{"id":87879,"date":"2023-02-14T04:45:00","date_gmt":"2023-02-14T04:45:00","guid":{"rendered":"https:\/\/cloudnewshub.com\/?p=87879"},"modified":"2023-02-14T04:45:00","modified_gmt":"2023-02-14T04:45:00","slug":"executive-interview-putting-a-value-on-open-source","status":"publish","type":"post","link":"https:\/\/cloudnewshub.com\/?p=87879","title":{"rendered":"Executive interview: Putting a value on open source"},"content":{"rendered":"
<\/div>\n

Per Ploug, open source tech lead at Spotify, has worked in open source<\/a> for many years and, having watched its evolution, he believes that companies are now far more aware about \u201copen source\u201d actually means. \u201cI think they\u2019re clearer on the cost side and also on what it means to adopt open source in more strategic ways,\u201d he says.<\/p>\n

Open source avoids so-called \u201cvendor lock-in\u201d, where end user organisations are tied into complex commercial software contracts. The rate of their IT architecture decision change is often dictated by the supplier of this software. But, while open source does not have the same level of lock-in, the flexibility it offers can be a double-edged sword for a lot of companies. \u201cI think open source gives you access to technology you wouldn\u2019t have the capabilities of developing yourself,\u201d he says.<\/p>\n

This means organisations can take a leap into an area of technology where they may lack sufficient know-how. In doing so, the user of the open source software is tied to the technology innovations they deploy.<\/p>\n

\u201cWhen you make these bigger investment choices, I think everyone needs to understand whether what they are adopting is something that\u2019s close to being a common standard<\/a> in a given area, or whether they are basically creating a dependency on something which is losing market share and possibly also mind share.\u201d<\/p>\n

Choosing the latter will result in the organisation having to move away from this open source tool at some point, which can be very costly.<\/p>\n

He says that if open source did not exist, the big technology firms would monopolise technology to serve particular niches of customers. Such technologies would likely be very expensive, which would make them only suitable for the bigger enterprises. \u201cSmaller companies would not be able to afford these kinds of things,\u201d says Ploug.<\/p>\n

For instance, Spotify began using open source from the very start, and this has allowed it to grow. \u201cWhen we were tiny, we used open source as a quick leap into markets, and I think we have developed a strategic approach to open source above everything else,\u201d he says.<\/p>\n

\n

<\/i>Making strategic open source choices<\/h3>\n

At Spotify, developers can pick and choose from a wide variety of libraries based on their own choices. But for bigger strategic investments, Ploug says Spotify will assess open source technology rigorously if it will become a standard that the business can depend on for a longer period of time, to ensure it is not prematurely forced to move away to a newer technology.<\/p>\n

One example, which he says, with hindsight, is quite amusing, is: \u201cOn the day before Kubernetes was released<\/a>, we open sourced our own container orchestration layer.\u201d<\/p>\n

A more positive project for Spotify is Backstage<\/a>, which Ploug says it has made open source, as a way of creating a common standard. Backstage is an open source framework for building developer portals, created at Spotify, which it donated to the CNCF. It has now been adopted by hundreds of companies. <\/p>\n

\u201cWe didn\u2019t want to just wait and see and keep it internal,\u201d he says. \u201cWe wanted to drive innovation in the space of developer portals.\u201d<\/p>\n

In doing so, Spotify Backstage has become the market leader. The company continues to invest internally but, by donating it to the CNCF, Ploug says Spotify also ensures it will \u201cstay around\u201d, which gives internal users the confidence to carry on using it.<\/p>\n<\/section>\n

\n

<\/i>Financial sustainability<\/h3>\n

Ploug believes the idea of having confidence that an open source product has longevity goes to the heart of the problem currently facing the open source community. \u201cWe have an enormous financial sustainability problem in open source,\u201d he says. \u201cI think a large number of open source maintainers are underpaid or underappreciated. They are also stressed about the rising demands on open source maintenance that we are seeing.\u201d<\/p>\n

Organisations using open source code need to understand the implications. \u201cYou don\u2019t have a service level agreement with this provider,\u201d says Ploug. \u201cIt\u2019s not a vendor. You\u2019re not paying the person who maintains the code. There\u2019s no supplier relationship [contract].\u201d<\/p>\n

The lack of a service level agreement has a material impact on the effectiveness of industry-wide initiatives to improve open source security.<\/p>\n

\u201cI think a lot of the problem comes from lack of maintenance,\u201d he says. \u201cThis is because maintainers simply don\u2019t have the time or they\u2019re not paid for their work and are running these projects in evenings and weekends.\u201d<\/p>\n

As a result, Ploug does not believe the concept of a software security supply chain can work in open source. Since the maintainers are not being paid, they are not a supplier. \u201cYou don\u2019t have a supply chain,\u201d he says.<\/p>\n

It\u2019s still not a common practice for companies to support projects financially, and Ploug would like to see more organisations which use open source offering financial support for open source projects.<\/p>\n<\/section>\n

\n

<\/i>Widening the talent pool<\/h3>\n

Given that only certain people are able to give up their time to maintain open source projects, he worries that this limits the community to a very particular demographic.<\/p>\n

\u201cIt\u2019s a very specific kind of person who has a passion to spend evenings and weekends working on open source,\u201d says Ploug. \u201cThat\u2019s someone who has no household chores, no kids to maintain, no family life, no sick relatives.\u201d<\/p>\n

He says open source needs to become more of a level playing field that is able to attract a diverse community of contributors and maintainers. This is also linked to the financial problem, and the industry and policy makers\u2019 ambitions to put in place software security supply chains.<\/p>\n

If maintainers and open source contributors are paid and projects are sponsored, people are more likely to see their role in the open source community as a vocation. And the contract they have with users of the code they develop and maintain is financially binding, which gives those users a service level agreement and accountability.<\/p>\n<\/section>\n","protected":false},"excerpt":{"rendered":"

Per Ploug, open source tech lead at Spotify, has worked in open source for many years and, having watched its evolution, he believes that companies are now far more aware about \u201copen source\u201d actually means. \u201cI think they\u2019re clearer on the cost side and also on what it means to adopt open source in more […]<\/p>\n","protected":false},"author":1,"featured_media":87880,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[533],"tags":[],"class_list":["post-87879","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-it"],"_links":{"self":[{"href":"https:\/\/cloudnewshub.com\/index.php?rest_route=\/wp\/v2\/posts\/87879","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cloudnewshub.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cloudnewshub.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cloudnewshub.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/cloudnewshub.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=87879"}],"version-history":[{"count":0,"href":"https:\/\/cloudnewshub.com\/index.php?rest_route=\/wp\/v2\/posts\/87879\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cloudnewshub.com\/index.php?rest_route=\/wp\/v2\/media\/87880"}],"wp:attachment":[{"href":"https:\/\/cloudnewshub.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=87879"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cloudnewshub.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=87879"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cloudnewshub.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=87879"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}