Tag Archives: open source

General

Part 2: Additional Sustainability Topics From the CHAOSS Practitioner Guides

This is the second post in a series, so I encourage you to go back to read the previous post about Building Healthy and Sustainable Projects Using CHAOSS Practitioner Guides if you haven’t already read it. The first post covered the introduction, contributor sustainability, responsiveness, and organizational participation, which were the original 4 guides in the series. 

Shortly after we launched the Practitioner Guide series, we followed up with three additional getting started guides on security, diverse leadership, and sunsetting a project. As I mentioned in the first post in this series, starting with the Practitioner Guide: Introduction – Things to Think about When Interpreting Metrics can help interpret metrics in light of your unique situation. Again, interpreting the metrics and figuring out what they are telling you is only useful if you take the additional step of driving appropriate actions to make decisions and improvements based on those metrics, and each guide provides recommended actions.

Security

Open source project security impacts the health and sustainability for our projects, which ripples out across the entire software ecosystem as dependency / supply chain components. Because security is a complex and critical topic, this Practitioner Guide: Getting Started with Security is designed only to get you started on your path toward improving the security of your project; it is not a comprehensive guide to everything you need to know about open source project security. The guide has suggested starter metrics that include OpenSSF Best Practices Badge, Libyears, and Release Frequency along with additional metrics that might also shed light on the security of a project. 

Recommendations for improvement from the security guide include:

  • Secure your code repository by managing access, implementing branch protection, managing contributions, and more.
  • Create a detailed security policy document (usually in a SECURITY.md file) with instructions for reporting security vulnerabilities along with documenting how the project will respond to those reports, including managing embargoes.
  • Keep your dependencies up to date and use tooling (e.g., Dependabot) to help identify and update your dependencies.
  • Make sure that your security fixes land in a release as soon as possible.
  • Working your way through the OpenSSF Best Practices badge criteria is also a good way to make security improvements.

Diverse Leadership

Without diverse leadership, underrepresented groups may face challenges in participating in and contributing to projects, losing valuable talent and ideas, so a huge thank you to Peculiar C. Umeh who drove the creation of the Practitioner Guide: Getting Started with Building Diverse Leadership! The guide focuses on three key metrics: Board/Council Diversity, Sponsorship (supporting people, not financial sponsorship), and Inclusive Leadership. The data collected can provide valuable insight, but storing, interpreting, and acting upon it requires careful thought to protect identities and be respectful of the people whose data has been collected.

Actions to take include to improve diverse leadership:

  • Start by creating and communicating clear pathways for contributors to grow into leadership roles, which may include creating sponsorship opportunities and transparent criteria for leadership positions.
  • Hold existing leaders accountable for promoting and improving inclusive leadership.
  • Implement programs that encourage diverse representation in leadership and promote diverse perspectives.
  • Regularly monitor and evaluate the diversity of all leadership roles by collecting and analyzing survey data and reporting progress to the community.

This was a challenging guide to write, and it can be a challenge to implement these recommendations. Open source communities are often global and encompass diverse people and backgrounds, so there is a need to avoid imposing a one-size-fits-all approach and be open to adapting strategies to fit the unique needs and values of different groups within your community. Each project should ensure that their practices are inclusive, making all members feel heard and valued, regardless of their background or identity.

Sunsetting (Winding Down and Archiving)

The Practitioner Guide: Getting Started with Sunsetting an Open Source Project is quite different from the other getting started guides because it’s not about making project health improvements or increasing sustainability, but instead about responsibly and proactively shutting a project down when it’s reached a natural end. It’s important to remember that not every open source project can or should exist forever: technologies evolve, corporate priorities change, and people’s interests change. Part of the beauty of open source is that we work in the open as we innovate, and some of those innovative projects will stand the test of time, while others should be responsibly deprecated via a sunset process. The guide looks at several metrics to determine whether a project is still active, Change Requests, Issues New, and Technical Forks, but the guide also covers other reasons for sunsetting a project. 

Once you’ve decided to sunset a project, there are several recommended steps:

  • Communication should start with any existing contributors, since there may be contributors who would like to continue the project. When you decide to sunset the project, this needs to be communicated to existing users in a transparent manner and being clear about the reasons for sunsetting it.
  • Do a code and security review to get it into the best possible shape before archival.
  • Review and resolve open issues and change requests (PRs / Merge Requests), including marking some as ‘won’t fix’.
  • Use the checklists and tools linked from the guide to help with this work.
  • Officially archive the repositories and consider adding the code to Software Heritage for preservation over time.
  • There are also recommendations for handling the special case of sunsetting an active project, which can happen when a company changes strategy or when an individual needs to step away. 

Sunsetting a project is not an indication of failure and should not be positioned as such. Projects have life cycles; they endure for as long as they are needed and then they should be responsibly deprecated when they are no longer needed. Consider providing transition details, and if possible, tooling that helps your existing users transition to an alternative solution if a reasonable one is available. I’d also like to express my thanks to Stefka Dimitrova whose work drove much of the content in the guide and to the team from the US Centers for Medicare & Medicaid Services OSPO who made significant contributions and improvements to the sunsetting guide.

Summary

Improving open source project security and increasing diverse leadership can help a project become more sustainable over time, but when a project has reached the end, it can be responsibly sunsetted, instead of being abandoned. The CHAOSS Practitioner Guide series can help with all of these activities. Come back next week for the next post in this series, ‘Part 3: Determining Value and Viability Using CHAOSS Practitioner Guides’.

As always, if you want feedback or help with open source strategy, sustainability, governance, or related open source topics, I’m available for consulting engagements.

Additional Resources:

As with everything I write, this was written by a human without the use of LLMs or other AI assistance.

General

Part 1: Building Healthy and Sustainable Projects Using CHAOSS Practitioner Guides

Metrics can provide deep insights into our open source projects, but they can also be overwhelming, and because every open source project and every situation is a bit different, metrics require interpretation. And that’s only the first step. Interpreting the metrics and figuring out what they are telling you is only useful if you take the additional step of driving appropriate actions to make decisions and improvements based on those metrics. I’ve been working in open source and using metrics for decades, but for me the metrics have never been what’s important. They are simply the means to an end, a way to make improvements or demonstrate whether we are accomplishing our goals. 

This is why I focused on creating the CHAOSS Practitioner Guide series during my three years as CHAOSS Director of Data Science, and I’m proud of what we, as a community, accomplished with these guides. I’ve written quite a few blog posts about the individual guides, but I wanted to take some time here to reflect on the guides and talk about how they can be used together as a cohesive whole. The guides roughly break into two categories, which I’ll address in a series of four blog posts. The first category focuses on health and sustainability of open source projects. This post is about the first category, ‘Building Healthy and Sustainable Open Source Projects’, with part 2 coming next week to cover ‘Additional Sustainability Topics From the CHAOSS Practitioner Guides’. The second category of guides are the more advanced ones dealing with complex topics, like value, viability, and impact, that span multiple projects. Part 3 in the series focuses on value and viability while part 4 will cover determining impact.

Overview

We launched the Practitioner Guide series with a few getting started topics that apply to almost every open source project: contributor sustainability, responsiveness, and organizational participation.

The guides are paired with as ‘Introduction – Things to Think about When Interpreting Metrics’ as a starting guide with more details about how to interpret metrics in light of your unique situation. The introduction has general suggestions about how you should spend time understanding the goals of the project and talking to the people working within the project as key inputs into interpreting metrics. When it comes time to look at the metrics, focusing on trends over time for just a few metrics can help cut through the noise before drilling down into the details where there might be a potential issue. This is why each getting started guide focuses on just a few metrics to get started with tips for expanding to additional metrics as needed.

Every project is a little different, so it’s essential to interpret the metrics in light of a project’s individual needs and ways of operating. It’s also important to remember that metrics are more than just data, they represent actual human beings, so it’s important to be careful about comparing people against each other in ways that might result in the punishment of individuals. The non-human data (e.g., bots, automation, AI) should also be carefully taken into account in your interpretation of metrics. The Introduction – Things to Think about When Interpreting Metrics guide has more details about how to think about metrics and use what you’ve learned productively and ethically.

Contributor Sustainability

The Practitioner Guide: Getting Started with Contributor Sustainability focuses not just on determining whether you have enough contributors to sustain a project over the long-term, it also has tips for increasing contributor sustainability while keeping in mind that new contributors can also create additional burdens on the time of already overloaded maintainers. The guide includes Contributor Absence Factor, Contributors, and Types of Contributions as the key metrics to start investigating contributor sustainability.

To improve contributor sustainability, here are just a few of the recommendations from the guide:

  • Start by looking at your existing contributor base to determine whether you have people who are ready to step into a maintainer role, even if they start by maintaining just a sub-project. If there are people who are almost ready, some mentoring or reviewer roles might be a good first step. 
  • Before starting to recruit new contributors, it might help to review and update existing contributor guides and other onboarding documentation to help people get up to speed quickly while requiring less help from existing maintainers.  
  • Good first issues and help wanted labels can help new contributors get started on something productive, especially if those issues are created with the information that a new contributor needs to know to accomplish the task.
  • Be proactive about asking people for help with specific tasks. Knowing that we’re wanted and appreciated makes us feel good, which can be a strong motivator to contribute to an open source project or to continue contributing.
  • Defining the roles and responsibilities for contributors, reviewers, and maintainers as a contributor ladder where contributors can climb up to become reviewers and those reviewers can become maintainers can help with recruiting new people into these roles. 
  • Think about how people can move into leadership positions to be responsible for documentation, community management, marketing and other important roles.

Responsiveness

Responsiveness is one of the most important factors in attracting newcomers and retaining existing contributors for a project. The Practitioner Guide: Getting Started with Responsiveness uses Time to First Response, Time to Close, and Change Request Closure Ratio as the key metrics to help determine whether a project is responding to requests in a timely manner. It can be tempting to attempt to solve issues with responsiveness by putting more pressure on existing maintainers by asking them to respond more quickly and resolve more contributions, but this rarely solves the long-term problem. It might result in short-term gains, but it could be damaging to the community and the project over time if you are burning out your maintainers by not resolving the underlying problems that are causing the lack of responsiveness in the first place.

Some suggestions for improving responsiveness from the guide include:

  • As suggested in the contributor sustainability guide, start by looking at whether you can promote some existing contributors into reviewer or maintainer roles.
  • Use the project’s contributing documentation to set expectations about when to expect a response to a contribution.
  • Use issue and change request templates to help contributors make good contributions that require less work from maintainers.
  • Talk to your maintainers and find out where they are spending too much of their time and focus documentation or recruitment in those targeted areas.

Note that responsiveness is hard to diagnose because many things can impact responsiveness, so don’t be discouraged if your first attempt doesn’t result in improvement.

Organizational Participation

Organizations can have a significant impact on the health and sustainability of an open source project. On the one hand, organizations can help sustain projects over time by employing people to work on projects, but they also introduce risk (e.g., from relicensing, strategy shifts, acquisitions) when one organization is too dominant. From a contribution standpoint, it can be difficult if one organization has all of the influence and other people don’t feel like they are participating as equals.

The Practitioner Guide: Getting Started with Organizational Participation uses three primary metrics, Organizational Influence, Organizational Diversity, and Elephant Factor, to understand organizational participation. 

The recommendations for improving organizational participation depend on whether the improvement is coming from the dominant organization. From the dominant organization:

  • Contribution documents should be clear about whether contributions are accepted from people outside of the organization and whether those people can move into leadership positions. Transparency and setting expectations can reduce frustration from other contributors.
  • Spend some time thinking about why the project isn’t getting contributions from other organizations. Is all of the work happening in the open, and can others easily find decisions and discussions in public channels? If not, some work might be required to redirect private conversations into the public channels.
  • Promote opportunities to contribute via social media, conferences, and other channels.
  • Use your existing connections to other organizations who are using the project to encourage specific people to contribute.

From outside of the dominant organization: 

  • Engage in the project to determine whether contributions are really welcome.
  • If so, encourage your employees to contribute to the project as part of their time at work. Don’t expect employees to contribute to work projects in their free time.

Being transparent is critical. Saying one thing in the documentation and doing another can damage your organization’s reputation more than just being honest and transparent about how people can (or cannot) contribute to a project. If you are considering using an open source project as a key component of your organization’s products or infrastructure, you should think very carefully about that decision when that project is controlled by a single organization.

Summary

Increasing contributor sustainability, improving responsiveness, and garnering participation from a variety of organizations can all help improve the health and sustainability for an open source project. Check back next week for the second blog post in this series about security, diverse leadership, and sunsetting an open source project.

As always, if you want feedback or help with open source strategy, sustainability, governance, or related open source topics, I’m available for consulting engagements.

Additional Resources:

As with everything I write, this was written by a human without the use of LLMs or other AI assistance.

General

Launching the Software Stewardship Lab

I’m excited to be a part of the new Software Stewardship Lab, which is launching today! The Software Stewardship Lab is a new organization dedicated to funding research on open source sustainability, a topic very near and dear to me that I’ve been focused on for the past few years. The entire technology ecosystem relies on open source infrastructure, and there are some great organizations funding maintainers and projects, but at the Software Stewardship Lab, we’re focused on funding the research that helps us all answer questions about important topics like analysis of critical dependencies and packages analysis, which ones are / are not well-maintained, and how the maintainers of those open source projects are handling the load while avoiding burnout. 

I’m part of the team shepherding this effort. Many of the others are people that I’ve been following and have a deep respect for the work that they have been doing, so I am looking forward to continuing to learn from all of them! The team includes: Our Executive Director Vlad-Stefan Harbuz (Open Source Pledge / Open Source Endowment), Andrew Nesbitt (ecosyste.ms), Miranda Heath (report on burnout in Open Source), Daniel Roe, (Nuxt / npmx), Matias Capeletto aka patak (npmx), Mike McQuaid (Homebrew), and myself.

But we can’t do this alone. We’re looking for organizations to fund the important research that we’re doing at the Software Stewardship Lab, so that people can get paid for focusing on research around software supply chain security and maintainer burnout. Please have a look at our sponsorship page for more details about how you can help support this critical work.

You can learn more about the lab by reading our announcement post and exploring our website.

I mentioned earlier that open source sustainability is a deeply important topic for me. I think it’s important for maintainers to have the funding and other resources that they need to build projects that can become sustainable over the long haul. I’ve written many articles related to open source project sustainability, so I won’t say more now, but will instead point you to a few previous posts from my blog:

If you want feedback or help with open source strategy, sustainability, governance, or related open source topics, I’m available for consulting engagements.

As with everything I write, this was written by a human without the use of LLMs or other AI assistance.

General

Thoughts on Governance

Having good open source project governance allows us all to collaborate and work together to build more sustainable, healthy and successful projects. It’s something I’m particularly passionate about, and I’ve frequently written about it here on this blog. I collected all of those links in this post: Good Governance for Open Source Projects. Writing those posts made me realize that I hadn’t given a full presentation about governance in a while, so I was excited to have the opportunity to speak about Proactive Governance to Build Sustainable Open Source Projects at the Linux Foundation Open Source Summit NA in Minneapolis in May 2026. The slides and video for that talk are now available.

While I spend more time talking about open source project governance, I’ve also started thinking more about public governance and how open source can be a key part of a digital sovereignty strategy. But the open source impact on public governance goes beyond just digital sovereignty, which is why I was so excited to be invited by OpenGov Africa to talk more about the intersection between open source and public governance last week. The slides and video for that talk are also online.

Related Resources:


Image by the CNCF (CC BY-NC 2.0)

General

A Strategic Approach to Demonstrating the Value of OSS Efforts

OSPOs and other open source teams often struggle to demonstrate the value of their work in a way that resonates with the people in leadership positions within their organization. The topic of demonstrating open source value is one that I’ve been blogging about and giving presentations about frequently over the past year, so this blog post is a way for me to collect all of that work in one place to make it easier for people to find.

In the CHAOSS OSPO Working Group, which I co-chair, the topic of how to demonstrate the value of our work in open source has been a popular topic since we started the group many years ago. However, given the current financial climate and the number of OSPOs that have been the targets of cutbacks and layoffs, this feels like a particularly important topic right now.  This is why we created a CHAOSS Practitioner Guide all about Demonstrating Organizational Value, which I blogged about when the guide was launched.  In a second blog post on the topic, More about Demonstrating Organizational Value, I talked about the episode of CHAOSScast where Bob Killen and I joined Harmony Elendu to share our thoughts about how organizations can more effectively demonstrate the value of their open source efforts.

I expanded on this topic in another blog post, OSPO Contribution Strategies to Demonstrate Value. This post highlights how to articulate the importance of your contributions to upstream projects as part of a broader open source strategy, which often has 2 components: 1) identifying which projects are most strategic / critical for your organization and 2) creating contribution strategies for individual projects. The blog post has examples of how I did this when I worked at VMware and Pivotal.

I’ve also presented on this topic several times recently, but I wanted to highlight the two most recent talks, since they are the most comprehensive examples of these presentations. I blogged about my talk for the folks from CURIOSS (Community for University and Research Institution OSPOs) where I expanded on the content in the guide to also include more about how to demonstrate value in a university context. I further expanded it beyond corporate and university contexts to include how government / public sector organizations can demonstrate the value of their work in my talk at the Open Source Summit in Minneapolis a few weeks ago. Here’s the video and slides for this most recent version of the talk.

If you want feedback or help with your open source strategy and how to demonstrate value for your organization, I’m available for consulting engagements.

Related blog posts:

General

CURIOSS: Demonstrating Open Source Value

The lovely folks from CURIOSS (Community for University and Research Institution OSPOs) invited me to join them in March as part of their Deep Dive series of talks. I gave a quick overview of CHAOSS before diving into one of my favorite topics: demonstrating the value of open source efforts. This is the first time I’ve given this talk with some additional content about how to demonstrate value in a university / academic context, which is a bit different from how we think about value in corporate environments.

The slides and video are available for you to enjoy!

Related resources:

General

Transitions

TL;DR version: As planned, my time as the CHAOSS Director of Data Science has come to an end, but I’ll still be around the CHAOSS community as a board member and Working Group (WG) lead. I’ll be taking April and most of May off before transitioning into open source strategy consulting starting in June.

The CHAOSS Director of Data Science role was funded by an Alfred P. Sloan Foundation grant for 3 years, so the plan was always to move on to something else when it ended in March 2026. I’m very proud of what we’ve accomplished in 3 years, so a huge thank you to the folks at the Sloan Foundation for the funding that allowed me to focus on this over the past few years. When I started this work, one of the first steps was to create the CHAOSS Data Science WG, which has allowed us to grow the data science community. We started the Practitioner Guide series within the WG and have published almost a dozen guides on a wide variety of topics! We also launched several research projects in addition to the Relicensing and Forks project that I’ve been focused on over the past few years. You can learn more about what we’ve accomplished by reading our updates from January 2025, June 2025, and November 2025. I feel confident that the CHAOSS data science community and the WG are in good hands as I step down and leave the work in the very capable hands of the other 2 co-chairs, Cali Dolfi and Sal Kimmich, and maintainer, Ernest Owojori.

However, I’m not leaving the CHAOSS community. I’ll still be on the CHAOSS Governing Board and will continue co-chairing the OSPO WG, Funding Impact Measurement WG, and the Education WG. All of these WGs have co-chairs, so WG meetings will continue and nothing should change while I’m enjoying some time off to rest and recharge in April and May. The only exception to my time off is to attend the Open Source Summit in Minneapolis in May, since I didn’t want to miss it. I’m disappointed to need to say this, but I also wanted to make sure people know that this transition and the time off has been planned for over a year and has nothing to do with the current drama unfolding in the CHAOSS project this week.

What’s next? While I’ve enjoyed being able to focus on data and metrics over the past few years, I’ve found that I missed working on open source strategy, which has been my focus over the past two decades. The data science work was a fun diversion, but now I’m ready to get back to my roots. Starting in June, I’ll be shifting into open source strategy consulting. This is NOT a temporary solution while I figure out what to do next. My plan is to continue consulting on a part-time basis while I free up some time for my other hobbies (reading, working out / running, designing 3D prints, traveling), and to continue to do this for as long as I remain able to work. 

You can learn more about my consulting business on my consulting website, but here are a few focus areas:

  • Open Source Strategy: Crafting strategies for your OSPO, open source teams, or product teams that help employees focus their open source work in areas with the most impact along with demonstrating the value of your open source efforts to your executive team.
  • Contributor and Community Strategy: Strategies and techniques for growing your contributor base and improving sustainability for the open source projects driven by your organization and when working upstream.
  • Governance: Documenting and improving project governance processes for open source projects along with providing advice when there are governance issues or concerns.
  • Research and Data Analysis: Open to a variety of research and data projects to answer questions you have about open source projects from understanding an existing contributor base to doing audits of your GitHub organizations to understand the status of your repositories.

If you’d like my help in any of these areas, please reach out to me in June!

General

Power Dynamics, Rug Pulls, and Other Corporate Impacts on OSS Sustainability at SCALE 2026

As many of you know, this isn’t a new topic for me. I’ve written here about what your OSPO can do about power dynamics, rug pulls, and other corporate impacts on OSS sustainability along with a post on the OpenUK blog, The Shifting Power Dynamics in Open Source: Rug Pulls, Relicensing and Forks, and on The New Stack, Clouds, Code, and Control: The New Open Source Power Struggle. I’ve also given other presentations on this topic, so you can watch the video from the recent Open Source Summit EU (OSSEU) in Amsterdam, which Jon Corbett did a lovely job of summarizing in his LWN Coverage of the talk. 

I’ve been continuing to think about how power dynamics and rug pulls impact OSS sustainability, and I had an opportunity to talk about this at SCALE 2026 in Pasadena last weekend! I already blogged about how much I love SCALE, so I won’t continue to gush about how great it is. SCALE gave me a bit more time than I’ve had for the other presentations, so I added some new slides about other types of rug pulls beyond the relicensing and forks that I’ve previously focused on. I talked more about MongoDB, which kicked off the recent wave of relicensing when they relicensed under the newly created Server Side Public License (SSPL), which didn’t result in a fork. I also talked about some examples of rug pulls that came about when images / releases were put behind a paywall (Bitnami / Linkerd). My slides are a bit sparse, but available, and SCALE will also release the video of the talk if you want more details.

Resources:

I’m available for consulting engagements focused on open source strategy, contributor strategy, improving project governance, and related topics.

General

Open Source Software: A Path to Building Leadership Skills

In traditional top-down employment structures, if a manager asks an employee to do something, there is an expectation that they will do what was asked. In the manager / employee relationship, the manager has quite a bit of power over their employees. The really great managers collaborate with their employees and lead with empathy, while less experienced and less competent managers rely on power dynamics to get employees to complete their work. In contrast, leadership in open source requires influence without power, which can help build skills in leading through collaboration, influence, and empathy to help people become truly great managers and leaders. I’ve been managing people within companies for 20+ years, and I’ve learned so much about how to be a better leader and manager through my work in open source.

A common pattern in open source is that a community member finds something to contribute and then contributes it, regardless of whether they are doing this as an individual or on behalf of a company. Those contributions are often followed by an interactive feedback process. A maintainer might review the contribution and request some changes, and the contributor will usually need to make some modifications before the contribution is accepted. In this case, the maintainer needs to be able to clearly communicate the request for modifications and use their influence (not power) to convince the contributor to keep working on the contribution until it can be completed. The contributor needs to collaborate with the maintainer and maybe even negotiate a solution that works for both of them. They both need to collaborate and use influence and collaboration, rather than power to find the best solution.

Another common pattern in open source is that there are activities that need to be accomplished, but the people involved in that part of the project don’t have the time or the skills to complete those activities, or they want to use those activities as a way to encourage newer contributors to get more involved. In this case, the people who want the work done will need to reach out to the community or to individuals and encourage others to contribute. This usually means convincing potential contributors of the value of these activities and using influence and negotiation skills to help people complete this work. Again, these are valuable managerial and leadership skills that can be learned and practiced by participating in open source projects. 

These skills can be developed even if you aren’t in a formal leadership position within a project. If you are a regular contributor, there is probably something you’re working on where you could use help from others. By getting others to help with this work, you can practice your leadership skills. I also encourage people to volunteer for leadership positions. There might be existing positions that need a leader, but you can also volunteer to lead something even when that leadership position doesn’t currently exist. You can volunteer to lead a user group, facilitate a meeting, start a podcast, manage a project, or anything else you can think of that might need doing. For those of you working within OSPOs, you can encourage your employees to think about using their work in open source projects to help build leadership skills, in addition to just considering open source work as a way for someone to gain new technical skills.

I know that some maintainers don’t like to think of themselves as managers or leaders, but a lot of maintainer responsibilities are more managerial than just writing code, and they require leadership skills. Even if you don’t aspire to become a people manager as a career, the leadership skills learned in open source projects can improve your interactions with other people both personally and professionally.

Additional Resources:

If you want help with your open source strategy, I’m available for consulting engagements.

Photo by Brooke Lark on Unsplash

General

OSPO Contribution Strategies to Demonstrate Value

Many OSPOs struggle to demonstrate the value of their organization’s contributions to open source projects. A good way to demonstrate the value of these open source contributions is by showing how the work helps your organization achieve its goals, and this is an approach that I’ve used when working in several different companies.  

Every leadership team has to look across the entire organization and prioritize the efforts that have the biggest overall impact on the organization as a whole. This means that if you want your leadership to continue to staff and fund your OSPO or other open source teams, you need to make the case for why your work is as important or more important than other efforts that are also competing for limited resources. Having a clear open source strategy where you can tell the story of how the open source work helps achieve the organization’s goals is a great way for leadership to understand the importance of the work so that you can continue to do it. 

Clearly articulating the importance of your contributions to upstream projects should be an important piece of that open source strategy. This often has 2 components: 1) identifying which projects are most strategic / critical for your organization and 2) creating contribution strategies for individual projects.

Identifying Strategic Projects

When deciding where to focus your organization’s upstream contributions, I’ve seen a lot of people struggle with the difference between open source projects that are frequently used within an organization vs. the projects that are truly strategic. The way I like to think about this is by asking whether I could easily drop in a replacement. You might use a tiny library in a bunch of your products to make some task quicker and easier, but if you could easily replace it with something else, like another similar library or you could re-write it yourself pretty easily, then it’s not likely to be a strategic project that is critical to your organization. Something like Kubernetes on the other hand is an incredibly complex piece of software that could not be easily replaced, and if you’re relying on it to be able to deliver products and services to your customers, then this would probably be a strategic project for you. You’re unlikely to get much value out of contributing to that tiny library, but you might get value out of contributing to those more strategic projects. 

When I was at VMware, I was responsible for maintaining our list of strategic projects. This came about because executives would ask which open source projects were most important to us, and before creating the strategic projects list, all we had to give them was the list of packages that appeared most frequently in our products, but this wasn’t what leadership wanted. They wanted to know which open source projects were most critical or most strategic for us. We started creating a list of strategic projects by talking to the product leads in our business units to ask them what open source projects they relied on and couldn’t deliver products to our customers without those projects. It provided a window for executives into what projects were most important and most strategic while also helping our business units coordinate with each other when they were engaging in the same projects. 

Contributions Strategies for Individual Projects

This strategic projects list also provided a start toward justifying having people contributing to those projects, but it can help to dive into the details of some of these projects to look at project health, feature maturity, and other aspects of each project to decide where you might need to contribute. For example, when I worked at Pivotal, I was responsible for our open source strategy, and Kubernetes was a big part of that strategy. This was before the VMware acquisition of Pivotal, and we were in the process of making the shift from using Cloud Foundry as the base for our main products to using Kubernetes. This was a huge shift for the company. Pivotal was one of the creators of Cloud Foundry and we had a ton of influence in that project, while we were just getting started with Kubernetes. I spent quite a bit of time talking to the people in leadership who were driving this shift along with the people responsible for driving the individual product strategies with a focus on where we wanted to be in a few years. I also started engaging directly within the Kubernetes community to explore the different aspects of Kubernetes while talking to our engineers about which parts of Kubernetes were missing features or lacking maturity so that we could match what we were going to need in the next few years with the areas within Kubernetes that would need work if we wanted to base our products on top of it.

I used all of this information to create a written strategy that clearly tied our open source Kubernetes work back to our overall company mission and goals, and I was able to get people allocated to upstream Kubernetes by showing how our long term product strategies relied on specific areas within the Kubernetes code base, and outlining where we needed to make contributions to support those products. We then continued to track those contributions so that we could show the value that we were providing back to the company. 

This was my approach when I was at Pivotal and later VMware, but every company and every open source project is unique, so this requires customizing your approach so it works for your organization. The CHAOSS project has an entire Practitioner Guide on the topic of Demonstrating Organizational Value with some additional ideas for how to demonstrate and frame the business value of your open source work. If you want feedback or help with your open source strategy and how to demonstrate value for your organization, I’m also available for consulting engagements.

Additional Resources:

Photo by Ian Hutchinson on Unsplash