ASHLEY WOLF: Hello, everyone.
Thank you for joining me today.
My name is Ashley Wolf and I lead
the open-source program office at GitHub.
I'm excited to talk with you-all about breaking
barriers to make open source work at work.
Let's dive into it.
In the past two years,
marked by extraordinary change,
one thing has remained true.
Developers continue to come
together from around the world to innovate,
connect, collaborate and solve
problems through open source.
As you work from home with your colleagues
in Japan and other parts of the world,
the tools that make that possible
are literally powered by open source.
The amount of open source that we will rely on in
the coming decades will continue to grow exponentially.
Our cars will continue to get smarter.
Software will help us diagnose,
treat, and even prevent illnesses.
It will help us improve the health of our planet as
we develop solutions to combat climate change,
food shortages, and resource constraints.
Behind all of that is the open source community,
a community that, of course,
many of you watching today are a critical part of.
Much of the software that we all use, build,
and rely on was created by developers
around the world that may have never spoken in person.
The open source software they developed is ubiquitous
and touches nearly every aspect of our daily lives.
In the last year,
there were nearly 5,000
contributions made on GitHub every minute.
From how we communicate, our cars,
the devices you're using right now to watch this talk,
open source is everywhere,
with progress happening every second.
While the ubiquity is impressive,
so much of its progress depends on the individual.
From the applications we use
to the organizations we're a part of,
building awareness and finding
ways to contribute even if you're
not a developer yourself is vital for continued success.
In order to maintain the software we already
have and create the software of the future,
we need the open source community to grow.
We need more developers, more maintainers,
and more contributors to help meet the demand for
more ever better software that works for us all.
We need companies like yours with
foundations and open source
to participate, and growing,
and sustaining the open source community so we
can all create the software of the future together.
There are many benefits for
companies to embrace open source.
In fact, you're probably
already experiencing some of them.
According to Synopsys's recent report,
97 percent of applications
leverage open source code and
78 percent of the average application is open source.
Open source provides an opportunity to invite
the global community to
contribute diverse ideas to your projects.
Developers can quickly
address security vulnerabilities in
major open source projects faster than waiting
on a single company to fix a closed source library.
By putting your code out there publicly,
you'll hold it to higher scrutiny,
which encourages better development practices
and quality of code.
An open source is the work you
can share publicly and celebrate.
This positively impacts your engineering brand
and ability to hire and retain talent.
In 2021, there were over 3.3
million external contributions made
to company led open source on GitHub.
That means someone that doesn't work in
the company contributed to the project.
I think that's pretty amazing.
But with over 2.6 billion
contributions made on the platform
in the same time frame,
that 3.3 million seems incredibly small,
especially in the context of what
your companies are contributing to the world.
That disconnect is only slowing our progress.
Let's talk about what we can do to improve from here.
Step One is to think about how you manage open source.
Consider the following scenarios and
if your company has a process on these.
If not, work towards one.
For the following scenarios consuming open source,
contributing to open source, and publishing projects.
Do you have somewhere to go to find this information,
or someone to ask, or a team?
If not, do you need it?
When you're ready, here is how you can
frame setting up process and policy.
First, make it easy for developers to use open source.
According to the latest Tidelift's survey,
the majority of organizations 61 percent have
a formal approval process for
introducing new open source components.
But getting approval to use those components in
large organizations is slow and tedious.
Approval can take a week or more.
That's a week before you're unblocked from
using that library to continue your work.
Second, make it easy for
developers to contribute to open source.
I saw a developer try to make
a contribution back to an open source project.
The project requested she sign
a contributor license agreement or a
CLA before beginning to make a contribution.
The developer went from team to
team scrambling at the company,
trying to get approval to sign
the CLA and make the contribution.
She ended up not hearing back for
weeks and ultimately didn't contribute the fix.
Her lack of process around contributing to
open source inhibited her from
making upstream fixes to that project.
Third, make it easy for
developers to release open source code.
Make every effort to open source
anything that isn't your secret source.
By putting your code out there,
you're inviting developers to use your software.
Some of them will want to contribute
their ideas and innovate with you.
Those are your first users.
Set up guidelines internally for
creating projects that are inclusive and welcoming.
Think about what good maintainership
and governance means for your projects.
Step Two is considering to create
an open source program office or an OSPO.
This will help provide structure to manage
your company's participation in open source.
This will also help supercharge growth
around your process because you will need
an owner to work cross-functionally to reduce
barriers with many departments like legal,
HR, engineering, and security.
They can also help you to increase
your organizational confidence in
open source and reduce developer friction.
From startups to large companies across tech,
financial services, to academia,
they're all creating OSPOs.
This group is the front line at your company for
support on open source when developers have questions.
There's also some great public resources available.
If you're interested in setting up your own OSPO,
there is a network called
the TODO Group which provides resources,
case studies, guides, and how to use,
as well as surveys like these,
all aiming to help organizations establish an OSPO.
New OSPOs are created by
all sorts of people; developers,
attorneys, program managers who have
all seen the need and taken initiative.
If you don't already have one,
consider creating an OSPO today.
Like Nadia's quote earlier said,
"As we're becoming increasingly
more reliant in open source,
we have a responsibility to give
back to the open source community."
You can get started by sponsoring
the projects and developers your company relies on.
I picked a few examples of how to sponsor,
but this is far from an exhaustive list.
Outreachy organizes three-month paid internships with
free and open source software
projects for people who are
typically underrepresented in those projects.
Open Collective gives open source projects
a transparent way to collect
funding and manage their finances.
Of course, at GitHub,
we have GitHub sponsors,
which enables companies and individuals to
financially support projects or specific developers.
You can also sponsor foundations that
represent critical ecosystems like Linux,
Apache, Eclipse, OpenJS and Python.
Growing reliance on open source means it's
time for us to recognize how many parts of
our critical infrastructure depend
on open source and how
essential it is we invest in
keeping the ecosystem healthy and secure.
In light of the security events we
witnessed with SolarWinds and Log4j,
these are key reminders of
the importance of securing critical code.
Collectively, we must work across
industries and communities to secure
the software supply chain and make it easy for
open source maintainers to secure their projects.
By engaging in alliances and partnerships with
security organizations like OpenSSF,
we can reduce security risk
around open source for everyone.
At GitHub, we're the home of open source.
We have the largest developer community in the world
with over 73 million developers and growing.
We depend on open source to help us quickly
build the products the developer community loves.
Modern software development is about
collaboration and about leveraging
the power of open source,
and that's no different for us at GitHub.
We recently released a technical preview
of GitHub code search.
We wouldn't have gotten anywhere close to
its current state without the excellent work of
tens of thousands of open source contributors
and maintainers who built the tools we use,
the libraries we depend on,
and whose insightful ideas we could adopt and develop.
This is a small selection of acknowledgment to
the communities and developers
that enabled us to move fast.
While open source and community
is core to our values at GitHub,
we have a lot more we can do to increase participation.
To that end, last year we established
our own GitHub Open Source Program Office to empower
developers to participate in
open source and use open source safely.
We encourage contributions to open source and nearly half
of our staff is contributing to projects we depend on.
Along the way, we've improved
some of our approval process to
make it easier for staff to
use and contribute to open source.
Now we're focused on being good stewards of
our projects in the community
and sustaining the ecosystem.
This isn't just about us.
We're all in this together.
By removing barriers to entry,
we can grow the community so
we can build software for everyone.
We can do that by reducing organizational
barriers around
open source so it's easier for
developers inside companies to use,
contribute, and create more open source.
With your help, we'll pave the way to build
the future of software together. Thank you.