Subscribe
Share
Share
Embed
CRAFTED. is a show about great products and the people who make them. Top technologists reveal how they build game-changing products — and how you can, too. Honored twice by The Webby Awards as a top tech podcast, CRAFTED. is hosted by Dan Blumberg, an entrepreneur, product leader, and former public radio host. Listen to CRAFTED. to find out what it really takes to build great products and companies.
[00:00:00] Nithya Ruff: We absolutely need open AI — not “OpenAI” — but open source AI because otherwise we'll be living in a world of black box AI and not understanding the algorithms and the rules and the bias and other things that they could be built with. That's
[00:00:19] Dan Blumberg: nithya rough and she's Amazon's point person on all things open source.
[00:00:23] Nithya Ruff: It's such a central part of how people are developing today. You cannot develop without having an open source strategy.
[00:00:30] Dan Blumberg: Nithya is also the chair of the Linux Foundation, so she has a wide view on what's going well with open source and what needs work.
[00:00:37] Nithya Ruff: A lot of new developers don't understand that ethos, what open source means, what do licenses mean?
[00:00:43] What does collaboration mean?
[00:00:45] Dan Blumberg: On this episode of CRAFTED., we dig into what it takes to succeed with open source. Why open source AI is so important, why we need to agree on a definition of it, and how as the head of Amazon's open source program office, Nithya helps balance the risk of using open source with the risk of not doing so.
[00:01:02] Nithya Ruff: It's a very real thing of not moving, not innovating, not leveraging, and not finding innovative ways to balance your risk with innovation and reward.
[00:01:18] Dan Blumberg: Welcome to CRAFTED., a show about great products and the people who make them. I'm Dan Blumberg. I'm a product and growth leader, and on CRAFTED., I'm here to bring you stories of founders, makers, and innovators that reveal how they build game changing products and how you can too.
CRAFTED. is brought to in partnership with Docker, which helps developers build, share, run, and verify applications anywhere without environment confirmation or management.
[00:01:42] More than 20 million developers worldwide use Docker suite of development, tools, services, and automations to accelerate the delivery of secure applications. Learn more@docker.com
And CRAFTED. is produced by Modern Product Minds, where my team and I can help you take a new product from zero to one and beyond. We specialize in early stage product discovery, growth, and experimentation. Learn more and sign up for the CRAFTED. Newsletter at modernproductminds.com
[00:02:13] You have a wide purview on open source in addition to your role at Amazon. You're also the chair of the Linux Foundation. What's the state of open source today?
[00:02:20] Nithya Ruff: So it's been more than 30 years of open source. So one thing for sure is that it's pervasive. It's everywhere from mobile devices and embedded in IOT all the way to supercomputing, but also in industries, financial, et cetera.
[00:02:36] The second thing is, frankly, we are aging as an open source community. So the question becomes how do you welcome new people into open source? How do we pass on the culture and the norms and the legal aspects of open source to this new generation? Sometimes when you come into a world where open source is a accompli, you kind of don't really dive in and understand what is a license, what does that mean, and what are the culture and the practices of open source?
[00:03:09] You just do it. Yeah, and so I think we need to go back and teach. I. And share what does it mean to be developing in a collaborative way? What is the culture of open source? Uh, what is a license and why is it important to protect an open source license? So culture and passing the baton is the second state.
[00:03:31] I would say. The third is there's been kind of an evolving, I guess, thinking on what is the role of open source in ai. We are very comfortable and familiar with open source in software, uh, and we know how to license software, how to work with copyrights and so on and so forth. But AI is so broad. It's got so many components in the AI system, from data to weight, to training to uh, model.
[00:04:00] And so there's a lot of work going on in that space. And there's also been a lot of angst on the part of companies starting, uh, their business on open source to find the right balance and the right business model and the right, uh, revenue strategy, if you will, if you have an open source, uh, component and, uh, you know, a commercial component.
[00:04:26] How do we give something away but still make money, and where do we make the money? So there's, there's a lot of debate. And so you've seen a lot of activity in that space where mm-hmm. Companies have either changed licenses or have taken a different stance because they are really trying to find the right, you know, balance.
[00:04:47] Dan Blumberg: Yeah. Oh my God, there's so much to follow up on there, including ai, which I wanna circle back to, but, but, uh, the, the cultural piece, and people say culture eats strategy for breakfast. Uh, I'm curious, like what's the culture today? How is it changing? I know, you know, diversity is important in open source, and I think that you're sort of alluding to it's, it's not.
[00:05:05] There's not enough diversity right now in open source
[00:05:07] Nithya Ruff: Diversity is, is definitely still a struggle in open source. Um, it's clearly started with. A lot of people who had a problem that they were trying to solve, they often were, if you will, out of the mainstream, they, they thought differently. Mm-Hmm. And they, you know, created licenses which challenged the norms in a world where proprietary was the standard.
[00:05:32] Um, you had, uh, MIT experts and others challenging that and saying, no users have a right to have access to source code and to change it, to modify it, to inspect it, to redistribute it, to use it for any purpose. Those are the four freedoms of open source, and I think a lot of new developers don't understand that ethos, uh, what open source means.
[00:05:56] And why those freedoms are important and what do licenses mean and how do you interpret those licenses and how do you use that correctly? But also, how do you work in an open source project? What does collaboration mean? What does transparency of communication mean? Why do we need to create trust in a community?
[00:06:20] And the challenge with diversity has been, we've not always been a very kind community to new people coming in. Right. And so we've not welcomed them, we've not encouraged them. We've not given them time to, or mentored them or taught them how to do it right. There are some shining stars in this area, outreachy, uh, which is a, a project that matches underrepresented mentees with mentors in the open source community, really teach mentees to become full fledged contributors.
[00:06:55] But it's really more than that. It, it needs to be an ongoing support in our mechanisms, in our structures, in our culture of open source to welcome people and to keep them there. Because if you don't have an ongoing culture of recognizing and teaching and contributing, you, you just lose people.
[00:07:22] Dan Blumberg: Let's talk more about AI and why it's so hard to apply the, the norms of open source to ai, which is so centered on the data that the models are trained on and, and less so on the, the software.
[00:07:33] What is it that makes it so difficult and where do you think we, we go from here?
[00:07:38] Nithya Ruff: First of all, we absolutely need open ai, not open ai, but open source AI, if you will, because otherwise we'll be living in a world of black box AI and not understanding. The algorithms and the rules and the bias and other things that they could be built with.
[00:07:59] So for sure, we need open source ai. The point is there are so many components to ai, unlike software, which is very, either you have open source software, give source code. Or you don't. In the case of ai, you have many, many, many components that make up an AI system. And then there are, what are the right licenses to use for all of those components?
[00:08:24] You know, for data. Is an open source license the right one or should we use an open data license? What do you use for weights? What do you use for the model? What do you use for the source code? One of the best documents I've seen is the model openness framework, and it was published by the Linux Foundation's data and ai uh, group, and it breaks it down into 17 different criteria for what constitutes open and what doesn't.
[00:08:55] And then it comes up with three different levels of openness. Open science, which means every, all of the 17 attributes are open or open tooling where some attributes are closed. An open model where many attributes are closed. So the question becomes where do you draw the line in the sand as to what open AI is?
[00:09:17] Should it be at the open science level? And that may be a high bar for people to reach, but it then establishes that this is where you need to be in order for full reproducibility, full transparency, you know, full engagement and full, uh, responsibility, if you will. Yeah. It also. Helps us then as consumers know what's open, what's not, and allows us to then ask the right questions of our model providers today, because there's no definition.
[00:09:52] It's very murky. So anybody can call themselves open, anybody can go get the benefits of the branding of open.
[00:10:01] Dan Blumberg: Right.
[00:10:01] Nithya Ruff: But not really deliver on the promise of it.
[00:10:04] Dan Blumberg: Yeah. I mean, it sounds like the word natural at the At the grocery store.
[00:10:07] Nithya Ruff: Exactly.
[00:10:08] Dan Blumberg: So say we agree on a definition of what open source AI is, how does that actually make a difference in the apps that get built?
[00:10:16] Who enforces that? Or is it just sort of a individual responsibility or app maker responsibility? What, what difference does it make if we actually do agree on a definition of of open source ai?
[00:10:25] Nithya Ruff: Yeah, you, you need not just the definition, but you also need some sort of a certifying body, which actually, uh, says this is certified as, you know, organic as in the case of the USDA or not.
[00:10:40] And these are some of the things that are being debated right now, and these are some of the constructs we still need to put together. It's early days, uh, it's almost like the early days of open source software. Uh, we are kind of in the beginning days of defining where the line in the sand should be.
[00:10:59] How do we establish that? What are the benefits of that? This also really impacts, you know, how governments look at what is open and what's not, and what policy should apply to
[00:11:10] Dan Blumberg: Yeah, each
[00:11:10] Nithya Ruff: of these things. So it's important. It's really important. And also not to mislead users in terms of what is genuinely open and not, and for AI to benefit from.
[00:11:22] What open source does well, it reduces cost, it democratizes usage. It really speeds up innovation. It's, it's such a big benefit to the world of ai.
[00:11:34] Dan Blumberg: What's something about open source that you wish builders and leaders better understood?
[00:11:39] Nithya Ruff: That open source is full of opportunities. If you use open source correctly, uh, it not only speeds up your development and innovation and you are connected to this global world of, you know, developers, but you can also open source things that allow you to create standards and open source or fill gaps or really build communities around a certain topic that you want to advance.
[00:12:06] Right? And, and we often kind of take a look at open source's risk, but we don't look at the opportunity side. Those who do it well, not only consume it. But they also engage actively with open source. So they have people who participate in open source projects and they're opinionated about the direction of the open source project.
[00:12:29] They tend to be leaders in open sourcing components that they create, that they feel would be of benefit to the world. They invest back into open source. They both funds as well as people, as well as you know, other types of contributions. And they deeply care about the health of open source. So those are the companies that do it well.
[00:12:57] Dan Blumberg: You run the osbo, the Open Source Program office at Amazon. You used to lead the osbo at Comcast. I'd love if you could explain what an osbo is for those who who don't know and and why do Amazon and other big companies need one?
[00:13:09] Nithya Ruff: It's really a group that. Deeply is an expert in open source that cares about open source and guides the company, especially developers in the company and business leaders on the proper use, the proper contribution, engagement with open source, if you will, open source program offices if they do their job right.
[00:13:31] Our standardizing the practices for the company in how they work with open source. And it's important to do that because without that, there's chaos and there's confusion and there's everybody reaching out to the legal department. Everybody doing it a different way. And from a brand perspective for a company.
[00:13:51] They need to have a cohesive and a uniform way that they work with open source. Otherwise they confuse the community in terms of how to work with the company. So not only companies but governments are establishing open source program offices. Uh, universities are establishing them and even small companies can have, say half a person or a CTO who really cares about open source and how the company works in open source because it's such a central part of how people are developing today.
[00:14:25] You cannot develop without having an open source strategy for the company.
[00:14:30] Dan Blumberg: I don't disagree, but draw out that point a little bit more of, of why you say that so forcefully.
[00:14:34] Nithya Ruff: I say it forcefully because more than 95% of companies and organizations use open source, whether they know it or not, and. Whether you are a small startup worrying about your business model or a company that is looking for an exit strategy being acquired, or a larger company that worries about its IP risk and its perception in the market.
[00:15:01] Open source is so central to the strategy, marketing strategy, your procurement strategy, your technology strategy. And so you really have to invest in, uh, having some blueprint for your company on how are you going to consume it, how are you going to use it? Yeah. What policy are you going to have for your developers in terms of licenses?
[00:15:25] How are you going to protect your ip? How are you going to participate? And how are you going to communicate your open source strategy to the world?
[00:15:34] Dan Blumberg: Yeah. You, you said something interesting there, which is whether they know it or not, I'm interested to hear a little more about companies that are using open source, that, that don't know it or don't realize how much they're using it
[00:15:43] Nithya Ruff: Exactly.
[00:15:44] You know, many people will say, uh, we don't use open source, but little do they know that the proprietary software that they get from their proprietary vendor has a lot of dependencies on open source, whether your Apple phone or your proprietary database. You all have dependencies on open source components, the libraries, et cetera.
[00:16:10] And so inevitably you will consume open source even though you may have a practice of saying, I only buy from, you know, proprietary solutions.
[00:16:19] Dan Blumberg: Right. And so what are the kinds of issues that developers or their engineering managers platform teams come to you with at the open source program office?
[00:16:27] Nithya Ruff: I say that we are like a, a, an advisory service or a con concierge service that, you know, handles a lot of different topics on any given day.
[00:16:38] It can be, can I use this component? Is the license okay? Is it within policy for me to use, or, I know it's not within policy, but I still need to use it because that is the only, yeah, you know, technology I can use and that license, so how do I use it safely? Or it can be a manager coming to us and saying.
[00:16:59] Uh, I want to support my open source developers and maintainers. How can I do it in the context of our role guidelines and job descriptions and our promotion process? How do I define their impact? You know, in our language as a company or a business leader saying we want to create a new service based on open source.
[00:17:22] What is the investment I need to make in my upstream open source so that I can maintain continuity for my customers? I can provide the best service, uh, on this open source project for my customers. So it can range from very tactical to very, very strategic.
[00:17:41] Dan Blumberg: Can you give some specific examples of some of the recent things that have come your way?
[00:17:45] Nithya Ruff: Yeah. Yeah. I, I mean, you know, a lot of companies have a policy on, um, copy left licenses like GPL or you know, GPV three. And so we will have people come to us and say, Hey, I absolutely must use this component, uh, and it is, uh, a license, you know, that you've said we cannot use, but, uh, how can I use it safely?
[00:18:09] And so we often are technologists ourselves, so we kind of ask them, do you need to modify it? Are you going to be shipping it? Are you able to separate out the code that you consume with our code? And can you create, you know, safe boundaries between the two when you create a new service? It can be questions such as, what is the percentage of people I need to dedicate to, you know, contributing upstream and.
[00:18:40] Do I need to give everything back or can I hold something back? How do I make that decision?
[00:18:47] Dan Blumberg: How do you make that decision? And that sounds, that sounds hard, is there's, there's a, there's a community spirit to it. You want to do it, but also you probably have deadlines and lots of other constraints, right.
[00:18:56] Nithya Ruff: That is exactly right. There's so many practical aspects to this. One being deadlines, right? And a customer needs, you've got to support that first. And so making time for giving back sometimes is harder. Um, the second can be not really being clear as to what is ip, what should. What is okay to give back.
[00:19:18] And, and many companies struggle with this, and it really depends upon that particular ecosystem or, you know, in databases it may be a different thing versus search versus, uh, you know, analytics. And so each business really needs to draw the line for themselves and feel comfortable about the line that they draw.
[00:19:39] The other thing that really trips people up is the tooling is different inside a company, the development tooling versus in open source. So sometimes they have to take the same patch and, and make it work in both sets of tooling. And so that prevents them from, you know, taking the time to give back or they just don't understand the need to give back.
[00:20:03] You know, they don't realize that. If they don't give back, the sustaining of the project is going to be hard, that they will have a lot of technical debt carrying these patches forward. And that doesn't serve our customers well, that doesn't serve, you know, developers well, yeah. If they're doing all this extra work.
[00:20:24] So it's, we work a lot with teams to clarify for them why they need to, you know, do what they need to do to set up a successful open source based service.
[00:20:35] Dan Blumberg: Is give back, is that even the right phrase? Sometimes? 'cause there's, it sounds like there's some very selfish reasons to keep an open source project healthy, especially if your company really relies on that project.
[00:20:46] Nithya Ruff: Yes, that is. And giving back is, is used a lot, but. But truly it is, uh, having an open first policy, right? That we will always work with open unless there's a good reason not to.
[00:21:02] Dan Blumberg: Right?
[00:21:02] Nithya Ruff: Uh, that we will always upstream this unless there's a good reason not to, and that's a good policy to take. And then to make it an exception if you're holding something you know back.
[00:21:15] But you should always start with the upstream source as the source of truth and the source of the latest and greatest, uh, innovation.
[00:21:24] Dan Blumberg: It sounds like one of the roles your team plays is similar to sort of a risk and compliance function at a bank. I've consulted to some banks, uh, and that can kind of be a thankless job 'cause you're often forced to think of the worst case scenarios and you have to say no to some things, a lot of things, but also the best risk and compliance people can be very creative and they can help you get to a yes.
[00:21:42] So, I, I'm curious how this tension plays off for you and your team.
[00:21:45] Nithya Ruff: Exactly right. Um, we are always looking to be the advocates for the builders and to look at their perspective as to what they're trying to accomplish and why they're trying to use, what they're trying to use and how they're doing it. So we always look for ways to make it possible for them to use open source and to work successfully in open source.
[00:22:09] And so we advocate for them with legal, for example, because legal may take a very conservative approach. And we as both understanding the technology and the use case, but also understanding the norms of open source and what's become more and more acceptable or what's less of a risk we can advocate, uh, for the developer with legal and with the business.
[00:22:33] So we absolutely try to always do. What's right for the business, but also to keep moving the needle in terms of what's less risky for the business to do. You can, you can often get stuck in an older picture of where risk was and you don't keep revisiting risk, and so you keep thinking that's where the line should be drawn.
[00:22:57] And so we keep kind of challenging where the line should be drawn.
[00:23:01] Dan Blumberg: Yeah. Well, I know, I know from working with some. The, the banks I've consulted is like, one of the hardest things is the risk of doing nothing. And how do you quantify, like, yes, there's a risk of like, oh, we, we use this open source in, in this example, we use this open source and we might get sued later, or we might, or, or, I don't know.
[00:23:16] You can tell me more of the bad things that could happen, but there's also just the risk of not innovating. And that's a hard thing to quantify, but it's a very real thing.
[00:23:23] Nithya Ruff: It's a very real thing of not moving, not innovating, not leveraging and not finding, uh, innovative ways to balance your risk with, uh, you know, innovation and reward.
[00:23:36] So that's our job is to find that line and it's to kind of push, uh, legal, push security, push operations to think open source.
[00:23:49] Dan Blumberg: You've said that to be successful open source projects should not just grow organically. Uh, I'd love if you could expand on that. What, what kind of planning and structure makes for a really successful project?
[00:24:01] Nithya Ruff: There are many open source projects that are successful organically. They, they just magically, you know, take off. Right. Like the kernel, when es put it out there, uh, there was a lot of engagement and there were a lot of, I, I think the world was ready for it. Yeah. But more and more, when you have millions and millions of projects on GitHub and GitLab, et cetera, how do you stand out?
[00:24:27] You really have to have intention as a maintainer, as a project leader to establish the right practices, to do the right branding, to do the right communications, to put the right read mes in place, and, uh, you know, grow the community in an intentional way. Yeah. Uh, otherwise you just don't stand out. So you, you really have to put a lot of thought into it.
[00:24:52] And sometimes maintainers are very good technically and have a great idea, but they need, uh, a community of people to work with them.
[00:25:01] Dan Blumberg: Yeah, I was just gonna say, as you're listing those different skills and those needs, marketing, community management, those are not the traditional software developer, you know, write code skills.
[00:25:10] Nithya Ruff: Exactly. And very few maintainers have those types of skills. And so, or
[00:25:14] Dan Blumberg: the bandwidth.
[00:25:16] Nithya Ruff: Uh, the bandwidth and, and, and hence you see a lot of burnout. And that's why intentionally if you build the right community of community managers or project leaders and others who work with you and, and help you or you, you see another model these days of projects kind of establishing themselves at a foundation, whether it's the Apache Foundation or the Linux Foundation, because the foundation provides, uh, culture and scaffolding and best practices and reach, uh, and help you kind of grow your project.
[00:25:50] So that is what I meant by not organic.
[00:25:53] Dan Blumberg: We're talking a lot about open source and software, but the concept of open source is used in many other domains, and I'd love if you could share some examples of where it's used. We don't think about it maybe as open source, but it, it really is.
[00:26:04] Nithya Ruff: I love that you asked this question because it's, it really is about collaborating together on a common problem and, and finding a way to finding common purpose, so you could use it in social good.
[00:26:20] Uh, how communities come together to work on a common problem in social areas, and the United Nations, for example, has asked open source experts to help work on some of the social aspects of the world and, and the problems in the world that need to be solved Hardware. Has clearly been disrupted by open source.
[00:26:44] You can certainly have, you know, things like the Risk five project where specifications and documentation, et cetera can be open and, uh, you can enable a broader set of, you know, people to create hardware based on those specifications. There's open data and there are data licenses associated with that, but also how do we work together to create, you know, open data together.
[00:27:12] So I would say the philosophy of open source can be used to solve problems, but it can be applied to lots of different areas. Open seeds, uh, is another area that I've heard of where seeds can be, you know, open for modification and use and redistribution and so on and so forth. So I think we need to broaden the definition of what open collaboration can do.
[00:27:37] Dan Blumberg: Yeah, tell us about your own story and how you came to fall in love with open source and, and just got working in technology in the first place.
[00:27:46] Nithya Ruff: Right. I mean, it's been 25 years of working in open source and even more years of working, uh, in technology. I did not start out working in technology. I, my undergraduate was in business in India, but I grew up in a family.
[00:28:02] Uh, my father was an engineer and really understood technology and it was his encouragement of me, uh, to go pursue a computer science degree as my graduate work. And so I traveled from Bangalore, India to. Of all places, Fargo, North Dakota, obviously, and obviously where else would you go in the US and, uh, joined NDSU, North Dakota State University to do my master's in computer science.
[00:28:33] And I fell in love with the notion of creating new worlds and new solutions, uh, using a very defined, you know, language and structures in computer science. So I started working as a developer, but very soon, like many developers, I, I wanted to see a broader and broader set of why are we doing this? Who wants this?
[00:29:00] Who's using it? So I started, I became a product manager and product marketing and strategy and, and so. Those different experiences really helped me succeed in open source because open source is such an intersectional world. Yeah. Uh, you've got to at the same time think legal, think community, think technology, think strategy, and find the intersection of these things to help your organization, you know, be successful in open source.
[00:29:31] And that's what, uh, ended up happening to me, uh, 25 years ago at Silicon Graphics. Many people may still remember SGII was involved in working with the open source strategy, and then the last 10 years have been really helping companies establish open source program offices, and. And discover, you know, their path in open source.
[00:29:57] Dan Blumberg: Yeah. I, I love it. And I love you. You've, you've said before you, you wanted to work in technology and find ways you could contribute without coding. I'm interested in how you would advise young people today who are looking for different paths and, and also, you know, AI is totally changing those paths as well.
[00:30:14] I'm, I'm curious for how you advise folks,
[00:30:17] Nithya Ruff: and I love the fact that open source should be seen as not just code contribution. Uh, for instance, my contribution has been in marketing, has been in governance, has been in community building. And those are very, very important aspects as we discovered, because maintainers need the support of a broader set of skill sets.
[00:30:42] So. As someone entering this field, you can volunteer your time with the project and look for opportunities in a project to help with marketing or branding or community building or answering questions. And that's how you really build up your open source cred and skills and strength, uh, by doing more, you know, uh, and volunteering there.
[00:31:08] And I think ai, you've got to, all careers have to discover what is the role of AI in their field and how do they use AI to become smarter, faster, and use it as a tool. Yeah. To do better. My oldest child is, uh, a physician and so I keep telling her that she needs to not fear ai, but to embrace it and to see how it can be a tool in her, in her serving her.
[00:31:41] Patience. And my youngest child is a journalist. And and the same holds true there. Yeah. How do you use it to research? How do you use it to fine tune your thinking, uh, and not to fear it?
[00:31:53] Dan Blumberg: For sure. Nithya, thank you so much. I really appreciate this.
[00:31:57] Nithya Ruff: My pleasure. And thank you for, uh, including me in CRAFTED.
[00:32:00] Dan Blumberg: Of course. That's Nithya Ruff. I'm Dan Blumberg and this is CRAFTED.
CRAFTED. is brought to you in partnership with Docker, which helps developers build, share, run and verify applications anywhere without environment confirmation or management. More than 20 million developers worldwide use Docker suite of development, tools, services, and automations to accelerate the delivery of secure applications. Learn more at docker.com.
Special thanks to Artium, where I launched CRAFTED. See how Artium could help you build your future at Artium.ai
And CRAFTED. is produced by Modern Product Minds, where my team and I can help you take a new product from zero to one and beyond. We specialize in early stage product discovery, growth, and experimentation. Learn more and sign up for the CRAFTED. Newsletter at modernproductminds.com.
Please subscribe to CRAFTED. on your favorite podcast app. Rate the show and share it with a friend.
[00:32:56] Nithya Ruff: How do you stand out? You really have to have intention.