foreign
good morning everybody welcome back for
the second day of pycon Australia uh I
will be your MC for this session my name
is Russell and it is my distinct
pleasure this morning to introduce our
first speaker in this block coming in
virtually from over the Internet uh
Amanda casari will be speaking to us
about our dependencies or our dependency
on open source dependencies please make
her welcome
all right
hello again everyone it's a delight to
see you uh or not because I can't see
you but I trust that there is a lovely
audience of people in person because you
have all come as a special guest of our
friend salty the sea otter here and her
many friends
um so I am excited to be talking today
about navigating the murky Waters where
uh hang on I I did that one already 48
hours ago
um so you know
look uh
present Amanda I get it you're here to
talk about our dependency on open source
dependencies I'm super excited for you
uh you're forgetting one thing uh which
is uh this this isn't uh my talk
um so it's only the second slide uh I
haven't even gotten to the title
um here's the Shameless self promotion
for the last talk
um but uh I have added in multiple
things of this it will be a roller
coaster
um we'll have Shameless self-promotions
Shameless run promotions side quests
um and it's a solid talk all the extras
exist because like I said this is
actually not my talk that's right this
talk was originally written and
performed and I mean presented by myself
and your very own brilliant Nikki
ringland who I hope made it to the room
it sounds like there might have been a
slight emergency beforehand if not we'll
be showing up and hopefully we'll throw
popcorn and huckle me accordingly
because this is V 2.0 of a talk that we
created together and gave the lesbians
who Tech Summit in June of 2022. Nikki
was kind enough to allow me to shine it
off and take it out for another spin
with all of you today
uh for those of you familiar with the
Australian program Bluey it might be
that this representation of ourselves as
very specific adults on that show is all
you need to know who we are uh in case
you are not one of those lucky folks
some context about myself I am a pale
white woman with light hair and eyes who
wears glasses I am a researcher and
engineer at Google where I'm currently
leading a team focused on research and
education in our open source programs
office I am using my nighttime DJ Voice
tonight because the last time I gave a
talk my kids complained that I was
talking too loud hopefully that will not
top in tonight I'd like to let Nikki
introduce herself but since she's not
here in the Stream with me and she might
be busy in the audience with you I get
to make it all up
Dr Nikki ringland also works at Google
she was hired in the year 2137 to hire
and build a team based on her
groundbreaking Research into human time
travel for Fun and Profit unfortunately
for Nikki one of the scientists on her
team forgot to carry a one causing her
to leave all relevant miseries as she
came into the past only retaining her
cover story fortunately for US future
Nikki was kind of a selfish jerk who
didn't believe in sharing so no one else
has been able to replicate her work on
this timeline also fortunately for us
present day Nikki is a wonderful human
being who believes that credit is always
best when shared freely and access to
education and information is a human
right
so my first Shameless self-promotion and
friend promotion and sidequest are now
all complete For Those whom it helps you
can find these slides with detailed
speaker notes which I may or may not
stay on script to at bitly that's bit.ly
backslash OSS depths Dash
r-a-n-b-o-w-s-n-e-k2023-slides
I would like to begin by acknowledging
and paying respect to the traditional
owners of the various lands on which we
meet today I'm joining you from Land
which has served as a site of sustenance
community meeting and exchange among
indigenous people since time immemorial
the Western Abenaki are the traditional
stewards of these Forest lands and
Waters in Vermont which they call
indakina or Homeland we respect their
spiritual and live connections to this
region and remember the hardships
they've endured both past and present
including violence and force
displacement at the hands of colonizing
peoples As We Gather in this physically
dispersed and virtually constructed
meeting as we share our knowledge
teaching and learning practices may we
give thanks for the opportunity to share
in the joys of this place where I am
coming to you from and to protect it
so this is a talk about technology we
will be as human-centered as we can
achieve starting with our communal
agreement that everyone here comes from
different backgrounds and understandings
of the concepts we'll be talking about
today
the words we use may have a different
meaning in your disciplinary area of
work to get us all starting from the
same meeting we're going to spend a few
minutes defining key Concepts
open sourced when aligned specifically
with software has a very specific
definition which relies on the criteria
governed by the open source initiative
these have to do with access to source
code and other musts and must Nots which
relate to distribution and authorship
rights you can learn more about these
criteria at opensource.org backslash OSD
next we have a dependency this is simply
referring to when one piece of software
relies on another piece of software
very simple
uh okay next I guess sometimes that's
true the reality is this definition is
oversimplifying things
so what we've got here is that a
dependency of a package or aversion is a
separate piece of software that is
imported by the package for the build
so let's say you want to use the python
package matplotlib to do that awesome
data science project so you import it
but to do that you first you've got to
install it
and when you do that it automatically
downloads and installs a bunch of magic
for you uh
so hey I'm sorry what was that do that
one more time keep going
uh-huh okay I installed that plot lip
cool cool cool uh what's all this other
stuff okay that was the dependency I
want to use and it's installing its own
dependencies
uh the thing is each of these little
progress Bars were the other packages
that were installed as dependencies of
the dependency I installed so here's
your nice tidy dependency tree right oh
no there's a vulnerability that's just
been discovered in one of those
dependencies so an example of this is
what when the popular logging package
that you were using maybe log4j had a
vulnerability discovered yeah so I don't
know about you remote code execution was
on your holiday wish list two years ago
not for anybody
um if you're lucky the vulnerability is
in one of your direct dependencies that
one little thing that you can see
immediately
but the vulnerability isn't a package in
an indirect dependency something further
down the tree then your options are more
limited uh with log4j it turned out that
this case that was more than 80 percent
of the open source packages on Maven
Central use log4j so some 16
000 packages were indirectly impacted
a surprise
this is also too oversimplified that's
not quite accurate chances are the
dependency graph doesn't look like a
nice clear tree hope you're all ready
it's a dependency graph and it might be
highly connected
so that vulnerability even if it's a
direct dependency is likely not only a
direct dependency but also an indirect
dependency
if you want to find out more how much of
a mess it is here my friends is the
second Shameless self I mean friend
because Nikki wrote that section the
second Shameless friend promotion for
another Nikki's talks explaining this
even more in detail especially around
what happened with log4j
uh time for more definitions let's talk
supply chain
concept of a supply chain refers to the
people and processes for making and
distributing a product and it's often
applied to manufacturing a supply chain
is a process of getting a product to the
customer now here like in the previous
it's not a tree it's a graph there is
iterative reuse one of a product Supply
chains is n number of products and N
Supply chains and an endless supply of
turtles all the way down
now a software supply chain refers to
the people and processes for making and
distributing a software product
a supply chain is a process of getting a
product to the customer and in the
software domain we will focus on the
software development process itself
which is again dependencies all the way
down
so a list of ingredients slash bill of
material materials is another term used
in manufacturing
a software bill of materials is a
complete formally structured list of
components libraries modules that are
required to Bill like compile and Link a
given piece of software and the supply
chain relationships between them so
these components can be open source or
proprietary free or paid and widely
available or have restricted access
wait and so
why why are all these fundamental
concepts so important
much of our modern technical
infrastructure is built on and with
dependencies from open source
which is great right there are obvious
benefits when it comes to building with
open source dependencies we love open
source it's awesome for so many reasons
uh I mean very selfishly
um it stops us from having like
selfishly as a developer the person who
wants to use it uh I stop stress from
having to reinvent things that already
work it's fantastic I don't have to
reinvent anything
um I don't have to do duplication of
effort I can use other people's work
that's maybe Nimble and quick
um also selflessly uh there's a low
barrier model for sharing your work with
the world while maintaining control over
your ideas there's many versions of Open
Source licenses that allow you to do the
level of control and transparency and
iteration that you want
I'm also very selflessly science belongs
to everyone
like when there was a discovery of being
able to see black holes and those
scientists were able to very quickly put
out how they were able to image that
using open source software uh both for
the explaining how the things were
processed and then explaining how the
science work behind it and then sharing
the code and the imagery is all at once
in a lovely little package Jupiter
notebook was fantastic
um also very shelfishally uh you get to
share things as you work on it and get
people's help along the way so other
people see you work if you have
questions if you have struggles if they
can work with you they can just see you
struggle because sometimes that's
something that helps people feel better
about themselves but really when it
comes down to it like being able to work
in a public space in an area that you
get to choose that's can be quite hard
to figure out if you're just building
that from scratch having open source is
a ready-made Community is lovely for
that
um selflessly
um open source out software can be a
means not the only but can be one means
to decentralize power and Technology
open source broke the copyright mold
that only authors get to say who and how
a copyright is used which was the
original reason and creation for it so
as part of the freedom and open source
history I think that we cannot ignore
the fact that copyright law has been a
central part of this along the way
when you build with open source
dependencies you also have to consider
the strengths the constraints that are
involved with being able to share things
with the world under certain kinds of
licenses
so one of these again selfishly there
are legal implications on what you can
do with open source depending on the
license that is released under I say
that this is selfish as well because
again like from the person who's going
and consuming it you may want more
freedoms than whatever the license
allows you to do but guess what that's
not your choice it's the people who
actually create and release the software
who get to say what kind of license is
used for it what you use after that may
depend on the license before that this
is why an open source you still get
questions about how things are going to
change upstream or Downstream and
there's a whole bunch of licenses that
fit under open source that allow you to
make those decisions
with open source software again other
people see your work this is the thing I
said before that was great why are you
saying it's bad now Amanda it's because
I worked it's a lot of work to maintain
yourself in an open space right so if
any of you have any inclinations like me
sometimes I turn into that little Trash
Panda and I'm like don't touch my stuff
just leave it alone it's there for a
reason I don't want you interacting with
it I just wanted to put it out there
now this isn't exactly the most dividing
way so from my perspective uh you know
putting things up where I mean people
use it great putting things where people
can see you also not so great
uh also if you want other people to use
it they have expectations of you even
when you don't want to support them
right so log4j happens all of a sudden
everyone starts calling you and saying
when are you going to be able to support
love for Jay when are you going to be
able to support log4j when are you going
to be able to support log4j and you're
like look it's holidays I just want to
go to the beach I'm hanging out with my
friends but the reality is is that other
people are using your work and other
people are relying on your work and at
some line there has to be there where
people and their livelihoods start to
depend on you in a way that you didn't
anticipate and you may not want
um so real talk recognizing and setting
your boundaries is not selfish the level
of transparency and access to your time
is not something you may have signed up
for this is also why licensing exists so
that you can put things into the world
decide where it wants to go how people
can use it but this is also where you
can put communication into the world
about whether or not you plan to be
there if problem happens
it's kind of the use it your own recipes
um
talking about risk open source keeps
changing
not like last eight months have been
exceptionally high volume around any of
that but what we expect it to look like
tomorrow I mean what I expected to look
like six months ago is not how it looks
today but that's also totally fine so
what it looks like tomorrow may not look
like what it looks like today
more recently we've seen a higher rate a
systemic level security issues which
impact everyone using open source
software we also seen a lot of movement
from certain organizations to try to
change what open source is means and
could mean in the future based on what
they want to call Open Source because
they're trying to take the term and go
from something specific to something
generic the power in that is when you
move from something specific to
something generic is the generic term
means less but carries all of the work
and the weight that went into that
specificity
so the folks who want to be able to use
it generically and Define their own
boundaries are relying on that
specificity to carry them forward in a
way that both carries Goodwill makes
them money and also costs things from
the folks who did so much in the
specific area
I bring this up because we are forced to
change previous ideas of what security
and stability looks like even now
um when you work with open source
software
just like now you are subject to all of
the Legacy problems the known the
unknown the known unknowns the open
source Legacy brings with you so if you
think that you could just do it better
in five seconds based on understanding
the problem I can't wait to see you put
that out into the world the good news is
is that eyes on the code does improve
security
however I think that Linus's law is a
myth a strong belief still held so like
many eyes make less bugs is not true
it's not true these days maybe it was
then it's definitely not now however by
making sure everybody can see the work
that's happening it also means that
things are open and transparent in a way
that we can work on them together rather
than waiting for someone else to sell us
the fixes
things are not improved when they are
fixed they are improved when we are
committed invested and motivated to work
on them together
as we said people rely on your work
happy holidays you get an rce you get an
rce you get an rce when things pop up
all of a sudden you have expectations
that you have or have not set with
people who will use your work to tell
you whether or not you are available to
work on them if you work in industry and
you have built on open source you have a
requirement to meet your customers where
they are with those security fixes if
you are not being paid for your work the
same expectation isn't there but this
also means that corporations need to be
working back into the world that they
are not getting paid for and fixing
things upstream and keeping the rest of
the comments maintained even if it
doesn't help the market
again other people know you rely on
their work so a risk that can happen in
open source that we have seen even more
recently in the past few years is that
people can take advantage of that they
can work deep in a dependency change to
make changes either to make a political
message or to be able to affect
vulnerabilities in a way that makes
their work more visible because they
want that visibility I'm not going to
bring that up here we talk about that in
another talk there's also the problem
that when other people know that you
rely on their work they can take
advantage of that being what we
essentially refer to as toxic jerk faces
who hurt people but become the UN the un
uh the person who cannot be lost from a
team so we get rock stars and ninjas who
become Central to a movement when really
they're just a jerk that doesn't mean we
can't change things that's what we're
all here to do to change things speaking
of which this is one of the most lovely
conferences I've ever been to and I'm
not even there so thank you all so much
like you were a force of change and I
love you all
I hope you're cheering for yourselves
even though I can't see it please send
me pictures
the ecosystem itself is much more than
the Kodi bits that we call dependencies
and it's more than the code that you
care about most
that's right okay second uh third fourth
Shameless self and for information I
lost count
um so several examples I just talked
about were things broke are covered in
more detail by my talk with Julie
ferrioli black swans of Open Source this
is different than Russell Keith McGee's
black swans of Open Source from pycon I
think that was in 2019 Russell uh but
both brilliant ideas black swans lots of
ways all the way down different concepts
still like this one here go check it out
there might be a sing-along there is a
sing-along it's recorded
okay getting back to talking about
software as an ecosystem surprise it's
not just a graph it's the OS and the
build system and the package managers
and cdms and then it's not just the OS
and the build system and the package
managers and cdms it's your OS and build
system and package managers and cdms and
their os's and build systems and package
managers and cdms and their os's and
build systems and package managers and
cdms so like we said all the way down
it's all the parts and all the bits even
more
it's more than just the software
it's a system it's a technical system
a technical system but there's even more
parts you depend on that are not evident
even if you understand the gnarly graph
it's a socio-technical system
and that's not just a technical system
of Technical Systems people of all kind
contributors full-time employees
volunteers unpaid labor visibility and
visibility people write the docs that
organize sponsorships they handle
finances they do the AV thank you so
much Patrick you've been a delight to
work with uh there's people who are
working in the room right now I don't
even know who everybody is but I just
have a Shameless plug again
that there are lots of folks who are
working on lots of different things and
we should talk more about all of those
parts there's other work coming up for
that that's why Salty's there
it's a complex ecosystem of
socio-technical systems
again when we start looking at all the
work that everybody is doing we also
have to talk about organizational
organizations within this we pay a lot
of money to people who do a lot of
things we pending money to foundations
non-profits Industry Program offices
professional boards what are they all
doing the government policy and
regulation what are they doing
so we have many ecosystems a ecosystem
many ecosystems and as a part of these
many ecosystems I just want to make sure
I'm not going to be cut off too quickly
and I want to talk if you have talk
ecosystems also have nutrient flows and
energy Cycles so how do we translate
this to practical applications and we
don't want you to talk about coral
relief Samantha we're talking about open
source software
so again open source software
dependencies
there are things that we can do to take
all of these Concepts which shape in my
brain Nikki's brain all of my
collaborators and talk more about like
how can we influence change and direct
change in this area I'm just going to
give you three takeaways
one
watch your software
so recognize that what you choose to use
is going to have implications down the
road watch your dependencies so that you
can understand the organizations you're
supporting by using that software with
those dependencies and so what's an
organization Amanda well in open source
ecosystems this could be large-scale
organization and investment who's paying
to maintain the things who's paying just
to maintain a trademark also important
but for different reasons where's
Community scale organization and
investment happening where policy change
is being pushed for when an organization
is pushing for certain policy changes
either in regulatory systems or being
able to push against changes in
regulatory systems what does that mean
about the software that you're using and
supporting that ultimately gets funded
as part of that organization when is it
that organizations may put out messages
about diversity equity and inclusion but
they don't actually do those things that
they're saying beyond the report
when do they require marginalized people
from their Community to step an up and
demand change when that should be coming
from the top
so again a great time promise last
Shameless self and friend promotion
depths.dev you can find out more about
which projects depend on you can dive a
little bit deeper and understand who's
writing that where that's coming from
what's their affiliation all good things
to know also who does the.dev I will
also say who does the.dev with Katie
McLaughlin and salty the sea outer who
is there in multiple places is still
very much a work in progress this is the
across project that Katie and I have
worked on together when we're doing
research to try to make more visible the
invisible work which comes and sustains
open source and if you have suggestions
and want to join us we love you
okay last part watch your ecosystems
again I can rant on this longer we can
talk about this more but this is a
complex interdimensional ecosystem uh
interdimensional yes there are many
different dimensions and how we are
thinking about this so when I think
about like complex ecosystems and
sources and sinkholes Things That Kill
open source projects and communities
things that enable open source project
communities I want to help and put more
food pellets into the system and less of
the poison pellets into the system that
are just like draining and causing
things to die so that for me is the like
enablement versus like things that kill
um so there are things in our control
there are things that are not in our
control but there are forces that are
impacting both of those and trying to
understand what is it that's enabling
and empowering what is it that's driving
things down stealing energy and time and
people that we care about and how we
enact change on those and it seems
really hard but I want to encourage you
not to give up hope
um in closing I hope that today as we
talk about all these things we can break
that mental model that Simplicity is a
if we could just solve this problem this
comic gets brought up all the time
because it's where people want to
emphasize if we can just solve this one
problem we can move forward in solving
all the problems
but I want to emphasize that we cannot
move forward effectively and sustainably
to address dependencies on our open
source dependencies until we break this
over reductionist model because in
reality this is closer to today's modern
open source digital infrastructure it
serves as a reminder that there are more
forces at work in the open source
dependency ecosystem than the implied
and under-resourced one person in a
remote area those people do exist and we
should look for them but we cannot we
cannot absolutely ignore the large-scale
forces at work with staggering amount of
global privileges resources and
Investments lots of money is being
thrown around about these problems is it
going to the right places does that
money have accountability how are they
making that information most visible how
are they making it transparent we cannot
forget that moving forward as we
continue to examine who has voice power
and access in these decisions will
impact us all and if we aren't going to
be the ones to ask for change for it
nobody else will
so in want to say thank you uh to Nikki
not only for your friendship and your
collaboration uh but for allowing me to
revise this talk with zero oversight
because I knew you were too busy anyways
um thank you Katie McLaughlin for
bringing our deer salt to the Seattle
and her many friends to the conference
to become everyone else's friend and for
not giving up on our cross and ocean
work even when it goes into maintenance
phase occasionally for months years
and thank you all pycon Australia
endlessly for allowing me to share time
with you even from many many miles away
thank you very much Amanda are you
available for questions or
yes if we have any remaining time and if
not then I can be on Discord time for
one quick question if uh if there's
anyone in the audience who wants one
okay I will get one in just to make sure
you're not left alone
um you have mentioned this is this is
obviously all the open source context
not all software is open source there's
also closed Source are these problems
unique to open source or a closed Source
just have them and we just can't see
their underwear in public
so I think that this problem is not
unique to open source we have obviously
seen uh every now and then some very
nice PR announcements come out from a
company about how they're making
strategic moves
um layoffs are continue to be ongoing
around the world in the tech industry
license change happens regulation
happens all of these other things are
still existing for the Mixed world that
is software technology in the modern
infrastructure and money moves in
different places so no this is not
unique the fun thing that we get
differently from open source is where we
get to see components of it but again I
think there's a lot of well we hope we
brought up in this talk is that there
are a lot of mental models that people
feel complacent in and failed to
recognize where the challenges and the
complexities lie
okay thank you very much Amanda everyone
please again another round of applause
for Amanda