Measuring Community Vitality: Navigating Multi-Stakeholder Governance in Open Source

Transcript

[music] >> So, yeah, hi everyone and I'm going to try sticking to time. So, this is going to be at 10x speed of my normal speech rate. I'm Divya Mohan and I'm thrilled to be here today to talk about yet another non-technical topic in the agent day of AI. It's about community vitality. Now, before I go ahead, I want to do a quick pulse check in the audience.

[sighs] Who here actually uses open source? Can I have a quick show of hands? Okay, thank God people are awake. That is a good sign. So, essentially it's not just you, pretty much everyone, whether you know, it's your grandmother. I know it's impossible to think of your grandmother using open source or contributing to it, but [gasps] honestly, everybody and anybody who touches the internet actually does use open source. So, it's not just you, it's pretty much everyone everywhere that uses open source and open source technically underpins nearly 90% of the

infrastructure today. But when we talk about open source, right? You must have heard of this gentleman Linus Torvalds and if you have not, he's the creator of Linux. He had said a couple of years or decades before that given enough eyes, all bugs are shallow. Emphasis on the word enough because Chetna here I think an hour back mentioned that maintainers are going through burnout in even big open source projects like Ansible. And I come from you know, a that has leveraged open source and now I

work in the open source ecosystem and I can confirm that's true because I'm going to quickly rush through these slides because there are a hundred CVEs I could actually click through and the list would still go on. So this was two years back. This was three not three sorry five years back. This was even further back and you would assume given the day and age of AI that we are in today things have changed Not quite. So who here actually heard of the quadruple vulnerability in the PHP ecosystem quick show of hands.

Yeah good. Others keep up guys you all use Twitter and LinkedIn where are you all? So these were AI assisted so clearly yes AI does help with the CVE discoveries but if you look down and scroll down in that announcement from the PHP foundation you will also read that they are short staffed and they do not have enough people to work on surfacing these CVEs and remediating those CVEs. In fact in the ecosystems that I work with specifically in the CNCF one sub project within the Kubernetes project had to actively be shut down because there was a continuous barrage

of critical flaws multiple CVEs being reported and the leads just didn't have the time. Similarly there was another sub project which was the external secrets operator because of contributor insufficiency and maintainer burnout they couldn't contribute or push out releases any further even though they had backing from major corporations like Amazon and Google and everyone's aware of shy Hulu if you all are not you all are definitely living under a rock right now.

Um so, these are all in the age of AI right now. And you would think why should you be bothered as a contributor, as a user, why should you be bothered about whether a random person um maintaining the code is burning out or not? Uh that's because if you're a contributor or even aspiring to contribute to the ecosystem, maintainer burnout means that you have fewer entry points and it definitely impedes the way you grow in the ecosystem and Linus actually said a quote about this two two years back.

Similarly, if you're an organization, it's going to lead to a long-term unsustainable engagement model because you got to spend more dollars to actually keep the thing running at your end in case the project gets abandoned. what is the way out? It's measurement. And when you talk about measurement, what do you measure? Because communities, people, how do you measure people? So, there are a bunch of things here and essentially chaos as a project allows you to do that with metrics that focus on one specific area and metric models that focus um on more deeper context within that specific

area like viability, governance, and development index. Again, here to reiterate that open source is a team sport and I am out of time, but if you are interested in this topic, which you should be if you're an open source user slash contributor, highly encourage you to get involved with the project and we not only do community stuff, but there's software deliverables in there as well. I look forward to seeing you there.