34C3 Intro playing Herald: Organisational Structures for Sustainable Free Software Development. Title says it all in my opinion and I think this is a very important topic. The talk will be held by Mo, who has experience with dozens of free software projects and funding sources. As a funder and recipient of grants, contracts and donations. The stage is yours, give a big hand and round of applause for mo please. applause mo: Hello everyone, nice rainy 4th day of Congress. Yes I'm going to talk about organizational structures. What I mean by that and why am I talking about this? I was invited to submit a talk about open source funding and they cut me short. They gave me instead of the 60 minutes that I offered they gave me 30 minutes. So now I'm cutting out all the part that is actually talking about funding. Because I think before you can go and even speak about funding you need to understand that funding can be dangerous, money can be very destructive for open source projects. And in order to be prepared for kind of the next part of my talk that you're not going to hear today. I want to talk a bit more about organizational structures and another alternative title of this talk could be open source governance so even more dry than the previous title. Before I go into detail of: why am I giving this talk? Who am I? Why do I think I have some experience with all these topics? Some caution, some trigger warning as you've might have experienced I'm using open source and free software exchangeably in this talk and I know this can cause a lot of uproar. People can die and I don't want anyone's feeling to get hurt I can go into detail about why I'm doing this and why I'm using this interchangeably. Both for the aspects of the licensing where it classically would use kind of open-source licenses as well as for all the open source principles and guiding guidelines for the development, the collaboration and everything that is happening on organizational level. So bear with me. If you're a free software person I'm your friend. So a bit about me. In 2010 I was studying computer science at the Technical University Dresden and as one of my side projects near the end of the studies I started something called torservers.net . Torservers.net is a network of organizations so we started with the first organization in Germany a non-profit members Association. And the goal of this network of organizations is to run Tor infrastructure. So over the years we've grown this network from this single organization in Germany to 22 organizations in 15 countries. Most of these organizations have been set up specifically for this purpose to run network infrastructure. And most of them are also charitable nonprofits so I kind of accidentally learned a lot about the the differences between the different countries. On how they look at charitable law and stuff like that. In 2013 I came across a pretty new foundation the Renewable Freedom Foundation it was set up in 2012 by Georg Chef the then newspaper owner of the Donaukurier in Ingolstadt, so it's a daily newspaper and he started a foundation with the goal to protect and preserve civil liberties in the digital space. And ever since we've been working with dozens of organizations and dozens of projects across the whole sphere of anything that you can basically see at the Congress. And we we are a small foundation so we had to find our purpose in this space. And we are focusing mostly on organizational development, taking away burden from people that set out to realize their goals and in order to realize your goals you sometimes have to do stuff that you don't want to do and we help with that. And this led to the creation of a new entity in 2016 the Center for the cultivation of Technology. Which is a non- profit limited liability company in Germany and a GGmbH and I will go back to that and mention it later in this talk. So why are we here? What are we talking about? I cut my talk short, I mentioned this. A lot of the stuff that you're going to see are basically references to outside material. This is a complex topic and I encourage you to look at the references and pick them up. They should be now listed in the Fahrplan for this event. So you don't have to take pictures or anything of this or follow the video to hunt the references they're all linked on the website. And my goal for this talk is that there's a growing number of people in our space that think critically about funding. That also see that more and more funding is coming to this space and that we need to become better at at organizing and learning and collectively sharing our experiences with funders with funding entities. How to write grants and stuff like that and if at the end of this talk maybe one or two people come up with to me and become part of that network that would be great, that that's my hope for this talk. So let's start on April 7th 2014. I think you all well recognize this logo. This was one of the first times where kind of in a marketing experiment people described a weakness in OpenSSL. This is heartbleed. And heartbleed kicked off quite a bit of activities. There was a blog post by the OpenSSL developers basically how they're not getting any funding to do their work properly. And also it kicked off a lot of other research in this area about how can we actually support open source. One of the most prominent figures that is walking around talking about these topics is Nagia Eghbal this is like three references that I feel are very important to to look at. The unstructured labor behind our digital infrastructure was a report published in July 2016. I picked out another short talk of her rebuilding the cathedral at the Strange Loop Conference. And she's maintaining a sort of a list of funding opportunities so she's comparing the different ways to to get opensource funded so if you're coming only for that part take a look at that list: "The Lemonade Stand". Mozilla also did quite a bit of research they're as you know a fairly large organization handling a lot of volunteers and a lot of volunteer contributions. We also know that there's a lot of controversy around how well they manage this and in order to improve they commissioned a few studies, one of the studies was done by Stanford in 2009. How do you actually work with volunteers basically the topic always is how do you scale and how do you keep volunteers excited around your project and contributors. There's an interesting Community Survey that I invite you to look at and there's a more extensive report published in 2016 about the motivations of contributors to open source and I will come back to this because this is exactly the crucial part when you transition from a project that has been run on volunteer basis or that has some people involved that managed to contribute to the project. And how to grow your project and keep that spirit up and and be inclusive as a community. Kind of the most famous and the most relevant reference here is Jono Bacon. Not necessarily this book. This is a good book, it's a lengthy book, but he also gave a lot of different talks and he's giving seminars about this. And I highly recommend his stuff. I put a small note at the bottom: This book is not an instruction manual because it is an instruction manual. And I don't like that style so try to read it and read in between the lines. There's a lot of takeaways that you can have from this book that are -- that you won't get if you follow it line by line. I think that many people demand an instruction manual for how to manage communities and then you end up with that kind of writing. But I still think that this is kind of the most valuable book describing the motivations of opensource developers. He talks a lot about like creating a sense of belonging in the community. That you need a shared belief in the project and that you will need to have opportunity to contribute on an equal basis. So this is the announcement of the core infrastructure initiative by the Linux Foundation that is only roughly like two or three weeks after heartbleed. So they managed to find some commercial companies to bootstrap a program that would support open source infrastructure and of course the first software that they supported with this and are still supporting is OpenSSL. And I will just briefly mention a bunch of funding opportunities and a bunch of ways how open-source projects might be able to get some funding. To show that there's been quite a lot of movement in these areas. The P that you can see here is the German prototype fund, that's the German Ministry of Education and Research that is supporting this project. So there is German federal government money that is used to fund open-source development and I encourage everyone of you to check out the prototype fund website and look at the previous rounds of projects that they've been supporting because I think it's an excellent selection. I listed a bunch of others I'm not going to go more into detail about the funders that's for a second talk, a separate talk, but you can find these resources like, I picked out tools specifically the snowdrift wiki the market research they did, that Aaron did is really excellent into the different ways of funding. And also we maintain a huge list of funding sources that's, I think, around 300 foundations listed there, not all of them fund open source technology. But since we are active in a more broader space of like digital everything you will find a lot of material there. One thing that I want to specifically pick out and highlight because it hasn't been talked about before not that I know of. Is a program that is currently in its phase of accepting applications. With a wonderful name of ICT-24-2018-2019, it's a European Commission call for participation. For the next-generation Internet. And this is relevant and interesting because the way they're framing this call will show you quite clearly that they are interested in the kind of technologies that get built by our communities. And sometimes the language is kind of funny and the terminology is something that you have to get used to. But I like it it's kind of human centric openness, cooperation across borders, decentralization, inclusiveness, protection of privacy kind of that's that's the values that also we stand for. And in this program the the research and innovation actions that this is going to fund should encourage when relevant open source software, open hardware design, access to data, standardization activities. So everything that kind of our communities have been doing and want to be doing so this is really a great opportunity and we will see how this will end up because, and now I'm coming to the to the crucial point of this call. It is a call for intermediaries so you're not supposed to apply as a project directly for that kind of money because that just too huge the amount of money that they're giving out in total budget just for this call is 21.5 million just in 2018. So as intermediaries you can apply for these fundings and they're split across three three different topics. One topic is privacy technologies.The other is peer-to- peer technologies. And the third is kind of data mining big data stuff. And these intermediaries then are responsible to split up that funding and give it away to third parties and this is something that Commission calls usually exclude. Usually they require you to develop everything in- house and make it very hard to involve external participants. So this will be interesting to follow, the deadline is in April and sometime maybe during the next year we will see who got this money and how they're going to redistribute this. Now, for dealing with money I put this nice little piggy bank as a kind of contrast to how dangerous actually funding can be if you don't think about it. So when you want to deal with money and I'm probably not telling you any news as a as a project you have to decide whether you want to start some kind of legal entity to help you with that because at certain points you don't just don't want to have it go through one individual. So you have the option of creating your own organization or you find an organization -- an existing organization to partner with. In the hopes that it's kind of less bureaucratic, you already have some kind of infrastructure, there's hopefully already some accounting happening and all that stuff. So let's look at the two different options. The one option starting your own is something that a lot of people feel that is the way to go because they believe that they stay in control, right. It's your own thing, you're not depending on some external weird partner organization. But I I am warning from this model because you're actually creating an organism when you create an organization you create some organism and that organism develops its own life and then my experience with many projects is that over time the organization swallows its people. And you're contributing to something that you set out to be doing and in this organization. Without necessarily taking a step back and deciding when to let go of an organization or when to restructure it. It will defend itself. So, how do you do this? What you see here is a very elaborate bylaws or chapter or the articles of creation of your organization. And there's typically two ways to do this. One you go and hire a lawyer and they come up with some draft document for you. This is kind of very often the way that people do it in the US. In Europe mostly what you do is you copy something, you compile it yourself. So in Europe you don't need a lawyer to create organizations. You're not expected to get a lawyer involved. So what happens then is that you look around you compare different articles from from similar organizations and then quite often you copy different parts of these documents together to form your own organization and the problem in both cases is that here what happens is that you are getting some template that has governance structure described. That does not necessarily match the governance structure of your project and it does not necessarily match the values and the spirit of a collaborative environment for open-source development. And this is even more dangerous the kind of copypasta. Because you usually end up with a document that is in itself incoherent because some of the articles at the beginning contradict some articles coming later and when you talk to lawyers that see they see this over and over again. So this is not something that just happens sometimes but this is the usual case that this is not even coherent in itself. Let alone coherent and compatible with how you actually want to run the project. And this is this leads to kind of a feeling that you have to have these two worlds you you think that there are some legal requirements for your organization that that does not exactly fit the spirit. But there is opportunity there there is opportunity there to to express the actual governance that you have in your project and even like probably unwritten right you have some idea of how you want to work together. So I caution people don't just copy and paste something don't go to your lawyer and say I want to create a non- profit or I want to create a company because you're getting the cheap kind of capitalist model of an organization. I call this the stack overflow effect right it's copy pasting stuff from stackoverflow and importing it and bootstrapping an organization like that. The alternative that you have is using a fiscal sponsor that's the professional term for looking for partner organization and partnering with an existing organization. And in the free software space there's a bunch of those that you can pick from and all of these include some guidance along the way especially if they're made for open source projects and if they're already experienced with other projects. So this is a newspaper article that in the LWN article. chooseafoundation.com is a website that compares a bunch of the most prominent ones in the US. I want to highlight the Commons Conservancy. The Commons Conservancy is a bit different model it isn't actually a fiscal sponsor and it's it is a way to define your own governance so independently of what kind of legal entities you're going to use. You can use the material that the Commons Conservancy is producing to pick and choose governance models. So they have documents about forking organizations for example. So you not only forking the source code but really forking the organization and what happens to the assets that the organization has domain names trademarks and stuff like that. So ultimately in any case you will have to talk about this ugly topic and that's why I use this kind of very ugly slide to talk about governance because that's something that kind of the projects usually that I work with are loose collectives, are politically motivated, come with anarchy spirit, are kind of against any form of formal governance . Which is not exactly what anarchism is about but that's a separate talk all together. Let's stick to this. So what we have in open source actually is a lot of tools that have been developed, that implement the governance models without it becoming kind of a long written statements. So when you think about issue trackers, when you think about mailing lists the way you interact on code with with revision control systems all of that is an implementation of inherently of a governance model in open-source. And we are lacking those tools in the other areas that become relevant for governance and this is basically what I want to highlight in this talk so. But how do we go from here? How do we take all these unwritten rules and this kind of spiritual or ethical guidelines that that we come out and this will be very different from organization to organization. How do we turn them into something that other people can follow? And this is important especially during the phase where you start receiving money because then you have to make a decision on how to spend that money and you can still make the decision collectively. But over time you bring in people maybe from different spaces and they're coming with a different background, they're coming with a different set of ethical principles. And they might be spoiled already by working in some bullshit company for a long time and then they come and they take that, these these principles that they've learned into your nice collaborative environment. And there's there's a tendency and I see that in many places that as organizations grow up there's this divide between the principles for the software development side and the principles of how the organization is run. A very good book that talks about this in a non-technical environment about organizations is this book. Frederic Laloux "Reinventing Organizations" and for me this is very inspiring as a blueprint for how you can actually copy the model, you will find a lot of material here where you can see directly how it relates to the open source way of doing things. I picked out the quote "Impressive! Brilliant! This book is a world changer!" and not because I believe that it is but because actually as a bit of a warning because it's written a very enthusiastic way. So sometimes you have to kind of let the author go and and and but still continue reading there's a lot of good thinking material in there and one thing I want to pick out is the sections where they talk about the different governance models in terms of hierarchical structures compared to consensus structures. And the third and the model that is highlighted across this book is what they call the advice process. And when you look at the advice process in that book it's basically what our communities know as rough consensus. So if you have an idea you have the full authority to execute that idea. But you are you are forced to get input, you're forced to get advice from the outside so the only way to violate kind of rules is that you're not reaching out to relevant people for advice and relevant people are the people that you work with are the people that might have some good ideas around that topic. But they cannot block you the authority stays with you for that decision. There's another really relevant section especially given what's happening here with code of conducts and and all this. Is the clear the need of clearly documented and explicit decision-making processes. In a way that is compatible with that kind of thinking that you are a self-organized group and yourself we want to strengthen the self organization in that organization. And there's really interesting material in there that could avoid some of the weird code of conduct stuff that has happened in our communities. So I really encourage you to at least look at that section of the book. Another interesting thing like they have a they had that he's looking at something some comparing some different entities that use this model. In in in their own ways and one of them is a multinational corporation in like active in 80 countries or something with like 20,000 employees. And still they have this principle that anyone in the organization can spend as much money as they want. As long as they're following that advice principle that I mentioned earlier. Ao this is just something to inspire you when you think about like managing money in an organization and there's a bunch of projects starting to appear that are trying to apply open-source principles to this. One is Co budget you're invited to look at that. The other more known is open collective, open collective you can sign up as an open-source project people can donate to your project and you can also establish some transparency. Because a lot of time you lose that transparency of like what is actually happening with that money, and who has access to that money and who can spend that money. Just briefly something about funding sources I already mentioned the "Lemonade Stand" list. There's like the three sections of like small donor, private foundations, public funding. There's a lot to be said about small donors but my when people ask me about crowdfunding and campaigning and stuff like that I I'm very reluctant about that because it usually doesn't work. So the the only thing that works in terms of raising money from small donors is that you can show the support of the community and then get some larger donor to top that up and and agree oh wow that project really has has users. It doesn't really work that well to for in most cases that but that's very specific cases. So quickly just dealing with funders some some of the learnings that I took away from from my work in the previous years. One that I'm still struggling with is how can we make this planning and writing grant applications fun. If any one of you has some exciting ideas about gamification of of grant applications and I'm all ears. And my advice is and and that's something that also a lot of people are making mistakes there is that plans change. Right? You you you develop a plan you give it to the funder it's maybe for one year or two year grant and they expect that this is going to change because it has changed. It like there's no way that you can follow that plan line by line but there's this it's it's mostly the side of the recipient that feels kind of weird when you deviate from your plans. Do that change your plans communicate this early and not because otherwise you're creating trouble at the end of the project or you're doing stuff that you don't really want to do anymore. In terms of writing grant applications a lot of things are kind of a mistake that people are doing because they're like in the developer mode of thinking. Is they think in terms of deliverables and deliverables in terms of what kind of features can we add to the software. This is actually an art form coming up with estimates for software development I encourage everyone to look into the material about software estimation. Because it's kind of crazy I cannot talk more about this because I'm already over time but one thing that I still want to mention and this is the last slide. Is that in a lot of cases I've seen that you can think about deliveries in a completely different way. You can think about deliverables in a way that is actually supporting community growth rather than just feature sets and the metrics of success that you can define there because funders want some metrics of success demonstrated. Is the number of people that are participating on your mailing lists, the number of people you have in your IRC channel that's all that kind of stuff and redirecting some of the funding to the more kind of community oriented hackathons, running events, t-shirts and all that. You know about this, but usually in the moment of a grant application that all that gets dropped and then you're struggling keeping that up so now that I'm over time I'm going to skip like maybe a hundred of slides. And I'm going to end with this slide. And thank you. Applause Outro playing subtitles created by c3subtitles.de in the year 2018. Join, and help us!