Executive interview: Putting a value on open source

Making strategic open source choices

At Spotify, developers can pick and choose from a wide variety of libraries based on their own choices. But for bigger strategic investments, Ploug says Spotify will assess open source technology rigorously if it will become a standard that the business can depend on for a longer period of time, to ensure it is not prematurely forced to move away to a newer technology.

One example, which he says, with hindsight, is quite amusing, is: “On the day before Kubernetes was released, we open sourced our own container orchestration layer.”

A more positive project for Spotify is Backstage, which Ploug says it has made open source, as a way of creating a common standard. Backstage is an open source framework for building developer portals, created at Spotify, which it donated to the CNCF. It has now been adopted by hundreds of companies. 

“We didn’t want to just wait and see and keep it internal,” he says. “We wanted to drive innovation in the space of developer portals.”

In doing so, Spotify Backstage has become the market leader. The company continues to invest internally but, by donating it to the CNCF, Ploug says Spotify also ensures it will “stay around”, which gives internal users the confidence to carry on using it.

Financial sustainability

Ploug believes the idea of having confidence that an open source product has longevity goes to the heart of the problem currently facing the open source community. “We have an enormous financial sustainability problem in open source,” he says. “I think a large number of open source maintainers are underpaid or underappreciated. They are also stressed about the rising demands on open source maintenance that we are seeing.”

Organisations using open source code need to understand the implications. “You don’t have a service level agreement with this provider,” says Ploug. “It’s not a vendor. You’re not paying the person who maintains the code. There’s no supplier relationship [contract].”

The lack of a service level agreement has a material impact on the effectiveness of industry-wide initiatives to improve open source security.

“I think a lot of the problem comes from lack of maintenance,” he says. “This is because maintainers simply don’t have the time or they’re not paid for their work and are running these projects in evenings and weekends.”

As a result, Ploug does not believe the concept of a software security supply chain can work in open source. Since the maintainers are not being paid, they are not a supplier. “You don’t have a supply chain,” he says.

It’s still not a common practice for companies to support projects financially, and Ploug would like to see more organisations which use open source offering financial support for open source projects.

Widening the talent pool

Given that only certain people are able to give up their time to maintain open source projects, he worries that this limits the community to a very particular demographic.

“It’s a very specific kind of person who has a passion to spend evenings and weekends working on open source,” says Ploug. “That’s someone who has no household chores, no kids to maintain, no family life, no sick relatives.”

He says open source needs to become more of a level playing field that is able to attract a diverse community of contributors and maintainers. This is also linked to the financial problem, and the industry and policy makers’ ambitions to put in place software security supply chains.

If maintainers and open source contributors are paid and projects are sponsored, people are more likely to see their role in the open source community as a vocation. And the contract they have with users of the code they develop and maintain is financially binding, which gives those users a service level agreement and accountability.

Listen to the podcast here >>