[00:00.000 --> 00:12.800]  Thank you all for coming and staying so long. I'm positively surprised and impressed. A
[00:12.800 --> 00:18.000]  bit nervous. I hope I entertain you better and don't make a mess out of this. Who of
[00:18.000 --> 00:26.760]  you thought that this title was clickbait? That's fair. It's clickbait a little bit.
[00:26.760 --> 00:34.800]  I'm also serious about it. I think it's a serious issue. A quick introduction. I will
[00:34.800 --> 00:39.240]  not read this to you and you already heard it. I think the key point, I work at Rathead.
[00:39.240 --> 00:46.920]  Yes. My motivation for this talk is informed by my experience at Rathead, but really I've
[00:46.920 --> 00:51.040]  been an open source free software for a long time and I'm really committed to that. That's
[00:51.040 --> 01:00.040]  the reason why I work at Rathead, not wise-worthy. Also, I have to give this disclaimer. Nothing
[01:00.040 --> 01:07.840]  I say here is an official position of any of my former current or future employers, although
[01:07.840 --> 01:18.560]  it may be the same things I tell my employer. Take that as you wish. Let's get on the topic.
[01:18.560 --> 01:25.360]  Why do I say that the cloud is a threat to free and open source software? Because while
[01:25.360 --> 01:34.680]  free software has democratized the access to code address, so code in a repository, taking
[01:34.680 --> 01:40.120]  that code and actually operationalizing it, running it, has become the new proprietary
[01:40.120 --> 01:48.400]  differentiator, even on top of free software. In my experience, that is undermining both
[01:48.400 --> 01:55.080]  the usefulness and the sustainability of free software. Let me explain that a little bit.
[01:55.080 --> 01:59.440]  Why do we do free software? I trust everyone here in this room knows the definition of
[01:59.440 --> 02:04.600]  free software, so I'm not going to believe in that. I'll use open source free software
[02:04.600 --> 02:14.520]  force synonymously. We can discuss that over beer later if you want. The point is that you
[02:14.520 --> 02:24.120]  have the freedom to use software and it matters. It's important because before free software,
[02:24.120 --> 02:31.440]  code was a major proprietary differentiator. Proprietary code was also the major entry
[02:31.440 --> 02:39.120]  hurdle for accessing technology. It incentivized centralization involved gardens and thus became
[02:39.120 --> 02:46.280]  an inhibitor or was an inhibitor to innovation. It created and maintained dependencies and
[02:46.280 --> 02:52.240]  lock ends. You were dependent on the decisions of someone else who had authority over the
[02:52.240 --> 02:59.920]  code that you used. Back then, that was annoying. Maybe it wasn't as big of an issue as it
[02:59.920 --> 03:04.720]  today, but the world has changed and they'll get to that. Free software, in contrast to
[03:04.720 --> 03:10.280]  proprietary code, levels the playing field and democratizes the access to technology.
[03:10.280 --> 03:17.320]  It incentivizes open collaboration and offers a base for technical sovereignty. Sovereignty
[03:17.320 --> 03:28.280]  being the state where you have authority over your technology. That's my own path to open
[03:28.280 --> 03:34.400]  source. I got to open source because I was in high school and I needed a compiler. I was
[03:34.400 --> 03:44.200]  using, I was using OS 2 at the time. Guess my age based on that. I was using OS 2 because
[03:44.200 --> 03:51.720]  DOS and Windows were not my thing. But the Tobos C compiler I had used on DOS didn't
[03:51.720 --> 03:58.160]  work on OS 2 and IBM wanted a lot of money for a compiler. Luckily, there was this guy
[03:58.160 --> 04:09.960]  DJ Delori who had ported GCC to OS 2 and that is what saved me. Let me use a compiler on
[04:09.960 --> 04:16.640]  OS 2 and what got me into free software. The key point here was that I was excluded from
[04:16.640 --> 04:22.160]  access to technology. I was excluded from being able to use something to write my own
[04:22.160 --> 04:26.480]  code on that platform that happened to be running. Could have switched platforms but
[04:26.480 --> 04:33.400]  would have run into similar problems. There were other compilers that were maybe cheaper
[04:33.400 --> 04:39.040]  but the problem became obvious to me because of the pricing that made it inaccessible for
[04:39.040 --> 04:48.360]  me. So that removed the hurdle. And as sovereignty is a big topic right now, for me it starts
[04:48.360 --> 04:55.000]  with individual sovereignty but that becomes an issue for any organization. If as a business
[04:55.000 --> 05:04.000]  you are dependent on other people's decisions or in Europe that's a big topic nowadays even
[05:04.000 --> 05:09.680]  as a state or union of states you become dependent on other people's technology decisions, that's
[05:09.680 --> 05:18.040]  creating major risk. Free software is the antidote for that. It provides you an environment
[05:18.040 --> 05:27.960]  that lets you control your own technology and it creates an environment where access
[05:27.960 --> 05:35.920]  to technology is fully democratized. It provides incentives for collaboration and creates a
[05:35.920 --> 05:45.880]  better innovation model that's based on collaboration. And it, well now I'm repeating myself, apologies
[05:45.880 --> 05:51.760]  for that. It creates this level of sovereignty and control over your code. That's why it
[05:51.760 --> 06:02.600]  matters and that is something that in the cloud is becoming harder to do. What happened
[06:02.600 --> 06:07.760]  is that software aids the world. Everything is software defined now. An example I often
[06:07.760 --> 06:15.200]  use is the connected mousetrap I have in my basement. Mousetraps is a pretty old concept
[06:15.200 --> 06:27.400]  doing something very physical. And now I have a mousetrap that has a microcontroller,
[06:27.400 --> 06:34.680]  talks to my network and tells me through a cloud backend with a front end on my mobile
[06:34.680 --> 06:44.200]  phone when it did its business so I don't find it weeks later. So that's software defined
[06:44.200 --> 06:53.360]  now. And I bought this one because it has software features. So that shows how integrated
[06:53.360 --> 06:58.680]  our lives become, I mean it's a silly example, but it shows how integrated our lives have
[06:58.680 --> 07:06.240]  become with software. How things are defined by software. I always go back to Laurenz Lasek
[07:06.240 --> 07:15.080]  book in late 1990s or early 2000s that he wrote called Code where he argues that code
[07:15.080 --> 07:20.840]  becomes law because it defines our ability to interact with the world increasingly. I
[07:20.840 --> 07:26.360]  came across it in the context of the fight against software patents in Europe in the
[07:26.360 --> 07:33.960]  early 2000s. And I think that's become more and more reality. Everything we do is more
[07:33.960 --> 07:41.160]  defined by code. And that is not defined by code at rest anymore. It's not defined by
[07:41.160 --> 07:52.920]  code in a repository. It's defined by code that's running somewhere. And the software,
[07:52.920 --> 08:00.560]  open source is a base for that, right? The cloud is built on open source. The software
[08:00.560 --> 08:06.680]  has the complexity of modern software. The integration of the world has left interdependencies
[08:06.680 --> 08:14.480]  that everything now has on that has led to a model where users, commercial users, private
[08:14.480 --> 08:19.440]  users increasingly just built on top of services provided by someone else, right? And it's
[08:19.440 --> 08:24.440]  just a function of the complexity with the utility of something. If I need a database,
[08:24.440 --> 08:28.000]  I can click a button, I get a database. I don't have to become an expert in deploying
[08:28.000 --> 08:32.560]  databases myself. I don't need to figure out how to find the right infrastructure for it.
[08:32.560 --> 08:37.800]  I just press a button. It works. And I can focus on the top 10% of my solution stack
[08:37.800 --> 08:44.880]  where I implement my, as a business, I implement my proprietary differentiation. I will use
[08:44.880 --> 08:56.640]  that. But the price for that is a dependency on a service that in itself may be based on
[08:56.640 --> 09:02.920]  open source code, but the step from taking the code that's in a repository to putting
[09:02.920 --> 09:07.400]  together multiple pieces of code into a running service, and running that service, keeping
[09:07.400 --> 09:13.480]  it running, keeping it secure, and integrating these other things increasingly becomes proprietary.
[09:13.480 --> 09:18.000]  And it becomes the proprietary differentiation to the degree that less and less people can
[09:18.000 --> 09:26.360]  actually run services on their own. And why is that? Because the knowledge of running things
[09:26.360 --> 09:30.880]  in this complex interconnected world gets harder. It's hard to keep things secure, even
[09:30.880 --> 09:39.360]  configuring them secure, which you can see in the news, basically daily base, is hard.
[09:39.360 --> 09:47.080]  People fail. And all kinds of data shows up in places it shouldn't be. And that becoming
[09:47.080 --> 09:53.240]  a new, that knowledge, right? So it's not just, it's not the question whether in this
[09:53.240 --> 09:58.040]  respect is a definition of free software. My complaint is not that I may have to pay
[09:58.040 --> 10:03.720]  for a service, right? My complaint is that the knowledge on how to go from code in a
[10:03.720 --> 10:10.920]  repository to a running service, that knowledge in itself has become a proprietary differentiator
[10:10.920 --> 10:19.440]  that's creating walled gardens and that removes access to technology. And I'm guilty myself
[10:19.440 --> 10:23.480]  in actually falling into that trap. I mean, I don't run my own mail server anymore, which
[10:23.480 --> 10:30.920]  has been a, I don't know how many of you are in that camp, who runs their own mail server?
[10:30.920 --> 10:40.920]  Yeah, that's sad really. I mean, in this audience, I was wondering whether I should dare ask this
[10:40.920 --> 10:44.920]  question because I would have felt really silly if all of you would have raised their
[10:44.920 --> 10:51.680]  hand and say, I run my own mail server, Daniel, you idiot. But in reality, why don't I run
[10:51.680 --> 11:03.520]  my own mail service because I can't, I don't have the time to do it and keep it secure and
[11:03.520 --> 11:09.880]  keep my family on it and deal with the support requests of that and provide the same access
[11:09.880 --> 11:15.640]  from every device that I get if they are just on Google mail, right? But that's a compromise
[11:15.640 --> 11:20.840]  I make for the ease of use, the utility of it, and in the end, it creates a dependency.
[11:20.840 --> 11:25.840]  Now I have the situation, I'm going a bit off script here, but I just like now they
[11:25.840 --> 11:36.040]  are scanning my mail for certain legal violations, right? And they will forward certain types
[11:36.040 --> 11:41.480]  of violations automatically to the police and lock you out of your account. I think
[11:41.480 --> 11:47.400]  that was, that wasn't Google. There was a case recently where a family got into trouble
[11:47.400 --> 11:55.960]  for a photo they had of their kid, like traditional family photo that was flagged as inappropriate
[11:55.960 --> 12:00.200]  and they lost access to their mail account. I don't say which vendor that was, but you
[12:00.200 --> 12:06.840]  can Google that in the US, right? And they're locked out forever because algorithm decided
[12:06.840 --> 12:13.320]  that that was not acceptable. And that might, it's all well intended, right? But it shows
[12:13.320 --> 12:18.720]  what it means to not be, not have technology sovereignty, right? You're now dependent on
[12:18.720 --> 12:25.880]  an algorithm that might be very, very badly implemented that then decides whether you
[12:25.880 --> 12:32.880]  lose access to your own data because it recognized a violation with the best intentions, but
[12:32.880 --> 12:40.080]  sometimes dangerous consequences. And we'll see more of that, right? Because there's a
[12:40.080 --> 12:44.760]  whole different thing I'm not talking about today that's happening with artificial intelligence
[12:44.760 --> 12:51.360]  and the further integration of these systems into cloud services. So my point here at the
[12:51.360 --> 12:58.840]  end comes down to that, like the question, it's great that we have free software, right?
[12:58.840 --> 13:03.600]  It's great that we have revolutionized the access to technology, access to code. We have
[13:03.600 --> 13:10.400]  revolutionized the business where free software has won. It's a base for all modern software
[13:10.400 --> 13:15.000]  development to some degree, right? There's always something like proprietary differentiation
[13:15.000 --> 13:22.640]  in code. Right now, I would say is limited kind of to the top of the code pyramid, right?
[13:22.640 --> 13:27.720]  When it becomes like the things that one company writes in-house, right? Their own business
[13:27.720 --> 13:34.320]  differentiations, that's always proprietary, right? That's where your trade secrets are.
[13:34.320 --> 13:39.080]  And that's okay, right? It's always shaking the head. It's a separate divide, but you
[13:39.080 --> 13:48.800]  will like at a point where something becomes so unique, right? You get into the question
[13:48.800 --> 13:55.640]  with a... We can debate that in a question and answer. I see it, but I think so ultimately
[13:55.640 --> 14:01.080]  I respect people doing that, right? But then you get down to something is domain specific.
[14:01.080 --> 14:05.280]  Maybe there's some proprietary stuff in there, but latest you're like outside of like one
[14:05.280 --> 14:10.000]  specific industry, you get into free software frameworks that everyone is using because
[14:10.000 --> 14:18.360]  all the stuff on the business side that's common, their free software is a huge advantage
[14:18.360 --> 14:24.560]  because it gives you the ability to collaborate among competitors, to not reinvent things
[14:24.560 --> 14:29.560]  all the time, to get to common standards in a very practical way, right? Because it's
[14:29.560 --> 14:40.880]  code is better than a standard. So that works. But how much use is it really if you cannot
[14:40.880 --> 14:46.640]  run it anymore on your own with a dependency, without a dependency on someone who is a big
[14:46.640 --> 14:57.560]  centralized provider? The issue here that goes into that is true for individuals, that's
[14:57.560 --> 15:03.920]  true for organizations, that's true for civil society, that is true for companies that are
[15:03.920 --> 15:09.800]  not as big as some other companies. You always create these dependencies because of the talent
[15:09.800 --> 15:17.840]  gaps and just the knowledge gaps and the risk included in it. And this has allowed the leading
[15:17.840 --> 15:23.560]  cloud providers to create centralized economies of scale based around their proprietary operational
[15:23.560 --> 15:29.280]  knowledge, right? And it's really useful. You click a button, you get anything you need
[15:29.280 --> 15:34.120]  in infrastructure. You know, this sometimes includes unfair strip mining of free software
[15:34.120 --> 15:42.000]  projects, right? We've all seen that. They can do that just because of the scale of operationalization.
[15:42.000 --> 15:45.960]  There's nothing to do with the code. It has led to a situation where sometimes code itself
[15:45.960 --> 15:50.960]  is actually commoditized, right? Your challenge is not writing the code. You can get enough
[15:50.960 --> 15:55.960]  people together to write the code. Really the problem comes running it and creating
[15:55.960 --> 16:03.760]  the economy of scale and adoption that makes it successful, right? And that is a dynamic
[16:03.760 --> 16:07.960]  that basically goes back to the main frame, right? We went full circle and now we are
[16:07.960 --> 16:14.280]  running black box services on someone else's hardware. It's a convenient model, but it's
[16:14.280 --> 16:25.720]  really creating lock-ins. And it's the same kind of lock-in and access hurdle that code
[16:25.720 --> 16:33.200]  used to be when I was in high school, right? It was impossible for many people to get to
[16:33.200 --> 16:40.320]  that level of technology, even if they knew how to code in a sustainable way. And now
[16:40.320 --> 16:46.400]  we are getting back there. And there are plenty examples how this goes even into how we create
[16:46.400 --> 16:51.880]  free software, right? This is not just a problem in using or deploying it. It affects our
[16:51.880 --> 16:57.680]  own creation, right? If you write modern cloud-native software, you aggregate existing services
[16:57.680 --> 17:01.840]  and you focus on the last 10% of what you really care about. You don't have to worry
[17:01.840 --> 17:05.920]  about anything else because you can use it from the cloud provider. If you are doing
[17:05.920 --> 17:09.960]  free software, then you have to run everything yourself because we haven't expanded free
[17:09.960 --> 17:20.920]  software to solve this problem, right? And we also, I mean, we can take prominent examples
[17:20.920 --> 17:32.960]  of who uses GitHub. Does it include GitHub issues and things like that? Who thinks that
[17:32.960 --> 17:40.120]  GitHub is open-source software, free software, right? And it's great. It's a great service.
[17:40.120 --> 17:48.800]  It's a great tool. Git is free software. GitHub and everything around the code management
[17:48.800 --> 18:03.240]  itself. You go into issues, actions, integrations. It's owned by Microsoft, yes? Yeah. Now, I'm
[18:03.240 --> 18:09.680]  not going to go there. I have a sitting comment who I work for, so anyhow. I think I don't
[18:09.680 --> 18:13.360]  want to have prejudice against, I don't want to single out Microsoft there, right? Because
[18:13.360 --> 18:18.680]  that wasn't my point. Slack is not on, I think, I don't know who owns Slack, but same thing,
[18:18.680 --> 18:26.560]  right? So much user. We can go around and around, and we will find that even the development
[18:26.560 --> 18:35.880]  of free software depends more and more on proprietary services, software as a service.
[18:35.880 --> 18:45.080]  And it's, this is not necessarily criticism in these companies, right? I believe that
[18:45.080 --> 18:49.480]  everyone has a choice to offer their software and their service under the license in terms
[18:49.480 --> 18:54.520]  of service they see appropriate. But it's a problem for me where I think, well, there
[18:54.520 --> 18:59.440]  should be an alternative, right? We need to think about how sustainable this is in the
[18:59.440 --> 19:10.440]  long term. And, you know, can we get to a model where free and open-source software development
[19:10.440 --> 19:18.280]  can be integrated with other free and open-source software development in a consistent model
[19:18.280 --> 19:26.360]  end-to-end, where it regains its utility all the way to running code, right? That is the
[19:26.360 --> 19:31.040]  underlying problem is that when you, you know, having code and they're not being able to
[19:31.040 --> 19:38.920]  actually offer the service or run your own mail server or, I mean, big topic that everyone
[19:38.920 --> 19:42.360]  here is probably aware of is like the switch towards the Fediverse right now, which is
[19:42.360 --> 19:46.640]  great, right? Which brings more attention to this issue. People are trying to run their
[19:46.640 --> 19:52.840]  own instances of a decentralized social network now, and that, they're finding out that's
[19:52.840 --> 19:58.080]  actually really hard, right? And, and it's, we haven't, like, that's going to get ugly
[19:58.080 --> 20:03.640]  before it gets good if people don't run back to the centralized wall garden because it's
[20:03.640 --> 20:10.640]  too hard, right? But that makes a point. Ultimately, right now, while the Fediverse, I think, is
[20:10.640 --> 20:17.320]  far ahead, right? It's one of the areas where I see hope, because, you know, it's fairly
[20:17.320 --> 20:21.640]  easy to run. A lot of people are running and it's a, it's this decentralized, centralized
[20:21.640 --> 20:27.200]  where you have hubs and people are running them for others as non-profits or, you know,
[20:27.200 --> 20:34.200]  I think where you have, you know, direct contribution, but it's not a walled garden. That's hope.
[20:34.200 --> 20:42.040]  I see hope with projects like in, in the home automation space. I personally use Home Assistant,
[20:42.040 --> 20:46.480]  but they're, you know, other great projects, but a lot of them go deep into actually giving
[20:46.480 --> 20:53.040]  you something that just runs, right? So operationalizing it isn't hard. It's actually often out
[20:53.040 --> 20:57.600]  of the box. You can download an image. It just works. Sometimes there are even services
[20:57.600 --> 21:02.800]  and the integration into services works out of the box, right? You can actually aggregate
[21:02.800 --> 21:07.240]  things. Sometimes it's a bit, you know, part of the problem is that there's no differentiation
[21:07.240 --> 21:12.520]  between integrating into other open source components and services and some weird proprietary
[21:12.520 --> 21:19.240]  or very weird proprietary cloud-based things that maybe upload your security camera images
[21:19.240 --> 21:24.520]  to places where you don't want them, right? So there's that. But on the other hand, it's,
[21:24.520 --> 21:29.120]  it's progress in the sense that part of the open source project is to actually solve this
[21:29.120 --> 21:36.480]  problem. And, and that is, I mean, this is a problem. Again, I think this is a problem
[21:36.480 --> 21:40.880]  for everyone, right? Even if you're, if you're building on top of the cloud, even if you're
[21:40.880 --> 21:45.400]  a company building on top of the cloud and you have like very little code that is your
[21:45.400 --> 21:52.640]  own code, where you put your business differentiation, like your UI to control the microcontroller
[21:52.640 --> 21:58.800]  code that controls the mousetrap, you still need to figure out how to operationalize it.
[21:58.800 --> 22:02.880]  That means you need to have that knowledge from somewhere, right? And that, that's becoming
[22:02.880 --> 22:11.200]  increasingly a problem because it's hard to do that securely. So, you know, open source
[22:11.200 --> 22:18.440]  as one is only half right. That's my, my takeaway. You know, open source is a preeminent software
[22:18.440 --> 22:25.600]  development model at this point, but it's not the operations model. And this limits
[22:25.600 --> 22:32.120]  how useful free and open source software is for users, whether it's individual users,
[22:32.120 --> 22:38.960]  private users, nonprofits, or, or, or civil society organizations, companies, or even
[22:38.960 --> 22:45.720]  governments that try to have sovereignty in their technology and data use.
[22:45.720 --> 22:53.320]  You know, the GitOps is a nice example here, right? It's great to have a GitOps model,
[22:53.320 --> 23:00.760]  but if you GitOps, you're free software, how free is it when the GitOps part is actually
[23:00.760 --> 23:09.560]  proprietary, right? So my, my thesis is that we need to expand the concept of free and
[23:09.560 --> 23:16.720]  open source software from code at rest, from code in a repository to really include the
[23:16.720 --> 23:27.520]  operationalization of the code. And we need to create a collaborative, decentralized infrastructure
[23:27.520 --> 23:35.200]  model for that, where we can use the same approach of aggregating existing services
[23:35.200 --> 23:41.560]  that are run maybe by other organizations, by other projects, without having to rerun
[23:41.560 --> 23:46.720]  everything on our own, right? We need to create an exchange on operationalization knowledge
[23:46.720 --> 23:56.120]  and we need to create a practical capability to build applications in that way. And I think
[23:56.120 --> 24:03.280]  it's, it's important to really take this also in the, in the, you know, something I hadn't,
[24:03.280 --> 24:09.360]  hadn't thought about before as much. I spent some time at an open forum event on Friday
[24:09.360 --> 24:14.600]  about where sovereign cloud, cloud sovereignty in the EU was a big topic, right? I think
[24:14.600 --> 24:20.040]  as a, as a free and open source software community, we need to also make sure that this point
[24:20.040 --> 24:27.040]  gets pushed into the cloud sovereignty discussion, right? Because if you end up with cloud sovereignty,
[24:27.040 --> 24:32.440]  many people and talk about how, oh, we're going to use open source cloud code, but at
[24:32.440 --> 24:40.240]  the end it's going to be in itself just a black box service. Maybe it's just a data
[24:40.240 --> 24:45.040]  center that happens to be in the EU, but otherwise it's following the same existing proprietary
[24:45.040 --> 24:50.360]  cloud centralized cloud model that wouldn't be sovereignty, at least not in my, in my
[24:50.360 --> 24:57.560]  definition of sovereignty, which means you have actual control over your, your destiny.
[24:57.560 --> 25:06.560]  So what I'd like to see is what, what we need to do here, you know, expand the model, create
[25:06.560 --> 25:14.520]  a collaborative model around, around actually running things, focus on the sovereignty aspects,
[25:14.520 --> 25:22.360]  and I think we need to consider technologies without bias. What I'm really concerned about
[25:22.360 --> 25:29.320]  is for example, when I see discussions around web three, there are a lot of people who have
[25:29.320 --> 25:39.320]  now a mindset where blockchain, web three, that's tainted by either scam affiliation
[25:39.320 --> 25:45.560]  of similar technologies, perceived or real, or by political affiliations. I don't know
[25:45.560 --> 25:50.200]  how big that is in Europe, in the US, that's like a big topic where you can talk to someone
[25:50.200 --> 25:59.080]  and they will say, no, web three, that's something that the crypto gross use. I'm, I think we
[25:59.080 --> 26:06.040]  need to be agnostic there. We need to look at technology that's utility. I'm, I'm skeptical
[26:06.040 --> 26:13.000]  on each individual technology, but ultimately it comes down to how can we solve the problems.
[26:13.000 --> 26:17.680]  And there are areas where a distributed ledger is going to be the right solution. There's
[26:17.680 --> 26:25.080]  going to be areas in my view where, for example, something like Filecoin is the right solution
[26:25.080 --> 26:34.200]  because you need to find a way how to monetize offering services on a peer-to-peer basis.
[26:34.200 --> 26:40.360]  And we need to be careful not to put everything into the same bucket as maybe other things
[26:40.360 --> 26:47.520]  like, you know, some, some scam coin and snowball model because they are not just because he's
[26:47.520 --> 26:58.760]  the same technology. They're not the same thing. So I want to give a concrete example
[26:58.760 --> 27:06.240]  of what can be done. This is something we are trying at Red Hat, but it's an open source
[27:06.240 --> 27:13.240]  initiative. Well, it would be silly to talk about it in this context if it wasn't. So
[27:13.240 --> 27:19.920]  we call it operate first. And I should explain the term. So Red Hat has internally in, in,
[27:19.920 --> 27:24.680]  in our Linux group and I think for most other groups, but there where it comes from, we
[27:24.680 --> 27:31.720]  have a core principle that, that's called upstream first, which says that we will never
[27:31.720 --> 27:41.640]  try to differentiate from upstream code on a technology base. So if we implement a feature
[27:41.640 --> 27:45.480]  in our product, we try to get it into the relevant upstream projects before we ship
[27:45.480 --> 27:52.320]  it as a feature to customers. It's not always true. We ended up maintaining Zen kernel patch
[27:52.320 --> 27:57.360]  for a long time because it was never accepted upstream, but we also regretted that quickly
[27:57.360 --> 28:04.280]  and switched to KVM because it's painful, right? And this is not, this is not altruism
[28:04.280 --> 28:10.120]  per se, right? The, the reason why Red Hat doesn't try to differentiate on the technology
[28:10.120 --> 28:15.000]  level from our upstream open source code is because it would make our whole development
[28:15.000 --> 28:21.360]  model really painful and almost useless because you lose the main point why a company should
[28:21.360 --> 28:29.520]  use free software. It's the development model that allows you to collaborate and achieve
[28:29.520 --> 28:35.240]  better, better solutions than anything you could come up with in-house, right? You lose
[28:35.240 --> 28:42.520]  the corrective and I mean most, most modern issues that you have in complex systems in
[28:42.520 --> 28:46.680]  the, in the lower layers of your, of your software stack, you're never going to solve
[28:46.680 --> 28:52.040]  on your own, right? Like any big kernel issue, any big security issue, it's always a collaborative
[28:52.040 --> 28:57.000]  effort and that's why they get solved. I mean that's even true for most proprietary software
[28:57.000 --> 29:03.360]  at this point because someone else finds it, right? So, so Red Hat has this principle called
[29:03.360 --> 29:09.640]  upstream first which features go upstream before they go into the product, you know,
[29:09.640 --> 29:15.800]  exceptions are always there, but that's, that's a goal and it's motivated by core business
[29:15.800 --> 29:25.880]  requirement not by altruism. Now we need the same for creating services, right? It is now
[29:25.880 --> 29:33.840]  as much service, software as a service company as it's a, we ship code company. All our services
[29:33.840 --> 29:40.800]  are based on free software. Not all the glue code gets developed in a free software open
[29:40.800 --> 29:47.760]  source development model. Not all the glue code is publicly available yet. The point
[29:47.760 --> 29:53.160]  there is we have the same problem, right? And so this is not only, this is not speaking
[29:53.160 --> 29:58.440]  about our use of services, right? We can't force and we don't have the capacity to build
[29:58.440 --> 30:04.480]  everything ourselves, right? We have to offer services on proprietary cloud, for example,
[30:04.480 --> 30:12.040]  right? There is no way around that. But for the things we create, we were also drawn into
[30:12.040 --> 30:18.000]  just like everyone in the culture of DevOps and cloud native development, we have created
[30:18.000 --> 30:25.120]  things that are proprietary in the productization step and we have lost the ability to collaborate
[30:25.120 --> 30:31.360]  on that which hampers ourselves, it hampers our customers that, that then try to do things
[30:31.360 --> 30:35.880]  on-prem or try to create a hybrid environment. And at the end, we believe strongly in a hybrid
[30:35.880 --> 30:41.000]  cloud model for whole different discussion would be its own talk. But so we created this
[30:41.000 --> 30:49.280]  initiative to change our own dynamic, but invite others to join it. And it comes down
[30:49.280 --> 31:00.880]  to approaching the creation of our own services from a model where we start with making the
[31:00.880 --> 31:06.560]  upstream code operational, right? So we make sure that what we put into the software repo
[31:06.560 --> 31:12.240]  is not just theoretically runnable code, it's actually everything you need to run it. So
[31:12.240 --> 31:16.840]  open source service, first of all, means something that the average person can instantiate as
[31:16.840 --> 31:23.840]  a running service. Second, drive the knowledge on how to operationalize it into the same
[31:23.840 --> 31:30.960]  community or overlay community because things aggregate into bigger services and create
[31:30.960 --> 31:38.240]  communities to have an exchange on how to operationalize the software and make that knowledge
[31:38.240 --> 31:44.640]  available under free software licenses in a free software exchange model and development
[31:44.640 --> 31:54.640]  model. And then also try to create actual running instances that our projects can reuse
[31:54.640 --> 31:59.760]  without having to run component services on their own and invite others to participate
[31:59.760 --> 32:07.120]  in that. We collaborated with some universities, and this is not new, right? To be fair, Matt
[32:07.120 --> 32:13.280]  Miller from Fedora Project is sitting in the first row and reminding me, which is present,
[32:13.280 --> 32:17.760]  Fedora has done things like that all the time, right? Like Linux distributions, of course,
[32:17.760 --> 32:23.600]  have run what nowadays would be called a cloud service, like build systems and so on in a
[32:23.600 --> 32:27.720]  collaborative fashion, right? So this is not net news. The problem is we have to expand
[32:27.720 --> 32:33.600]  that into everything, into databases that we need to run, we need to make reusable,
[32:33.600 --> 32:45.960]  to any kind of software that we ship, we have to include the operationalization. So that's
[32:45.960 --> 33:05.840]  the pitch. And we have 10 minutes for questions, discussions and answers. 15, I did some quick
[33:05.840 --> 33:21.360]  talking there. Do we have questions online? Maybe we can start with these then. Yes, no.
[33:21.360 --> 33:26.120]  Nothing online, so questions. Yeah, I will take the first one then and then.
[33:26.120 --> 33:34.760]  I'm not going to hackle you. Closer, okay. There we go. So a lot of the public discussion
[33:34.760 --> 33:39.920]  I've seen kind of about cloud services and open source has come from a different direction.
[33:39.920 --> 33:45.600]  It's like companies who have open source software and their business model will support around
[33:45.600 --> 33:50.560]  it and then some other much larger company suddenly runs their software better than they
[33:50.560 --> 33:55.280]  do and they say, hey, that's not fair. That's not why we open sourced it. We wanted something
[33:55.280 --> 34:02.560]  else out of that. And there's been a kind of a fight over licensing and some new licenses
[34:02.560 --> 34:09.600]  basically meant to restrict that kind of running things. And there's been a debate about those
[34:09.600 --> 34:13.560]  fit under open source. I think you're talking about something entirely different. And is
[34:13.560 --> 34:17.600]  there a licensing approach we can take to drive software towards this operate first
[34:17.600 --> 34:27.520]  model? So I'm not convinced that code licensing itself will solve the issue of strip mining
[34:27.520 --> 34:34.800]  code. Like the problem when a larger company takes your code and runs a service and monetize
[34:34.800 --> 34:38.240]  or it doesn't have to actually be a service, right? They could just ship the code into
[34:38.240 --> 34:41.840]  it better, which is always, there's always like a risk like that. It's a dynamic that
[34:41.840 --> 34:46.600]  always existed in a Linux distribution, right? We ship something that undermines the ability
[34:46.600 --> 34:52.520]  to sell the same thing unless you find a way how to make you're selling the same thing
[34:52.520 --> 34:58.960]  either better or an add on, right? So in the tradition sense, I always like, I was a product
[34:58.960 --> 35:06.120]  manager for RHEL a long time where we ship components that other people try to monetize
[35:06.120 --> 35:11.080]  because it's expected from a Linux distribution to bring certain things out of the box. Now
[35:11.080 --> 35:17.600]  what we always said is, look, we have a very generalized solution here. We will help you
[35:17.600 --> 35:22.880]  upsell your specialized support, right? So that solved it in that sense. But if you go
[35:22.880 --> 35:27.320]  into the strip mining by, for example, cloud providers, it takes the same piece of software,
[35:27.320 --> 35:31.680]  run it, compete with you, and they can operationalize it much better than you then when also have
[35:31.680 --> 35:36.240]  more reach and have a better customer model, they have a marketplace where they can promote
[35:36.240 --> 35:41.480]  their solution over years. I don't know if a code license can solve that because part
[35:41.480 --> 35:46.520]  of the problem there is that they could also rewrite and when that was done, they rewrote
[35:46.520 --> 35:50.720]  a code, right? Or forked an earlier version when you change the license, right? So this
[35:50.720 --> 35:56.440]  didn't work. What worked, however, I think is creating the awareness, creating specialization
[35:56.440 --> 36:05.200]  and creating a dynamic around the integrations, right? Embracing that you're not selling actually
[36:05.200 --> 36:12.240]  the code, right? Now, I still believe that it's probably better to license a code on
[36:12.240 --> 36:19.800]  a copy left license and license your operationalization under a copy left license to minimize
[36:19.800 --> 36:27.520]  the abuse, right? Versus a license that's too liberal and allows people to take it proprietary.
[36:27.520 --> 36:34.200]  But the successful countermeasures I've seen were not based on licensing primarily. They
[36:34.200 --> 36:48.040]  were based on a business model and engagement with the customers. How do you copy left the
[36:48.040 --> 36:54.880]  operas? I can't say that word. Well, you get into it. We just found out, luckily, that
[36:54.880 --> 37:05.560]  game rules cannot be copyrighted. So D&D will live, despite Hasbro. But I think the code
[37:05.560 --> 37:11.120]  you implemented in can, right? And at the end, it comes down to how much of a hurdle
[37:11.120 --> 37:16.400]  is writing new automation code and actually that becomes a fairly big hurdle to reinvent
[37:16.400 --> 37:23.440]  automation code. And then copy left helps. It doesn't help you against the reach and
[37:23.440 --> 37:29.720]  economy of scale. There you need awareness of your benefits, a good business model, and
[37:29.720 --> 37:36.000]  awareness of the problems of world gardens, right? I mean, and the Twitter versus Fediverse
[37:36.000 --> 37:41.640]  situation is a great experiment of that. You know, I think we should all try to help make
[37:41.640 --> 37:52.000]  that successful, right? How do you feel about decay of self-hosted infrastructure? For example,
[37:52.000 --> 37:56.160]  servers or domains disappearing and in general, being less reliable than, for example, GitHub?
[37:56.160 --> 38:03.840]  I couldn't. Okay. How do you feel about decay of self-hosted infrastructure? For example,
[38:03.840 --> 38:25.080]  servers or domains disappearing? That wouldn't be the case with GitHub. How do you feel about
[38:25.080 --> 38:29.840]  the decay of self-hosted infrastructure like servers and domains disappearing and in general,
[38:29.840 --> 38:39.880]  less reliable than, for example, GitHub? So that's a huge issue, right? Self-hosted infrastructure
[38:39.880 --> 38:45.520]  always decays, right? And I mean, that's true for anyone who does something. You're interested
[38:45.520 --> 38:49.760]  at the beginning, and even if you're still around, you move on to the next interesting
[38:49.760 --> 39:00.640]  topic. That is at least true for me. I'm very happy with Home Assistant. I wouldn't want
[39:00.640 --> 39:09.440]  to run a security scanner on my Home Assistant device. Now, that's fairly okay because it's
[39:09.440 --> 39:17.320]  so isolated and doesn't control, well, it controls the heating. So there's a risk there.
[39:17.320 --> 39:23.120]  So yeah, that's a problem. I mean, and I think, my impression is, for example, as a Home
[39:23.120 --> 39:26.720]  Assistant community, and again, that's just the one I'm using. I don't want to like single
[39:26.720 --> 39:30.760]  them out and I haven't had time because, I haven't had time to try others. There might
[39:30.760 --> 39:34.600]  be better ones, but what I'm seeing there is that there is out of the community, actually,
[39:34.600 --> 39:40.800]  people start offering the services commercially, right? And nothing I said today is an argument
[39:40.800 --> 39:45.480]  against commercial offerings, right? It is an argument against proprietary offerings.
[39:45.480 --> 39:50.640]  It's totally fair to charge for something, right? Developers want to eat. So does admins
[39:50.640 --> 39:57.880]  need to eat, right? We can sell services. And so I think professional free software infrastructure
[39:57.880 --> 40:05.680]  is the answer to the decay of self-hosted systems and, you know, a reasonable approach,
[40:05.680 --> 40:10.200]  and some of us, we have to figure out, a reasonable approach to decentralization where multiple
[40:10.200 --> 40:16.040]  people can offer things without making you to choose proprietary lock-in is the answer.
[40:16.040 --> 40:20.040]  And that's why I think we need to look at web three without the bias because that is
[40:20.040 --> 40:26.640]  one way that could work, right? If I look at Filecoin, IPFS as an example, that actually
[40:26.640 --> 40:33.280]  is working right now, not economically for the people who are offering it because the
[40:33.280 --> 40:38.600]  hardware is too expensive for the money you can get with it. But if you're using Filecoin-based
[40:38.600 --> 40:44.400]  storage, that is actually pretty cheap and very reliable, right? And the cost, like the
[40:44.400 --> 40:49.280]  problem is that the compute capacity, or the specialized compute capacity needed to offer
[40:49.280 --> 40:55.360]  it is too expensive right now. But that's just, you know, that's going to be solved with
[40:55.360 --> 41:01.800]  progress in technology. And I'm sure that we'll see some risk-5-based specialized Filecoin
[41:01.800 --> 41:06.520]  systems in the near future that makes this affordable. And then we have a way how you
[41:06.520 --> 41:12.160]  can have, you know, at least for storage, you can have distributed infrastructure with
[41:12.160 --> 41:18.600]  good funding model. Other ways are foundations or other peer payment models or small companies,
[41:18.600 --> 41:23.640]  right? Decentralized small companies. We have three more questions. There was someone
[41:23.640 --> 41:34.080]  over here, there, and then there, and then over there. So what do you think is the way
[41:34.080 --> 41:43.160]  or the sort of gold standard or endpoint for packaging up operational capability with the
[41:43.160 --> 41:50.720]  code and with the application when shipping to end users who are not software developers
[41:50.720 --> 41:59.520]  and who don't have servers? I agree with everything you said before. My thesis so far has been
[41:59.520 --> 42:05.080]  that it's straight peer-to-peer, you know, stuff like BitTorrent or Tor or old-school
[42:05.080 --> 42:10.840]  file-sharing apps would be an example where when you got LimeWire, you got the app with
[42:10.840 --> 42:16.240]  the data. But, you know, it could also maybe be Web3 something. But what do you think that
[42:16.240 --> 42:23.040]  looks like for the 2 billion people who don't have servers and aren't software developers?
[42:23.040 --> 42:28.120]  So I have an example of right now a piece of software that I think is doing this really
[42:28.120 --> 42:37.720]  well and that's a sync thing. It's a peer-to-peer file synchronization system that I use between
[42:37.720 --> 42:43.360]  my mobile phone with Android, Linux machine, bunch of servers, and I now use it for everything
[42:43.360 --> 42:48.960]  where you use it for everything where you need the full copy everywhere. At least last
[42:48.960 --> 42:53.080]  time I haven't checked for new features. It was a debate. They don't have like on-demand
[42:53.080 --> 42:58.400]  replication. I didn't have that last time I looked for it. So I use other things when
[42:58.400 --> 43:02.240]  I want to have things like the Google Drive type thing, right, where you have something
[43:02.240 --> 43:06.520]  in the cloud and you only download it when you look at it. For that, it wasn't the right
[43:06.520 --> 43:13.200]  thing last time, but I use it for my, you know, key pass replication, things like that
[43:13.200 --> 43:23.000]  for backup for all documents I want everywhere. And it's super easy. It just works. And so
[43:23.000 --> 43:30.360]  my 11-year-old daughter uses it. Now the poor kid also has to run a Linux laptop because
[43:30.360 --> 43:38.320]  I refuse to do anything else. I can tell you of the pressure to go into a proprietary
[43:38.320 --> 43:44.720]  ecosystem of a specific company that sells laptops and phones primarily, I think, to
[43:44.720 --> 43:50.880]  what they do and watches. It's a fashion business I hear, but like the pressure on
[43:50.880 --> 43:58.800]  kids to be on that because all the other kids have that is enormous. So, you know, poor
[43:58.800 --> 44:04.720]  kid is in trouble, but she has something and some other cool things. And Roblox works
[44:04.720 --> 44:08.800]  in wine, just like if you're struggling with this.
[44:08.800 --> 44:17.840]  Hi. Thank you for your talk. I'm wondering whether this might also come as a problem
[44:17.840 --> 44:29.040]  because of sometimes a need for centralization. I myself moved to Mastodon, but I still push
[44:29.040 --> 44:37.440]  all of my toots to Twitter. And I would move to GitHub, to GitHub, I mean to a local GitHub,
[44:37.440 --> 44:42.960]  but if I want to have users on my code, I still need to push all of my code to GitHub
[44:42.960 --> 44:50.560]  as well. So, what's the solution with that?
[44:50.560 --> 44:56.480]  I mean, I'm in the same boat, right? Like, of course, I have a Mastodon account. I'm
[44:56.480 --> 45:06.480]  not super active on Twitter. I tried to do all my code projects on GitLab, which GitLab
[45:06.480 --> 45:11.600]  is slightly better, right? As a more hybrid model, although it's not perfect, but I like
[45:11.600 --> 45:19.640]  them. But yeah, I think it's a cultural change in awareness, right? People need to understand
[45:19.640 --> 45:28.000]  that you need decentralization and we need to create code and infrastructure and culture
[45:28.000 --> 45:36.360]  that works in the federation to give you the reach, right? The problem is reach, right?
[45:36.360 --> 45:43.280]  And that's, it's really a cultural question at the end. I mean, the perfect example is
[45:43.280 --> 45:50.960]  the switch from IRC to Slack as a dominant, like, interaction for developers in many places.
[45:50.960 --> 45:57.800]  I mean, there are, there are really limitations with IRC, right? That become problematic.
[45:57.800 --> 46:02.800]  Technology-wise, Slack isn't fundamentally different. It's nicer UI, some additional
[46:02.800 --> 46:07.680]  features and the ability, like the persistence that you had to do extra steps to get with
[46:07.680 --> 46:13.960]  IRC, right? But it's primarily kind of like minor improvements like threading and the
[46:13.960 --> 46:24.840]  web UI and persistence. And then the critical mass effect and the reach it created. Really,
[46:24.840 --> 46:30.080]  the answer is a cultural change where people appreciate the, the, and do the extra work.
[46:30.080 --> 46:34.560]  And it, and it goes back to the earlier question, right, about, like, what's a gold standard
[46:34.560 --> 46:40.680]  for creating such an app? It's us here who have to drive that and then make it usable
[46:40.680 --> 46:48.240]  for all the others, right? Like, and that's, that's not different than what happened with
[46:48.240 --> 46:53.280]  free software in general. We, we've been through this cycle and I think it's truly equivalent.
[46:53.280 --> 47:01.720]  I mean, using free software 20 years ago was hard, right? I mean, when using software
[47:01.720 --> 47:10.720]  was hard, but when I installed my first Slackware, that was painful. And then nothing was available
[47:10.720 --> 47:17.160]  and then you had to recompile it and it behaved randomly whenever you compiled it. So we have
[47:17.160 --> 47:19.960]  to do that.
[47:19.960 --> 47:34.720]  This has to be the last question. Okay. So I agree with what you just said about cultural
[47:34.720 --> 47:41.600]  change and to give an example of that, um, for me, Microsoft, uh, acquisition of GitHub
[47:41.600 --> 47:45.720]  with the last straw and I closed my account, but that means that if I want to contribute
[47:45.720 --> 47:52.000]  to free software projects, it's increasingly hard because I'm expected to have a GitHub
[47:52.000 --> 47:57.760]  account and it seems to me that anyone here who agrees with what you've been saying and
[47:57.760 --> 48:04.640]  yet who still uses GitHub or other proprietary software and particularly proprietary software
[48:04.640 --> 48:11.320]  that they allow to be at the heart of the development of the free software is being very hypocritical.
[48:11.320 --> 48:16.120]  And so it's up to us surely to, as you say, take on that pain, but that includes a lot
[48:16.120 --> 48:22.360]  of people in the room who put their hands up when you asked who has a GitHub account.
[48:22.360 --> 48:27.760]  So I put it to you. Should we not change? We have to go through that pain.
[48:27.760 --> 48:33.520]  Thank you. Yeah, I agree. We have to change. And I'll be honest, my presentation, part
[48:33.520 --> 48:37.360]  of the reason why I was struggling, I couldn't read my speaker notes because I created it
[48:37.360 --> 48:42.280]  in what's the default at Reddit with this Google presentation, Google docs, and then
[48:42.280 --> 48:50.680]  downloaded it because I didn't want to look super silly in front of you.
[48:50.680 --> 48:57.880]  So yes, it's a hard right. Like, and what I honestly believe in, I don't know who recognizes
[48:57.880 --> 49:05.520]  this t-shirt. All right, people, you have, you're not watching enough TV or the wrong.
[49:05.520 --> 49:11.080]  Watch the expands. Best show ever. But that's from the TV show. No, that's the TV show.
[49:11.080 --> 49:14.560]  They changed it. Next time I'll do a tattoo or something.
[49:14.560 --> 49:22.960]  Anyhow, so I believe in the power of subversion and not the not to get pretty assessor. I
[49:22.960 --> 49:30.760]  do not. I do not believe that was great at the time and stick with it. But my point is,
[49:30.760 --> 49:38.240]  so for example, I kept my GitHub account. I do contribute to projects where I need to
[49:38.240 --> 49:41.920]  because I don't want to put too much of a burden on people I'm trying to collaborate
[49:41.920 --> 49:46.880]  with that I depend on, right? Like it's hard. But I do try to problematize it, bring it
[49:46.880 --> 49:55.720]  up, and they do everything I can on alternative platforms, right? And I think, and you know,
[49:55.720 --> 50:03.120]  I think that's really like adding that extra step of advocacy and pulling people, trying
[50:03.120 --> 50:08.680]  to pull people over is the best we can do. I just created my, and I had that on the first
[50:08.680 --> 50:14.000]  slide, I'm sure I've put it right. I just created a Nostr key, and now I'll do Nostr
[50:14.000 --> 50:19.640]  instead of Twitter because that's a fully decentralized thing. But I'll cross post,
[50:19.640 --> 50:24.320]  but I'll point out that you find me on Nostr, and if you want me to reply, you have to talk
[50:24.320 --> 50:30.240]  to me on Nostr, right? Things like that. I don't know if we all do it. I think if everyone
[50:30.240 --> 50:57.720]  who comes to foster starts behaving like that, I think we can change things.