Around the World in 80 Pull Requests: Open Source Through the Eyes of a Maintainer

Transcript

1. Marco Belladelli - marco@hibernate.org - https://github.com/mbellade Around the world in 80 Pull Requests
2. About Me Marco Belladelli • Software Developer @ IBM • Hibernate maintainer, ORM team • Quarkus and LangChain4j contributor • OSS Advocate • Commonhaus Foundation member This activity is not sponsored or approved by IBM. All those involved are voluntarily engaging in their individual capacities and not in their IBM roles.
3. Open Source
4. What does “open source” mean? Source code that anyone can see, modify, and distribute
5. Richard Stallman “Free as in Freedom”
6. • Freedom 0: Freedom to run the program • Freedom 1: Freedom to study and modify the program • Freedom 2: Freedom to redistribute copies of the program • Freedom 3: Freedom to distribute modi f ied copies of the program
7. L’esplosione • 1991: Linus Torvalds publishes the Linux Kernel with GPLv2 • 1993: Debian • 1995: Apache HTTP Server • 1996: MySQL Linux e gli anni ‘90
8. Mainstream • 1998: The term "open source" is coined • 2008: GitHub is born, o ff ering collaboration on a global scale • 2010s: Kubernetes, Docker, React, TensorFlow Open Source per tutti
9. Free Software != Open Source Same code, di ff erent philosophy
10. The Numbers Open Source usage 97% 100M+ developers, 420M+ repos
11. Hibernate
12. What is Hibernate? Object/Relational Mapping
13. Short story • 2001: Gavin King creates Hibernate (alternative to EJB2 entity beans) • 2006: JPA spec 1.0, Hibernate becomes the reference implementation • Oggi: Hibernate ORM 7, Search Reactive, Validator How the Hibernate family was born
14. ORM Validator 6.4k Stars 647 Contributors 1.3k Stars 106 Contributors
15. Open Source Foundations Commonhaus Foundation Apache Software Foundation Linux Foundation Cloud Native Computing Foundation
16. The bene f its of Open Source
17. For the project • Bug reports from millions of users (large-scale free QA) • Contributions from background and di ff erent use cases • Trust and transparency: "read the code" OSS Bene f its
18. For the ecosystem • Shared infrastructure, less duplication of e ff orts • Interoperability and standards • Linus' law: "with enough eyes, all bugs are super f icial" OSS Bene f its
19. For the developers • Low entry threshold: there is always a need for contributions • Building a portfolio, reputation • Career opportunities • Continuous learning OSS Bene f its
20. Contributing != Writing Code There are a thousand ways to get started • Bug reports • Forum, Stack Over f low, Chat • Guides, blog posts, tutorials • Mentoring and education • Documentation • Presentations • Testing pre-release
21. Show me the money
22. Who pays? The economics behind Open Source
23. Models with corporate backing • Open Core: Free base + paid enterprise functionality (GitLab, Elastic) • SaaS / hosted: Sell the service, not the code (MongoDB Atlas, Redis Cloud) • Supporto e consulenza: RedHat / IBM (Hibernate, JBoss EAP, Quarkus, Liberty) • Dual licensing: MySQL / MariaDB (Oracle), Qt
24. Kubernetes Google Meta React Hibernate
25. Community-backed models Open Collective GitHub Sponsors
26. Most maintainers don't earn anything from their project
27. https://xkcd.com/2347/
28. Number of maintainers of top 5% npm packages
29. The role of the maintainer It's not just code • Triaging issues • Documentation • Community management • Release engineering • CVE response • Backward compatibility • Often unpaid • Done in free time • -> Burnout
31. Jackson • “Marshalling”: JSON, XML, YAML, CBOR, Smile, Avro, CSV, Properties, ecc. • 25M+ monthly downloads • Websites, services, Android apps JSON for Java
32. (My) Life as a Maintainer
33. Day in the life Of a Hibernate Maintainer • PR from every time zone, every continent • Di ff erent languages, di ff erent cultures, di ff erent levels • The art of saying "no" with kindness and "yes" with attention • The human element
34. The joys
35. The hardships • PRs that do not follow the guidelines • Discussions with community members • "Fixes" that cause even more problems • Con f licts of code and opinion • Pretentious users (and customers) • The eternal list of things to do • The few resources available
36. The human side • True relationships that transcend national borders • Mentoring and learning • Responsibility for individual decisions • Work-life balance Behind a big project
37. The story of XZ Utils
38. XZ Utils • Compression library included in most Linux distributions • Maintained by a single person: Lasse Collin • Low tra ff ic repository, small community (~10 people on IRC) • OpenSSH dependency xz / liblzma https://tukaani.org/xz/
39. Social Engineering • Ott 2021: "Jia Tan" sends the f irst contribution (an .editorcon f ig f ile) • 2022: "community" begins to put pressure on Lasse Collin • Jia Tan positions himself as the reliable and available co- maintainer • Years of patient, constant, genuine contributions Building a relationship of trust
40. The backdoor • Feb 2024: 8 malicious commits • CVE-2024-3094, CVSS scre: 10.0 (max) • Hidden in binary f iles (tarball used in tests) • Objective: OpenSSH • The stakes: a universal key to enter all machines with SSH xz 5.6.0 e 5.6.1
41. https://www.youtube.com/watch?v=aoag03mSuXQ
42. The lesson Open Source needs us • Maintainers without adequate resources are not only impacted personally — they put everyone's safety at risk • The OpenSSF and the OpenJS Foundation warned: this may not be an isolated case • Similar social engineering attempts detected on JavaScript projects • This is the risk you run when the critical infrastructure depends on unpaid and unsupported work
43. The AI wave
44. The new reality • GitHub Copilot, ChatGPT, Claude, … • Lower threshold for "writing code" • Poor average quality • Total number of PRs is growing Of the OSS world
45. Maintainer Pressure • More reviews, often on low- quality code • Large amount of code, more di ff icult to understand • Missing feedback loop with human on the other side • Signal/noise ratio worsens The responsibility
46. AI is a tool that greatly ampli f ies our potential, for better or for worse
47. Positive side • AI can also help maintainers: triage, testing, documentation, review • Lower access barrier for new contributors • Powerful collaboration and learning tool Great power Great responsibility Open questions • Who is the real “author” of these contributions? • More e ff icient maintainers, or higher workload? • Will the quality of the code of large projects be guaranteed?
48. OSS from a maintainer’s POV
49. The general picture • Open Source is global collaboration • Based on trust, on the reliability of people • On which the whole world of software depends
50. What can we do • As users and companies: Financing the projects we depend on • As developers: starting to contribute • As maintainers: sustaining a rich and hospitable environment
51. Thank you! Questions? Marco Belladelli - marco@hibernate.org - https://github.com/mbellade