that and the cost of dealing with all those
customers and paying money like that, who asked Apple about how much money they spend keeping their
customers happy at some level and advertising? It gets weird, right? But more importantly,
there's no DRM here. This stuff is free. So, here, can I copy your left pad, please, right?
That will happen all the time. Let's say we charge, oh, I type it. I apologize. I'll fix this
if they don't. This is producers. So, now you're a publisher of package. We should charge you for the
fact that we're giving you a jump bandwidth and things like that, right? This will go great, right?
Oh, sorry. This is, I'm sorry. I got it right. This is consumer's redo subscription model, right?
Mike, can I borrow your Netflix account? I need to download them, build my new package, right?
Charge publishers? Great. Announcing shitty ass company over here now has their own dedicated
package registry for the packages from them. You as a consumer will now have to know that whole
space and of course they're going to run it really well and really securely it's going to be awesome,
right? No. Right, exactly. Fragmentation, bulk organization, whatever phrase you want, right?
One of the popular concepts and we are working to is because there are legs here
is to do things like enterprise features, enterprises care about their namespace, a lot.
They care about the fact that when Bob or Mary could use a package working at food corp,
right, that when they leave food corp, they don't keep the keys to the package with them
at belongs to the company. It's a reasonable thing, but not actually universally available today.
So that's great. We could do that, right? It'll be great, right? Yeah, it'll be awesome.
They're not really dying over this. Nobody's paying for it today. They're not like beating
a path to Mike's door saying, if you do this, we'll give you a $10,000 a month, said nobody ever.
So, anybody got better ideas? Great. The mitochondria of our ecosystem, right?
Think it through. You'll hate the ads there, right? So looking ahead, right, we have
AlphaMega has been running a set of conversations with package registry folks for the past year.
Honestly, half of it is just getting ourselves used to the concepts, this talk summarizes a lot of things
that they actually contributed to the conversation, how we reasoned about it, think about it,
and more diverse models, specifically so that as the Evan Flow of how it works out and how people react
to it changes, we're not waking up one day going, whoopsie, that model didn't work as well. They've
worked around us and now we have no money, right? When AlphaMega funds in particular staffing roles
like Mike, we have a hand here, Mike, and if any of us were funding here, please hear your hands.
Thank you very much, Marty. When we fund those people, we budget for two years, which isn't
a very long time in OPEX world, specifically so that if we don't win the OPEX wars in our particular
funding organizations and they decide not to fund us this year, that we don't have to pull the rug out
from Mike and Marty and others like that, right? That's a big deal. So, oh, that did something wrong.
I've locked my laptop. So, I would invite you again, this QR code will get you this
deck, it's also published on the Faustem site now. I did a bunch of deeper stuff, literally just
firing up with Claude and having a good time asking it to produce ridiculously cool looking
charts that I never would have bothered to do. But go take a look at the data, dig in,
understand it yourself, and then by all means, come and join us. We'd love to have you in the
conversation here. It's not a private club of conversation, but this is a topic that has historically
been taboo a few years ago. I even said, like, I talked about this and remember the thing in D.C.
And awesome person. I like very much, God, I'm saying, this cannot be.
This changes too a little bit now, right? But I mean, this is part of the change that we all have to
think about. And I'm here to start that conversation, and hopefully others will help figure it out
finish it. So with that, thank you very much. Here's the promise QR code.
My time. I think I have time for questions, too. I do. I'm not from Philippe. Sorry.
Philippe is verboten. Mirrors. Right. That's just that you broke it into bandwidth jail.
Way to go. If you do mirrors, you solve the bandwidth problem, but you haven't solved the revenue
problem. Is going to revenue when you have mirrors? No, you're literally you're missing the
most important point. It is not about the bandwidth. They're not spending any money on bandwidth
today, but the problem is they don't have enough money to spend on a very security features that
we all desperately need to stop being a bunch of idiots in PLM installing food when it's malware
intensive or whatever. It is not, repeat after me. It's not about the bandwidth.
Okay. Mirrors would be great. You should all be caching. If you're bringing stuff into your
supply chain today, and you don't have an in-house cash for all the stuff you're using,
you're a goddamn idiot. You're begging to be screwed by the next colors.js or whatever,
somebody throwing a tantrum. So if you're not running a cash and you're developing organizations
today, go home and fix that now. All right. All right. Over there.
Like I said, you should be caching and mirroring.
I'm all in favor of caching and mirroring to reduce the bandwidth load. It does not solve the problem I'm here to solve.
They're not spending any money on this capacity structure. I can count it on one finger.
Right here.
So the question was, enterprises tend to pay for security related features and capabilities.
There's some interesting ethical credit challenges in terms of charging for security that
everybody would benefit from having. And there's also the problem that the enterprises that
have woken up to this need today are currently buying it from some vendor. That's not a bad thing,
but putting the public road utility in competition with the private towing service on the road,
metaphorically, creates some other person's sense as well. These are the right questions.
And the end of the day, finding a way to get to the point where enterprise can look at this as
a normal cost of doing business and have it show up in their opx, as opposed to their
Ospo donation budget, is the goal of this process. Question of here.
What about like how copy left really help open source, like creating a new license, where if you're
only money with the package registry, a certain percentage has to go through. Basically,
the licensing. So can we achieve some sort of licensing model here tied to the distribution
of the packages in some way? You're actually closer to the target than you think, but you're
also smoking something spectacularly good because if your solution is to change everybody's licensing
model, the stuff that is currently available for free, right? And also if you just imagine Matt
Swozo with the Osis reveal the fine, we'll just build that ourselves because that's what Michael
says to do in his other talks, which is stop pulling down other people's bills. And so you get again
perverse incentives. But licensing and interpretive models of like the other day, let's face it.
The registries are effective monopolies. They own the namespace. You could put cashing and mirroring
in there and you can even have licensing terms to that, right? But here's the thing. The cost
of spinning up an alternative crappy registry, as Andrew has identified in so many cases,
is almost zero. So the moment somebody says, great, my monopoly is awesome. I'm going to monetize
my monopolies, right? People will route around you. They have done this over and over again. So
you have to find the, make it not worth their effort to go somewhere else, making not worth their effort
to try and build up popularity by building a free one that's really shitty, but somehow doesn't
have to get, like, because you keep finding all the data that points us to all of the problems,
right? How am I doing in time? I got a few more? Yeah, okay. I went fast so I would have questions,
because the questions are actually the most interesting part of the conversation. But if you run
out of questions, we can give people more time. In your stats, yes. So the question was, did we have any
data about how much GitHub consumes Google started some simple Google cool hosting? Like 20 years ago,
because they felt that so sport was too big. Right. So we, we, we've, we've given. Yeah,
of course, our way past, way past, way past that point. Yeah, it's, so, you know, we all get addicted to,
you know, various times of socially interactive engagements that happen, cause more addictive behaviors
in other places. It's not the biggest problem we have, right? This is one of the bigger problems
that we have. So I'll take one more question then we'll go from there. I love your questions.
If we get the money, how do we do it? So part of the effective model that we have to come up with is
one that allows us to measure the usage, the, the load, the impact on ecosystem so that we're not
propping up ones that are probably dying or maybe need to die, right? And that we're not,
you know, depriving those that are carrying more load from appropriate revenue, right?
I don't have the answers to those questions. We are talking about them. I love your questions are
great. With that, I think, we just have a mic. What between all of the maintainers is it?
I prefer to think of it as a, but the Netherlands dictator somewhere, but, you know, you
potato potato, it's, it doesn't end well no matter what, right? How am I doing on time?
Yeah, I think that's about it. All right. I haven't seen, is Mike McQuay here?
Oh, I could give his talk. Well, I want to thank you all for answering my questions,
before.