View of the Prague Castle lit up at night from across the river.
General

Open Source Summit Prague: Sovereignty, Metrics, and Burnout

At the Open Source Summit EU last week in Prague, there were a few common themes that I wanted to write about with the caveat that these are, of course, not the only themes, and they were certainly biased by the types of talks that I chose to attend.

Digital Sovereignty

This was an EU event, so it wasn’t surprising to see digital sovereignty front and center in a bunch of talks. The opening keynote talked about the results from the newly released 2026 State of Open Source in Europe, which found that 94% of European organizations think digital sovereignty is strategically important (61% very important). The EU sees OSS as a solution that offers availability, transparency, and a forking safety valve. However, single vendor OSS trades one dependency for another, so there is a preference for openly governed OSS where projects are under neutral foundations. Security & privacy were also important drivers of digital sovereignty.

Nithya Ruff and Johan Linåker talked more about this in their keynote, Open Source at a Crossroads: Geopolitics, Sovereignty, and the Fight to Stay Open. They started by diving into the geopolitical backdrop in Europe that has led to a lack of digital sovereignty. To start, the prolific use of outsourcing has led to a capability gap, lock-in, and structural dependencies. Geopolitical tensions have turned these dependencies into risks to autonomy and resilience. Now we’re seeing governments waking up at different speeds to regain control. Open Source is now a strategic pillar in national and European technology policy as a way to begin to regain this control while balancing sovereignty with global collaboration. Governments can use the same model as industry by innovating at the edge to maintain national policy and strategic autonomy while staying as open as possible to collaborate on shared digital public infrastructure. Governments need to choose where to collaborate, invest, and control because sovereignty is a set of decisions, made layer by layer.

Maintainer Burnout 

AI was also a hot topic, but I’m less interested in writing about AI itself, and more interested in talking about how the use of AI in open source is impacting the people leading our projects in the form of maintainer burnout. A common thread throughout the conference was that maintainers are drowning in AI slop PRs that are increasing the workload for already overworked maintainers. 

My Software Stewardship Lab colleague, Miranda Heath, had an entire talk about maintainer burnout based on her research, which can be found in this report. She approached the topic of burnout during her talk as a structural problem that we can solve together. The causes of burnout vary, but include the difficulty in getting paid, workload and time commitments, unrewarding maintenance work, hyper responsibility, and toxic communities. When it comes to solving this issue, it’s important for all of us to remember that burnout is a system-level issue that requires us to collaborate on system-level fixes, rather than it somehow being our fault that we are burning out. We need to also make it easier for people to get paid, give people more autonomy over their work, and be kinder to each other. If you are interested in sponsoring research on maintainer burnout, software supply chain security, or related sustainability topics, reach out to us at the Software Stewardship Lab.

Evolving Metrics Needs

For quite a while, I’ve been convinced that how people are thinking about open source metrics has changed, and I think we could do more within the CHAOSS project (and elsewhere) to evolve with the changing needs of the software ecosystem. 

In Daniel Izquierdo’s talk, he talked about how metrics were originally for the communities themselves, but the people asking for the metrics have gradually shifted over time from community managers -> OSPOs -> security and compliance teams -> regulators and procurement. The questions people are asking have also shifted, and we’re still missing a shared health vocabulary for SBoMs, ability to set thresholds that depend on context, ways of telling AI-generated noise from real work, and implementation of mitigations for projects the data flags as at risk. Alyssa Wright and Adam Herzog had a similar presentation about measuring what matters, since what we tend to measure often misses bigger, fundamental issues with projects that can lead to major security concerns. They talked about how Active ≠ Healthy ≠ Secure where popularity and metric volume do not equal project health or supply chain security.  Rather than focusing on questions like, ‘is this package vulnerable? or how many CVEs does it have?’, which tell you what already broke and are a record of the past. Instead, they recommend questions about what happens or could happen next, like: ‘is the software we depend on actually healthy? is it sustainable? who is holding it up, and how many of them are there?’ Both of these talks were using the same tooling to look at NPM packages, which can be found at https://health.purldb.io/api/ and https://github.com/aboutcode-org/healthycode.

The day before the summit, at the OpenChain x OSPOlogy day, I led a workshop titled: Strategic Approach to Improving your OSPO using CHAOSS, which I already talked about here on my blog. I also gave a talk about taking a Strategic Approach to Demonstrating the Value of Open Source Efforts, which was less about metrics, and more about how to demonstrate value by focusing on how your OSS work helps the organization achieve their strategies and goals. Every organization has unique needs and goals based on what they are trying to achieve, so there is no “one size fits all” way of demonstrating value, but aligning your OSS strategy with your organization’s goals and focusing on the most strategic projects can help show the value of your efforts.

Summary

As always, the hallway track was excellent, and it was great seeing everyone! I enjoyed many of the other talks at the Open Source Summit, and the videos usually come out shortly after the event, so I encourage you to have a look at some of those other talks!

Related Resources:

As with everything I write, this was written by a human without the use of LLMs or other AI assistance.