Speaker 1: How'd you like to listen to dot net rocks with
Speaker 1: no ads? Easy? Become a patron for just five dollars
Speaker 1: a month. You get access to a private RSS feed
Speaker 1: where all the shows have no ads. Twenty dollars a month,
Speaker 1: we'll get you that and a special dot net Rocks
Speaker 1: patron mug. Sign up now at Patreon dot dot NetRocks
Speaker 1: dot com. Hey, welcome back to dot net rocks. I'm
Speaker 1: Carl Franklin at Amateur Cable, and we're here doing the
Speaker 1: thing with the stuff. You know what, we like it.
Speaker 1: I think I might make a write a song called
Speaker 1: the Thing with this Stuffing with the stuff. It's just
Speaker 1: so so useful in everyday conversation because you know, it's
Speaker 1: just what it says, is you know that whole context,
Speaker 1: the thing we've been talking about lately. Yeah, that's what
Speaker 1: I'm doing.
Speaker 2: The thing that's the thing with the stuff and the stuffy.
Speaker 2: Definitely need them both. Yeah.
Speaker 1: Now, if you just walk down the stairs in the
Speaker 1: morning and say you got to do the thing with
Speaker 1: the stuff, now there's a problem because there's no context.
Speaker 2: But if we've been there yet, all right anyway, so
Speaker 2: you put just fully in the bit, right fully how
Speaker 2: are you man's puppy. You know, she's a chaos monkey.
Speaker 2: She's head there and you but uh, you know it's
Speaker 2: very good. Yeah, I'm not. You know, I'm not unhappy
Speaker 2: to have a dog around. I didn't need to have
Speaker 2: a dog around.
Speaker 1: Of course you're not.
Speaker 2: But most people will know that animals adore me, and
Speaker 2: this one does too. So yeah, we all get along
Speaker 2: just fine. We'll see, you know, with the grandchild coming up.
Speaker 2: You know, we got a bit of a hurting dog here.
Speaker 2: My goal is that this dog annoys the grandchild so
Speaker 2: much because won't let her near the ocean. I want
Speaker 2: this kid to say, Grandpa, Joe, Joe won't let me
Speaker 2: get near the ocean, And I'll say, that'll do, dog,
Speaker 2: that'll do. All right.
Speaker 1: Well, let's roll along right into better no frameworks awesome.
Speaker 1: I know we're talking about open source today, but I
Speaker 1: found a GitHub repo that is trending and it turns
Speaker 1: out this is kind.
Speaker 2: Of a hub who uses get hub.
Speaker 1: Yeah, I know this is actually on GitHub marketplace, so
Speaker 1: it's not really an OSS thing, but it is on
Speaker 1: GitHub and it is trending. And I noticed this because
Speaker 1: when I looked at the list like translation systems seem
Speaker 1: to be very much in demand right now.
Speaker 2: Yeah, you know, especially with a on the new LLM
Speaker 2: tools are just tokenization of language has led to better
Speaker 2: translators without a doubt.
Speaker 1: Yeah, well this one is a little bit different. So
Speaker 1: this is PO editor, and it does have a free version,
Speaker 1: but then you got to pay for more use, right,
Speaker 1: So it's a sort of a try before you buy
Speaker 1: kind of thing. But here's here's what it is, and
Speaker 1: I'm just reading. It's a PO editor is a highly
Speaker 1: scalable translation management system and localization platform. So it's an
Speaker 1: online collaboration environment for the entire localization team. But you
Speaker 1: don't need a team. So here's how. There's a couple
Speaker 1: of options of how you can use this. You can
Speaker 1: assign translators to specific languages by adding them as contributors.
Speaker 1: You can crowdsource translations from your community using public projects
Speaker 1: because it integrates with GitHub. You can order professional human
Speaker 1: translation services from one of their partners, or you can
Speaker 1: use machine translation or any combination of those things. And
Speaker 1: so it supports all sorts of different file formats.
Speaker 2: Which is what you need, right. You want all that
Speaker 2: all that text, all that sourcing in centralized formats, so
Speaker 2: it can be swapped out.
Speaker 1: Right or even in multiple formats. If you have a
Speaker 1: dot net application, you have something that doesn't read Jason,
Speaker 1: it needs to read Angular XMB files or something.
Speaker 2: You're making iOS and Android and you want to do
Speaker 2: translation as well. Those are different file formats. Man.
Speaker 1: Yeah, yeah, that's right. It even supports any files. Oh boy,
Speaker 1: how about that.
Speaker 2: I don't know. That is a good thing. But okay,
Speaker 2: I don't know.
Speaker 1: I don't know, Rob, how do you feel about any files?
Speaker 3: I have a custom XMEL format that I remember we
Speaker 3: did work when I was in office to make sure
Speaker 3: it could ship over to Ireland where we did all
Speaker 3: our translation and come back. So I hope that they
Speaker 3: have access to or have the ability to support WXL
Speaker 3: files because that's what we use for all our stuff.
Speaker 1: I don't let me look down the list. I don't
Speaker 1: see WXL files.
Speaker 2: No, I don't see WXL. I means it.
Speaker 1: I see XML files, but I see XML, but it's XML.
Speaker 3: So most people be like, yeah, this parts translated, this parts,
Speaker 3: and ID go.
Speaker 2: Yeah, nice.
Speaker 1: Well anyway, so that's where it is, and right on
Speaker 1: there you get it for free. You can get three
Speaker 1: thousand strings and then medium projects and premium and enterprise.
Speaker 1: You can go all the way up to a couple
Speaker 1: of files a year. So that's awesome. That's it. It's
Speaker 1: just interesting. How you know these two, this one and
Speaker 1: the one I showed last week, we're right at the
Speaker 1: top of the list of trending GitHub projects.
Speaker 2: Interesting.
Speaker 1: So well, that's what I got. Richard, who's talking to
Speaker 1: us today.
Speaker 2: I'm going into the wayback machine here and grabbing.
Speaker 3: Yeah.
Speaker 2: Rob's first show, the one we did back in March
Speaker 2: at twenty twelve, episode seven four seven, so only twelve
Speaker 2: hundred episodes ago or so. Wow, talking about the Wicks
Speaker 2: tool Set, which had a ton of comments on it,
Speaker 2: really like sixteen eighteen something like that. Yeah, and one
Speaker 2: of them is from Timothy Klink in a mid at
Speaker 2: least from thirteen years ago.
Speaker 1: Oh wait a minute. We should differentiate between WIS the
Speaker 1: popular web development environment. I know Rob is shaking his
Speaker 1: head like, oh my god, these guys ruined my life.
Speaker 2: Yeah, who stole your name? Man?
Speaker 1: And but WIS that Rob did is a set of
Speaker 1: tools for building Windows installation packages.
Speaker 3: The Wix tool Set is what we call it to
Speaker 3: avoid all the legal problems there, right, Yeah, may or
Speaker 3: may not exist that we have never investigated. No never, never,
Speaker 3: help don't want to under We call it the Wicks toolset,
Speaker 3: and then you could call it Wix and all the
Speaker 3: lawyers at Microsoft HILP come toool it that way back when.
Speaker 1: Yeah, there you go, all right, so sorry to interrupt.
Speaker 2: So that's all that problem. So, yeah, it was an installer.
Speaker 2: And this is what exactly where Tim clinkwaed where you
Speaker 2: said this is a great show. I was doing a
Speaker 2: lot of nodding during the discussion. And how still today
Speaker 2: many people dismiss how critically important a good installation package is.
Speaker 2: It's all about the first impressions. The user's first impression
Speaker 2: of your app does not begin when they double click
Speaker 2: the desktop short top of the first time begins when
Speaker 2: they double click set up XM. I was reminded of
Speaker 2: his story a long time ago about an applicant to
Speaker 2: Harvard Paper clipping a dollar bill to their application along
Speaker 2: with a short note. The note requests of the reviewer
Speaker 2: go get a donut, take a break, relax, and get
Speaker 2: into their happy place before they read the application.
Speaker 1: That's great.
Speaker 2: A good installation package is like this. It's a dope.
Speaker 2: It we'll set the user's mood to frustrated or happy
Speaker 2: place prior to them clicking on your applications debtstop icon
Speaker 2: for the first time. Legit absolutely and that's an old comment,
Speaker 2: too right. It's an old comment. It is so right.
Speaker 2: It's still writes today by a mile. It's still true, Tiffyth.
Speaker 2: Thank you so much for your comment. In a copy
Speaker 2: of music, Coby. It's on its way to you. And
Speaker 2: if you'd like a copy of music go buy. I
Speaker 2: write a comment on the website at dot at rocks
Speaker 2: dot com or on the facebooks. We publish every show there,
Speaker 2: and if I comment there and every reading on the show,
Speaker 2: we'll send you copy music to go buy.
Speaker 1: And you can get music to Koby music to code
Speaker 1: by dot net and that is a u r L
Speaker 1: DNS entry, so don't put hgdps in front of it.
Speaker 1: And that brings you to another place where you can
Speaker 1: listen to a sample and get track twenty two or
Speaker 1: the entire collection rob before we get started here. When
Speaker 1: Richard was reading that, I was reminded of Mark Miller's
Speaker 1: new invention that he unleashed unveiled on Mondays, which was
Speaker 1: called the install Buddy and so the install buddy, when
Speaker 1: you're running an installer, it's in the background and it's
Speaker 1: just clicking next, next, next, next, next, next, next, next, finish.
Speaker 2: That's awesome.
Speaker 3: That's awesome. So I have a rebuttle to that if
Speaker 3: you care.
Speaker 1: But yeah, sure, why not.
Speaker 3: I appreciate the sentiment one hundred percent, And we actually
Speaker 3: talk to our customers a lot about minimizing the amount
Speaker 3: of input that you have to put in install Again,
Speaker 3: first impression, let's get to the product. That's where they
Speaker 3: want to be. They want to get past your progress
Speaker 3: bar and to the end. So to that point, I
Speaker 3: one hundred percent agree. Fortunately, the industry has definitely been
Speaker 3: moving that direction. Like app installer now is just one button.
Speaker 3: But at the same time, a lot of customers that
Speaker 3: I work with are large organizations with very large and
Speaker 3: complex software, and you're not going to next, next, next
Speaker 3: your way through it. There is complex information you have
Speaker 3: to provide up front in order to configure it. So
Speaker 3: there are different worlds, and we see all kinds in
Speaker 3: the insulation space because we see all software in the
Speaker 3: slation space, which makes it interesting for me. So yes,
Speaker 3: I totally get it next, next, next, except when you
Speaker 3: have some really heavy software.
Speaker 1: Well it was. It was a joke, so it was funny,
Speaker 1: a funny joke, but it did hit all right, So
Speaker 1: let me introduce Rob.
Speaker 2: Did you want to do nineteen forty eight?
Speaker 1: Yes, I do want to do nineteen forty eight before
Speaker 1: I introduced Rob officially. Okay, because this is episode nineteen
Speaker 1: forty eight. We have been doing this lately. We go
Speaker 1: back in history and see, you know, try to summarize
Speaker 1: what happened.
Speaker 2: Pretty much till we once we got in the nineteen hundred's,
Speaker 2: the history part came more. Yeah. Yeah.
Speaker 1: So nineteen forty eight was a pivotal year several major events,
Speaker 1: including the assassination of Mahatma Gandhi, the declaration of independence
Speaker 1: for the State of Israel, and the start of the
Speaker 1: Arab Israeli War. It also saw the beginning of the
Speaker 1: Berlin Airlift, the US establishing the Marshall planted as I
Speaker 1: said last week, to aid post war Europe and the
Speaker 1: United States. It's recognizing the state of Israel, which was
Speaker 1: it happened at the same you know, in the same year.
Speaker 1: Also in the United States, President Truman signed executive Order
Speaker 1: in nine to nine to eight one ending racial segregation
Speaker 1: in the United States Armed Forces. Do you have anything
Speaker 1: to add, Richard.
Speaker 2: The land Camera, the Polaroids and Camera nineteen forty eight,
Speaker 2: No kidding. Yeah. For Canadians, the Davelin Beaver, the DHC two.
Speaker 2: This is a prop plane float typically float planes, the
Speaker 2: ultimate bush plane and I flew on one like a
Speaker 2: month ago. It's called the Beaver. Yeah. Wow. Of course
Speaker 2: in the dash too. Uh and it's like it's a legend,
Speaker 2: just an unbelievable machine. Wow. Only made for until in
Speaker 2: nineteen sixties, still flying today. And finally, because it is
Speaker 2: a tech show, so let's talk about the men Chester Baby,
Speaker 2: which was one of the very they arguably the very
Speaker 2: first electronic quote stored program computers coming out of World
Speaker 2: War Too. There was a lot of computers being built,
Speaker 2: but this was a computer that could actually store a
Speaker 2: program within it and execute that program. It added thirty
Speaker 2: two words of memory of thirty two bits each for
Speaker 2: a total of one twenty four bits.
Speaker 1: Wow.
Speaker 2: Good Lord, and the Baby was the test bed for
Speaker 2: the Mark one, which eventually became what they called the
Speaker 2: Manchester Ferrante, which was the first commercially available stored program
Speaker 2: computer in the world.
Speaker 1: Also the first Canadian land cruiser was called the Moose
Speaker 1: Nice and the first Canadian boat was called the Otter
Speaker 1: and then the sister submersal submersible. Anyway, I kid, you're
Speaker 1: making this stuff all right, So let's now let me
Speaker 1: finally introduce Rob Officially. Rob MenShing is the CEO and
Speaker 1: co founder of fire Giant, a company that provides commercial
Speaker 1: support in tools for the Wicks tool set. He's also
Speaker 1: the creator and maintainer of Wicks. Of course, we talked
Speaker 1: about the most powerful set of tools for running building
Speaker 1: Windows installation packages. The Wicks tool set holds the unique
Speaker 1: distinction of being the first open source project released by Microsoft,
Speaker 1: and Rob has been deeply involved in open source over
Speaker 1: twenty five years. He's passionate about making open source sustainable
Speaker 1: and his latest proposal, the open Source Maintenance Fee, is
Speaker 1: all about creating a better path toward. It is all
Speaker 1: about creating a better path forward for projects and their maintainers.
Speaker 1: This ought to be really good, Rob, welcome back.
Speaker 3: Thank you. I'm looking forward to talking to you guys.
Speaker 3: It's I didn't realize that twenty twelve that was that
Speaker 3: was easy for show. You had some after that, but yeah,
Speaker 3: twenty twelve of you were still a Blue badge.
Speaker 2: That's how long ago that was.
Speaker 3: Just barely that's right. I started fire Giant twenty thirteen.
Speaker 2: Wow, yes, there you go. So it's like it's been
Speaker 2: twelve years in fire Giant. But yeah, it's a way back, yeah,
Speaker 2: way back moment.
Speaker 3: As long as that's kind of throws me off. I
Speaker 3: think I've been fire Giant as long as I've been
Speaker 3: at Microsoft, as I was at.
Speaker 2: Microsoft, as long as your Microsoft n Yeah, and he
Speaker 2: still feels like it's your new thing.
Speaker 3: Yeah, it feels like a startup. It feels like I've
Speaker 3: been doing this for about three years. But when I
Speaker 3: look back, we've done more than three years of work,
Speaker 3: and I just can't reconcile the two together. So when
Speaker 3: you say it's been twelve years, I have to and
Speaker 3: go really, I guess, man, we have so much more
Speaker 3: to do.
Speaker 2: Yeah, it's not like I'm getting the bottom eye to
Speaker 2: do list. That's not a thing.
Speaker 1: So when did you go solo again? Thirty thirteen twenty.
Speaker 3: Right at the beginning. I retired from Microsoft in twenty
Speaker 3: twelve and started fire Giant. Fire Giant officially launched in June,
Speaker 3: But you know, takes six months to put everything together,
Speaker 3: but we had the idea, you know, to begin to
Speaker 3: my thirteen I was working towards that.
Speaker 1: Yeah, well, when immediately came to mind when I read
Speaker 1: your bio. There in the things that you're talking about
Speaker 1: for open source, making it sustainable and better, you know,
Speaker 1: better prospects for owners of OSS projects. Is that we
Speaker 1: is that show that we did at NDC in twenty
Speaker 1: twenty two with David Whitney. I was in November twenty
Speaker 1: twenty two making open Source Work for Everyone with David Whitney,
Speaker 1: and I remember we got into this really cool what
Speaker 1: if discussion about what if you know, places like GitHub
Speaker 1: would have some sort of pay mechanism built in, so
Speaker 1: like write in Visual Studio, you could say, hey, this
Speaker 1: is open source, but they would really appreciate your donations
Speaker 1: or something like that. Just make it low friction for
Speaker 1: people to donate to open source projects. You're nodding your head.
Speaker 3: Yeah, there have been ideas in this space for a
Speaker 3: long time, and lots of different ideas floating around this space,
Speaker 3: which is fantastic because I don't think we're going to
Speaker 3: end up with one solution to what do we do
Speaker 3: with open source to make it viable for everybody to
Speaker 3: continue working in it. So I do believe there are
Speaker 3: many different options that we need to consider because there
Speaker 3: are many different kinds of projects. And the idea of
Speaker 3: having some way to pay maintainers in GitHub was very
Speaker 3: present because now they have sponsors, which turned into very
Speaker 3: much that even if it's not deeply in a Grandville studio,
Speaker 3: it is exactly in that space. So yeah, there's been
Speaker 3: lots of thinking and talking about this, and I decided
Speaker 3: I had to formalize some of it. So that's why
Speaker 3: I want to talk to you today about.
Speaker 1: So let's get to it. What are your ideas?
Speaker 3: Do you want the history? Do you want the idea first?
Speaker 2: That tweet thread is really important, Okay, because it's an
Speaker 2: encapsulation of so many projects I've seen.
Speaker 3: Yeah, so maintainers. When you're a maintainer of a successful
Speaker 3: project for a long term, the world changes a little bit,
Speaker 3: the changes for you a little bit. And I have
Speaker 3: this theory that I've been developing of there are these
Speaker 3: mega projects that people know about, that's the ones they
Speaker 3: think of. They usually have corporates running them, and they
Speaker 3: have a different way of operating. You have the hobby projects,
Speaker 3: I don't have like that term acoungement, but you know,
Speaker 3: startup projects, they're just getting off the ground and the
Speaker 3: people are still very enthusiastic about what they are, what
Speaker 3: they could be, the future is everything ahead of them, right,
Speaker 3: and they're just trying to find more users. And that
Speaker 3: place is awesome. Then you hit the what I call
Speaker 3: the working class projects, where you've usually graduated from being
Speaker 3: a hobby project and you've now ended up in a
Speaker 3: space where people depend on you, and you take that
Speaker 3: responsibility seriously that you have an important piece of the ecosystem.
Speaker 3: It's the what is that the Ohio project? You are
Speaker 3: that tiny little cog standing up the whole system on
Speaker 3: top of you from SKCD, Yeah, you are that little
Speaker 3: block and you take it seriously, like this is my project.
Speaker 3: And I've been running the Wicks tool set for twenty
Speaker 3: plus years longer if you count the stuff I did
Speaker 3: in Microsoft, but twenty plus years. And after a while
Speaker 3: you kind of get to a place where not everybody's
Speaker 3: treating the project particularly well or you particularly well. And
Speaker 3: for the last few years I've been very frustrated with
Speaker 3: what's been going on around the project. And then the
Speaker 3: EXZ UTLS issue hit at the March last year. I
Speaker 3: think it was fourth that issue. I saw all these
Speaker 3: people talking about the attack vector that almost turned into
Speaker 3: a back door on Linux that got into cloud servers
Speaker 3: and every Linux like it was crazy, and I knew
Speaker 3: people are going to do the analysis of what it
Speaker 3: was and how it worked, because that's like the geeky
Speaker 3: technical stuff. But for me, I saw the story behind it.
Speaker 2: We better recap what happened last year because not everybody's yeah,
Speaker 2: good idea. All right.
Speaker 3: So someone found a way to use and xx udles,
Speaker 3: which is this like compression library and tool that was
Speaker 3: included in I think every major Linux distribution, and a
Speaker 3: we believe an attacker. Now at this point, someone very
Speaker 3: dedicated found a way to use the build system to
Speaker 3: inject code that did not appear until inside the Linux
Speaker 3: build or something in that effect, so that they could
Speaker 3: insert a back door into the Linux build system that
Speaker 3: they could then connect back in and it would end
Speaker 3: up on all Linux machines. And it happened to be
Speaker 3: found by a dev working on performance some performance issue
Speaker 3: was like Microsoft and Azure and said hey, wait this
Speaker 3: is acting a little slow and found the problem.
Speaker 2: It was like a half a second or something, right, Yeah,
Speaker 2: it was minuscule.
Speaker 3: It was talked about narrow, narrow, narrow by the slimmest
Speaker 3: margins that someone found that that could have been catastrophic,
Speaker 3: and then nobody might have even noticed once it's out there,
Speaker 3: it could have just been an invisible back door.
Speaker 2: Well, they also bags the question how many we not noticed? Right?
Speaker 3: Yeah it was. It was a very very sophisticated attack,
Speaker 3: so obviously fascinating to every developer out there, like, wow,
Speaker 3: how did this work? How did you get in there?
Speaker 3: How do you slip yourself into s sh or all
Speaker 3: the And I'll be honest, I didn't dig into those
Speaker 3: details because the part that I saw was the a
Speaker 3: thread and someone pointed out a thread, the email thread
Speaker 3: archived on you know, set of way pages of their
Speaker 3: their their mailing list, and I started at the top
Speaker 3: and I found the maintainer of the project talking to
Speaker 3: the people that are then believed to have put in
Speaker 3: this attack. And in it you have people pushing on
Speaker 3: this maintainer saying you're not doing enough for the project.
Speaker 3: Why haven't you submitted all these prs, why haven't you
Speaker 3: fixed all these bugs? And you can hear the maintainer saying, oh, yeah,
Speaker 3: I'm going to get to that. It's just it's been
Speaker 3: really hard and I've just been a lot of pressure.
Speaker 3: And you can hear like there's other things in their
Speaker 3: life going on, right and and he says, oh, and
Speaker 3: there's someone that's been helping me on the side. You know,
Speaker 3: that's been really helpful. But you know, it's it's really
Speaker 3: hard finding people to take over a project or helping
Speaker 3: a project. And then you have repeated cases that if people, well,
Speaker 3: you should give up on your project because clearly you're
Speaker 3: not going to take care of it, and someone else saying, oh,
Speaker 3: we understand, it's really hard to maintain your project. You know,
Speaker 3: you could be really busy, but you really should do
Speaker 3: something because your project will suffer because you're not doing this.
Speaker 3: And at the end, the guy's like, well, you know,
Speaker 3: this other person's been really helpful, and you know we'll
Speaker 3: probably have them helping more. It turns out that that person,
Speaker 3: that named person is the person that's tracked back to
Speaker 3: it's the attack or inserting the attack vector into make
Speaker 3: files and the data files and everything else.
Speaker 1: And they made themselves look like, you know, they were
Speaker 1: going to help out like they.
Speaker 2: Well, they be clear. They they had been more helping out,
Speaker 2: They had been making contributions, like one person had been helping.
Speaker 1: Right, it's what I'm saying. But all the way along
Speaker 1: the goal must have been to at once they gain
Speaker 1: their trust to launch this attack, and nobody would ever
Speaker 1: suspect them.
Speaker 3: Right, So one person was helping, and then two other
Speaker 3: people showed up in this particular thread, and the timing
Speaker 3: spread out. It's not like immediately back in back and forth.
Speaker 3: It's like a week spread out, two weeks here. I mean,
Speaker 3: it's not obvious. And when I originally saw this thread
Speaker 3: and I wrote down a tweet about this, that I realized, oh,
Speaker 3: and it was like, I don't know, thirty tweets and
Speaker 3: I was like, oh, I hate it when people write
Speaker 3: tweet thread. So I ran and put in my blog
Speaker 3: so you can read it all one big pass much
Speaker 3: as you read, and I had more contexts. At that time,
Speaker 3: there were theories that this could be a truly coordinated attack,
Speaker 3: with multiple people operating what we call sock puppets pretend
Speaker 3: to people pretending to be different. I don't characters in
Speaker 3: a play trying to manipulate what they wanted I thought
Speaker 3: that felt a little far fetched at the time, because
Speaker 3: it felt very real. Everything that was being discussed and
Speaker 3: treated and the way that people were acting was very
Speaker 3: common for what you get on maintainers. You get sets
Speaker 3: of people just showing up going why haven't you fed
Speaker 3: me yet? I want my fix? Where's my build? I
Speaker 3: can't believe you haven't fixed this in ten years. I
Speaker 3: just got that comment this morning from somebody. I can't
Speaker 3: believe you haven't fixed this in ten years.
Speaker 2: And that's when you offer them the refund of everything
Speaker 2: they've paid.
Speaker 3: I actually offered to assign them the issue, which is
Speaker 3: my new tactic. In the end, I ended up really mad,
Speaker 3: like just stomping mad. And I've been low key mad
Speaker 3: for quite a while having seen other maintainers treated the
Speaker 3: same way, feeling it myself. And I'm fortunate that I
Speaker 3: have Bob who works who's a co maintainer on the
Speaker 3: WHIS tool set with me, so I have someone I
Speaker 3: can talk to and kind of, you know, walk off
Speaker 3: that ledge. No, sorry, step away from the ledge from
Speaker 3: the ledge. Yeah, just like this is this is too much?
Speaker 2: You're really a friend, you'll jump off with me? No, No,
Speaker 2: that's not the goal here.
Speaker 3: Well, and when you're in a project that is popular
Speaker 3: and successful and you have lots of users, you will
Speaker 3: hit this space where you went up with a non
Speaker 3: trivial number of people showing up making demands of the
Speaker 3: project without any thoughts of any contributions. And so the
Speaker 3: xc udels that event and then finding out that it
Speaker 3: was very possibly Nation State actors. Nobody knows for sure,
Speaker 3: but that level of coordination made me just go that
Speaker 3: that's it. I'm going to do something. I don't know
Speaker 3: what I'm going to do. But at April last year,
Speaker 3: you know, about a year ago now, I said, I'm
Speaker 3: going to find something and I'm not doing it like
Speaker 3: this anymore. We're not just going to have maintainers out
Speaker 3: here unprotected from every you know, everything. We need to
Speaker 3: change the culture and the way that we treat maintainers.
Speaker 3: And so I sat for months just I couldn't put
Speaker 3: it down. I had job to do. This is not
Speaker 3: my job. But I had this thought process in the
Speaker 3: back of my head, going what can we do that
Speaker 3: builds a system that works well for maintainers, that is
Speaker 3: fair to everybody involved, and can scale. And it was
Speaker 3: all based off this tweet of mine that got a
Speaker 3: million in some views, which I don't write tweets like that.
Speaker 3: I'm not a mean person, right, I write tweets communicate
Speaker 3: Moory project, my company and what I do. That thing
Speaker 3: went crazy and everybody in the thread agreed that it
Speaker 3: was a problem. I have never seen so many people
Speaker 3: agree on Twitter.
Speaker 2: The Internet. You're not supposed to get along, that's not
Speaker 2: how Ever.
Speaker 3: The only discussion that went sideways where people were disagreeing
Speaker 3: was whether we should have universal basic income. And I
Speaker 3: was like, Okay, I'm not touching that. You guys, go
Speaker 3: have fun on that conversation. That's a bit far. Yeah,
Speaker 3: a bit far, And it just was like a side
Speaker 3: thread on the whole thing. But everybody agreed.
Speaker 2: So yeah.
Speaker 3: I went from there and my experience with frustration of
Speaker 3: where I was at as a maintainer, because like a
Speaker 3: year before that, I remember one morning I woke up
Speaker 3: and you know, dealt so with me and I just
Speaker 3: get my wife said that's it. I'm done. I'm not
Speaker 3: going to do this anymore. Like why am I Why
Speaker 3: do I even do this? Why am I putting myself
Speaker 3: through this? I have a company built on this open
Speaker 3: source project. I'll just do it a different way. And
Speaker 3: I'm the guy that worked for years inside Microsoft to
Speaker 3: make open source happen. So I was like, I'm walking
Speaker 3: I my mind was torn. It was I was I
Speaker 3: was broken. It was pretty bad in this space. So
Speaker 3: to hear other maintainers having these same problems and pains,
Speaker 3: I reached out to a number of them. And every
Speaker 3: maintainer that has a project that you think of successful,
Speaker 3: that you thought was successful, if you know it by
Speaker 3: name and you know that maintainer, they are in either
Speaker 3: one of two camps. One they don't care about what
Speaker 3: happens to the project and they're just distracted from it.
Speaker 3: DHH has this famous slide where he's just like, f you, Like,
Speaker 3: that's the way he approaches his project. He doesn't care
Speaker 3: about you. That's a fine way to go. I know
Speaker 3: no maintainer, I personally know no maintainers that operate that
Speaker 3: way because they care too much about their project and
Speaker 3: being how it work well. All the ones I talked
Speaker 3: to all have were like, yep, I totally agree. I've
Speaker 3: all thought about quitting every single one of them, all
Speaker 3: of the major projects, all of them are all in
Speaker 3: the same spot.
Speaker 2: So now you wake up in the morning up, you know,
Speaker 2: immediately anxious about I haven't dealt with I haven't got
Speaker 2: to like you're dreading going to your office.
Speaker 3: Yeah, And so that was the reality. That's where it's at.
Speaker 2: End.
Speaker 3: I decided I was going to have to create a solution. So,
Speaker 3: like I said before, I think there will be many
Speaker 3: solutions for many different sized projects, for different kind of
Speaker 3: types of projects. I know, my project, it's about half
Speaker 3: a million lines of code. There's two of us that
Speaker 3: work on it. Often there's only one person that works
Speaker 3: on it. And we have you know, millions of downloads,
Speaker 3: tens of millions of downloads, ten million downloads, twelve million downs.
Speaker 3: Now it's a big project, all that kind of good stuff.
Speaker 3: And I said, all right, in this space, what can
Speaker 3: I do? And so I sat down for a while
Speaker 3: and started going, what if we charge a fee for
Speaker 3: people to use the project? And from there I started
Speaker 3: putting it together. So should I go jump into the
Speaker 3: details of the maintenance.
Speaker 2: Fe then yeah, let's go all right, yeah, let's do it.
Speaker 3: So the maintenance feek idea came as I slowly started
Speaker 3: teasing apart the problem and I realized that there's open
Speaker 3: source software and that has a license on it that
Speaker 3: we all know and love. All of our various license
Speaker 3: out there, whether you're like MIT or GPL or my
Speaker 3: favorite MSRL, whatever license, we know all of that. And
Speaker 3: what I got to was that license applies to the
Speaker 3: source code. And if we say that that license will
Speaker 3: only apply to the source code and stop there, that's
Speaker 3: an open source project. Like that's enough to say that
Speaker 3: your software is open source. Right. You don't have to
Speaker 3: build the source code for people. You don't have to
Speaker 3: have an issue tracker, You don't have to take changes
Speaker 3: from other people and apply them to your open source software.
Speaker 3: Your open source software is open source. Are done?
Speaker 2: Yeah?
Speaker 3: You you have successfully created an open source project. So
Speaker 3: all that other stuff that is generally expected of maintainers.
Speaker 3: Build a binary that other people can use. Answer the
Speaker 3: discussions that people have, keep a discussion list where people
Speaker 3: can ask questions, have an issue tracker, deal with them.
Speaker 3: Some people expect you to fix all of them. Do
Speaker 3: regular builds, stay up to date with all of the
Speaker 3: dependencies that you have, as those keep changing. Dot A
Speaker 3: framework I'm looking at you. You know, security vulnerabilities that
Speaker 3: pop up, you know all of the you know, spam
Speaker 3: shows up. Yeah, go make sure that doesn't show up. Oh,
Speaker 3: you have to have signing certificates for your binaries, we'll
Speaker 3: keep those up to date, so on and so forth.
Speaker 3: So there's all this other stuff that's actually that's the project,
Speaker 3: that's the work that the maintainers do regularly, outside of
Speaker 3: maybe choosing to write some lines of code as a contributor. Right,
Speaker 3: So if we separate those two concepts and we say,
Speaker 3: I'm going to make the open source software open source
Speaker 3: by this license, but the rest of this stuff that
Speaker 3: I have to do to maintain the project to make
Speaker 3: it viable as most people expect it to be. What
Speaker 3: if I have a fee? And in that tweet thread
Speaker 3: that we were talking about, I kept throwing out the
Speaker 3: idea of what if you paid ten bucks per month
Speaker 3: for a project? Nobody ever said peepe. They're like, yeah,
Speaker 3: that seems fine, right, maintainers ten bucks a month, no problem.
Speaker 3: So I said, all right, we're going to create the
Speaker 3: maintenance fee and for all of the stuff that isn't
Speaker 3: the source code itself. You want the bills, you want
Speaker 3: issue tracker and discussion lists, and you want signing certificates
Speaker 3: and all that stuff maintained. You pay ten bucks a
Speaker 3: month if you make money. So if you're a student,
Speaker 3: if you don't make money, if you don't want to
Speaker 3: play in the money game, no problem, you're in. Hang out.
Speaker 3: Let's go right, we're talking source code, we're talking open source.
Speaker 3: But if you're making money, if you're a compan or
Speaker 3: your employee at a company using a project, you're in
Speaker 3: a different world. You're using this and you are getting
Speaker 3: some value out of it. So you get to.
Speaker 1: Pay, and you're taking a dependency on it a.
Speaker 3: Fee, right, right, And you depend on it and you
Speaker 3: want to presumably want it to be there, so you
Speaker 3: pay the fee. Really simple. And then I stacked it
Speaker 3: and I said, all right, we have dependencies an open
Speaker 3: source project. So if an open source project says I'm
Speaker 3: going to start charging a fee for all of the
Speaker 3: stuff that isn't the software, than any dependency that you have,
Speaker 3: you pay their fee too. Okay, Right, So if I
Speaker 3: have a dependency us on some other project, then I
Speaker 3: pay them. My project takes a fee, then I pay
Speaker 3: them however many fees they have.
Speaker 1: So you basically now are in a money distribution royalty
Speaker 1: kind of right system.
Speaker 3: Right, You you taking a fee in your project means
Speaker 3: you now have decided to take money, So now you
Speaker 3: play as money. If your project doesn't take money, then
Speaker 3: you don't have to pay money. At the idea of
Speaker 3: being like, look, if you're not making money, you're not
Speaker 3: paying people, right, You're not trying to bankrupt people or
Speaker 3: anything like that. We're trying to get to a place
Speaker 3: where maintainers now can get paid for the work that
Speaker 3: they have to do to keep the software going and
Speaker 3: viable in an environment where people expect it to be.
Speaker 2: Any you're driving this through GitHub.
Speaker 3: Yeah. What I realized was that with the system, I
Speaker 3: ended up with about the tightest feedback loop that I
Speaker 3: could create. Consumers pay a maintenance fee for the maintainers
Speaker 3: to maintain the project. The maintainers maintain the project, so
Speaker 3: that the consumers continue to pay the fee, so that
Speaker 3: the consumers pay the fee to maintain the projects, and
Speaker 3: the maintainers continue to part and you end up with
Speaker 3: this tiny little loop cycle. Nobody else involved. There's nothing
Speaker 3: else out there, because so many other proposal I'd seen
Speaker 3: required somebody out there to do something to make this possible.
Speaker 3: Usually some company is going to come down on high
Speaker 3: and say I have now created a system by which
Speaker 3: you will get paid, and the maintainers could be like, oh,
Speaker 3: thank you, finally good assuming payment what they want. But
Speaker 3: you know, a solution from outside here. Maintainer just says
Speaker 3: I require a fee and it all works. It's just
Speaker 3: between you and the consumer on that fee. You're good
Speaker 3: to go.
Speaker 2: All right?
Speaker 1: And I have so many questions, but we got to
Speaker 1: take a little break here, so we'll be right back
Speaker 1: after these very important messages. Stay tuned. Did you know
Speaker 1: that you can work with AWS directly from your ID?
Speaker 1: AWS provides toolkits for visual studio, visual studio, code, and
Speaker 1: jet brains rider. Learn more at AWS dot Amazon dot com,
Speaker 1: slash net slash tools. And we're back. It's dot net rox.
Speaker 1: I'm Carl Franklin and that's my friend Richard Campbell and
Speaker 1: our friend Rob Menching, and we're talking about making open
Speaker 1: source sustainable. I have so many questions, but the first
Speaker 1: question I have is do you just work on the
Speaker 1: honor system? Do you just say, how do you prove
Speaker 1: that you're not making money? How do you prove that
Speaker 1: you are? How do you do you go after for
Speaker 1: people if they start using it and making money without
Speaker 1: it without paying?
Speaker 3: This is this is a fantastic question. And I sat
Speaker 3: here for a long time going how do we do enforcement?
Speaker 3: And every maintainer as I presented this idea to them
Speaker 3: always kind of got to this point, like I really
Speaker 3: love this idea. I never thought of it that way.
Speaker 3: How do you make it happen?
Speaker 2: Right?
Speaker 3: So, in the new gut world, we produce nugat package. Sorry,
Speaker 3: in the dot net world mostly about nugat packages. That's
Speaker 3: how a lot of things are attributed. Even my own
Speaker 3: system is now msbilled, SDKs and dot net tools and
Speaker 3: a whole bunch of NEWGAT packages. So we're all in
Speaker 3: on nugat. I kind of sat and got all right,
Speaker 3: So what do I want? I want to declare a
Speaker 3: I have a license, an open source license that applies
Speaker 3: to source code. I need a YULA, an end user
Speaker 3: license agreement to apply to the binaries and the rest
Speaker 3: of the project. Okay, oh, I can have a license
Speaker 3: for this source code. I can write AYULA that does
Speaker 3: not impinge on your rights that the license gives you.
Speaker 3: I can put that ULA in the nugat package, and
Speaker 3: then lo and behold. Nugat has a way to say
Speaker 3: require acceptance when you accept a Nugat package. So you
Speaker 3: have to say I accept the terms of the ULA
Speaker 3: AKAI will pay the maintenance fee because I am making money,
Speaker 3: and you have to check that box. And now you
Speaker 3: have legally said that you are complying with the maintenance
Speaker 3: fee for any project that you want.
Speaker 1: And that amounts to Diddley Squad, however, because we've all
Speaker 1: agreed to ULA's because otherwise we can't use the software.
Speaker 3: Yeah.
Speaker 1: Yeah, So nobody's ever knocked on my door and said, hey,
Speaker 1: did you read that ULA?
Speaker 3: Yeah. But if you remember, lawyers had a huge, huge
Speaker 3: challenge when they first started trying to pick up open source,
Speaker 3: and they held up everything saying no, no, no, we
Speaker 3: can't pull source code into the company that open source
Speaker 3: license until we understand what those licenses will do to
Speaker 3: us and our company. The maintenance fee puts a legal
Speaker 3: document in there that if a lawyer sees it and
Speaker 3: you've accepted it, you're on the hook for it. I
Speaker 3: believe it's written correctly. I've had another lawyer write it.
Speaker 3: You're now on the hook. So any lawyer that saw
Speaker 3: it inside the company be like, we're on the hook
Speaker 3: for this.
Speaker 2: Yeah, okay.
Speaker 3: And this is actually important because there are many maintainers
Speaker 3: out there that I've come out and said, oh, you know,
Speaker 3: I would I would pay I you know, get how
Speaker 3: sponsors is great. I would pay it, and my company,
Speaker 3: you know, should pay it. But you know, the procurement team,
Speaker 3: I just they they won't do anything. They're so hard
Speaker 3: to get work through, and I believe them. Procurement teams
Speaker 3: are very challenging with my own company. You know, we
Speaker 3: can spend six months with the company and their procurement
Speaker 3: team just trying to get them to pay us for
Speaker 3: the legal agreement they already signed up for and the
Speaker 3: services they're paying for. It's a challenge, I get it.
Speaker 3: So let's create a system by which the curement team
Speaker 3: has to pay it because the legal team will show
Speaker 3: up and say, hey, you know this open source thing,
Speaker 3: we already went through our time and figured out how
Speaker 3: to deal with open source. Now you, as a procurement team,
Speaker 3: you now need to figure out how to deal with
Speaker 3: open source projects that require this maintenance because you have
Speaker 3: to pay them because the license says that you have to.
Speaker 1: And for big businesses with lawyers, I think that's probably
Speaker 1: a valid thing. What about all the small businesses.
Speaker 2: But that's that's who we want to pay.
Speaker 1: But what about a small business that's making a million
Speaker 1: dollars a year and it's Joe and his wife and
Speaker 1: they don't have lawyers. You know, maybe they do, but
Speaker 1: they're going to take the chance. How are you going
Speaker 1: to enforce? How are you going to enforce it?
Speaker 3: So I've been slow walking the enforcement past the legal
Speaker 3: requirements that will hopefully build the structure that everything else
Speaker 3: stands on. Okay, I've had people ask, hey, what do
Speaker 3: you do with the issues in the Wicks tool set.
Speaker 3: We've called out that you check a box if you're
Speaker 3: using money and you go through our templates, it says
Speaker 3: you're using this for monetary value. Check the box it
Speaker 3: says you are sponsoring the project. So we're getting the
Speaker 3: education and awareness out there.
Speaker 2: Now.
Speaker 3: There are some projects that I saw that lock their
Speaker 3: issue tracker unless you sponsor.
Speaker 2: So you can't submit an issue.
Speaker 3: Enter that, you can't submit the issues, you can't get
Speaker 3: the issues unless you sponsor the projects. That's doable through
Speaker 3: GitHub sponsors. Straight up, that's.
Speaker 1: Only if you're making money, right What about the student who.
Speaker 3: Isn't Again, So that's the challenge of the enforcement on
Speaker 3: that front for people that aren't making money. We have
Speaker 3: to find a place in there. After I made this announcement,
Speaker 3: the GitHub sponsors lead reached out to me and we
Speaker 3: had some conversations about what could be done. So there,
Speaker 3: what I'm saying is right now, we're in the beginning,
Speaker 3: and I want to start the enforcement by assuming that
Speaker 3: the developers that said I want to be able to
Speaker 3: help you and maintain your project, but I can't get
Speaker 3: through procurement now have the tool they need to go
Speaker 3: to their legal team and say, I now need to
Speaker 3: pay this project because it has a legal requirement. Please
Speaker 3: help me solve this issue with the procurement team.
Speaker 2: And people have told me, but also coming to them
Speaker 2: with the documents to say here's how it solved exactly.
Speaker 3: Yeah, it's not. Before it was like, you know, let's
Speaker 3: say as an individual contributed company and you're using this
Speaker 3: project that you want to support it, and you're like, yes,
Speaker 3: I want to help them, and you go to your
Speaker 3: boss and your boss says, no, dude, too much work.
Speaker 3: Let's not bother. Just just go do it and be done.
Speaker 3: Now you're able to go to the boss and boss say, hey, boss,
Speaker 3: there's now this legal requirement. We have to do this.
Speaker 3: Boss will be like, well, if we're going to continue
Speaker 3: this project, we have to go do with legal, we
Speaker 3: have to go do with procurement. They now have that tool,
Speaker 3: will they maybe say, you know what, forget it. Let's
Speaker 3: just go use a different project that's free, that doesn't
Speaker 3: have this open source maintenance fee. Absolutely, that may absolutely happen.
Speaker 1: So I have ideas. I have some ideas, which always
Speaker 1: happens when I have these great conversations with guys like you.
Speaker 1: But one idea is to have a sort of an
Speaker 1: outside agency that does enforcement. And I don't because I think,
Speaker 1: you know, software developers, they don't want to be in
Speaker 1: that position. You know, nobody wants to be the bad
Speaker 1: guy and have to on top of having to write
Speaker 1: good code. Now you got to wake up every morning
Speaker 1: and wonder who's not paying me that needs to be
Speaker 1: paying me. So an outside agency is not like a
Speaker 1: union or something, but just somebody that works on behalf
Speaker 1: of contributors to enforce this. The other thing that I
Speaker 1: was thinking of was is gone from my head. It's
Speaker 1: just gone.
Speaker 3: These ideas are great. I want the ideas, and honestly,
Speaker 3: if someone comes up with an idea and is inspired
Speaker 3: by the open Source Maintenance Fee and says, ah, this
Speaker 3: is a good idea, but it is fatally flawed this way.
Speaker 3: But I can create a system that works better. I
Speaker 3: hope that happens. Or people say, hey, here are different
Speaker 3: ways that you can do enforcement with the structure that
Speaker 3: the open Source Maintenance fee happens, I'm going to write
Speaker 3: them down. I have a discussion list on the open
Speaker 3: Source Maintenance Fee dot org. It says, hey, if you
Speaker 3: have more facts that your more ideas, you want to add,
Speaker 3: more questions that need to be answered, let's put them
Speaker 3: up there. There is a place to have the conversation
Speaker 3: to say, here's what we need to do. And I
Speaker 3: want to be really clear. The Wix tool set is
Speaker 3: the first project to apply the open Source Maintenance Fee,
Speaker 3: and we did so on the seventh, so a week
Speaker 3: ago today.
Speaker 2: The seventh of April, of April of.
Speaker 3: Twenty twenty five, the seventh of April twenty twenty five,
Speaker 3: so a week ago today. That has put all the
Speaker 3: pieces in place, and I've been then using that experience
Speaker 3: to update the step by step list for maintainers on
Speaker 3: the open Source Maintenance Fee dot org site. So if
Speaker 3: you want to go through it. It just lays out
Speaker 3: all the five or seventh steps you have to do
Speaker 3: to work your way through.
Speaker 1: It's really cool, right, so I found I remembered the
Speaker 1: second idea. Okay, the second idea was to require by
Speaker 1: law companies to publish as software bill of materials. So
Speaker 1: on every website in there about page or whatever, there
Speaker 1: should be a link to a s bomb page and
Speaker 1: then every dependency that they've taken must be listed there.
Speaker 1: And that way would it be easier for an auditor,
Speaker 1: even if the auditor was GitHub?
Speaker 2: Right yep, you know.
Speaker 1: GitHub seems like the logical place where this kind of
Speaker 1: thing would happen for getthub repost. But maybe in another place.
Speaker 1: I don't know.
Speaker 3: I actually had someone ask me if we would try
Speaker 3: to get an SPDX identifier for the OSMF.
Speaker 2: So.
Speaker 3: SPDX is the software what identity system They have a
Speaker 3: way of saying s bombs. Basically, they're one of the
Speaker 3: standards for specifying s bombs and one of the big
Speaker 3: features they've provided are the standard list for all the
Speaker 3: various open source licenses out there.
Speaker 1: Because it's advantageous for every software company to have an
Speaker 1: s bomb, right Yes, it's absolutely advantageous to them. Yes,
Speaker 1: because of security problems, right, and so you know when
Speaker 1: there's a problem, oh, we're using.
Speaker 3: That, right. And if the maintenance fee was in SPDX,
Speaker 3: then you would just use the identifier and then you'd know, hey,
Speaker 3: they're already doing this, and they would they'd all roll
Speaker 3: down the direction that you're saying. Now. Yeah, there's only
Speaker 3: one project using the open source maintenance fee right now,
Speaker 3: and we are slowly working our way through the experience
Speaker 3: of what does it mean to do so? And enforcement
Speaker 3: is an area where I'm trying to be extremely respectful
Speaker 3: to the challenges that I know individual developers will have
Speaker 3: inside their companies. I worked in Microsoft, I know big
Speaker 3: company challenges. I spent a lot of time with lawyers
Speaker 3: when I was first trying to get the WISK tools
Speaker 3: set released as an open source I think part of
Speaker 3: that training helped me design the open source maintenance fee
Speaker 3: is learn how to use lawyers to help you get
Speaker 3: a problem solved. Where we go through enforcement is a question.
Speaker 3: I think getting the first foundation and then normalizing the
Speaker 3: idea that maintainers should be paid to maintain the projects,
Speaker 3: and that if you don't want to use the project,
Speaker 3: and you don't want to pay a maintainer money for
Speaker 3: them maintaining the project, then you can go take the
Speaker 3: source code because it's still available, it's still a source.
Speaker 3: You can go take the source code and maintain it yourself,
Speaker 3: which is the alternative.
Speaker 1: You know, in the interest of security. This is the
Speaker 1: same reason that that bill got pass that requires everybody
Speaker 1: to allow cookies, yes or no. Right that is required
Speaker 1: by law right in GDPR. Yeah, the GDPR. And so
Speaker 1: just like that the way that got passed, this could
Speaker 1: be you know, you you must have an s bomb
Speaker 1: and you must be able to well.
Speaker 2: I would point out that that is not enforced. No
Speaker 2: one has ever been charged for not doing that. Yeah, so,
Speaker 2: and yet lots of people have done it. Like enforcement
Speaker 2: is a separate issue here, yea, And I would argue
Speaker 2: long before you get to anywhere near that, you can
Speaker 2: have nudges from within GitHub. Like the main thing we're
Speaker 2: hoping for is a get hub. Here is poke at
Speaker 2: obvious large organizations that are utilizing these resources to write, Hey,
Speaker 2: you know you should be making a contry.
Speaker 3: Here is the path and to basically put a system
Speaker 3: in place that starts allowing people to do the right thing.
Speaker 2: Yeah, make it reduced to friction doing the right thing.
Speaker 3: He says, Look, you have to do this. So now
Speaker 3: the people that want to do the right thing are
Speaker 3: now empowered to go take care of the larger systems
Speaker 3: that naturally would not change or continue to run the
Speaker 3: way they do. And we will continue to have large
Speaker 3: companies with their procurement systems which are designed not to
Speaker 3: spend money to you know, not spend money on maintainers
Speaker 3: for these projects. I mean. One of the interesting comments
Speaker 3: I got very recently was someone left a comment saying, hey,
Speaker 3: I will need some extra verification of to give you money.
Speaker 3: I will need some extra verification to know that you're
Speaker 3: not a terrorist organization, right right, because my procurement team
Speaker 3: can't fund terrorist organizations. And I was like, sure, whatever
Speaker 3: you need, let me know, we'll answer those questions. But
Speaker 3: then I stopped and said, it is harder for the
Speaker 3: the procurement team. The procurement team has higher standards than
Speaker 3: the developers do for taking the code, like you already
Speaker 3: took the code the binary code usually and are using it,
Speaker 3: and I don't remember a background check or anything like
Speaker 3: that to take the bus. I heard terror because I
Speaker 3: use my code. What we have done is create some
Speaker 3: artificially high bar on the procurement and the sustaining the
Speaker 3: project if projects want to be sustained by money, and
Speaker 3: the way that you can take the code into the
Speaker 3: sources world. And we've also created a culture where I
Speaker 3: just take it and I don't have to do anything
Speaker 3: else after that.
Speaker 2: Well, and there's an advantage to that too, because you
Speaker 2: want to take it out for a spin. You want
Speaker 2: to prove that it's valuable to the organization, Like you
Speaker 2: need to get to a place before you even have
Speaker 2: the conversation about you know, do I want to spend
Speaker 2: money on this or not? I mean, I do appreciate
Speaker 2: and I've included the link to how wix tool sets
Speaker 2: maintenance fee is set up where it's based on the
Speaker 2: size of the organization with the size of the contribution.
Speaker 2: Is because this now roll the other way where a
Speaker 2: CFO should be able to go to gethub and say, hey,
Speaker 2: what libraries is my company using? What is the total
Speaker 2: fee I should be paying. My experience with CFOs is
Speaker 2: they'll kind of check once a year, but don't make
Speaker 2: it more complicated than that.
Speaker 3: And so we fell upon I fell upon GitHub sponsors
Speaker 3: because it was very straightforward for a lot of maintainers
Speaker 3: to be able to access that directly without having to
Speaker 3: do a whole lot of extra work. And also because
Speaker 3: gethub sponsors has may have relationships has larritionships a lot
Speaker 3: of companies through their enterprise system, and through that enterprise system,
Speaker 3: you can say pay for sponsorships by invoice. It doesn't
Speaker 3: have to be a credit card. So you can walk up
Speaker 3: with an invoice to get Hub and say here, I
Speaker 3: want you know, give me. I think the minimum invoice
Speaker 3: is like five thousand dollars. It's a pretty large number.
Speaker 3: But you can pay an invoice in bulk and know
Speaker 3: I will pay my maintenance fees, you know, in bulk
Speaker 3: for this amount of time for all projects.
Speaker 2: Yeah, so GitHub will disperse it.
Speaker 3: There's a process.
Speaker 2: Well that's important, right, Like that's the important part of it.
Speaker 3: And it can also wire straight into your enterprise buss.
Speaker 3: So if you're already paying for repose and you know
Speaker 3: actions and all time, and you know space inside GitHub
Speaker 3: with they already have that, then your sponsors just end
Speaker 3: up as line items inside that nice payment system.
Speaker 2: Already.
Speaker 1: I'll tell you what we don't want. We don't want
Speaker 1: the Spotify model. Like imagine GitHub. In order for you
Speaker 1: to access any of this open store of source stuff,
Speaker 1: you'd have to pay GitHub, you know, ten dollars a
Speaker 1: month or thirty dollars a month or whatever, and then
Speaker 1: you can use whatever you want for free, and then
Speaker 1: that gets dispersed among all of the projects. Like that
Speaker 1: model is horrible. It's horrible for the music business, and
Speaker 1: it would be even more horrible for the software business.
Speaker 1: I'm just the anti patterns are community.
Speaker 3: I've seen proposals for doing that through like Newgate, like
Speaker 3: nugat would get a bulk upload and then send out
Speaker 3: whoever has most downloads.
Speaker 2: I don't like that at all.
Speaker 3: I don't like any of those systems either, because they
Speaker 3: all can be gamed. With the numbers. With the open
Speaker 3: source maintenance fee, you basically say, here are the projects
Speaker 3: I use. Whatever you know in your package reference or
Speaker 3: your package cafig. If you're still using that, you look
Speaker 3: at your packages you depend on. You chose them. They
Speaker 3: didn't get in there because someone out of them. You
Speaker 3: chose them. You go to each others project, you go, oh,
Speaker 3: there's the fee for that one. There's a feed for
Speaker 3: that win there's a feed for that, and there's a fee,
Speaker 3: but there all of the things that I use and
Speaker 3: the people that I depend on, I've now paid the fee.
Speaker 3: You're done. You don't have to go down some crazy train,
Speaker 3: you know, tree.
Speaker 2: And ultimately the maintainers are setting the fear for their projects.
Speaker 3: Correct.
Speaker 2: And if you don't like that fee, don't use that project.
Speaker 3: Right, if a fee is like ten thousand dollars per month,
Speaker 3: you might go, hmm, I think I can have an
Speaker 3: engineer use that source FEDE and maintain it myself and
Speaker 3: all the overhead that goes with staying on top of
Speaker 3: the source code, being awarable, security vulnerabilities, that whole list
Speaker 3: I brought back. You're like, yeah, that makes sense. But
Speaker 3: for a small company, ten dollars And I've had many
Speaker 3: business people tell me ten dollars is too low, just flat.
Speaker 1: That depends on depends on the value right that you're providing, correct.
Speaker 3: And so the Wix toolset I use as a tiered model.
Speaker 3: So we're going to try to also show that where
Speaker 3: if you're a small company less than twenty people, it's ten,
Speaker 3: if you're twenty to one hundred people, it's forty. And
Speaker 3: if you're over that at sixty. That tiered model basic
Speaker 3: to say that you're getting more value out of it
Speaker 3: as a bigger company, that those tiering systems will see
Speaker 3: how all that works. But the goal is basically, look,
Speaker 3: nobody's arguing that ten dollars is too much.
Speaker 2: Yeah, right, like it just if it is.
Speaker 3: It's like a dev at one hundred thousand dollars a year,
Speaker 3: it's like two hours of their time for the year.
Speaker 3: So if you can take the source code, build it,
Speaker 3: maintain it, keep up the date on all those things
Speaker 3: for less than two dollars per year, then that your
Speaker 3: procurement team's right. You should copy the code and maintain
Speaker 3: it yourself, right, right, But two hours is not a
Speaker 3: lot of time to keep up even build a project
Speaker 3: and keep tracking. Come on, it doesn't work, and that's
Speaker 3: why we want maintainers. Do you see the reactions when
Speaker 3: other projects say, hey, we're gonna not be open source anymore.
Speaker 3: You can see people being upset. She's like, look, you
Speaker 3: have the source code, you can build it, and they're like, oh,
Speaker 3: that takes work. I'm like, wait, so.
Speaker 2: You know it takes work. You know enough to know
Speaker 2: why I'm where I am.
Speaker 3: You're complaining that it takes work, but we're not doing
Speaker 3: anything to support the people doing that work. And I
Speaker 3: want to be really, really really clear, because I don't
Speaker 3: think I've said this yet. These are not support contracts.
Speaker 3: These are not I if you're going to get fixed
Speaker 3: my bugs, you're going to fix my features, you're going
Speaker 3: to write the code. It's not that, it's essentially the
Speaker 3: work it takes to keep a project running that people
Speaker 3: don't see. I know a lot of people don't even
Speaker 3: know that's there, but just sucks up so much time
Speaker 3: of a Maintainer's so much energy out of a maintainer.
Speaker 1: Have you published the documents and the mechanisms to go
Speaker 1: ahead and do this in your own projects? Like if
Speaker 1: somebody's listening and they say, yeah, I want to implement
Speaker 1: this in my project, do you have a little zip
Speaker 1: file they can download and with instructions and everything.
Speaker 2: Yeah.
Speaker 3: So if you go to open Source Maintenance Fee dot org,
Speaker 3: you will get presented with two options at the top.
Speaker 3: If you're a consumer. It explains why the open source
Speaker 3: maintenance fee is there. And I have a six minute
Speaker 3: video where I tell pieces of this story in one
Speaker 3: unified video, and then it breaks it down with the
Speaker 3: fact and things like that. There's a separate route you
Speaker 3: go through as a maintainer, and that essentially lays out
Speaker 3: the Hey, you're a maintainer. Here's why you should consider
Speaker 3: taking a maintenance fee all the work you're doing. Because
Speaker 3: when I talk to maintainers, a lot of them had
Speaker 3: never thought about all the work they'd been doing. But
Speaker 3: as I was talking to them, when I was first
Speaker 3: vetting this idea, a lot of them would like get
Speaker 3: to that point. They all start nodding, going, oh, yeah,
Speaker 3: I do a lot of wow, And I thought, oh,
Speaker 3: that's a lot of work, isn't it. So there's that,
Speaker 3: and then there's next one is this five step process.
Speaker 3: I think of the steps to do, and the first
Speaker 3: step is communicate the change. Tell your community that you're
Speaker 3: going to introduce a maintenance fee at some point in
Speaker 3: time in the future, with the date whatever that date
Speaker 3: is for your product. And then it says here's how
Speaker 3: you can set up with GIOB sponsors. And then here's
Speaker 3: what you do and you read me, and then here's
Speaker 3: the EULA. By the way, here's a EULA already man
Speaker 3: verified by the fire Giant lawyers. So if you want it,
Speaker 3: you can have it. It should work for you, no problem.
Speaker 3: I can't guarantee that. My lawyer won't let me tell
Speaker 3: you that. We guarantee that because lawyers won't ever do that.
Speaker 2: You're a lawyer.
Speaker 3: But it's good and because we got feedback on the
Speaker 3: first draft that I had up there that was not good.
Speaker 3: It had problems, and I got plenty of feedback from
Speaker 3: the internet that it was bad. But we fixed those bugs.
Speaker 3: No problem. And then it goes through on how to
Speaker 3: add the EULA to your package. And I have steps
Speaker 3: for both MPM, for for MPM and for new gits
Speaker 3: because those are the ones that I understand enough of
Speaker 3: to do that. But if people come along and say, hey,
Speaker 3: here's how I could do it for other types, I'd
Speaker 3: love to get that information on the website. But it's
Speaker 3: it's like a five step process. And the big one
Speaker 3: up front is copy this blank you know this message,
Speaker 3: replace the date, and send it to the place where
Speaker 3: your people are. Create an issue, pin the top, put
Speaker 3: a discussion, put at the top, say we're doing this,
Speaker 3: and then you do the rest of the steps and
Speaker 3: it will take you a day, I mean or two
Speaker 3: to do it. It's not hard to step up. Just
Speaker 3: had to get the I mean the hardest part was
Speaker 3: getting the yula put together that passed all the rules.
Speaker 3: Now you just copy and paste it and replace your
Speaker 3: license inside your your nigga peck and had.
Speaker 1: I can't believe we haven't asked you this question, but
Speaker 1: how did it work out for you so far? And
Speaker 1: how long has it been in place?
Speaker 3: It's been seven days?
Speaker 1: Wow, Okay.
Speaker 3: At the point of recording, it's been in force in
Speaker 3: seven days. It has been announced for a month and
Speaker 3: a half ish, because I announced it four weeks right
Speaker 3: after the maintenance fee was announced, which was the end
Speaker 3: of February, okay. And I got a lot of feedback
Speaker 3: and various questions up front, not a lot of pushback
Speaker 3: on doing it, not a lot of pushback on why
Speaker 3: or none of that real negativity of that. It could
Speaker 3: be that they're not saying it. I'm sure they're just
Speaker 3: not saying out loud they're playing people. I'm sure they're
Speaker 3: very upset that we're making.
Speaker 2: Do this work.
Speaker 3: I have got the feedback from some people say, hey,
Speaker 3: this is a lot of work to go through our
Speaker 3: legal team and our procurement team, and I'm like yep, yep,
Speaker 3: we would pay you money, but the procurement team's really
Speaker 3: a problem. I'm like, yeah, I know, like, well what
Speaker 3: do I do. I'm like, dude, it's your procurement team.
Speaker 3: Like you're going to have to educate them, and every
Speaker 3: company's procurement team needs to be educated so.
Speaker 2: Well, and you're going to build up more language around
Speaker 2: how to talk to your procurrement team as this goes by,
Speaker 2: because part of this is what's the cost of us
Speaker 2: moving off of this project or maintaining itself and like
Speaker 2: showing larger dollar signs to the CFO, then get this
Speaker 2: through procurement so we can keep working.
Speaker 3: So one of the feedback I got from people was
Speaker 3: our one idea I got out there was hey, be
Speaker 3: cool if you had a list of companies that had
Speaker 3: already adopted this as yeah, we're doing this, so I'll
Speaker 3: try to go there. We're early in this, and that's
Speaker 3: why I was really happy you got had me on
Speaker 3: because I just.
Speaker 2: Wanted super early stages. I think the main thing you
Speaker 2: READNACT right now, Rob, more than anything is more projects
Speaker 2: to set up like this.
Speaker 3: Yeah, So that's my feeling is that I was That's
Speaker 3: why I'm really glad you guys had me here is
Speaker 3: because we can get the message out to maintainers so
Speaker 3: the day can start going, Yeah, you know what I am.
Speaker 3: I know exactly what he's saying. I know exactly how
Speaker 3: he feels. And when I first announced this at the
Speaker 3: end of February, I got so many dms from maintainers
Speaker 3: and you know them, you know who they are. They
Speaker 3: DM me saying this is brilliant. I was like, great,
Speaker 3: but I didn't have the ule at that time, and
Speaker 3: there's a leap of faith that you have to do it.
Speaker 3: We've seen a couple so I want to talk about
Speaker 3: the commercialization that projects has been going through, because that's
Speaker 3: that's what we're kind of I'm hoping we can counter here.
Speaker 3: But the idea that maintainers will be like, you know what,
Speaker 3: my time is worth something, sure, and I should be
Speaker 3: paid for this set of work that I am doing.
Speaker 3: That actually is taking a lot of energy out of me.
Speaker 3: And if I could put this into my project, I'm
Speaker 3: not going to retire. I might not have enough users
Speaker 3: to make a business, but one developer I talked to
Speaker 3: said he probably has fifty ten to fifty companies using
Speaker 3: his software. I was like, so that's like, you know,
Speaker 3: one hundred to five hundred bucks a month. He's like, yeah,
Speaker 3: that's about a weekend. Okay. Oh if I had five
Speaker 3: hundred bucks a month that I could do something fun
Speaker 3: on a weekend, then I could spend the other weekend
Speaker 3: maintaining my project. Because he's just like, why am I bothering? Yeah,
Speaker 3: he's and he'll walk. Those companies will be out of luck.
Speaker 2: But you hit on the key point, which is the
Speaker 2: alternative is they head towards commercialization, which is going to
Speaker 2: make it even more expensive for a bunch of people
Speaker 2: who want to use this. It's going to make ask
Speaker 2: a developer to do thing I maintainer, do things they
Speaker 2: don't want to do, like operating a business like that.
Speaker 2: That is a weaker choice. Then here's the low friction
Speaker 2: way that lets everybody keep doing what they're good.
Speaker 3: At, and it walks away from open source, which I
Speaker 3: don't want. I don't want that to be the way.
Speaker 2: The alternative open source starts to implode.
Speaker 3: Yeah right, It basically says, you know what open source failed,
Speaker 3: and that requires me to say, yeah, no, that idea
Speaker 3: that I had well in nineteen ninety nine, and then
Speaker 3: finally made a reality in two thousand and four that
Speaker 3: you know, companies should do open source and it should
Speaker 3: be a thing, and people and developer should do open source.
Speaker 3: You should be able to go out there and create
Speaker 3: communities around your source code. Wow, that should be possible.
Speaker 3: It just says no, don't or don't be successful because
Speaker 3: you will end up in a space.
Speaker 2: Yeah, you can do it, you just won't be successful.
Speaker 3: Where you hate it. Yeah, just don't be successful. Don't
Speaker 3: don't have your project work out because you will end
Speaker 3: up in a space that you want, or if you do,
Speaker 3: you have to enter that space where I don't care
Speaker 3: about any of you, which is a completely different way
Speaker 3: of interacting with your project and the community. It's not
Speaker 3: a community. It pains me and I'm I'm very conflicted
Speaker 3: in this whole space still because I'm seeing people commercializing
Speaker 3: their projects. At the same time, I couldn't reach out.
Speaker 3: I couldn't reach out to everybody. So I'm hoping here,
Speaker 3: at least take a little maintenance fee and go you
Speaker 3: know what, I will follow that because there's a list
Speaker 3: or no, no, I'm going to go route like that,
Speaker 3: but a different way or a different spin on it great.
Speaker 3: I want to see where people go. I just want
Speaker 3: maintainers to have an option that they don't have to
Speaker 3: give up and commercialize or just walk away, and they
Speaker 3: can have a space that you know what, I could
Speaker 3: fund a bit of my world here and feel good
Speaker 3: about this space and if you know, and they'll have
Speaker 3: other maintainers with them. I'm out here, right. So people
Speaker 3: told me I was gonna get fired at Microsoft when
Speaker 3: I said I was going to try to open source
Speaker 3: my little project. It didn't. I was there for eight
Speaker 3: more years until I decided to retire. I'm doing this now.
Speaker 3: I was afraid I was going to get lambasted off
Speaker 3: the internet. I haven't been, and I hope so we
Speaker 3: could do something to change the ecosystem, because that's where
Speaker 3: I want us.
Speaker 1: Well, I have a few open source projects that are
Speaker 1: popular that then I think I might visit this with
Speaker 1: So yeah, I'm going to be looking through my repos
Speaker 1: and it.
Speaker 2: Looks like a weekend's worth of work. Yeah. To learn
Speaker 2: the pattern, yeah, and put it into your project.
Speaker 3: Yeah. Yah, Yeah, you follow pattern and if there's issues,
Speaker 3: you know, send them to me and will revise the
Speaker 3: document and make it better.
Speaker 2: Yeah. And the more we can refine the material the better.
Speaker 3: Yeah, yeah, exactly, it's good stuff. Yeah, that's that's the
Speaker 3: I hope we can get to a better space.
Speaker 1: I'm sure we will at some point.
Speaker 3: Can I add a couple of gripes at the end here? Yeah,
Speaker 3: go ahead, you could try to stick where you want,
Speaker 3: all right. So one people will say it's a rug pull.
Speaker 3: You're going to get that the whole open source maintenance fee,
Speaker 3: any charging for anything turns into rug poole. I don't
Speaker 3: have a good answer that, because they're not entirely wrong.
Speaker 3: It is a bit of a rug pull. It is
Speaker 3: we're changing the rules on you.
Speaker 2: The ultimate rug pool is a project you're depending on
Speaker 2: no longer being dependent and being maintained. Right, which rug
Speaker 2: pole would you like? Yeah?
Speaker 3: Yeah, the alternative is exactly. The alternative is they just
Speaker 3: go away. And my hope is that we can get
Speaker 3: out get to a place where it's no longer a
Speaker 3: rug pole. Because everybody expects it that companies walk up
Speaker 3: to a project, go man, this one doesn't take a
Speaker 3: maintenance fee or anything. How do we know that the
Speaker 3: companies the project is going to stick around for us?
Speaker 3: So I'd love for us to get to the other
Speaker 3: side where it's not a rug pull, it's a you
Speaker 3: need to do this so that we can, like, we
Speaker 3: would like to have some interaction here, so we know
Speaker 3: that you'll continue to maintain this project for us. So
Speaker 3: I'd love for the to turn around. Maintainers may still
Speaker 3: say I don't want money, because I don't want money,
Speaker 3: that's fine. I'd love for it to be turned around,
Speaker 3: so it's not a rug pull. The second right is
Speaker 3: that I've been seeing this a lot as the commercialization
Speaker 3: has started happening, or as this whole all these issues
Speaker 3: have popped up. I see people saying they shouldn't have
Speaker 3: made an open source in the first place if they
Speaker 3: didn't want to give it away for free, and it
Speaker 3: just it. It makes me so mad.
Speaker 2: Is an awesome piece of ignorance there.
Speaker 3: Because I didn't make it open source to make it free.
Speaker 3: I made it open source so that people could join
Speaker 3: and we could build something right right, But that's not
Speaker 3: what happened. The fact that the source code is available
Speaker 3: for you to do as you wish with it, as
Speaker 3: in freedom to go forth, is what this is about.
Speaker 3: It was never about me giving my time away for
Speaker 3: twenty five years for free and having people not appreciate it.
Speaker 3: That was never the goal. And it also is never
Speaker 3: the goal that we'd get to the end twenty five
Speaker 3: years later and say, haha, I'm now going to charge
Speaker 3: you for this thing that you become dependent on.
Speaker 2: That was the goal. That's what I wanted all along.
Speaker 1: Like, come on, well, and the fact is right, you're
Speaker 1: not paying.
Speaker 3: No maintainer's doing that.
Speaker 1: You're not paying if you're not making money on it.
Speaker 1: If you are making money on it, it should be
Speaker 1: less of an issue exactly.
Speaker 3: But this whole attitude I see about. They never should
Speaker 3: have made it free in the first place.
Speaker 1: Say just I get so torq staggering bullshit.
Speaker 2: That never made it free. I expected contributions. They never came.
Speaker 2: Now I'm buried either pay me or contribute. Well, not anymore.
Speaker 3: You know, I don't even expect contributions, like like, let's
Speaker 3: be like, even as a maintainer, I didn't expect contributions.
Speaker 3: I wanted people talking about it, helping people participating, working together.
Speaker 3: I would have my project suffered significantly in documentation because
Speaker 3: I'd hope that people would contribute what they learned is
Speaker 3: a great contribution and just write it down and give
Speaker 3: it back to us. Nobody did that. They wrote it
Speaker 3: on their own blogs in their own places, and they
Speaker 3: spread it all about the internet. They never came back
Speaker 3: to a project. That's probably partly a failure on my
Speaker 3: maintenance of my project and my doctition and my community.
Speaker 3: But the goal was that people would work together and
Speaker 3: we could all be set up ninjas together.
Speaker 2: Yep.
Speaker 3: Right, those sixteen people you talked about the beginning, Yeah,
Speaker 3: those my people, right, that's why we're out here, right,
Speaker 3: we're making these things happen, and we are not alone.
Speaker 3: And then there's way, way, way too many people are
Speaker 3: out here. Well, it's free, so I'm just going to
Speaker 3: use it. And I can't believe that you didn't take
Speaker 3: care of I issue ten years ago when someone else
Speaker 3: opened it.
Speaker 2: Yeah. The original mantra of the open source community was
Speaker 2: this small group of peers building stuff and helping each
Speaker 2: other to make it better. Right, And that's I think
Speaker 2: one tenth of one percent of the audience is actually
Speaker 2: out there. And I'm not saying anything bad about that.
Speaker 2: It's like, but recognize where you're sitting. Yeah, there's a
Speaker 2: whole other show here to talk about. How do we
Speaker 2: work with contributors to just recognize their value. But we
Speaker 2: can do that today. Let's work on the reality of
Speaker 2: where we are right now, which is that most of
Speaker 2: these open source projects have a maintainer and that person
Speaker 2: needs help. Rob.
Speaker 1: We got to pull the clock here and say thank
Speaker 1: you very much. This is great. It's a great idea,
Speaker 1: it's great stuff. I hope that I can get involved
Speaker 1: in it, and I hope other people listening will evaluate
Speaker 1: their open source projects and see whether this makes sense
Speaker 1: to you.
Speaker 3: It's the beginning of a conversation that we need to have.
Speaker 3: I'm hoping it can unlock more ideas so that we
Speaker 3: get to a place that is sustainable for all these maintainers.
Speaker 3: Thanks Rob, Thanks guys.
Speaker 1: And thank you for listening, and we'll see you next
Speaker 1: time on dot net rocks. Dot dot net Rocks is
Speaker 1: brought to you by Franklin's Net and produced by Pop Studios,
Speaker 1: a full service audio, video and post production facility located
Speaker 1: physically in New London, Connecticut, and of course in the
Speaker 1: cloud online at pwop dot com. Visit our website at
Speaker 1: d O T N E t R O c k
Speaker 1: S dot com for RSS feeds, downloads, mobile apps, comments,
Speaker 1: and access to the full archives going back to show
Speaker 1: number one, recorded in September two thousand and two. And
Speaker 1: make sure you check out our sponsors. They keep us
Speaker 1: in business. Now go write some code. See you next time.
Speaker 3: You got JAD middle vans. Then I