Delivering Sustainability of Critical OSS Projects - Berkeley 2024

[Music] and I hope you find this useful I trying not to deliver it as like the only way to do things but but we found something that works and I'd love to see if there's ways to be additive to it so the Linux Foundation um and we really got our start about uh uh as something called the uh uh open Linux standards base uh and the and the open software group I forget exactly the term it started at but it was about 2002 and then in 2006 it kind of pivoted to its current model is basically a governance as a service organization right we are a 501 C6 industry Consortium right so it's not a it is a nonprofit but it's not a charity uh it's uh funded by membership dues uh and it has built kind of a collaboration platform that started out focusing on open source code but has broadened into a bunch of adjacent domains uh uh the design of open Hardware things like the uh uh uh not not the risk I'm sorry uh uh shoot what's the risk 5 risk 5 uh project which is an open CPU architecture um to community specifications and standards work such as the trust over IP Foundation uh and uh and and other things actually I'll give some examples of this um uh and uh we are Central to uh so much of the software that's built around the world a lot of the value exchange let me postulate that happens in the open source ecosystem is non-financial it is in the form of technical contributions that come in uh and obviously the use of that code that goes out right are kind of four pillars of of any successful uh or or anyone any project we try to Launch um first is a sense of neutrality first is you want to have a common place where uh even if it's bootstrapped by one organization or a set of organizations the participants know that uh and the consumers of the technology know that that project will persist even if that originator moves on uh Cuts their budget passes away uh is that weak Link in the chain because they know that there's a neutral org that holds some of the core assets but also uh keeps the engines running from a community point of view um they also need IP Clarity uh this you need this to make the lawyers happy you need this to reassure people that they're not going to get rug pulled by a term that's that's embedded inside an almost open source license they want to know that a project is run uh according to principles of Doocy I hate the word meritocracy because assessing Merit is is really fraught but if you can say hey those who show up to do the work you know history is made by those who show up right I I I are should have a role to play in where the project goes um whether they are contributing financially or not to the project doesn't shouldn't it shouldn't matter if it's an open source project anybody should not only be able to use it and report a bug submit a poll request but they should be able to climb all the way to core contributor and have governance rights over where that project goes uh no matter who they are right um and then finally some sort of financial support infrastructure that's not about paying a person to write a 100 lines of code uh or paying for this thing to be built but it is about uh think of it like air traffic control think of it as a as a as a as an ongoing concern how do you make sure that this project will be there next week next month in a year um responding to security issues responding to uh uh trying to recruit new members uh uh uh encouraging more growth in the ecosystem so at the LF we have a couple of different tiers of that we think about doing a project in one of those is there's a bunch of stuff we'll do for free now I'll clarify we're not a grantmaking organization we're not you don't have a pool of funds that we just get to throw out to projects uh that we think are leading projects but through our our overhead through like the skim like the very small skim we're able to fund some stuff for free so projects like spdx which is about standardizing licensing terms across open source and making that traceable and machine uh parsable uh is a project we do for free chaos which is a a toolkit for assessing Community Dynamics on an open source project we do that kind of thing for free then uh we'll do other things where it's like take that Community uh basis and add just enough funding to do things like run the cicd systems or run uh uh the Linux git uh repository because it's not run on GitHub it's it's for lots of reasons run on own get infrastructure uh uh do some some spot things but but don't really try to uh make it a I I you know just try to be supportive and fill in some gaps right so answering the question of why this works for so many people uh uh first off the heart of this has to be developers if the developers don't show up to these projects it doesn't matter what what happens in them it's just pissing in the winds also importantly there's benefits to their bosses right to to the to the to the folks who control budget because it means um there's a predictability that comes from this versus dev's just working on a bare GitHub repo uh and and then really importantly to their bosses lawyers that IP Clarity um it no knowing that there's not just an open source license to it but contributor agreements have been tracked and and those sorts of things is enough to help open the floodgates to whether it's technical contributions on company time uh or or the kind of Financial Funding that that helps these projects work so as I mentioned in kind of when we set a project up the typical support mechanism is not grants it's not uh one onetime payments or or anything it's it's a sustainable membership infrastructure it's saying here's our sponsors of the project they're assessed each year you know a sustainab a support fee um it's different project by project uh slightly different because uh budget needs can vary uh depending on the phase of the project depending on how many people show up and what their actual needs are um but but there's an essential fairness to it any company could join and and by the way when I say company I don't necessarily mean for-profit I don't necessarily mean the Google and apples and microsofts there those organizations can join and be Financial sponsors and be peers to the other entities there could be nonprofits they could be government agencies they could be uh uh grantmaking organizations it tends to be different than how those entities fund technology initiatives and so uh uh it's been limited so far and how uh and and in how we get those organizations involved but um I I but there's essential neutrality to it and any new company can join and be a part of it right the way that we manage uh these projects uh is first off we're we're behind behind the scenes we're trying to find the the superstars in the projects and put them on the podium uh uh make them successful uh uh and and and and manage the behind the-scenes details right and in order for everybody to trust that these systems work we've got to be competent from the boring bits right making the meet making sure meeting notes are taken by the meeting so that when developers said yeah let's do this thing like there's some record of that somewhere you won't believe how much time is wasted by people um the bike shedding argument uh at best right people perhaps have heard um I IP policies being followed this is how you get the boss's lawyers to let you as a developer work on this thing even if you work for a very conservative company um I I and then let's see anything else really really it's just about actually the the key thing here is trust um I we we recognize that being a neutral organization uh in a even in a space that should be as trustless as open source code Pro people can always for if that trust is lost lost and and they should uh in if if any neutral entity does something that you know violates the concerns of the community the open source licenses guarantee you the right to fork and move on right and so uh we we understand that that's delicate and that the only way to kind of preserve preserve that trust is to be competent and behind the scenes stewards of these projects rather than trying to either aisee or or or flake or do the kinds of things that cause people to lose that kind of trust sometimes a a bit of aggregation and a bit of scale and uh can lead to both the trust and the persistence required to have projects that last decades [Music]