Panel Discussion: The Role of Open Source in Shaping the Future of Software Development

This talk explores the role of open source software in shaping the future of technology and software development. The speaker, Albert, discusses his extensive experience with open source in big data and AI projects, emphasizing its transformative impact on the IT industry. He engages various industry experts, including Mike, Mario, and Nelson, who share their experiences with open source tools such as Kubernetes and programming languages like Elixir. The conversation highlights the community aspects of open source, the importance of contributions from companies, and the necessity for sustainable business models that support open source development. They also address challenges such as licensing changes and the need for better funding to maintain these projects, underscoring the significance of collaboration and community engagement in driving innovation.

ladies and Gentlemen please welcome to Pal discussion about the topic role of Open Source in shaping the future of software [Music] development hello and welcome everybody my name is Albert and I have the experience with open source from very interesting perspective as I used open source for for multiple big data and AI projects so I can tell that I use like the open source Technologies for the

last seven years and it's also interesting that I did it in the industry which moved from Enterprise you know like a very regulated software to V open source and during today's discussion we'll talk about the open source how it reshapes and in fact how it shapes the current IT industry with people who have experien from multiple different perspectives Ives so now it's time to uh tell to

our audience what is your like experience with open source and well what do you do daily Mike would you like to start yeah sure thank you I'm Mike Vesak I'm uh uh founder of two companies um I founded one in back in the '90s and uh consultancy uh in uh 2016 and uh my relationship to open source is that uh when I founded my first company uh

we used Python and many other open- source projects uh to build software was a core of uh what we did and uh created value for for customers and uh yeah now we develop uh creating uh Cloud native applications and uh front ends where we use open source Frameworks open source software so my company would not be possible without open source thank you Mike Mario and what is

your relation with open source yeah hi I'm Mario um I work for a company that is basically uh briefing open source so uh we built what two open core products and one open source product uh but we are also heavily involved in the cloud native world so every engineer that works in our company is contributing to at least one open source project and um the main for

project that uh we work on and we use is you probably have heard of it is kubernetes so I myself am the technical lead for the contributor communication sub project in kubernetes and uh I'm part of the sick kades infra so I think we can talk about this later a bit but uh the kubernetes project is organized in special interest groups that are basically part of which

all the small things that are inside of kubernetes and those six and they needs work to be done and that's my relation to open source thanks Mario and Nelson thank you I'm Nelson VI I work inang Solutions we are a consultancy around distributed scalable systems we work mostly with herland and elixir and uh we are like together with Eric on one of the main maintainers of the

very language itself faang we have uh plenty of Open Source projects that we lead we also contribute to others like Ravid mq uh me personally I work espcially on two open source projects a messaging server extensible with customizations and so on and a low testing tool and with that experience with these two projects and the language itself uh sometimes I also manage to make some minor contributions

to the language um we release from our main libraries we release like from our main projects we release a lot of small libraries also to open source we have plenty of projects in in GitHub and most of our work is enabled by open source and me personally I am a huge fan of it I I I love the fact that I can contribute and have a build

a community and have a relationship with the open source Community thanks Nelson I think that we need to start with like the most important question so what kind of value is delivered by open source projects and why companies why we as Engineers should use and also commit to open source projects Nelson would you like to start value well what can I say uh as I say that

open source enables the whole thing like for example with uh the language one of of the biggest non-official but still biggest contributors is WhatsApp it's Facebook that back in is building nland and they are beautiful contributor they contribute so much to to the whole um ecosystem because the ecosystem is what sustains their business they they earn lots of money Facebook has relatively infinite resources you can call

it that way and this is enabled by open source they contribute to the language they contribute to tooling around the language uh same thing here like we also use uh tools that were created by other people that enables uh the job that we do like there are I don't know performance libraries for example for TLS implemented in in native code that we use from the community to

improve the performance things like that um a a lot of particularly in in my case a lot of the work that I do it starts with uh like Consulting around an open source tool and then building customization support um like legal liabilities these kind of things so yeah and Mario how do you see it especially that you you work like on kubernetes and I think that all

of us like use uh at least some some of kubernetes stuff yeah exactly and I think that's the that's the biggest Point um that we that you need to consider is that uh half of the internet is running on kubernetes servers and we basically built the Linux kernel for cloud native more or less and um the good thing is that different companies that are normally competitors get

together work on the same project to advance the technology and and and work on it and there was an interesting uh paper published in the beginning of the year by the Harvard Business School uh that basically said like how much is the worth or the value of Open Source uh because nobody puts a price tag on open source because how do you put a price tech on

open source people do it in their free time people get paid for this uh but they tried it there's a there's a method which is called Kumo and you can basically take the uh lines in git and the code lines and then calculate it together say like how how much time was spent with a default engineering wage and stuff like this and the open source value is

uh what they calculated is 8.8 trillion so that is how much worth is open source without change management without any um maintenance or stuff like this just like the code that is written which then Cor response to if any one of us is working in a company and we would need to pay for the software that we use like programming languages editors things like kubernetes things like

Docker and stuff like this we would pay 3.5 times more than uh we would now pay because it's open source and we benefit everyone is benefiting from open source Mike I'm very curious to hear your opinions like you founded companies you like daily with customers so how do you see like value of this open source directly for your customers yeah so the the value for our customers

is of course that we can develop uh Solutions uh individual Solutions faster and um it gives uh also uh another kind of opportunity to our customers that is some kind of uh digital Independence so um there's something called the vendor login so if you by uh commercial software as a company and integrate it into your systems and maybe the vendor uh loses um the interest to uh

maintain and support uh the solution then you have no chance uh than just removing it and start from the beginning um you could could develop the software your own uh as a company uh but if you're not a software company this might be very difficult and very expensive um so the next best thing is to join open source projects contribute to open source projects and integrate them

into your it infrastructure uh to be more independent and remove remove the vendor login okay thank you if I may just add take it with a pinch of salt this is something that I read couple of years ago and I don't remember the exact numbers and the sources I always like to be like very truthful to uh there was some calculation about the cost of the Linux

kernel if it was to be created like today we just make a business and decide to implement something that does all of that the cost surpasses the budget of uh defense of the US and it's free and it has been free for how old is the Linus Kel 20 years more more more more I I uh read a quote uh the free in uh free software uh

or in open source software is more like freedom than like free beer so it gives you freedom to uh use it yeah I think that well you mentioned very important part which is about like the business aspects of Open Source projects and I think that during the last months we could observe cases like uh changes like changes in license of elastic search in the last time of

Hashi Corp of redes so well how do you see like the business model for open source and what should be like the way to maintain like the open source score and also to enable in fact people like to have money to leave and also like to commit so Mike would you like to start yeah sure um so of course the software has to be written by uh

people like like you or uh other developers all over the world and uh people have to be paid to make a live make a living and uh the money has to come from somewhere so um we need to think about uh more and more sources of uh money that enable developers all over the world to contribute to open source projects and to make it possible to have

these uh high value uh Solutions and high value software and M maintain it support it and write documentation for it so um a good part would be to uh really engage in uh open source project when you're using open source project you have to chance to contribute also with money uh to the project uh it helps a lot I I have I have a salty take on

on this especially um so every employer that does software development should spend time not money time of each engineer that the engineer can work on an open source project for some given amount every single week because you use every company is using open source tools on a daily base they make profit from it they take and um the goal is to give back uh especially for the

big projects that that are around um we have like the big maintainer companies and when we go to the contributor Summit for kubernetes and we usually so it's twice a year at cubec con and um we basically do a show of hands who of you is being paid for working on kubernetes and who is doing it in in in their free time and 80% of the people

are getting paid to do this but the problem is these are people that are working for big companies that is there googlers Facebook um and the funny thing is our company and we are 55 people we are number one contributor to communties in Europe which is hilarious we should be there there are enough companies in Europe that has enough manpower uh or employ employees to basically surpass

us in a wimp or in any other open source project and open source can only live if companies invest in it because they are also reliant on it um we had the discussion before that when a cve came out who who is fixing a cve in a in an open source project some other person and that's not a solution because this could have a business impact on

your environment so you you should have someone that might be able to help there mhm and I think that yeah you talked about like critical point right about like this maintenance so what kind of solution do you see like and especially like what do you think like about the last move for example uh of Hashi Corp or redes like what what do you think about like this

license change right because we could observe a lot of discussions inter in the internet right and most people weren't like satisfied with this change and well what do you think what should be like this sustainable model for open source projects and well what is like the future for it yeah actually like you just I were saying about a show of hands and I'm curious about the public

who has the luck to be paid to contribute to open source project at least a couple of hours a month oh it's it's four people five people I think it's still good somebody's higher than average thank you I was going to say something sorry I forgot next one yeah yeah yeah uh so I think that there's there's a lot of business value for companies to gain when

they send people into open source because it's also putting people people learn from this you educate your people there and now you got your idea back yes because you just say that every company should pay your employees to put some time and I actually have a a statement and a bit of the opposite opinion you all know this classic problem that you have a new hire then

you need to onboard it that needs to like learn your practices your Technologies your code base versus uh an old employee that has an experience in the actual project may not be like a general programming experience but in the project there is that years of experience in a certain project that are very valuable for a company and for that reason I believe if there is any manager

in the room I hope that you agree with me that um all employees uh are in a way more valuable than than the new hire and I think that open source has the same problem like I I'm a complete like fan of them like I don't use any other editor I'm like I'm I'm young but sometimes I I look like I was born in the ' 80s

or something I do t-x V everything on the shell I don't have a UI I don't use the mouse I have never contributed a line of code to Vim Neo in my case and if I was to start there is a lot of c and Lua that I'm not familiar like I I think that and and and I have a lot of experience in programming I could

probably get around and get to it I think that a better like more correct I don't know if it's better or sustainable but a correct model is pay the maintainer he's the one that knows how to do things and he's the one that is going to do a certain job in the least amount of time if I was to fix a bu it will take me I

don't know a few hours weeks of Discovery how to debug this project how to compile it what are the practices then make a PO request that and I don't know my code style is not the useful the maintainers know how to do it and there is so many maintainers that there are so many projects that sustain the world like op SSL or log forj you all have

heard of this issue it was like one guy in his garage maintaining the logger library for all of the Java world and then suddenly the world went in to Madness and there is this one guy in the garage that he's not being paid for it being like scream at hey your your software it's it's vulnerable he's crashing everything just him right that's that's a stat you put

attention I think on very important point right because in most cases when we talk about like contributing to open source projects we think about directly coding but let's be honest we are like a lot of different ways in which we can support projects so how do you see like way to like support projects you on daily basis not specifically in fact contributing code I have hopefully made

a bit of advertisement on themm if anybody hasn't used it please do that's my contribution to open exactly it's like marketing right and Mario like how do you see like these other ways to contribute yeah so we um the funny thing is um the uh I my go code that I can write is it's really bad and I don't I have never contributed a single line of

code to the kubernetes core however what is strange I'm the tech lead for coms so what does a tech lead for coms do oh I do things like managing buffer buffer is what we use for our social media channels because we have the q& iio Twitter account we have the link an account we have the mailing lists we have the slack Bots that need to be maintained

we have uh we have a Blog we have the the contributor website we have the kubernetes website itself we have documentation um this has nothing to do with the core itself but is work that is needed for the project itself and also what you need to to take care of is governance um new topics that come up so guidelines about using AI um in open source projects

uh project management I mean it's these are all huge projects they need to be managed we have as mentioned an infrastructure team that is just there to where do we run our builds for the next release and um these that these are SES for example these are not like go Engineers why why because s e do the the job better than a go engineer probably MH so

um there's always there's always ways to contribute and another point that people don't do a lot is feedback because open source projects if they want to go into a certain direction like Alpha features who who of you is using kubernetes Alpha features oh not so many who is using a beta feature one or two the problem is when it's G we can't change it anymore so if

you want to have an impact give feedback on Alpha and beta features and not like when it's j because when it's j you can't change it or you can change it but the process to change it is really hard really long because if you change something there you might break people and you can't break people and Mike and how do you see like this changes with open

source as you are like the user uh and and someone who is like this open source domain like for many years and how do you see like this changes over years with open source software okay uh how did open source software change so uh it's bigger the projects are much bigger much bigger companies are comp contributing to uh huge projects uh like kubernetes or uh let's put

the finger in it AI it's mainly open source and uh it's really really big Microsoft and Google are uh the uh uh companies um who do the big platforms like uh open Ai and uh other things so they invest uh huge amounts of money uh and this this has changed when I started with open source it was still small libraries uh things that fixed uh small problems

and which you could uh could use and uh yeah nowadays uh we have a situation where there's no chance uh that open source can go away anymore so if you if we can uh have if he has have a switch to remove open space from the world then we don't have the internet we don't have mobile phones we don't have uh yeah uh laptops or something like

that everything is relying on open source so it can't go away anymore at that time when I started it was sometimes uh little bit of a curiosity universities did so uh it's a great development it's nothing bad it's it's really cool because uh I I love open source and I I like the philosophy behind open source and well I think it's also like interesting to see for

example how universities or in fact how students can also take advantage of Open Source that's what we like discussed just before like our session and well how do you see like like this capability also for treating like this open source projects as a kind of like entry point for next generation of Engineers how do Nelson entry points for new generations of yes uh I think we were

talking about that before uh universities are a great um pool of Labor to call it somehow like there is lots of students that want to make a portfolio you know a career so I think portfolio is better that's that's a very common pattern like you collaborate with a university you get a few students you guide them and they start contributing to some tooling documentation for example and

it's a good entry point for the developer and for the tool that they are contributing to and well which Industries have you observed as the like the one which profits the most from open source like do you see like a specific industry which is you know like which in fact relies on open do you have like some examples trying to think is there any industry that doesn't

that's also like a good point and I think that well we can also think about like uh we can talk about like the case which is about in fact providing managed open source projects like something that is like behind the reason why for example redis changed their license right that for example some major Cloud providers provided redis as a service like without in fact contributing or paying

like enough fees and and well how do you see like this license change or how do you see like this fight between like the biggest it companies and in fact well open source projects or open source teams I like the example of uh Docker from a couple of years ago like who doesn't use Docker like it's quite a universal tool these days and they are doing an

amazing job at doing something that we all use daily and it Powers all of our business more or less and it was free and now they they changed this license that only when your company is more than not sure like a hundred people or makes more than a million dollars a year something like that then you need to pay it's it's a fair like uh license you

get uh like a free room for all the students and the open source projects and the like the the the Freelancers the startups but once you make profit like you have made profit because someone else did something for you so pay back right I mean I have also a salty take on this so I like I like open source projects that are not maintained by a company

that are maintained by a nonprofit organization that's also the point what Apache Foundation did long years ago they started with it uh Linux Foundation was then founded and I mean cncf is part of the Linux foundation and basically projects are then owned by uh the foundation and not by a company mhm and um there's also like the the governments thing that you need to have at least

two or three companies that say they will sponsor a project into a foundation so that it's uh that it's always overrule so that not a single company take can take advantage like Hashi cor did with terraform because Hashi cor owned terraform because they created it they they open sourced it in some kind of way and the problem for example there was that a a ton of issues

or a ton of PRS with features that were not like considered valuable for Hashi cor because it would go against their business value like encryption for credentials in the uh in the terraform apply process yeah they wanted you to use wal so that you pay for wal I can understand this this would have never happened if it would be on a govern uh governance board uh that

was maintained by different companies and my my take is that open source projects that are maintained by a single company always fall in the risk to this license changes as we saw with reddis elastic uh terraform uh I don't know a ton of projects and also what was strange about these things was um yeah Hashi cop announced that there are plans that getting acquired like three months

after the uh after the uh after the the license change who would think why they did the license change what their motivation was of course to bring up more revenue and to have the product in uh by themselves so I will uh I'm strictly voting for putting open source projects in foundations but Mike you also have a take on this I guess uh sure um so why

not using open source open source was uh invented at MIT uh initially as a way to manage software projects and currently we have a situation with digitization uh of companies who were not classically it companies or software companies they need more and more software so these companies also have the chance to uh maybe collaborate and create open source software sponsor the open source software and use this

uh way of creating new software to uh get what they need to be successful in uh digitization and uh creating new models and well we mentioned like about this importance of Open Source like for all kind of companies like it doesn't matter whether we talk about small big companies and in what in industry and how do you see like the importance of community right so like the

group of users what should be like the perfect community of Open Source projects right because like based on my experience when I work with all of this like Apachi Hadoop Apachi spark uh Kafka Flink it was always about the community as Community like opened discussions and in most cases in fact like especially I think in this like uh data market before most companies moved to the cloud

in fact it was like the only way to find some walk arounds or Solutions and how do you see like this importance of community and what should be like the Source Mario as you work like on this com I think you have also a salty take um um I in my opinion the the open Community especially for maintainers in projects is the most welcoming and most friendly

community that you can find on the world because there are no borders there are no there are nearly no language barriers more or less and we can make it work uh usually um it's people work together on a common goal which makes them all nice there's us there's always a uh there should be a code of conduct in place that's that's a main given because uh you

always find the Troll And as we all know don't feed the troll and uh there's always some for someone salty um Tim Hawkin and dims two of the main maintainers of kubernetes had had a nice talk about this kubernetes maintainers read mean tweets against maintainers where they just went through issues where people just comment in like this is in kubernetes why did you do this or why

did why is the issue still open for half a year what do you even do and something like this and um for us it was great because it was the it was the fuel for it was the F fuel for them for a talk but internally inside of inside of the community if you're if you're willing to invest some time and if you're and people see that

you're willing to invest time they do everything to Mentor you and then if we go back to the student topic that we had before where we said like why is open source good for students because you're building basically a CV and uh there there's no one that I ever counter that said I won't help you to get onboarded into the project where you can get some help

so uh we have for example we have Shadow programs where people just can follow along and see what other people do and then they learn new skills inside of the open source project and they they then also they make contacts that's the most important thing because I had a couple of folks that were laid off in the past half year and they said like yeah I know

a company there's they are hiring I know a company there there's hiring because you know people from all over the world in different companies that are maybe your next emplo employer will be uh and it's easy for you to join because you already have a personal reference because you know someone that knows you you also have a CV that is in GitHub that everyone can see and

um you can prove that because everything is recorded and put online because everything is open source you can just say like hey this is how I work this is the way how I work so basically they already have an interview the first three rounds of an interview process are already done more or less because of your references yeah I think that's very like the idea of the

CV in GitHub and I don't know when they added that but I only noticed recently that you know when you get your profile and you see like your commit history and you get these funny graphs and so on it also can show commits to private repositories and it doesn't say the name but it says like like a parenthesis and there's activity on private repositories which is sometimes

the job that you cannot share because it's private there is an IP on that but it shows that you were active in this period you really build that history you build your CV there and then you also build your best practices your opinions on the pool request reviews I hope that every single pool request is reviewed hope we don't have to discuss that of course oh I

I have a story about this but yeah go ahead no no that's all go ahead yeah so I think it's time for a story um so we had a we had offsite last week where our company got together and we had a Hecker ton and uh we we um there was the go build the go build tool where that you can use to run go builds and

one of the mainers made a commit mhm self approved the pr and mered it which basically was like uh adding ver BOS to the output of the build process so all of all of the all of the keys and certificates were just in the lock and when you when you had the public so we immediately fill we immediately filled the security uh notification and they patched it

they we wrot just the the the pr that was self approved but things happen if you give people power they this was the Friday evening it's 8:00 p.m. and push into production I think it's starter P it's a starter P for sues in it Friday evening and self self approved PR I I I'm I once pushed to production on a Friday evening before Christmas but I I

nothing happen I have no funny story to tell but I was very nervous about it yeah like what is your experience like with with like open source and what is like in your opinion like the most valuable open source projects in the world as currently well we rely on the open source like operating systems we have programming languages I think that in many cases well we for

forget that well it's in many cases like open source so what do you see like as one of the most you like valuable open source project I'm going to mention Vim for a third time no but apart from that like obviously the kernel you were saying before about using Alpha features and so on and I remember when I started programming and I was very excited and Linux

and I was learning the shell and I decided to enable night builds for my Kel it was so unstable I I mean I'm exaggerating of course but but you you get to remember all the times it broke and in retrospect it felt like a lot of course my computer was working but I I at the beginning I was also like trying to join the mailing list and

say hey this broke for me it's it's quite a big community that was years ago uh now I'm I'm a great fan of V Teo Firefox those are like three communities that I try to like also send my opinion um programming languages like of course that's my actual job is that one yeah I mean I would personally go for kubernetes but the most valued open source projects

in the world are the programming languages they make up uh this was also in the paper that I mentioned um they make up 84% of the uh the amount of money it would cost to build them so this the languages are the project yeah um I had the chance to work with students uh two years ago or so so and uh to teach them a little bit

of uh open source uh and uh they needed to contribute to an open source project uh to get their grade and uh I saw that they really like the uh social uh projects where software was used to um fix or reduce uh social problems and uh help to communicate or help to educate people and so on so um I really like this uh these projects and uh

I think they play a very important role in our society thank you guys so I your your project honestly as I I think Apachi Kafka is still like the one software which I used in so many projects across so many Industries you like in most case is like the case like like with kfka it's like like for example like with karos right you can also find a

great G book caros beyond like the Gate of Madness because it's like very tough to configure let's be honest but when you are able to configure it properly it you know like it like matches all requirements I think that's like the projects which I do like the most because I use it like the most and I think the second one is like still like kubernetes everyone uses

it like that's like the something that powers and like program languages Le are like the fun fundamental thing everything I think we can jump into questions as we do not wanted to mention a little story I was actually recent like a month ago in my team we were discussing alternatives for the terminal emulator I started the discussion the one that we were using I don't want to

give names to advertise or dis advertise the one that I was using was not uh GPU accelerated so sometimes on drawing and I was like I'm going to look for some other and then I started the discussion with my team and we came we found it was easy to find Alternatives but there was one that looked amazing like had all the features you could expect performance was

just incredible but it was not open source and I remember in my team there most of the people there was one guy saying no we cannot have a terminal that is not open source it's like like the most critical thing together with the Kel and and I don't know your programming language and your browser why how why how do you know that that's also a thing that

I like in favor of Open Source not open source project how do you know that they are not doing something under the hood that God knows what it is like or even uh maybe it's not like a for malicious inent itions we all heard like something like 15 years ago there was this scandal with pris and all of that maybe let's forget about like a malicious intentions

a mistake like people can just make a programmer had a bad nights SL bad and just a typo and there is a buag in open source there is thousands of eyes looking at that code in Clos Source there is just a few so I think that's those kind of pieces that are very critical like a kernel or an a terminal emulator the programming language I I I

think it's healthy that they are very carefully looked at by as much people as possible yeah I think it's also like security aspect is like critical also for open source in many cases yeah of course then we have issues because I saw yes so let's uh let's start so we can we like present question okay Nails on this I can see so you can read there yeah

but I see I'm sitting what can you do to prevent security preaches using Open Source Products recently a death in big Tech accidentally found malicious code and prevented a disaster questions later was the name of the Cod that is the ex Library yeah and I think that it's it's exactly like with close Source software right in most cases we need like to provide test and like to

implement like this shift left approach and well it's like always the part of of like any of any kind of engineering domain right but there will be like some bux issues and well we need need to improve process I mean that's the that's the most most important thing processes uh we there's for example again kubernetes I'm sorry I'm boring you um we have we have a s

that is purely there to check updates for um Reliant projects like a no a new Go version has come out and stuff like this so that that's purely there to uh update dependencies and uh and fix them and there was a cve uh a couple of weeks ago with in container D or it affected container D it was the problem was that it was then chipped with

kubernetes and stuff like this and I think it took 24 hours to fix the cve fix the container D version fix the kubernetes version publish it uh the major Cloud providers provided a patch uh and implemented the patch version and uh I think only only one op operating system that was not even affected took some time to patch it because the problem is also with security breaches

is we have cve which is fine but a cve might not affect you because a cve first and foremost is we have a security issue but it's it is not mean that it is exploitable it does not mean that is it is imminent for example the uh the L team changed I think two or three days ago their procedure that bu fixes are uh retrospectively added as

cves which is opinion not a great idea because it's will inflate the cve process and cves uh and it won't affect you anymore because it's already fixed it so it right you cves need to be considered in some way if they really affect you mhm [Applause]