David Cramer (CEO of Sentry) and Isaac Schlueter (CEO of npm) joined the show to talk about building businesses in open source, why they decided to turn their side projects into full-time work, how they experimented with finding steady sources of revenue, raising venture capital, working with investors and with community, and different company approaches to developing open source projects.
David Cramer: [43:49] Thatās always been a little bit interesting with the npm client, because it was⦠There are a couple of different things to talk about when we talk about our participation in open source. Thereās the npm project itself, the CLI project. Thereās the massive number of open source modules which are published and shared and installed on the npm registry, and then thereās the broader open source JavaScript community which sort of includes Node, React, Amber and all the rest.
The npm client is open source - it always has been - but for a very long time it was essentially a single-author open source project, which is a very simple governance style. The governance was, āI make all the changes, and if you have an idea, Iāll either take your pull request or notā, but it was essentially just run by me.
Thatās since changed significantly. We have a team of people working on it - there are three individuals working on it today, and quite a bit of their actual day-to-day work is spent on communication with our open source users. We take issues on the open source GitHub issues list, they have a semi-regular call that they do as an open hangout where people can suggest things for their agenda to discuss for that week, and they do regular releases with release notes, and are very responsive to the community.
That transparency has caused an increase in the number of pull requests and the quality of bug reports that they get, but theyāve also been working on making the codebase itself a little bit more accessible, which is a big and somewhat overlooked challenge in any open source project. I think the social structures around most open source projects make it so that you never really address that, because all of the people who are working on it obviously are the ones who are capable working on it, who are not intimidated by the codebase and who think itās totally fine⦠Whereas newcomers can look at this, the way that itās structured and the way that the architecture isnāt really well explained and say, āGosh, this seems kind of hard. I donāt know if I really wanna get involved.ā So they donāt get involved, they donāt get a voice and so it never changes.
Iāve seen this in literally almost every single open source project Iāve ever been connected to - npm, Node, PHP Core project, the Linux Kernel⦠Although the Linux Kernel probably does a better job of this particular aspect than most projects. Itās still pretty daunting, though. You can approach it in a couple of different ways, by breaking things up into smaller modules, breaking things up into sub-projects that people can contribute and be a part of, but itās still just an ongoing, difficult, unsolved problem to make a codebase accessible.
But in terms of our role in the community, thatās been a little bit more challenging. I feel a personal weight of responsibility to make sure that this community is a functional community and to make sure that our users are able to use the service and not be in too great a conflict with one another, and able to actually get what they expect out of it. As the community has grown, weāve gone through several different stages where different sorts of governance approaches have made more or less sense.
In the very early days actually, Michael wrote the first version of the registry, which had no authorization or authentication whatsoever. It was like, āYou wanna publish a thing? Alright. You probably know what youāre doing if you know what this thing is.ā That didnāt last very long. That had people taking advantage of it almost from day one, so we scrambled to add some authorization in there, but it was the simplest possible thing and now weāre kind of grown up to this stage where we have private code, where we have teams, and you can specify which team has access to which modules, to read access, write access and so on.
[48:08] Also, as a community, you go from the state where literally everybody has met everybody else. Where everybody was one or two degrees of separation from each other, to the point now where thereās more npm users than in some major American cities. This requires a different sort of policy, it requires different practices in terms of having things more well-documented and a little bit more regimented in how we approach certain types of conflict.
While on the one hand itās a little bit troubling to have a for-profit company - or any entity, really - in this position of authority and control, at the same time anarchy doesnāt really serve anybody. Anarchy just means that the loudest voices have the most control, and thatās really not any better. I feel like there does need to be some sort of governance structure, and a body with a dedicated interest in keeping this community healthy is in charge of keeping this community healthy. Otherwise it doesnāt happen, and you end up with a tragedy of the commons really quickly.
At the same time, we try very hard not to abuse our position and to be as transparent as possible. Some of the things we do there - we have a support team, which if you email support@npmjs.com you will talk to them. Theyāre not there to do your Node homework, they are there to resolve issues that you might have with the service if thereās no other outlet that sort of makes sense. Itās sort of the frontlines of our support for the community.
We also have a lot of time and effort and money and energy spent on keeping the service running, which is sort of the core thing that keeps the community healthy. We try very hard not to abuse our position as much as possible. We are trying to run a business, but the actual purpose of this business is to keep the community alive and running and healthy. My main goal with starting a company is to keep the npm registry running forever. I think thatās in the interest of most of our users, so I can sleep okay at night because of that.
If two people want the same thing or are fighting over something, the one that you donāt agree with is gonna be very upset at you about it, and thereās sometimes just no way around that.