All right, folks, thanks for sticking it through Sunday afternoon, 335.
This next talk, we're going to continue on the sustainability theme, and it's Ruth Seely,
and her two panelists are going to talk about what it takes to sustain a project once
it's successful.
The camera doesn't hit, oh, now the camera here is very awesome.
Hi, she said my name is Ruth Seely, I see many familiar faces, I may have met you in
many open source places over the years.
These days, I run an Ospo to a data analytics company called SAS, and I am President of
the Apache Software Foundation and serve on the OSI board.
I make my way into lots of communities, but somehow this is all led to me talking a lot
in the last year to about the sustainability of the open source ecosystem, and in a lot
of ways.
I think often when we say the word sustainability, people hear money, we need more money
that is about funding, but there's so many more aspects to it than that.
So I've been thinking a lot about how we got here and the history of open source, and
I'm going to give you the tiny bit, but if that's interesting to you, if you can Google
my name, if you look up this panel and the future of open source, I go through the whole
history of how we got here, but in short, when in the late 1900s, some guy in my dorms
led me a Linux CD, the ecosystem was much smaller, it wasn't truly this ecosystem yet.
It was some open source folks doing this thing that was useful to them, and we had a lot
fewer needs in terms of funding, and we didn't have any mentors because we were still building
the ship while we were sailing across the ocean, and this ocean turned into the whole planet,
because now that little thing that we were just kind of doing because it was useful under
pens every piece of software that runs everything that we all use and rely on every
single day for everything, and that turned into so much more, and that's why sustainability
means so much more than the funding, even though that's a part of it.
One of my favorite news articles in open source history is, in January 1999, in the New
York Times, this grammatically fantastically terrible headline that says, free access to a software
code may come into its own in 1999.
I would say our free access to a software code has finally come into its own, but along with
that has come, a lot of regulatory movement, not just so here many of you are probably familiar
to the CRA so much as happening in Europe, but around the world wherever you may be from,
there's a lot happening with an eye on open source software, and a lot of that is because
the security landscape has changed so much, because you don't generally threaten things
that aren't interesting, that aren't used, and now we are the thing that everyone uses,
and so security is a concern for the sustainability for the future.
The funding is a concern because meeting the security requirements are going to cost money,
and like I said, we didn't have mentors 20, 30 years ago, because we were all figuring out
as we went along, and so now an interesting side effect of that is we also don't have mentors
in mentoring, so that's the next thing that we all, those of us who are measuring things in the
late 1900s have to figure out is how to be good role models to the next generation, to grow the
community, so that it continues to be successful, and if you look up sustainability, like what
is that really mean, you generally get some sort of definition about sustain, like keeping things
as they are for the future, except that's not what we want either, I think we actually need a new term,
because we want to continue the growth of the success of open source software into something
even bigger than it's what it's become, so I will stop there and let my two friends who are experts
in bits of this thing that I'm talking about, introduce themselves and explain what sustainability
means to you and your part of the open source ecosystem. Hello everyone, I am Richard Littauer,
hi, I'm a PhD student in New Zealand, I also run a network of community open source
program offices, sorry, a community of university open source program offices, so academic open source
called Curious and for the past eight years I'm running a podcast called Sustain open source software
about the sustainability of open source software, so we've had like 400 episodes about this,
and I have no idea what it means and I hate the word sustainability. So
awkward, I also ran known last year, don't do that if you live in New Zealand, it's really bad
time zones, so what does sustainability mean to me? It's a completely meaningless word, it's
it's actually like a bad word, keeping things going doesn't talk about the fact that most of our
communities are broken in really important ways, they're either broken because of funding is
wrong or the broken because other people are trying to extract value out of them or because we're
burning out our maintainers, so I really don't like the word sustainability at all because every
single project can get better and I'd rather have like growth or something else. I also run a project
or I'm part of the organizer for Open Sustain Technology, which is the largest database of
sustainable projects for the climate crisis and that's like the other word for sustainability,
right, like that's keep environmental sustainability going and the fact that those two terms
bleed over all the time makes the word even worse, so when I hear the word sustainability when you
ask me about the panel, I kind of cried a bit and I'm still working on that. Richard
skips the part where he's also linguistically brilliant and now that I know he hates the word
too, I'm going to depend on him to come up with a better one. linguistically, I ain't brilliant,
so I'm timidated now, so my name is Bob Callaway, I've been an open source contributor for
going on two decades and you referring to things as the late 1900s is quite disturbing to me,
but I guess you're accurate there. In addition to being a contributor for a couple of decades,
my current role is running open source security at Google, which we recognized several years ago
quite before the log for shell incident, but that certainly helped to generate some
positive velocity on the problem at hand was that Google needed to do more to help
address some of the shortcomings that are happening in upstream, like there's tons of work to do,
right, and we wanted to do our part, so that represents an engineering team of 60 folks who can
contribute upstream, try to work on building systems and some solutions to these problems.
It's not meant to be a cure all and all for everything that else open source, but we want to do
our part. In addition to that, I'm also a board member of a couple of different foundations, one of
them is the Open SSF, which is the Open Source Security Foundation, which is a group of projects,
working groups and folks, which have like-minded interest in how do we make open source more secure?
Also need to make open source continue to be available, which is a procurement of security,
which is if it doesn't exist anymore, that's an existential risk to all of us, to all the critical
infrastructure that you mentioned as well. The other thing that I'm a board member of is something
called the Alpha Omega Project. This is a directed fund where Google Microsoft, Amazon, and city
have all donated multi-million dollars to help fund durable improvements in various upstream
ecosystems. So many of the great improvements that we've seen at the Python Foundation,
the Apache Foundation, other places, the people that have had the time and energy to focus on
solving those problems in the foundations have actually been funded through the Alpha Omega Project.
And again, funding isn't everything. It's certainly a part of the dimension of how do we get
things to be sustainable. I would agree that like I don't know that we want to perpetuate the status
quo when we talk about sustainability, but I think of it as like, do we have positive
forward momentum that we can sustain? So that's what really how I think about using the word.
It's like, do we have that positive velocity? Are things getting better on multiple dimensions?
Not, are we perpetuating patterns that lead to burnout, lead to maintainers walking the way,
cause that existential risk? How do we turn the curve and then make sure that we don't just
dip down in the, you know, which is great again. You can throw money at the problem,
macroeconomic, macroeconomic event can happen, that can disrupt things. So we really are thinking
about how do we make step changes and things which go everywhere from business models to expectations,
being very clear around like open-source licenses are great. They talk about what the expectations
should be and must be, but also as we talk about kind of the responsibility of those who are
consuming in the light of regulation and many other things, we have to be evolving. How do we want
maintainers, foundations to all step up, any evolve they're thinking in these models?
Because again, open sources are a great place. We all want to continue in certain facets, but we
things have to change in order for things to continue to be healthy.
The Bob started to pre-insure my next question. Thanks, good job. So historically, all of these
open source foundations as they exploded because so in 1998, February 1998 was when the
term open source was coined. The OSI existed by the end of February. The ASF was incorporated
in March and now I couldn't even begin to guess how many open source foundations there are.
But they all tended to operate in these silos, doing whatever the thing that they had formed
around was. And one of the most fantastic, accidental side effects of the CRA, I think, is that
they've all started working together in new ways, around security problems, compliance problems,
funding problems, and ways that we've never seen before. And since you've both been involved
in various organizations over the years, I'd love to hear your thoughts on how we can strengthen
those relationships even further and build on that collaboration.
So the first thing is you mentioned organizations and foundations. Those are different things.
When I think of foundations, I often think of five of one C3s, five of one C6s, which are a
tax-go to the US. All of us, for some reason, are from North Carolina or have connections there,
really weird. That hadn't been said, I really don't like my whole country. So the
there are foundations that are outside the states and there are foundations here. If you're
up that to deal with the CRA, as you just mentioned, but most of the American software foundations
haven't had to deal with the CRA or the EU. As far as I know, there's a few people who are
working in those foundations, people like Simon Thips, et cetera, who are like, hey, we have to
understand the legal ramifications what we're doing, but the majority of open source foundations
are organizations in the US can't fund the manpower to deal with legal geopolitical issues
across the division, which is okay. I mean, it's a different thing. Thank you.
But when you talk about how do we band together, what I think we need to have is better
communicating between foundations in this fears where they actually have the ability to have
influence and power. For Europe, I think that means a better understanding of what foundations are in
Europe. There's a really interesting mailing list called the Floss Foundation's mailing list that I'm
not on, but it's really useful for talking between foundations. And that's the best. And
oftentimes, I've heard that if you have a question, you just ask that mailing list and they'll
answer it for you. I think we need more of those. And I also think we need more funding to go to
things like Floss Dem, where we all meet each other and actually have the ability to say after
two or three beers or non beers if you're non alcoholic, hey, I'm really scared about this other
thing and I'm what what do I do about it? Because that's honestly kind of how most foundations
work, there's someone who asks that question and someone helps out. So that's what I look forward to
in a much larger world where all of a sudden there are politicians asking those questions of us.
We need to make sure that we have more people who are doing law in open source because there's
very few open source lawyers, which is super, super awkward. And I'm really tired of emailing the
one lawyer I have. In fact, my lawyer did say, please stop emailing me on sub-short notice. So it's great,
but we need more people to actually go into that field. If you're a young person and you want to
have a good paycheck in the future, please go do an open source law degree. Anyway, that's my thought.
I think I would plus one year your notion of how do we get people to not only continue to have
the right conversations. I think the other big thing is like, how do we create space for people to
focus? And because it's a very fragmented political landscape, it's a very fragmented geopolitical
dynamic. However, many of, and so it gets a little context. So one of the areas that we've
facilitated kind of some of this information sharing was a really around how do the various package
managers address the security threats that they're seeing? And you start to look at it. Like,
how are we all handling multi-factor authentication? And you start to go around the room and people
realize, well, when we turned it on at the foundation X, we were inundated by password reset requests.
Because people were going back and they were screwing up, you know, associated in their UBK,
we were drowning, and you know, volunteers were really struggling with that. So if you're going to
do it, roll it out in this way, and people started running along and going, okay, cool. We're all
actually going to go down a likely quite similar road map in adding security capabilities to the
registries. We can learn from each other, not always take the exact same technical approach,
just in the different language nuance. But we can really learn around what was the feedback?
How can we evolve quicker? Can we skip making the same mistakes and move faster? And since we
created that securing, I think we're called the securing software repositories working group.
We've had that running now for about two years. We've agreed on kind of different kind of
ladders for, we all kind of say level one, mean you do the following thing, level two, mean you do
the following things. And it's really just to help to motivate this is where we are on the journey.
We want to continue to move forward. If you give us money or if you come to contribute,
these are the areas that kind of continue to move us in a good direction where we can all rally
to a cause. That has been really helpful for the various foundations and various registry
operators to not only articulate what good looks like, which gets people interested to get
other checkbooks. But it also just makes that there be an actual sub community of people that are
dealing with like-minded problems. When a fishing attack happens on crates.io, you can quickly jump
into a various chat rooms and say, hey, is anybody else dealt with this? Does anybody also have a
contact at this DNS provider to help figure out how do we take down this fishing domain? And within
a matter of minutes, we've helped to create that network effect. So whether it's the mailing list that
you mentioned, we're creating that shared context and the ability for people to focus on the problems.
And I think that's been- on the least on the security domain has been super influential over
the past couple of years. So last one more question and answer myself before we take questions.
And the question is what you feel like is the one thing in this room of people who are interested
enough in open source community to come to the community of the room and want to know about
sustainability. What's the one thing we can ask each of these? How are many people you are to go
do to ensure the sustainability of the ecosystem? And for me, it's to go to be the mentors,
to go find someone, preferably someone to bring into the ecosystem. Raise your hand if you're
in open source because someone said, hey, let me tell you about the cool thing that I do and you can
come do it too. Yeah, that's at least half of you. That's how you got here. So be that person
for someone else and grow our community. Go to therapy. No, like really, like the number one
thing you can do to help your open source community is to spend time figuring out how to deal with
your own emotions. This is the number one thing that people fail to do. So that that I know an
amazing, amazing maintainer Gina Halska, who works on OctoPrint. She's German. She's awesome.
She has a giant punching bag in her office. She'll answer an issue and then go punch the crap
out of a bag for five minutes. And that's how she sustains her momentum, right? It's being
able to say, I'm not going to be affected by this and also acknowledging I'm a human and that
person was really annoying and I don't want to take it out on them. And so a lot of beings
say, I said that because that's the thing I never hear at open source conferences. But like really
we're all humans and we suck at being human and we're all trying to learn how to do it better
and fixing yourself is probably the easiest way to fix open source. That's unconventional answer.
I guess two things to mind, one is maybe a bit of a different variant of what you said, which is
don't be afraid to articulate boundaries. It's okay to say, I'm not willing to take contributions.
It's okay to say, I'm not willing to be badgered by enterprise companies to go have X, Y and Z outcome
happen. It's okay to draw a line or what you're willing to do and what you're not willing to do.
But oftentimes when you leave that space open and open to interpretation, folks will get
taken advantage of. And I think that's something we all could potentially do better at.
The other dimension to this is I think we're obviously in a space where the favorite two-letter
term that's probably on everybody's mind at some level that rhymes with Schmei.
Things are going to change through the better for the worse who knows, right? It's up to
personal interpretation. I think embracing that change being honest about how we feel about it,
being honest about what we like about the new model, what we don't like about the new model.
I think over the next couple of years, what it means to be an open source project is likely to
evolve. We can either control that or we can dig our heads in the sand. And I think really
where open source is really shine is when we get, we look at a shared problem together.
For honest, we're open, we're transparent while we're coming from. That's what has made it so
awesome. There's a lot to look in the future and say, hey, we're going to have unprecedented
capabilities and we'll be able to do many things faster. Maybe better. I don't know about cheaper,
but we'll see. But on the flip side, there is an existential risk to, you know, a bifurcation
in what we think about as open source today versus what it's going to be in the future.
And so just, I guess my thought is just embrace the change. What's make it what we wanted to be
if we pull back, I don't know, it leads me into a place where I'm like, oh man, I don't know
that's not a super positive mental space to be in. But I do think the more that we get out of it,
we defy our boundaries, we say what we want to do, how we want to interact with what we want
in terms of community norms continuing those conversations. That's a step in the right direction.
Can I answer the question again? Well, I mean, I had a new answer to you, so go ahead.
It's not all about the individual. Please organize and fight fascism. It is the biggest threat to
open source. So, do whatever you can. Join your local leftist communities, join your local
tech unions. You don't have a tech union. Make a tech union. If you don't know your neighbors,
get to know your neighbors. And every single line of code you write is political.
Know that. And know that the entire idea of open source depends upon licensing, which is a legal
thing. Right? It's not like random. These are laws. So think about under what jurisdictions you're
writing your code and how you can fight fascism in your own country or abroad. It's not just
about you. It's also about the systems we live in. Thanks. Thank you both. We got some at all things
open. And even when we start out, this is not about money. It's somehow always ends up about money
anyway. So, high five, both of you. I think we do have time for like one question. You go out of
micron. Somebody else has to stand there for the people on the camera. If I had a dollar for
everybody I've heard this week, apologize for being American on stage. We could fund open source
for the next 30 years. Yeah. If we're talking sustainability of the community, is it very important
to try to get the meon like get education involved, try to introduce open source software in schools
and such? Actually, one of the things I did when I worked at Red Hat for a long time was we
help start an open source minor at the Rochester Institute of Technology. And so definitely
at least in the US we're seeing a lot more programs at the University of level of focused on open
source. And I think that's where we get a lot of contributors from. But if that is an audience
that is interesting to you in your community build structures for them because... We have a mic already.
It cut out when I was coming back to other things. Build structures for them because university
students come and go very quickly. And so you will find that you have someone drop in, pay attention
for six months, maybe two years. And then they wonder how to get a job. So build structures
that keep them in the community. So since we don't actually have a session about this, I think
we're going to ask. There are a lot of sessions this weekend about the impact of AI on contributors
and about a contributor burnout in software sustainability. What are your thoughts on contributor
less projects, projects that are completely operating it and managed by AI without contributors?
And that as a path towards sustainability.
Yeah, I'm sorry. Sorry. Yeah, it is partially got to go. I guess my personal thought is I think we
will see that in some extent. I think the you're going to see varying hybrids of it to work
maybe, you know, the actual maintainers are setting the road map at the bulk of the actual
code is delivered by an agent. I think you're going to see what we see today where you have an
influx of, you know, slop. I think you'll see high quality vulnerable. It's coming from other
entities and you'll see certain communities embrace the technology as a tool. Others will use it
as a default operating model. There's obviously, you know, some level of pros and cons there.
Again, I think we need to experiment. I think we need to be honest about where it works, where it doesn't
work. There's certainly a dimension to it that means the attachment that we have emotionally to
code as being an artistic output seems to be something that's going to change in some dimension.
It's scary, but embracing the medium and saying, you know, how could we use this for good? I think
it's something I would encourage. But yeah, it's going to fundamentally change it. But I think
seeing a hybrid of models is we can already kind of see this emerging. I think we need to continue
to share about openly. Where is that working? Where is it now working? And go forward from there.
We're super duper out of the town. Oh, one could look up the Luddite movement. That's all I'm
going to say for that one. And where was the one more? Yeah. All right. Oh. Yeah. When we talk about
sustainability, we always talk about money, places and everything. But what is being done with our
education system? We're not teaching people that failure is not a big divs and a problem.
We're building new languages because we couldn't teach their languages. We're talking about AI
and systems engineers, they have no idea what a vector actually is in practice. And they've been
for five years in college. So what we're doing with people that actually is not money, that's
the open source. It's not the code that's the thing they open source. If there's no
someone there to build that code to understand that code and to manage or not people, what is
going to do with the future? So the education problem is a whole other session that we definitely
don't have time for. But I will tell you, I have a 16 year old in the US who is in a computer programming
program where his teacher is saying, just five code, it's fine. So let me know where that's
going to end up in 10 years when that's how all of our developers have been trained is just five
code. But there actually isn't a adjacent problem. I think, this really is a whole other session.
I don't have time for which is that the education system, at least in the US, even well before
we get to the writing code part, tanked in the pandemic. If you look at what has happened to the
math and reading scores and the competency level of students now compared to five years ago,
you would be a poll that it is even possible to have dropped like a rock. So if you have, so 56%
of Americans can't read at the level of an 11 year old, a sixth grader if you're American. 56%
of Americans cannot read at a sixth grade level. And it's getting worse. So if that's the state of
the education system, we got a big problem before we even start to teach them to code or be a part of
a community.