There is a discussion happening within tech communities on the subject of engineering ethics. It is a multifaceted, nuanced, interesting topic. For the purposes of this post, it is reasonable to define engineering ethics as developers accepting responsibility for the code they write and the impact that their code has on others.
Before I wrote software, I was a licensed civil engineer and worked in a structural engineering firm. I have spent a lot of time thinking about how software developers can conduct themselves ethically, because my previous career was one that had a defined ethical structure. The result of my musing was a conference talk on engineering ethics.
But What About Open Source?
When you give a conference talk, people tend to track you down afterward and continue the conversation that your talk started. I received a lot of feedback on my talk, and was gratified that people were interested in engaging in the issue. Far and away the most common question I received from people was, “But what about Open Source?”
That is a really great question.
Open Source Software (OSS) is software that is shared. It means that anyone is able to view, use, modify, and distribute the code. If engineering ethics is about being responsible for the code you write, what happens when you are using code that you did not write? Do you need to assume responsibility for all of that code? What happens when you volunteer your time and talents to an Open Source project? Is the standard different because you are donating your time? How can we responsibly (read: ethically, deliberately, safely) use Open Source Software?
Benefits of Open Source Software
So since the use of OSS software raises these questions, a new user to OSS might wonder why we embrace it at all. There are numerous benefits to OSS, making it well worth it to wrestle with these questions.
Don’t Reinvent the Wheel
When code is shared, we don’t need to repeatedly solve the same problem. We stand on the shoulders of giants–people who have worked hard to build something truly useful. As much as developers like to work in green field projects, using, maintaining, and extending known solutions just makes sense. Starting at the very beginning just sounds disheartening and tedious.
Don’t Spend Money to Reinvent the Wheel
Starting at the very beginning also sounds expensive. Time has a cost and development time is pricey. Our industry is competitive. Open Source Software allows developers to get to the meat of their product faster. OSS is part of being economically competitive and is therefore likely to be part of the industry for a very long time.
Collaboration, Community, and Creativity
Open Source has value beyond these practical considerations. Open Source Software has shaped how developers interact with each other and how we view our work.
OSS is collaborative. We build together what one person could not build alone. Ideas can be debated and refined. People can pitch in where they will be most useful or where they want to gain more experience. We build something together that is greater than the sum of its parts.
When done well, OSS can bring together people from around the globe, from various backgrounds and groups. Communities spring up among people who maintain and contribute to an Open Source project and among those who use the project. There are numerous friendships, business partnerships, mentorships, teams, clubs, and more that are a direct result of our Open Source ecosystem. Technology can have a tendency to isolate, so I am very thankful that there are things within our industry that bring people together to share ideas and to work alongside one another.
Open Source can be a creative endeavor within itself. People are building something new and interesting or improving on an existing project in innovative ways. It is also the foundation of creative work for many people, whether it is a just for fun project (I love those) or a more substantial creative endeavor that can be part of someone’s livelihood. Being able to build creatively is deeply satisfying for many and I am grateful that Open Source exists as a tool within this realm.
Challenges Inherent in Open Source Software
OSS has many benefits (more than just those discussed above) but it is important to understand its limitations and challenges in order to use OSS in a responsible and ethical way.
I don’t pretend to know what all of the challenges are–I would love additional perspectives from everyone from users, to first time contributors, to seasoned maintainers. I am going to mention a few Open Source challenges that are relevant to understanding how we can responsibly use OSS and are broadly true about the majority of projects.
Volunteers are Amazing, and Can Opt Out Whenever they Like
Contributor. Maintainer. Board Member for a specific project. You are wonderful and the community is so appreciative of your work. Thank you for the time and expertise that you have contributed to Open Source.
The community has many reasons to thank the people who make our favorite projects possible. We are very grateful, but I hope we are able to check ourselves whenever we begin to feel that we are entitled to your time or contributions. Burnout is real. Making space for new endeavors–whether technical, personal, familial, or simply rest–is 1000% valid.
Users of OSS need to keep this in mind. The use of Open Source Software may seem fairly similar to commercial software, at least in your day to day work. But it is fundamentally different in that it is not reasonable to have expectations about when new features or versions will be ready or that issues, bugs, or vulnerabilities will be addressed immediately. We are not owed anything by volunteers.
Transparency has Pros and Cons
Another issue with Open Source is that it is well, open.
Don’t get me wrong. This is a strength of Open Source. Issues can be caught by the community. If you are using the software you can dig into it so you are sure of what it is doing. You can make changes that you deem necessary.
It also means that bad actors can examine the code in order to exploit it.
What These Challenges Mean for Users
So how do these challenges impact our work?
I see them as an opportunity to understand the industry better and to think about what I can do to deliver the very best product that I can. I see these challenges as an opportunity to create a recovery and mitigation plan for when things go wrong, either with my code or with my dependencies. Both working within this these challenges and using the many benefits of Open Source have the capacity to make me a stronger developer.
I want to discuss a few ways that different groups and individuals can take these opportunities as well.
It Takes a Village
Together we can all ensure a bright future for Open Source Software. I have suggested a few things that different groups can do to help foster responsible use of Open Source Software.
Thank you for everything you do! Your work has contributed to so much promise and possibility to the world. You do not owe us anything, but if you want to contribute to the discussion and make your project easier to use in a responsible way, please consider the following steps.
Be Sure to Select the Best License for Your Project’s Needs
For a project to be Open Source, it needs a license. There are a number of options and and they have different implications for how the software can be used and reused. I am hoping to write more about different kinds of licenses in a future post, but this is a very good resource.
Be Transparent About Security Measures
Maintainers and contributors to OSS can come from many different backgrounds, which may or may not include security literacy. This shouldn’t disqualify anyone from contributing, but it is reasonable to include documentation on what measures have and have not been implemented. If this is included, users can better access how they want to use the software.
Have an Exit Plan
At some point it may be time for you to move on. You may no longer have an interest in maintaining the repository, or want to invest your time elsewhere. If possible, draft an end of life plan for the project, or hand over the maintenance of the repository to someone you (and ideally the community) trust.
If you use Open Source Software at your business, invest in its future and do what you can to use it responsibly.
Contribute financially and/or contribute developer time to help the projects you use continue forward. Especially if you have developers who have specialized skill sets (ie. security), their ‘on the clock’ contributions to the project will be worth it to your company and to the community.
Document and Plan
Keep close track of the OSS projects that you use and the dependencies that those projects use. Build time in your roadmaps for your developers to keep up to date with their project versions or refactor when a particular tool is no longer supported. Those kind of things are not “nice to haves”, they are essential to a healthy project.
Use Available Tools
You don’t have to do everything yourself. There are solutions for helping you identify problems in your code or in your dependencies. You can learn more here and here.
If you find a problem in one of your Open Source dependencies, do the right thing by the community. Write a patch, notify the maintainers of the project, and work with them to make sure the fix goes out in a way that will minimize potential damage to others in the community. There are groups in this space that are willing to help you do this right.
Educate yourself on OSS. Github has a number of Open Source guides that can give you a good introduction. Keep track of your dependencies. Consider a security tool (many are free for Open Source and other public repos). Write tests, monitor your apps, keep up to date. Advocate for a more deliberate Open Source plan at your workplace.
Tech communities come in many different forms. They can be based on language or tools, geography, overlapping identity, educational background, or on some combination of all of these things. For instance, I am part of an online community for women and other gender minorities in tech who graduated from a specific bootcamp and largely work with Python.
These communities have the chance to set the tone. If you are a leader in a tech community, consider including discussions on things like engineering ethics, security, and open source software into your community life. This could take the form of an event, a dedicated slack channel, or just starting a conversation. If you are organizing a conference, consider soliciting and accepting talks about these issues. We can make the space to have these important discussions.
Ethical Open Source
Engineering ethics involves taking responsibility for your code and the impact it has on others. Although it might seem difficult to integrate OSS into this framework, stakeholders can take steps to be sure that Open Source can be used responsibly.
I want to express my thanks to everyone (whether they are writing Open Source or working on private projects) who considers the impact of the code that they write. I believe that kind of consideration and thoughtfulness will be important as the industry moves forward and tech is further incorporated into our lives.
I have found the GitHub Guides to be really interesting and informative on different aspects of Open Source Software.
This video on Who Owns Open Source Security was also very good.
This is my talk on engineering ethics, which was mentioned in this blog post.