#241 – Tiffany Farriss on Drupal Funding, Community, and a Shared Journey With WordPress

[00:00:19] Nathan Wrigley: Welcome to the Jukebox Podcast from WP Tavern. My name is Nathan Wrigley.

Jukebox is a podcast which is dedicated to all things WordPress. The people, the events, the plugins, the blocks, the themes, and in this case, Drupal funding, community, and a shared journey with WordPress.

If you’d like to subscribe to the podcast, you can do that by searching for WP Tavern in your podcast player of choice, or by going to wptavern.com/feed/podcast, and you can copy that URL into most podcast players.

If you have a topic that you’d like us to feature on the podcast, I’m keen to hear from you and hopefully get you, or your idea, featured on the show. Head to wptavern.com/contact/jukebox, and use the form there.

So on the podcast today we have Tiffany Farriss. Tiffany has spent the last 30 years working in web design, development, and creation, and she’s been deeply embedded in the Drupal community for the past two decades. She’s currently the interim CEO of the Drupal Association and is the organization’s longest serving board member after Drupal’s founder Dries Buytaert.

This episode is a bit of a departure as we usually focus squarely on WordPress, but Tiffany brings a wealth of experience from the broader PHP family, and this conversation explores the similarities and differences between the WordPress and Drupal ecosystems, particularly when it comes to infrastructure and the sustainability of open source projects.

Tiffany explains the maker-taker problem, and the challenges of sustaining free software platforms that end up in millions of sites across the web. She shares her insights on the real costs behind open source stewardship, drawing from both data and experience, and discusses how tiny groups have shouldered the burden for everyone, and why that might no longer be viable.

The discussion explores the Drupal Certified Partner Program, the push towards quantifying contributions, and how the open source community can improve transparency and sustainability.

Tiffany also touches on the role of public sector procurement in shaping the future of open source, the impact of new regulations, and how community driven recognition could incentivize more organisations to buy their round of beers for the ecosystem.

If you’re interested in the sustainability of open source, the evolution of governance models, and how WordPress professionals can learn from the broader PHP landscape, this episode is for you.

If you’re interested in finding out more, you can find all of the links in the show notes by heading to wptavern.com/podcast, where you’ll find all the other episodes as well.

And so without further delay, I bring you Tiffany Farriss.

I am joined on the podcast by Tiffany Farriss. Hello, Tiffany.

[00:03:19] Tiffany Farriss: Hi Nathan.

[00:03:20] Nathan Wrigley: Thank you for joining us. So this is a little bit of a departure. Usually we talk about WordPress. It’s WordPress on the menu every single day of the week. And that is going to be the case, I suspect a little bit today. But there’s also going to be a foray into Drupal because Tiffany is very much connected with the Drupal community.

So Tiffany, really just to get this podcast started, can I just offer you a chance to give us your little bio, tell us who you are and what you do over on the Drupal side, lo these many years. It’s been multiple decades that you’ve been involved in various different ways I think.

[00:03:52] Tiffany Farriss: It has been. Yeah. Thank you Nathan. I’m really glad to be here. I do consider all of us part of the PHP family, whether we’re Drupal or WordPress or Joomla or TYPO3, like I think we all have so much in common.

But I am Tiffany Farriss. I’m currently the interim CEO over at the Drupal Association. I have been involved in web design, development, creation for the last 30 years. And I’ve been heavily involved in the Drupal community for the last 20.

In particular in its governance. I’m the longest tenured board member of the Drupal Association, the 501 (c) (3) that is responsible for the governance. Other than Dries Buytaert, who is the founder of the Drupal Project.

So I’ve been around a long time and I’m currently on leave from my own company, palantir.net to take a year to help Drupal kind of navigate this time of kind of intense disruption, I think it is for all of us. Pretty safe to say, that we are all experiencing the same disruptions from AI. And then just economic pressure in general.

[00:04:50] Nathan Wrigley: So Drupal, I suppose, it would be a good thing to say at this point, Drupal is very similar in its project, in its status, in its goals, in its aims, in its infrastructure and technology to the CMS that most people listening to this are familiar with. It’s a PHP based CMS used by millions of websites all over the world. So broadly it’s the same.

Now you mentioned the foundation. Would you just be able to dig into that a little bit more because that may be confusing for people on this side. There may be some significant differences there. What does the foundation get itself involved with? I know that you described that a little bit there, but if you could go into a bit more depth, that would be great.

[00:05:26] Tiffany Farriss: I do think our governance is one of the places where WordPress and Drupal are a little bit different. In Drupal, we have the Drupal Association, which is an independent 501 (c) (3), which is a US-based not-for-profit. And we have specifically an educational and scientific mission that we’re authorised to do.

We run Drupal.org. We run all of the infrastructure. We support all the security coordination. And we are responsible for Drupal Cons around the world. We do have a founder as well, right, Dries, and he is currently the Executive Chairman of Acquia. But Acquia doesn’t have the same single privileged actor role, that say Automattic does in the WordPress community.

Dries serves on the board, but he doesn’t control the board and he doesn’t control any of the technical steering committees, although he is still the founder and the lead of the project.

[00:06:17] Nathan Wrigley: Okay. So there is a significant difference there, isn’t there? That’s kind of interesting.

[00:06:20] Tiffany Farriss: Yeah.

[00:06:20] Nathan Wrigley: Okay, we’ll dig into that in a moment. However, in the preparation for this podcast episode, Tiffany was very kind to send me three things.

One of them was a YouTube video. It runs to about 20 minutes and sort of summarises what we’re going to talk about, I think, fairly well.

Another one was a blog post that you wrote in June of this year. It’s called Freedom is Not Free, A model for Open Source Sustainability. Again, very much aligned to what we’re going to talk about. That’s on palantir.net, which I’m at pains to point out is not the palantir that you are probably thinking about when you say the word palantir. And there’s another one which again, tackles the same subject, written broadly the same time. It was July this year, written by Dries, the founder of Drupal.

And what we’re trying to deal with here is, what I think Dries has summed up in the past is this maker, taker problem. And it’s very difficult to summarise. I must confess, I genuinely cannot articulate this problem. No matter how many times I’ve tried to articulate it to friends, to colleagues, to relations. At some point I get lost. At some point, the dynamics of it and the argument of it kind of boils boils down to it’s a moral thing.

So I’m just wondering, could you paint the picture of what you were trying to say in that YouTube video and in your blog post. What is the open source sustainability problem that you think, amongst many others, we have at the moment?

[00:07:47] Tiffany Farriss: We like to talk in open source about free and the four freedoms, especially for projects that are based in the GPL, right? But one of those freedoms, I think it comes down to the idea of the word free, right? There’s free is in speech. Where I am free to say what I want and when I want, and accept the consequences of that.

But then there’s also this idea of free as in beer. And the reality is that the beer was never free. And the problem we have in open source is that for the last 25 years of Drupal, a really small group has been buying the rounds of beer for an entire ecosystem. And what I’m saying is that, beer has never been free. You just haven’t been taking your turn at buying the round, right?

So as we deal with kind of the pressures of the current economic situation, the uncertainty and opportunities created by AI, the number of people who are still buying those rounds is dwindling. But there’s still a lot of people who want to drink that free beer. There’s still a tonne of people who use WordPress, a tonne of people who use Drupal and get a lot of value out of it, right? They’re enjoying that.

But what the problem is, is that we have this open source licence, and the licence is what conveys the freedom, right? It makes the code available. And in open source the more people who use the code, the cost of that code goes to zero. And no one’s use of the code is diminished by someone else also using that code.

However, there’s more to being an open source project than just the code. And this is where the concept of stewardship comes in. Stewardship is what makes it dependable. It’s what has made it so that millions of people around the world can feel confident in downloading the software, using the software, hiring someone to create a WordPress or a Drupal implementation for you.

And that stewardship includes things like code hosting, or packaging. Testing frameworks. The security coordination. All of those things, which as more people use it become more expensive, not less.

So, there are these tensions around people who are getting value from open source software, but who currently don’t help pay for the cost that they impose on the project, largely because it’s invisible, right? So I think the first step is that we need to make those costs much more visible. So that’s something I’ve been working on in Drupal for a while. And so I want to expose it, right?

We have 2,800 organisations in the last year who contributed into Drupal, but under 5% of them did two thirds of it, right? There are, I think as in WordPress, you know who really is driving and doing the work. And we do too, right? Obviously in Drupal we know who that is. And because we know who they are, and we know that they’re invested, and that they are passionate about open source and our project. They’re the ones who are easy to ask for financial contributions, or sponsorship to Drupal Con.

So you keep going back to the same pool. And in Drupal’s case, that means that 94% of our financial contribution comes from this tiny group of 5%. So they’re buying the rounds of beer for everyone. And that’s not a sustainable proposition.

[00:11:00] Nathan Wrigley: Do you think, I’m going to rewind the clock a little bit. So, I regard the internet as an ongoing experiment. Where we are now is definitely not where it’s going to end up. And where we were 10 years ago, I don’t know that anybody would’ve predicted that we’d end up where we are today. You know, the internet came around and it evolved in the way that it did.

Do you see in the last, let’s say 25 years that many people have had access to the internet. Can you see moments where, and I’m doing air quotes, mistakes were made, which led to this problem? Or was it just happenstance and serendipity? We just got to this point? There’s no real pointing of a finger. There’s nobody to blame. There’s nobody to say, okay, you made dreadful mistakes. It’s just the way it evolved. There’s no question there, but do you understand what I’m saying?

[00:11:49] Tiffany Farriss: I do.

[00:11:50] Nathan Wrigley: With the benefit of hindsight, can you look back and point the finger, or is it more a case of okay, let’s just deal with the reality of where we’re at now.

[00:11:56] Tiffany Farriss: I can point to that moment. I was on the board at the time when Drupal moved over to Composer, right, and to modern packaging. And what I can tell you is that the board was never, wasn’t a big deal, right? They came to the board and I don’t even think we were really notified that this was happening or what it would mean.

And nobody modelled that packaging costs scaled to infinity, the more people who use it, right? There was no financial model put around it. We became a utility as opposed to just a repository. And I think that’s the moment for us that really changed things. You can continue to run events, Drupal Cons and Drupal Camps and all of that stuff. Those have pretty known economic models, and you can continue to run a website that promotes things. And you probably could even continue to be a collaboration platform.

But once you start to become a packaging utility, then you become part of everyone’s infrastructure. And if you start to provide that for free, and people will expect it to continue to be free. And so I’m, really it’s only in the last couple of years that I’ve started to look into those costs. And for Drupal, we provide the Drupal Association itself provides $10 in services to every site, every year, every modern Drupal site every year.

[00:13:16] Nathan Wrigley: Oh, that’s an interesting stat.

[00:13:17] Tiffany Farriss: It is.

[00:13:18] Nathan Wrigley: You’ve figured that out, you’ve done the maths and it costs $10 for every Drupal site that exists, whether or not they pay anything? That’s such an interesting number.

[00:13:26] Tiffany Farriss: Isn’t But I actually only take in $7.50. So I’ve been pushing forward in technical debt things for years. And that’s a risk, right? That’s a risk for me. And it’s also just unpleasant. I think that if we all start to become a little clearer around what the costs are as a utility, it’s actually not a lot.

When it goes unpaid, it does have a cost, a compounding cost. And in Drupal’s history, what we used to say was if you want to support the project, support the conference. We all learned, obviously, during the pandemic that having an economic model based around a conference wasn’t the best choice.

I still think our ability to get together in person as a community is incredibly valuable, but I don’t see it as the way that we make the money to support the infrastructure. I really don’t like this idea that our revenues, and our expenses are so decoupled like that. And I think that’s really charity thinking.

And part of what I’m working to do is to evolve it into utility thinking? For a couple of reasons, right? One, it’s, not a charity. We are providing a service that people build businesses on, and they expect it to be there. But then also, especially in the case of Drupal, we have such a huge footprint in public sector work, and very large enterprise level government sites. And institutional sites, things that people need to have enterprise level expectations of. And they do, they hit our infrastructure every 15 minutes, right?

Procurement has no way to pay either a community or a charity. However, they can pay for their costs if you can explain it to them in a cost recovery model that this is your share. And I want to be clear, as I talk about what the Drupal Association provides, that leaves aside the volunteer labor for what I like to consider the operational roles that also exist as a part of stewarded open source. Which are the release management, the security team, all of that work that we’re all so very hyper aware of after last week, that also has a cost.

So beyond the $10 that the Drupal Association is providing, there’s $30 provided just by the community as a keep the lights on sort of level. If we had to boil it down to its essence. Beyond what it takes to scratch your own itch, right?

We all know that open source succeeds because I needed to write a module for this, I want to extend that. There are operational roles that aren’t actually in someone’s self-interest to perform, or to underwrite, if you’re an organisation. And so quantifying it has been something I’ve been working on for the last couple of months. And so we’re working now with this $40 a year figure around the services that are provided in addition to the code, that we don’t have to, right? The licence says it’s used as is, but nobody actually does that.

[00:16:08] Nathan Wrigley: No. Okay. That’s an interesting thought. I’m just going to pivot ever so slightly and just talk about the community that you’ve got. I imagine it maps broadly to the community that we’ve got. Do you find having these conversations is challenging? Let’s go with that word. Because over on the WordPress side, is a reluctance for many people in the community to bring money into the conversation at all. You know, it is just almost a taboo in many senses.

And obviously you are pioneering this, the word dollar comes out a lot. You know, you’re actually putting specific numbers out there quite a lot. What’s the pushback like over there? Are there two camps? It’s like the “we’re never going to do this, is crazy,” and the acceptance? Or is there some sort of homogenous bit in the middle where people are starting to realise, okay, Tiffany’s making sense, this adds up. This is what we need to do in 2027, 2028.

Basically, how’s it going? How much pushback are you getting from your community?

[00:17:02] Tiffany Farriss: I think Drupal is a little bit different than WordPress because we don’t have a paid plugin economy. All modules are GPL’d and they’re free. So anyone who is working on Drupal has no direct way to monetize it. And I think that has made this conversation, this recognition a little bit clearer, right?

Our entire economic base of support has been from a lot of the agencies. That’s the segment of our entire ecosystem that’s under the most pressure right now, and so if I say to them, I think we need to stop asking so much of you and we need to start asking more of the others in the ecosystem. It’s been a little bit of a recognition, like yeah, maybe that’s true.

Our ecosystem, our agency ecosystem, they give well beyond what they take from Drupal. And so I think for me, quantifying what just the general site takes from Drupal, has made it really sharp and clear that this isn’t a huge ask. And maybe the labor costs, maybe the infrastructure costs. It is time for us to be able to mature, and to recognise that more people need to be involved in supporting that.

[00:18:09] Nathan Wrigley: I know that you are not involved in the WordPress space in the same way that you are with Drupal, but I’m just wondering if, from what you’ve just said, it sounds a little bit like you have more of a bat-phone into the people who need to be on side. In the WordPress space, I feel like there may be more people who, I don’t know, they own a plugin business, and they make money in that way, but they might contribute nothing back to the community.

There’s people who turn up to events, there’s people who own hosting companies. They’re all spread out in different ways, and earning money in different ways. And so when messaging about, I guess our equivalent would be called Five For The Future, it’s very hard to know where to put that messaging, because you can’t really sum up where these people all are. They’re all over the place and there’s no one place where they gather.

But it sounds a little bit like, and I said bat phone, I hope you knew what I meant by that. It sounds like you have a line of communication which is much more easy to tap perhaps than we do on the WordPress side. If I’ve misunderstood that, please say.

[00:19:10] Tiffany Farriss: I think I do feel like we have a lot of engagement from a lot of the organisations. One of the major changes that Dries put in place back in 2014, was our contribution system. And so we know, it’s public, who is contributing to Drupal, and that’s not unique to us.

But I think the innovation is that every commit has the opportunity for an organisation as well as a sponsor. So when work is done in Drupal, we do have a lot of telemetry around who’s doing that work. So I think that’s given us insight into where some pieces of the value have been experienced over the last 25 years.

And so we’re able to recognise that. But I do think we over index on those agencies who are involved. And so have a lot of, currently we have a Drupal Certified Partner Program, where a lot of those agencies participate. And they know that they’re supporting and underwriting the infrastructure and they take a lot of pride in that.

I think the difficulty is that one, we’re not a 501 (c) (6), we’re not a trade association. So I can’t deliver benefits specifically back to that group. You know, I can’t go out and say to procurement agents, “hey, you really should drive business to these folks. These are the ones who are actually supporting and working on Drupal,” because it feels like a pay to play. And in our case, there is some payment there, but it’s really you can’t become a Drupal Certified Partner without having made the maker contributions, you know?

[00:20:32] Nathan Wrigley: Oh, so there is a sort of quid pro quo there. If you contribute, I don’t know what the specifics are there, but if you manage to get over whatever the hurdle is, you can then access something. What is the something there that you can access? Sorry, I interrupted.

[00:20:48] Tiffany Farriss: Nothing. There’s nothing you can access, right? I mean, we recognise our makers on our website as Drupal Certified Partners.

But I do think that because it’s just a wall of logos, and it isn’t actually an attestation, it’s a lot of marketing copy, right? It becomes hard for procurement to put any credibility in it. And so this is actually the big innovation that I’m working on involving the Drupal Certified Partner Program, which is largely built around those agencies into a Drupal Certification Program that encompasses our entire ecosystem and essentially sets the standard.

[00:21:21] Nathan Wrigley: Tell us a little bit more about the things that you are doing there then. Because that sounds really intriguing.

[00:21:25] Tiffany Farriss: Yeah, I think that what I recognised is that as a 501 (c) (3), one of the things I can do is I can recognise those who are being good citizens. Now we have to come up with what that standard is. And I think in open source, it’s something that you know, but maybe hasn’t been articulated.

And part of that process has been to recognise that there are three pillars of contribution that are all essential for Drupal to be successful.

First is making, those who are actually contributing code, or code adjacent activities to Drupal.

Patronage, right? Those who are actually funding the infrastructure. Funding the core release managers, the core maintainers, the security maintainers.

And then there’s also advocacy. Helping the world to understand what Drupal is and what it does, and to create the documentation, and to go out to events, and to help others learn to use it.

So those are the three pillars of success. And so what we’re doing is we’re taking that idea of the contribution credit that we’ve had for a long time, which has always recognised more than just code contributions, and explicitly breaking it into these three areas.

And then our Drupal Certified Partner Program has been about agencies. So the eligibility requirements for who we recognise were based around what agencies already were doing. And what we’re evolving that into is different kinds of certification for all the parts of our ecosystem.

So we have platforms that are specifically Drupal tuned. Our platforms as a service partners. We have shared hosts. There are cloud hosts. There are infrastructure CDNs. There are end users. There are individuals. And so that entire spectrum of who’s participating, and getting value and benefit from Drupal, I want to create the opportunity for them to become Drupal certified.

And what that means is that Drupal certification is a badge of recognition of those who are engaging with Drupal in a net neutral, or net positive way. That they’re giving back at least what they are taking from the community, or more.

I think we start to move from something that is more like a sponsored badge wall, into a public trust register, which I think is, very helpful. And I, currently on Drupal.org, you can look up any individual, or any organisation, and you can see how they contribute. But unless you’re super in the weeds, it doesn’t mean much to you.

So I think that the lever here is around procurement, and around making this a trust ledger, something that can’t be bought. But something that is understandable to a procurement officer to say, who is contributing to Drupal? What are they contributing to Drupal, so that they can make decisions. Especially if they have two different potential vendors. One who contributes and one who doesn’t.

I think this is all a conversation we can now have because of the way that Europe is leading the way with their open source strategy. You know, that they want there to be more open source used in the services that they provide. From a digital sovereignty perspective, it’s essential for them.

[00:24:18] Nathan Wrigley: Let me see if I’ve understood that correctly. So on one level, I’m just going to use the word Brussels. I hope that everybody understands what I mean when I say Brussels.

[00:24:25] Tiffany Farriss: Yeah.

[00:24:26] Nathan Wrigley: So, Brussels encapsulates the EU, the governance of the EU. Because of the posture that Brussels takes. It could, coerce is the wrong word, but let’s go with that. It could apply a certain degree of pressure to big procurement initiatives to say, look, I don’t know, we need a new website for the French Health Service or whatever. And Drupal is right in there, and we’re looking for organisations that can help us to build that Drupal infrastructure.

Given that’s the case, we are now going to go to this extra layer of what do these agencies that are competing for this contract, what is their position vis-a-vis Drupal? And if it looks good, in that you’ve contributed in the past and you have all the accreditation and what have you, you will more likely have a favourable outcome in that procurement procedure. Did I sum that up right or have I completely misunderstood?

[00:25:22] Tiffany Farriss: No, I think that’s a part of it, right? I think that Brussels has already recognised that it’s in their interests to use open source products, right, open source solutions, and has for a while. But I think procurement’s the real lever where we start to enshrine or encourage bad behaviour, right? What we were calling extractive use of open source.

So if you think of open source as just lumber that you can take and use however you want, right? If nobody is replanting the trees, cutting it down, sawing the boards, then it doesn’t exist anymore, right?

And also on the government side, when we talk about public money, public code. It’s important that you actually get the benefits of it. So it wasn’t just a starter kit that you take and then you own, right? We know that good use of open source, whether it is WordPress or Drupal or TYPO3, right? You want to minimise the amount of code that you own. That’s the advantage. That’s how we all experience the network effects.

So you need to have some behaviours, and I think that procurement officers don’t care, don’t need to know, about what open source is or our specific projects. But what they need to know is that when they are procuring any project, or any solution, that has open source as a component of it. That open source isn’t going to end up being code that they own down the road. They have the right to use it, extend it forever, and they know that somebody can’t turn it off on them, which is I think a very important.

[00:26:48] Nathan Wrigley: Oh, big thing at the minute.

[00:26:49] Tiffany Farriss: Big thing right now, especially in light of the 2018 USA Cloud Act, right? So that’s really been the driving impetus around digital sovereignty. But when we think about good open source use, responsible open source use, there are some behaviours that regardless of project we know are true.

And it is that when you write a new plugin or module, you release it, right? So others can use it so that you’re sharing the maintenance burden moving forward. If you don’t, then you own that and you’re going to maintain those lines of code yourself.

Two, if you patch something, you want to release that patch upstream because otherwise you may have ended up inadvertently forking it. Or in some cases the government pays for the same patch over and over and over again, right? If there are economic benefit to using open source, you need to know that whatever vendor you’re using is contributing the patches back upstream so that you continue to stay, anything that’s non-confidential, obviously, but so that you can stay current and up to date, right? Woe for those who were not current and up to date last week with PHP, right? It made that problem all the more difficult.

So when I think about making it open source use at the government level very sustainable, there’s really three policies I think that they need to implement to help really get the benefits of open source, right?

One is that the patches are contributed upstream if they’re non-confidential within 30 days.

Two, I think that they need to understand that there is a cost to their use. And so creating whether it’s 2% or 5%, creating a line item in every project that uses open source of any flavour, for the delivery of the project, that there is a standard percentage that is contributed back upstream to that open source project, to offset that use. Because right now, the agencies and the companies that are responsible open source users, they bear their contributions and their participation in open source as a tax. So it becomes baked into their hourly rates. Which then as economic conditions get constrained, it becomes a disadvantage to do the right thing for open source.

So I’m very worried about that. But if it is instead a flat line item that all who are responding to a tender have to meet, then the virtuous behaviour that continues the virtuous cycle of open source isn’t a burden on any one firm.

And then the third piece is you want to know, are they a contributor to that open source project? And so this speaks right to Dries’ maker taker dilemma, which I’ve extended to the maker taker faker dilemma. Which is obviously, I think makers and takers are pretty clear, right? You either are someone who’s making and contributing into your open source project. And takers being the ones who are like, thanks for the wood little elves who magically made it in the woods. Great. This is all good. Good luck with that forest.

I think that the fakers are, in some ways, much more dangerous, because they have this, it’s like open source washing. The fakers are the ones who maybe sponsored a coffee one time at an event, but they’re not really giving things back. So they’ve got a badge. Procurement, they can say, oh look, I’m a sponsor.

I appreciate anyone who sponsors at any level. But I think that when you’re talking about competing on a public procurement, there is a very important difference between someone who maintains modules, contributes to the security team, and someone who sponsors a coffee. And I think that it’s on us as open source projects to make that clearer.

So the Drupal certification is our attempt to really become a very trusted public ledger about who’s contributing what, and why it matters to folks who aren’t in our community. I think today, where we stand and where we’re starting, it is a very transparent ledger. But there’s a difference between transparency and clarity. And I think if we want Brussels, and other governments and procurement, officers to be able to differentiate and give a preference to those who are good open source citizens, if you will, those who are actually involved in the projects that they’re using and implementing, for these very important public projects, I think it’s on us to make that easier. So that’s something I’ll be focused on next year.

[00:31:02] Nathan Wrigley: It sounds to me like you could kind of sum this up in the word clarity. Everybody needs clarity. Those people who are procuring things need to be clear on what they’re going to get. Those people who are delivering things need to be clear on what they’re going to do. And the notoriety, for want of a better word that they’re going to get from that.

It also seems like you are in a very interesting role, where you are like this go-between between all the people doing the work on Drupal, and the people who are procuring, and I’m sure that’s really fascinating work. Like what is the proclivity of, let’s say for example, USA or Canada. What are the requirements that they have around, I don’t know, 20% of all public software needs to be open source or something like that. That must be utterly fascinating work. You’re right at the chalk face of all this. Wow, that’s so interesting.

[00:31:52] Tiffany Farriss: It’s absolute candy to my brain. Like I just, I can’t tell you how much I really am enjoying being part of those conversations. And I never would’ve thought that I would’ve been invited to speak at a plenary at the United Nations, and yet I was. And that blog post that you mentioned, that’s on palantir.net, actually those are remarks I gave to the German Consulate, in New York, right?

It all comes from this conversation we’re all just starting to have about what does it mean to sustainably and responsibly use open source as we look ahead to the next 25 years, next a hundred years.

There was a board member I had served with in Drupal a long time ago, Donna Benjamin, and this was, I don’t know, maybe almost 20 years ago now. And she always used to say, what’s our a hundred year plan? And at the time, I was taken back. I’m like, uh, I can’t even with that.

And now as we fast forward to where we are today, I actually can start to see that. And it’s about understanding that nobody intends and sets out to be a taker, right? You can’t pay for things that you don’t know are there, or things you don’t know are already happening. And you can’t meet expectations that aren’t communicated.

So this is the opportunity for open source projects to say, this is what it takes for us today. This is what it takes for us where we want to go. And here’s your share of it. How do we make it easy, and expected that everyone does a little, so we’re not resting on a few who have to do a lot?

[00:33:22] Nathan Wrigley: This is going to sound like a really poor summation of it, but it feels like open source, up until this point, you know, the analogy, carrot and stick, you know.

[00:33:30] Tiffany Farriss: Yes.

[00:33:30] Nathan Wrigley: So the carrot is, we hope that you’ll come along and, you know, follow the lead and do all of the right things. Where a stick is more, if you don’t do the right thing, there’ll be a punishment for that. It feels like open source for the last 20, 25 years, there’s been more carrot than stick. And although it’s incorrect to summarise this as stick, is there a little bit of stick here? Are we trying to cast a, let’s say, a glowing light on those that do everything well, who are the makers? You know, we want to raise your profile, shout from the rooftops that you did things well.

Conversely, is there a bit of okay, those that don’t, we are going to shame. Or is it more a case of we just leave you alone? You just don’t get a mention. You don’t get to be part of the community in quite the same way.

[00:34:15] Tiffany Farriss: Coming back to that frame as open source stewardship as a utility. Nobody considers it a donation to their electric company. They pay the bill because the lights matter. And I think it’s about resetting this frame. We’ve never sent utility bills to people. We’ve never even exposed what that looks like, or maybe we don’t know ourselves. Based on projects, Drupal certainly didn’t until I started this work.

So I think that there’s this expectation that we’re going to continue as we always have on this balance of goodwill and volunteerism. But as last week showed, PHP Foundation, which WordPress is very involved in, Drupal as well, has one full-time employee. And 70% of the web runs on it. So it’s something that we have taken for granted for too long. And I think that this moment is brokered by the blessing and the curse that is AI.

[00:35:07] Nathan Wrigley: I wonder if the wider issue at stake really is notifying the general public. Letting all of humanity know that when you are picking up your phone and using that app, and it’s connecting with that service over here to enable you to, I don’t know, book a restaurant or get a taxi. There’s probably some layer of free software around there.

And would you do anything for free? Is that, I’m not asking you that question by the way. I’m just saying, you know, dear app user, would you do things for free in the same way that you’re expecting this software to be free?

And I think that argument’s fairly persuasive, but it’s not something that has leaked out into the public. You know, the coverage of the PHP thing, nobody knew. The guy that came on the BBC, who was the BBC correspondent, he’d never heard of PHP. And he’s the cybersecurity correspondent for the BBC had never heard of PHP.

And so getting it out into the vernacular, getting it out into the mainstream, that all of this stuff that you’ve taken for granted, we all need to pay a little bit. I wonder if that’s an interesting. It’s like the stick that I was talking about earlier. If the public are more aware whether they will be able to pressure things a little bit more. I don’t know. I’m not sure there’s any mileage in that, in all honesty, but it’d be an interesting experiment to run.

[00:36:20] Tiffany Farriss: I think we’re about to see that experiment, right? So the Cyber Resilience Act in Europe is requiring SBOMs, which are Service Bill Of Materials to be disclosed. And I think that once SBOMs are readily available, it may become clearer, at least to decision makers, exactly how much open source software is in the solutions that you’re providing. And I really am curious to see how it evolves when you do have these manufacturers or organisations, whether they’re service organisations or actual manufacturers, starting to become liable for the risks in your security chain.

[00:36:56] Nathan Wrigley: Right.

[00:36:56] Tiffany Farriss: As I look at this, I look at it as a supply chain issue. And so we’ve now exposed that there are weaknesses in our supply chain. So the argument isn’t, it’s really less of a shaming. It’s saying hey, this is a risk management approach. And I was looking at it as a design flaw. That open source was an idea around writing software. It wasn’t actually envisioned at any time that this was going to run the world. It was just, this is a good idea to do good way to do things. Let’s try it.

But now that we understand that open source does run everything, we need to come back and treat this as a design problem and say, how do we align the incentives? What needs to be true?

I appreciate the work that’s going on in Europe right now, and I think that becomes a bit of the stick. It’s not coming from us. It’s saying, actually if you sell a product that’s based on open source, and that open source has a security issue, you are liable. You’re the manufacturer. See, as an open source steward, the Drupal Association does not have liability. We have responsibilities to disclose, which we have done, all the way back through 2007.

Drupal is a CNA, right? We’re a numbering authority for CVEs. We’ve had a very mature security practise for many years, and we will continue to do so, and meet our CRA disclosure requirements. But those who have blindly been using open source in products or in services for others, they’re now manufacturers. And come December of next year, they’re really going to start to understand how liable they’ve become for any issues in the supply chain.

[00:38:34] Nathan Wrigley: There’s something quite virtuous about that. In that it’s allowing the open source posture to carry on in the same way that it always has. Shifting the responsibility over to the governments in a way. You know, that they’ll create the legislation, which means that if you fall foul of this, that and the other thing, you will now be responsible. And if you are responsible, it’s it’s the same reason we have car insurance and buildings insurance. You need to know what your position is going to be in the event of a fire or a crash. You just have to know it. Because if your business were to go under because you weren’t thinking about those things, that would just be negligence. And so that’s such an interesting way of framing it. I like that a lot.

I also like your definition there. You described the internet over, you know, the last 20 years and how nobody knew that it was going to work this way, and now here we are. And, I guess it would be a bit like, I don’t know, going to a lemonade stand or something like that and getting a really cheap lemonade from a child who’d done it because it was a nice thing to do for the community. Let’s sell cheap lemonade.

But then turning up with 12,000 people and saying, we would like 12,000 cheap lemonades, please. Immediately. No, that’s not available. That’s not the way it was designed. And that feels to have certain overlaps here.

Nobody knew that open source was going to take over the world. Now it has. It’s chronically underfunded. There will be a collapse at some point if companies and businesses are allowed to just have a taker mentality. So you are putting things in place to make sure that is checked. And I think that’s really interesting.

[00:40:06] Tiffany Farriss: It goes from this idea that we passively consume whatever we get. Whether it’s a website or a phone. To this idea of having some sort of active upstream strategy. And again, I don’t think that many of us had the opportunity to understand what software was running on our phone. You didn’t know, right? You can’t mitigate a risk that you don’t know is there. I do think it is unreasonable to think that we don’t know the risk is there now, especially after last week.

[00:40:33] Nathan Wrigley: There’s just no bit of me which would walk into a store and pick things up and just wander out and say. There it is. I’m going to have it because it’s there for me to take. And yet, broadly speaking, I think it’s fair to say that the vast majority of the people in the world consuming things on the internet have exactly that position.

You switch on the device, the device itself is probably working on, in many cases, open source software. And then I’m just going to consume all the things that are there, you know, it’s all free. You know, it might not be free, it might be sponsored by advertising or what have you know, we all have opinions on that.

But we have got ourselves into this position where we completely pick up the devices and think, all free, from top to bottom, free. And we need to change that mentality. So, going back to what I said earlier, getting the message out to the population at large, I don’t know how you do that.

[00:41:25] Tiffany Farriss: I’m a big believer in what Buckminster Fuller called the trim tabs, right? I don’t set out to turn the ship. I turn the little piece, the trim tab that turns the rudder, and that turns the ship. And I think that whether we’re talking about compliance, or we’re talking about OSBOs, and helping compliance within organisations, I think that’s how we turn the ship, right?

We need to create an economic model that really does protect the supply chain. This is a consumer problem. It is a consumer risk. And I think that’s exactly what many governments were set up to deal with.

And so I think they do have the opportunity that the governments, whether it’s the EU or the US or the Canadian government, they spend so much money. And if they change the way that they spend money, and they change the way that they look at open source and how they understand it. And to be a responsible open source consumer, who’s asking for, are we giving back? Are we minimising our footprint? Are we restoring services that we use? Are we treating it like the utility that it is? That alone makes such a huge difference, such a huge difference.

And helps us to move away from this idea of licence only open source economics. Which is essentially that idea that I’m just going to take it because the cost of code go to zero over time, right? That’s not it alone, right?

We expect that when someone finds an issue, especially an issue that can cause remote execution, right? That they’re going to tell us about it. That they’re going to fix it. And that we’re going to be able to have access to that fix. And that’s where we move beyond this idea that the licence itself is free, and it will be free forever.

Those services that is about the human capital, and the human technology that make those things possible. And they are not free, they have never been free. You just haven’t known who was picking up the bill on your behalf.

[00:43:17] Nathan Wrigley: What kind of timeframe? This is going to be my last question by the way. What kind of timeframe do you put on this. How far into the future are you gazing? I’m guessing the answer is it’ll never be complete, this work. But how far into the future are you hoping to get so that you can look in the rear view mirror and say, yeah, we’ve achieved most of what we wanted to do there.

[00:43:37] Tiffany Farriss: Because we’re kind of on forefront here in having these conversations, and we’re certainly not alone. Every one of the open source foundations is having some version of this conversation, or some approach that they’re trying, to make sure that they have the base of support that is commensurate to the folks that they serve, right?

I really am approaching this as a pilot for the next six months, and seeing can we, as we broaden and understand different segments of our ecosystem, and the ways in which they can contribute that align with their interests, right? I’m always looking for the triple win. The win for Drupal. The win for the end agency. And the win for the public, right? Because I am a public facing charity, right? I want all of those things to be true.

And I’ll be experimenting and having conversations with infrastructure providers, with our shared hosting platforms, with cloud providers to say, okay, what does it make sense for you to contribute? What does it mean for you to be a good Drupal citizen, and to give back in a way that feels appropriate to the amount of value that you’re generating from this?

I don’t think that any system can be designed where it requires a hundred percent good behaviour, or a hundred percent participation. It’s going to be a process of iteration and learning as fast as I can. Making sure that we’re being transparent about it, and approaching it from this cost expensing perspective. I’m not looking to maximise profit or other things. I’m a not-for-profit, and I care about resources, and money, and attention going to Drupal. If it comes to the DA, through the DA or directly into the Drupal community, all of those states are a win.

So it creates a great table for conversations with different kinds of players and providers who haven’t engaged. But at least now I can go to them and say, hey, this is what you’re already consuming from our ecosystem. And here’s a pretty good back a napkin for what I think you’re making from it. If we didn’t exist, what would you do? How would you do the security pieces? How would you do the packaging pieces?

And it’s okay if one of the answers in those conversations is, oh, wow, I didn’t realise we were using so much. We can dial that back. That’s perfectly valid. I want to make sure that open source and that Drupal is there for whoever wants it in as secure and as innovative a way as possible.

And so whether you reduce how often you ping my packaging server or you are like, yes, I need this, this is part of my critical infrastructure, and you fund it as if it is a utility part of your infrastructure. Both of those are valid answers to me.

[00:46:03] Nathan Wrigley: There’s so many people in the WordPress space who will resonate with everything that you are doing here. I said I was going to ask no more questions. I have one more. Do you have lines of communication open with, for example, WordPress and maybe PHP? Are you doing this very much in isolation, even though there may be overlaps? Do you have that? Would you welcome that? Would you like to have introductions to people? And if so how can people communicate that to you?

[00:46:29] Tiffany Farriss: I’m always happy to talk to everyone. I will say Drupal and Joomla, WordPress and TYPO3, we have the Open Web Alliance, and so we do talk every month. And we’ve just invited PHP to be a part of that obviously. I have Slack access to all of those folks and we do talk regularly.

In addition, there’s just a broader open source community of leaders. There was the Open Source Congress, that happened in September. I really appreciate being able to talk to my colleagues whether it’s RubyCon for the Apache Foundation, which actually put on this year’s Open Source Congress and did a fantastic job. All of us being able to talk together.

I can say to the CEO of Python, I can say, oh you know, hey what lawyer are you using right now? Or what software did you use for your community elections? I’m looking for some new ones, right? And they have tonnes of ideas and then I’m able to say, oh, here’s how we are doing this, or here’s how we’re doing that. And I just think that level of collaboration and conversation, has been incredible. Right. Rust Foundation, UN Open Source Week and the EU Open Source Week, and Open Source Congress. Those conversations among colleagues have been fantastic.

Any new colleagues I’m happy to talk to as well. You can reach me on many different Slacks, whether it’s the Open Source Congress Slack, or the Alpha Omega Project for Drupal. I’m in Drupal Slack. You can reach me in all of those places, is @Farriss. That’s FARRISS.

[00:47:51] Nathan Wrigley: Nice. Thank you so much. It really is fascinating work. I would really be genuinely curious to watch what you are doing over the the next six months. Where you end up. How the project is received at both ends.

[00:48:04] Tiffany Farriss: Me too.

[00:48:04] Nathan Wrigley: To see what the pushback is like. I would really love to keep a track of what’s going on. But for now, best of luck. I hope that it all pans out in the way you’re anticipating. So, Tiffany Farriss, thank you so much for making the time to chat to me today.

[00:48:16] Tiffany Farriss: Nathan, thank you for having me.