How an OSPO Can Help Your Engineers Give Back to Open Source – InApps 2022

When it comes to open source software, there’s a big and growing problem: most organizations are takers, not givers.

There’s a classic XKCD comic that shows a giant structure representing modern digital infrastructure, dependent on a tiny component created by “some random person in Nebraska” who has been “thanklessly maintaining since 2003.”

Randall Monroe’s XKCD comic illustrates the open source dilemma: overreliance on a small number of volunteer project maintainers.

This would have been funny, except that this is exactly what happened when security vulnerabilities were discovered in Log4j last December.

The Java-based logging tool is ubiquitous in enterprise publications. In the last three months, for example, Log4j has been downloaded more than 30 million times, according to a report by the enterprise software company Sonatype.

The tool has 440,000 lines of code, according to Synopsys‘ Black Duck Open Hub research tool, with nearly 24,000 contributions by nearly 200 developers. That’s a large dev team compared to other open source projects. But looking closer at the numbers, more than 70% of commits were by just five people.

Log4j’s home page lists about a dozen members on its project team. Most projects have far fewer developers working on them — and that presents a problem for the organizations that depend on them.

“There is little incentive for anyone today to contribute to an existing open source project,” said Jeremy Stretch, distinguished engineer at NS1, a DNS network company. “There’s usually no direct compensation, and few accolades are offered — most users don’t even know who maintains the software that they use.”

The most common motivation among open source contributors is to add a feature that they themselves want to see, he said. “Once this has been achieved, the contributor rarely sticks around.”

Meanwhile, as a project becomes more popular, the burden on the core team of maintainers keeps increasing.

“More users means more feature requests and more bug reports — but not more maintainers,” Stretch said. “What was once an enjoyable hobby can quickly become a tedious chore, and many maintainers understandably opt to simply abandon their projects altogether.”

The Tragedy of the Commons

The open source software ecosystem is a perfect example of the “tragedy of the commons.”

And the tragedy is — when everyone uses, but no one contributes, that resource — whether it’s an overrun park or an open source project — eventually collapses from overuse and underinvestment. Everyone loves using free stuff, but everyone expects someone else to take care of it.

This approach can save you money in the short term, but it can become a fatal flaw over time. Especially since open source software is everywhere, running everything.

Linux, for example, the open source operating system, runs on 96% of the world’s top 1 million servers, and 90% of all cloud infrastructure is on Linux. Not to mention that 85% of all smartphones in the world run Linux, in the form of the Android OS.

Then there’s Java, Apache, WordPress, Cassandra, Hadoop, MySQL, PHP, ElasticSearch, Kubernetes — the list of ubiquitous open source projects goes on and on.

Without open source, much of today’s technical infrastructure would immediately grind to a halt.

“It is a real problem,” said Danil Mikhailov, executive director at Data.org, a nonprofit backed by the Mastercard Center for Inclusive Growth and The Rockefeller Foundation that promotes the use of data science to tackle society’s greatest challenges.

While nearly all organizations use open source software, only a minority contribute to those projects. Forty-two percent of participants in a survey released in September by InApps, Linux Foundation Research, and the TODO Group said they contribute at least sometimes to open source projects.

The same study showed that only 36% of organizations train their engineers to contribute to open source.

Individual companies should support projects that they use the most and are critical to their success, Mikhailov said: “If you use, you contribute.”

OSPO Benefits: Less Tech Debt, Better Recruiting

Participating in open source communities — especially when guided by an in-house open source program office (OSPO) — can help ensure the health of projects critical to your organization’s success, improve those projects’ security, and allow your engineers to have more impact in the projects’ development road map.

Say, for example, a company uses an open source tool and modifies it a little to make it better. If that improvement isn’t contributed back to the community, then the official version of the open source project will start to diverge from what the company is using.

“You start to grow technical debt because when the original source changes and you’ve got a different version. Those differences grow rapidly, compounding daily. It doesn’t take long for you to be the proud user and maintainer of a one-of-a-kind open source project variant,” said Suzanne Ambiel, director, open source marketing and strategy at VMware.

“The technical debt gets bigger and bigger and it gets very expensive for a company to manage.”

Support for open source activity can also be a recruiting tool. “It’s really a talent magnet,” said Ambiel. “It’s one of the things that new hires look for.”

Some engineering managers might worry that open source contributions will detract from core product development,  she said. Their rationale, she added, might run along the lines of, “I only have so much talent, and so many hours, and I need them to only work on things where I can measure and see the return on investment.”

But that attitude, she said, is shortsighted. Supporting employees who contribute to open source communities can build skills and develop talent, she said.

Loris Degionni, chief technology officer and founder at Sysdig, a cloud security vendor, echoed this notion: “Finding employees who contribute to open source is a gold mine,” said.

These employees are more capable of delivering features a company wants to use and merge them into community-supported standards, he said. And in a war for talent, companies that embrace open source are more attractive to developers.

“Lastly, open source is driven by a community of technical experts you may not be able to hire,” he said. “When employees actively contribute and collaborate with these experts, they’ll be better informed of best practices and bring them back to your organization.

“You start to grow technical debt because when the original source changes and you’ve got a different version … It doesn’t take long for you to be the proud user and maintainer of a one-of-a-kind open source project variant.”

—Suzanne Ambiel, director, open source marketing and strategy, VMware

“All of this should be rewarded — developers shouldn’t have to spend their free time honing their skills, as your company will quickly see benefits from their efforts.”

An OSPO, Degionni suggested, can help achieve these goals, as well as help prioritize contributions and ensure collaboration. In addition, they can help provide governance that mirrors what companies would have for internally developed applications.

“Members of the open source team are also in a position to be great internal evangelists for open source technologies, and act as bridges between the organization and the broader community,” he added.

In the September survey from InApps, Linux Foundation Research and the TODO Group, nearly 53% of organizations with OSPOs said they saw more innovation as a result of having an OSPO, while almost 43% said they saw increased participation in external open source projects.

More OSPO Benefits: A Business Edge

Contributing to open source communities doesn’t just help the communities, but the companies that contribute to them, said Tom Hickman, chief innovation officer at ThreatX, a cybersecurity firm.

“Growing the community of developers around a project helps the code base, and attracts more developers,” he said. “It can become a virtuous circle.”

Also, companies that contribute to open source projects get twice the productive value from their use of open source than companies that don’t, according to research by Harvard Business School.

Many of the biggest companies in the world are contributing to open source, said Chris Aniszczyk, chief technology officer at Cloud Native Computing Foundation. He pointed to the Open Source Contributor Index as a reference for exactly just how much companies are doing.

The tech giants dominate the list: Google, Microsoft, Red Hat, Intel, IBM, Amazon, Facebook, VMware, GitHub and SAP are the top 10 contributors, in that order. But there are also a lot of end users on the top 100 list, said Aniszczyk, including Uber, the BBC, Orange, Netflix, and Square.

“We’ve always known working in upstream projects is not just the right thing to do —it’s the best approach to open source software development and the best way to deliver open source benefits to our customers,” he said. “It’s great to see that IT leaders recognize this as well.”

To contribute alongside these giants, companies need to have their own open source strategies, and having an open source program office can help.

“OSPOs provide a critical center of competency in a company when it comes to utilizing open source software,” he said.

It’s similar to the way that companies have security operations centers, he said.

“Growing the community of developers around a project helps the code base, and attracts more developers. It can become a virtuous circle.”

—Tom Hickman, chief innovation officer, ThreatX

“If you don’t make the investment in a security team, you generally don’t expect your software to be secure or be able to respond to security incidents in a timely fashion,” he said.

“The same logic applies to OSPOs and is why you see many leading companies out there such as Apple, Meta, Twitter, Goldman Sachs, Bloomberg, and Google all have OSPOs. They are ahead of the curve.”

Support for open source activity within your organization can become a differentiator and marketing opportunity for software vendors.

According to a Red Hat survey released in February, 82% of IT leaders are more likely to select a vendor who contributes to the open source community.

Respondents said that when vendors support open source communities they are more familiar with open source processes and are more effective if customers have technical challenges.

But it’s not just software vendors who benefit.

According to September’s survey by InApps, Linux Foundation Research, and the TODO Group, 57% of organizations with OSPOs use them to further strategic relationships and build partnerships.

Mark Hinkle started an open source program office back when he worked at Citrix a decade ago. He pointed out how having an OSPO in-house benefited the company.

“For us the biggest job was to educate our employees who weren’t familiar with open source to get involved and be good community members,” he said. “We also provided guidance on how to make sure our IP didn’t enter projects without proper understanding and we made sure we didn’t incorporate open source that conflicted with our enterprise software licensing.”

The OSPO also helped Citrix identify strategic opportunities for the company to participate in open source projects and trade organizations like The Linux Foundation, he said.

Today, he’s the CEO and co-founder of TriggerMesh, a cloud native, open source integration platform.

There are some significant economic benefits to participating in the open source ecosystem, he said.

“We participate in Knative to share the development of our underlying platform but we develop value-added services as part of our business,” he said. “By sharing the R and D for the platform, it gives us more resources to develop our own differentiated technology.”

How to Get Started in Open Source

Sixty-three percent of companies in the September survey from InApps, Linux Foundation Research and the TODO Group said that having an OSPO was very or extremely critical to the success of their engineering or product teams, up from 54% in the previous annual study.

In particular, 77% said that their open source program had a positive impact on their software practices, such as improved code quality.

But companies can’t always contribute to every single open source project that they use.

“First, thin the herd a little bit,” advised VMware’s Ambiel.

Companies should look at the projects that make the most sense for their use cases. This is an area where an OSPO can help set priorities and ensure technical and strategic alignment.

Then, developers should go and check out the projects themselves. Projects typically offer online documentation, often with contributor guides, governance documents, and lists of open issues.

“For the projects that rise to the top of your strategic list, introduce yourself — say hello,” she said. “Go to the Slack channel or the distribution list and ask where they need help. Maybe they don’t need help and everything is good. Or maybe they can use a new person to review code.”

An open source program office can not only help make a business case for contributing to the open source community, Ambiel said, but can help companies do it in a way that’s safe, secure and sound.

“If I work for a company and want to contribute to open source, I don’t want to accidentally disclose, divulge or undermine any patents,” she said. “An OSPO helps you make smart choices.”

An OSPO can also help provide leadership and the guiding philosophy about supporting open source, she said. “It can provide guidance, mentorship, coaching and best practices.”

Commitment to support open source has to start at the top, said Anaïs Urlichs, developer advocate at Aqua Security.

“Too often,” she said, “companies do not value investment into open source, so employees are not encouraged to contribute to it.”

In those cases, employees with a passion for open source end up contributing during their free time, which is not sustainable.

“If companies rely on open source projects, it is important to make open source contributions part of an engineer’s work schedule,” she said. “Some companies define a time percentage that employees can contribute to open source as part of their normal workday.”

InApps is a wholly owned subsidiary of Insight Partners, an investor in the following companies mentioned in this article: Sysdig.

Featured image by Mathew Schwartz on Unsplash.