Jos Poortvliet – Beyond the license: measuring real openness in open source #FOSSBack

This talk focuses on the challenges and benefits of open-source software, particularly through the lens of Nextcloud's mission to provide an open-source alternative to centralized platforms like Microsoft 365. The speaker explores different types of open-source licenses, such as GPL and permissive licenses, discussing how they influence user control and project openness. Real-world examples illustrate the limitations of some projects that claim to be open-source yet maintain centralized control, contrasting them with truly community-driven projects. The importance of good governance, contributor engagement, and the community’s ability to fork a project for maintaining openness is emphasized. The talk also raises awareness of issues like 'open washing' and encourages a careful assessment of open-source projects, including their funding models and development practices.

Yeah, thank you. There we go. Okay. Well, I was already introduced. I work at Nextcloud. I want to go super quickly through Nextcloud. Like we're I think many of you probably know us. We essentially are building well our challenge is that everything is centralized. What we want and I think I don't need to sell that to anybody here is a world where things are not centralized. And

so we as Nexcloud try to take on the challenge of replacing the most used like um um yeah digital workplace which is Microsoft 365 with an open-source on-prem self-hosted product. We just do software so we don't host. You'll have to run it yourself or find somebody to do that for you. Um let me see. And it's definitely possible to do this today. If you're wondering you know

is this serious? Can I use this? There are ministries uh France for example, Austria or whole states in Germany that use it with tens to hundreds of thousands of people even over a million in some cases. So it's already everywhere. Last year I think we rolled out about 100,000 sovereign digital workplaces per month. So it's really there's some real momentum here. I don't think I need to

explain anybody where that is coming from. Um so that's enough now about next slide. Let's talk about licensing. So I'm going to try to have a bit of a practical talk. Um maybe sometimes a little provocative. Uh I want to quench question some assumptions about open source. And in principle the question if open source is always freedom. Um hence who's using open source? I know that's going

to be everybody of course. >> Um for how many of you had does that have to do with trust? >> Most people. Yes. I guess for the others it might be cost. Yeah. So hold that thought. Um so what is the fundamental goal of open source licenses? What are they trying to do? Can somebody maybe just shout something or wave and then shout some thoughts? What do

they do? Nobody wants to say anything on that. Come on, >> tell me. >> Well, it depends. There are a couple of levels I open. >> Oh, I was hoping I would bring the nuance, but thank you. You already did that. So, you said there are multiple levels to it. Depends how open the license is. Yeah, I mean it's it's being public. It's earlier people talked well

everybody raised their hand pretty much or two/3s raise their hand on freedom. Uh the others may be on cost. Uh I think a lot of people also like open source because you can contribute to it right that plays a big role as well. Um I would say that the fundamental goal of the GPL is to u move power. Um ah I am behind with my that's not

really helpful. Uh give me a sec. Maybe this I can see better. Yeah. Um I am every time one slide behind. Exactly. The question was what makes a project really open? Um and then I wanted to ask what is the goal of the license? Sorry for my mix up. Um but I think the goal of what at least the GPL does is that it moves power. It

moves power from the vendor to the user of the software. I think that is the key thing that it does. And this move of power is of course well that's because you have the ability to run you know study the code change it share it again right these are powers that normally only the vendor has and it's moved from vendor to user now I want to argue

that that is indeed helpful and it is always a step forward I think an GPL project is always better than a proprietary project when it comes to openness to control etc because it does always move power however it's not really sufficient depending on of course what your goal is as user or customer or potential contributor and the end it's a legal instrument so it tells you what

you're allowed to do it does not really say anything about what you're able to do uh or what the pro product structure makes practical so what it is in practice now I think you're all aware with the three broad families we have we have of course copy left like the GPL AGPL they're basically viral they protect the freedom of the code once it has been released Then

you have the permissive licenses. It just showed the others already. Um so that's MIT BSD do as you wish including magnet proprietary. And there's of course a bit of a graze on licenses that you know look open but have certain restrictions maybe anti- businessiness restrictions or other um limits. block and cloud providers is a very common one of course and the OSI the open source initiative that

does not consider these licenses open source but you know of course there's still this degree of open wishing right some projects really deliberately blur the line here um they might be trying to protect against AWS style freewriting they might be um yeah trying to to better monetize the software but yeah in the end it's a license that is not open source and it's important to know what

you're getting when you use open source Yeah. Um, a quick question. Um, hands who thinks that the MIT BSD style licenses are more open than the GPL and then I'm going to ask the other. That's very few. Okay. And who of you thinks that the GPL is more open than the BSDs? A lot more hands, but still a lot of people are like, I'm on the fence.

It's more complicated than that. Of course, it is. Yes. No, definitely true. Um I do think that a permissive license on a really communityrun project for example and I'm going to try to illustrate that later can be more open in practice than the GPL on a very corporate you know drop the code every now and then uh yeah project. So it's really it depends and so I

want to do a bit of a thought experiment. I'm going to have going to display three companies and on paper well they're all using the GPL so they're identical in theory right but in practice are going to be wildly different so let's walk through them quickly um so project A um GPL well I actually have a nice graph that I made of the tree so let's just

go through it this way um or well slides on it so project A uh the code is technically available but it's hard to build uh you can't contribute, you can't participate because they don't take pull request. Basically, they just throw code over the wall every 6 months or every year when they do a release. Yeah. License is used in marketing. They tell the customers, "Hey, it's open

source GPL. You can do what you want." But the project is otherwise just a proprietary software product that occasionally releases code. I think it's better than fully proprietary software, but there's still a long way to go before you're really open. So, for example, company B does a little bit more. So, development is visible. They actually put the code in GitHub, you can see the developers work. Um,

but it's still often code drops. Uh, if you want to contribute to CLA is required. They don't always take pull request or maybe they don't at all. Um, and of course, they might have an enterprise edition with enterprise only features because of the CLA. they can do actually proprietary versions of the product if they want to. Yeah. So that's still very much controlled but a little bit

more power so to say has been shifted from the company to the community or if you want to put it from one entity to the users and a project C um try to make the poster boy of really open source uh GPL or AGPL uh open development you can see the road maps you can see all the commits and the comments and the discussion happening there's no

CLA everybody can do a pull request it gets reviewed uh people will seriously look at your proposal um you know the build scripts are included so you can actually build the bloody thing and you know contribute but also use it that way and there are a lot of actually there are a lot of contributors and I think this is a thing to keep in mind like a

project without any actual external contributors that means there's no knowledge of the code base outside of the one entity that develops it and that's actually quite bad if you want to do something else with the code because of course this is why we care about all these things it's the fork test right the practical ical freedom test. Can you fork it? And this fork option isn't just

because it means that you know you can decide to go in a different direction than a project, but it also keeps the company or yeah charity or whatever is behind it honest because if they know that at any point somebody can come and fork it or that creates a certain discipline. Yeah. Better not piss off those 150 contributors because otherwise well we have nothing. They walk away.

We lose a lot of you know goodwill. we lose a lot of help. So it changes the behavior of a company just like you know being watched as you might know in this uh well we're slowly building surveillance state here in much of the western world as well you know that being watched changes behavior of people right and when you're not being watched and open source does

the same a lot of studies show open source code tends to be more secure why is that well you know you know people are watching so you will change your behavior a bit doesn't mean that every to-do can always be fixed but it create a certain discipline, a bit more attention on bad things. So it's it's a government mechanism, not just technical or legal. Yeah. It changes

behavior without legally changing it. So I'm saying the three things you need. Yeah. The code well all three pass the ability to build it and to to to know how it works. Only B and C kind of pass because development is more or less open in B and C as well. But only with C is a real community that knows the codebase who could fork it. And

that makes quite a difference. So that also then shows you the lock in mechanisms that exist beyond the license and they're not in the license. They're not relevant for the license, but they're very important. A project can be GPL and still you're completely dependent on what you can do. I know there have been companies in the past whose business model was essentially to yes they published the

source code they worked in the open but they made it so incredibly hard to actually build the code and then distribute it that people essentially ended up paying them for binaries I don't think it's a good business model because it means you also create a huge barrier for contributors you also create a huge barrier for home users but you know it's a business model and there are

still some companies that uh go that way um on the other hand then you can have a a MIT licensed project but it has a big volunteer community. So if somebody decides to make a proprietary fork and go in a certain direction, the big community might just outdevelop them essentially. And this is more or less what happened when uh Google created Android initially. They started with a

fork of the Linux kernel and they thought well we're Google we're like one of the biggest companies in the world. Of course, we can develop this kernel without all the overhead of actually having to talk to other people much faster than Linux kernel can. Well, guess what? They could actually not keep up and they've spent an enormous amount of resources trying to catch up and get all

their code and their changes back into the Linux kernel and to ship an as mainstream as possible kernel because they can then benefit from the improvements the white community does. So open source has benefits and if there's a big community then as a company even from the outside if you're trying to fork it might just not be smart to do it. So it actually can prevent forks

as well. All right. So um how many of you have like felt locked into an open source project into an open source product? One two I see I see a bunch of hands. Exactly. So there are war stories I'm sure. Would one of you maybe be willing to elaborate a little bit on it? You raised your hand first. Could you maybe in a few sentences explain what

happened? >> It's happened a few times. >> Mino. Yes. >> Yeah. So, you mentioned I'm I'm going to repeat for the recording. I don't know how relevant it is, but um basically mentioning Mo uh you said you always expected they might pull well do rackpool and in the end they did they change the license um yeah and then of course you're kind of stuck there. Uh, of

course, luckily then there are people who will then fork um and create a new project. But of course, the more close development is as the criteria we looked at for before, the harder that can be and that creates a barrier allowing then the company to do less nice things and therefore maybe monetize better, which is of course very relevant when you're thinking of venture capital backed firms

that you know have a lot of pressure to squeeze out basically value. Um yeah, I just wanted to throw in the term open washing here as well. Um I mean of course open these days is well you know people like if it's more open they like the open source license but again the company behind it might not actually want to be open because you know it makes

it harder to well squeeze money about the users but it's a good marketing trick and uh yeah that's where you get open washing um open core and other license shenanigans. So I think the goal of a yeah for you as a user is to pick a project that's not just has a public repo or public code but a project with multiple stakeholders because that's as I said

earlier what keeps the company or you know project behind it can also be charitable organization of course it can still screw you over uh keeps them honest basically this way external stakeholders can be other companies can be governments it can be individuals of course they have real influence and that makes the thing more resilient. And actually I think while on one hand it makes the fork threat

more credible, it also means that it's less likely to fork because again the the most dominant power behind the project knows that the project can get forked and therefore better not fork. H you see which projects get forked well like Oracle has caused a lot of forks, right? Because again, there's this one company that doesn't really care that much really about openness and so you get forks.

Well, real open projects actually don't fork that often because why would they? Yeah, they stay aligned because they all know that they should. So, I want to introduce you to a website is it really foss.com. Uh this is a website that basically has been trying to capture these things that go beyond the license and give an idea also about how development is, how open it really is,

what the government governance is behind the project. uh uh how open it is to pull request for example input from other people how much contributors there are as well as the business model for the company behind it because you know if you're afraid of a rock rugpool well better know what the business model is of the company because if there's a lot of pressure on them and

they have a CLA then they might be working towards a rockpool or not of course it's hard to know for sure um but you know as they say uh don't listen to what I say look at what they do um yeah and I think This website can be quite a good tool for procurement for OPOS. Um, but also if you want to contribute to a project or

just use it privately, it's a good site. Uh, I would bookmark it. I just want to have a quick look at it to show you what the website looks like. It's fairly simple. Sorry. Um, yeah, you can just see the the different projects there. Um, they have some interesting cases which I quickly want to show. So, one is for example only office. um they are technically under

an AGPL v3, but they've added some clauses to the code. There are a lot of binary blobs in the codebase and and compile JavaScript. Uh they basically don't take pull requests pretty much at all. Um so it's essentially the code drop kind of model. Um yeah, and a CLA of course in case you would want to contribute, but again as I said they pretty much don't really

take contributions. Um, and then there's a shenanigans with the license where they basically say, "Hey, if you distribute this, you must show the logo and by the way, you don't get permission to use the logo." That's uh a nice one, isn't it? Uh, very creative, I thought. Um, other projects, windmill. Um, again, uh, you can see the issues. So, on the bottom, you can see the concerns.

Uh, they're mixing it. Uh, they're open core, they're doing various shenanigans. can look up on the website a little bit about the all these examples. And of course, also wanted to show a good example at Master for example. Um they're developing in the open fully GPL. No weird license things, no weird stuff. And then you have one that is not open. Um yeah, they have a custom

license which is not OSI approved. So it has these limitations there. Uh basically it's open washing example here. Um then you have project that doesn't really try. that just provides some transparency. And by the way, again, I don't necessarily want to shame the projects here if they're transparent. They just say, "Look, I want to allow you to examine the code, but that's it. It's just transparency that

I want to provide. Um, but I'm not claiming to be open source. I'm not claiming to be, you know, community-led. I don't want anybody to fork. I'm fine with that. This is not a value judgment. is just something you need to be aware of especially because a lot of these projects of course advertise themselves is very different. Yeah. Um only office will advertise themselves basically similar to

collabor online uh or or the Libra Office project but they're very different in terms of the real openness even though technically they all have the AGPL license and Android. I already mentioned this um every one has a every one of these has a nice overview on the bottom. It's a communityled project. So basically yeah the discussions about the projects happen uh it's a gitlab instance I think

um and yeah you're you're welcome to help uh contribute there your thoughts but also propose for example projects to look at etc. Um, yeah, it's a uh and look, the people who do this, they're not lawyers. Uh, I've contributed a bit. I'm not a lawyer either. Um, so yeah, don't don't take this as legal advice, but just take this as a start maybe to do your own

research and look a little bit. I mean, what what are the things you need to look at? So, let's say you are an Ospo or you are, you know, in a company and you want to say, okay, we want to deploy a piece of software. What are our options? Then these are the kind of things you should look at. Who controls the road map? Is it buildable?

Can I just independently build it and run it without having to depend on the vendor or vendors behind it? Um, can be true both for a library, for a platform or even infrastructure tools. You should know basically who contributes. Are they all paid by one company? Is there multiple companies that are contributing? It has a big difference in in how free you will be and yeah, what

the long-term future is of each of these projects. So, I want to end it here. uh open the floor maybe maybe somebody says okay um has some thoughts or questions or anything to add um now is your time it's up to you >> thank you >> now does anybody have a question yeah >> there's a hand already >> hey uh thanks so internally I tend to call

these kind of discussions risk evaluation because in the end for a company that's a kind of business risk if we depend on certain kind of stuff. Um, and the stuff that you mentioned are really well understood for the last 10 to 15 years, but there might be more or other risks. And I'm looking for basically other companies willing to share their risk evaluation criteria >> cuz there

is probably like 30 things on my mind and the companies I've talked so far to none of them want to share those kind of criteria publicly which makes my job quite hard to discuss those kind of criteria because I have to come up with more than those five that you mentioned. >> That's really interesting. So that sounds a bit like a call for OSOS to get together

and discuss the criteria on which they judge open source projects. Yeah. Um yeah, I mean I'm guessing your approach is like I mean for some of these it's not so hard, right? You can see on GitHub how the road map goes. You can see how many people contribute, who's paying them. You can puzzle out as well. It's hard to put hard numbers on it, but often well

it's not like there are 50 projects to choose from. Usually there are one, two, three and you can do um but this interesting maybe um h trying to think if there is a venue to to discuss these subjects. Um >> chaos. >> Yeah, maybe not a question but this could be interesting. Does somebody have a suggestion of where this could be discussed? The chaos >> the chaos

>> community the >> ah the chaos >> the chaos community discusses those uh parameters those uh um and I think there was also a business discussion uh last time uh so reach out to Cornelius from the business I think he would be good to contact >> Cornelius Schum >> yes >> yeah yeah yeah I mean you know him so that's an easy one yes okay u is

that public those discussions Okay. Well, there you go. Sounds like a problem solved. Worth it. Um, anybody else questions? I have one at the two at the front, one at the back. >> Hi, choose for the presentation. I come from the open LLM communities and it's a completely different part of the OS environment. I feel like we've got OS here and OS AI out here and all

the principles seem not to apply to open LMS. Let's say can you build it yourself kind of but you don't have access to GPUs to supercomputers who contributes mostly there are a couple of tech leads who've got those keys to supercomputers and who push the button to train and >> well I feel like I haven't seen a large language model community not the small language model because

those you can train yourself but those working on large language models it's always some kind of a I don't want to say mafia >> Mhm. >> But uh >> but mafia, >> have you have like is there even a like a vision for the true opensource LM because I have none right now. >> Yeah, there's been some discussion about it of course and the OSI has been

trying to create criteria and there have been others working on it as well. Um, the way I see it, it's very similar to open hardware, which you know, 20 years ago was like like not really a movement that you would expect to go anywhere. I mean, who can build a CPU, right, as a community? And yet today, the open hardware movement has really evolved and there's some

amazing stuff happening there. Um, the day before Fosdam, uh, two days before Fosdam, there were the open source awards. I don't recall the exact name but two days before falsam they did this uh and one of the winners was an open hardware um yeah person pushing open hardware basically or two I think uh there's really something happening there so in time these things tend to democratize in

big part because people like you push on it right like there will be things pos possible but it'll take time especially given the hardware requirements at the moment for LLMs yeah that's that's a tough one but again that was the case with open hardware or two when they found solutions like you know wafer sharing uh for example and it's now possible for relatively you know yeah for

a student or for a university to to to develop uh a chip design and wafer share to get this printed for a very reasonable cost together with other universities and other projects so I think it'll come it'll it's all still very new right so um Yes. >> Yeah. Um thanks for your talk. Um I have in my opinion or from my perspectives where there is another point

an important point um to have a look for. It's the hosting platform. Uh you mentioned GitHub in the project examples. So from my perspective is a centralized closed platform and perhaps it is not a good idea to host there if you really want to develop free and open source software because of the SW kill switch button. Yeah, I'm I tend to be a very pragmatic person when

it comes to tools. Uh I happy to share stuff on LinkedIn even though well I'm not a huge fan of the platform. I remember in my KD times a very long time ago. Uh I actually introduced Google Docs to collaboratively work on documents simply because it was the best that was available at the time. But later EtherPad came out and of course we switched to EtherPad and

it's I think similar with the open LLM movement. Um I think you need to find a pragmatic middle ground. um GitHub at the moment there are now alternatives that are building and getting better and better and they're definitely maybe not fully at the same level. Um but I'm personally keeping an eye on those to move projects I care about uh there. Um I would say it is

also important to use the right tools and get the benefit uh while yeah while the open alternatives aren't there cuz I mean you know we can't all solve all problems ourselves you know what I mean everybody every project has to focus on what they can fix and you know you can't say hey I want to build a project to do X but let me also fix you

know the infrastructure and fix you know what I mean like too much can be Yeah. So I I in principle I agree it would be better if but I think that you know if as a project you try to have the maximum impact you should try and use the best tools for now while you can. I wouldn't be too extreme in it. Sorry it's >> no that

certainly absolutely yes. All right, one more question. >> Just a quick followup to two earlier questions of this one on forges. As somebody who represents a competitor to GitHub, just want to add >> that the main thing these platforms need is your vote of support more so than improvements to the software. The software is mostly there and helping with the network effects is the really big challenge.

And then to add to the earlier question about uh where to talk about things like risk assessment, another place would be the rightfree software.org org forum which I think is kind of purpose-built for this kind of conversation. Just wanted to add that as a possible venue. >> Thank you. >> Yeah, just another question. Um you showed really nice that um the different aspects which uh make project

A, B and C more or less open source. I wonder um how do you regard the availability and freshness of documentation especially architectural documentation because in in my opinion um it's very hard to grasp what a project um is supposed to be from the architectural side of things if there is no documentation available about it and there are studies that show that um architectural documentation is missing.

So, >> how do you regard this? >> I think up until about a year ago, I would have agreed with you. Today, if you well, one of the things that the big LLMs are really, really good at is explaining code. Um, I think you can actually get pretty darn far if you load a project into well, Visual Studio with um, you know, a uh, what is it?

Uh, the Microsoft thing or with cloth, etc., and ask it to explain what does this do, what's the architecture, etc. And you'll be contributing fairly quickly explaining code they're really good at. So maybe in a way this was a barrier that companies put up and they just lost a you know uh protective barrier there which is yay for open source. Um yeah, I think this has changed

a little bit. Um any more questions? Yeah, one in the front here. Yeah, I wanted to ask because in in the website I see that you also measure or take a look at uh BC funding as a factor of risk or not open. Yeah. >> And I'm wondering if you could elaborate that a little bit more like uh Yeah, there are a few elements to that, but

one is that it adds a kind of a degree of pressure. Of course, I've worked in a VC funded company. Uh I know there is a lot of pressure because they need the 5x in so many years kind of stuff. Um, and there is also an an kind of a stability issue because a VC can pull out fairly quickly as well. They tend to be very twitchy.

Let me put it that way. So, they go in, they throw a lot of money at it, which can be good, can be bad. Um, the high pressure like again we at Nexcloud, right? I'm one of the co-founders. We run and from the beginning we started Nextcloud different from the VC funded project we had before. uh whose name I will skip. Um and one thing is there

a lot of short-term decisions were made um which harm the long-term success and often you know you have to explain community of course as well to investors that can be tricky as long as you say oh it's just for marketing they will understand they like marketing but you know they don't actually want this shift of power because you know lock in is how you make money uh

so they will probably insist on an CLA for example so if a company is not VC funded I would expect it probably to outlast a little bit more. Uh it's a soft factor for sure. There's no guarantee. Um because yeah, if you set it up right, that shouldn't make a difference in theory. But I think it is hard in practice. I mean, if you've worked in a

big company, you might know this stuff of like, you know, oh, you can't book this yet this quarter cuz you know, the quarter needs to look good and then we do it for the next quarter even though then it's twice as expensive. That's trading short-term good numbers for long-term costs and viability. And that's what you sometimes get with these pressures basically. And I think it's just a

risk factor that adds to it. It's not necessarily evil. It's not black and white. It's just a risk factor to keep in mind. Look at Matrix um and how they are doing. Um not amazing. The company behind it element I think um yeah it's not great. I think if you depend on that or work there it's just tricky I think with venture capital because of the short

timelines the the short time horizon that they have. Thanks a lot for uh this interactive session.