أعوذ بالله اسمي العلي من الشيغان اللعين الرجيم بسم الله الرحمن الرحيم أهل السلام عليكم ورحمة الله وبركاته أردنا مرحباً في مجال أخر مرحباً حيث نذهب إلى الدعاة أبدأ مع الله وما أدخل على أهل القبور السرور يستخدمون أهل القبور السرور في مرحبات المنفاستيشنة بشيخ خلفان ممتنة جداً في مرحبات المنفاستيشنة أمام المرحباً وردنا وردنا أكثر إلى مرحبه لأننا سنذهب إلى بعض الأشياء التي ينجحون في المرحب إن شاء الله هذه المرحبة سنذهب إلى أهل القبور السرور عن كل مكروب أهل الله أساعدة لكل مرحباً أهل الله أساعدة لكل مرحباً ونبدأ بشكل كما نفعل في الأسرحة سنذهب إلى مكروب مكروب ونحاول أن نفهم جداً أمام مكروب مكروب يأتي من المكروب كرب وكرب يبدو أن يكون مخلص أو أكثر من half of المكروب كربالا ونعلم أن المكروب كربالا المنطقة كربالا يأتي من أعلى أعلى أعلى أعلى أو يتفل أعلى أعلى أعلى أعلى أعلى كرب وبلا ويأتي من المكروب يعني مرحباً مرحب فلق مرحباً مرحباً وذلك نفهم أن المكروب يأتي من مرحباً مرحباً مرحباً إذا كنت أساعدة الله أساعدة أن نفهم أحد من أعلى مرحباً ومرحباً ومرحباً يجب أن نرحلك الأمر من دل مرحباً بح tremendously لا أريد من رباً بالنسبة ل يشعرون بما يفعل أن يشعرون بلئة ببيضة الأمر يشعرون ببيضة تشعرون في مطبخ يجب أن يكون رمدي يجب أن يكون سلسلة لذا فعال أو أساعدة كنا نمرحنا وم crise وما يستعجلون أساعدة وما يساعدة أن يلتقوا إذا كنت لذا كان ذلك ممتن أنها ستكون جداً جداً than the one who is going through deep grief because they are attached to having something or something materialistic i.e. an abundance of money like their neighbour does but because they aren't able to get it they get into more of a state of grief and frustration and anguish and worry ايضاً ايضاً ايضاً the two causes they're going to be very different say they will have her own journey if you like and it's going to be a test from our last panel it's out et cetera for the more menin however for this individual the root cause is really coming from their materialistic affection affection for the materialistic world and therefore just as a first point to ponder of one you're a site this line of those are we need we need to ourselves reflect and think have there been moments where am i currently going through a moment where i am in deep grief and anguish and what is the cause of it can i pinpoint it to something materialistic that i am attached to that i have a yearning for more and more and more and actually it's completely unfounded it's completely against or not at all towards our last اعلى and it's a first level of reflection for us that maybe it's coming from a place of weakness in my faith and an attachment to this world so as we said when i when we recite this line to our we're asking for that root cause to also be cut off so if i am in that state i really pray that that root cause that attachment be it whatever that worldly desire if it's fame if it's money if it's power if it's whatever it is if it's nothing to do with Allah and therefore it's completely materialistic that inshallah that root cause is cut away going beyond this then i need to then assess that when i recite this line what if it is that for example i when i seek to be lifted from my grief it should be that i can go towards my lord so whatever it is that i whatever the cause of this grief is i need to ensure that when i pray for its remedy and the cause to be solved that it takes me towards Allah that it's a vehicle it unlocks me to go towards الله so taking that first example again off the one who is for example hungry for for more money because their neighbor has it by asking for this to alleviate me of this anguish that root cause needs to be taken apart and as a result i need to see that journey towards Allah thereafter that now this shackle has been removed i'm able to now continue my journey towards الله and similarly for example let's say if you are in a state of anguish and a state of grief due to being in a state of poverty first of course you ask الله to alleviate you from that state but so that you can then go about living your daily life as normal and continue in a notion of safetyness that you're going to survive that now you can spend your time focusing on becoming even more involved in your فكر of الله سبحانه وتعالى and your journey towards Allah and similarly if you're facing a tough illness you ask for that relief to come about so that you can then have the strength to continue in your فكر of الله and your journey towards Allah سبحانه وتعالى so just to conclude this first point which is that there is a root cause behind that anguish and grief we need to identify it first we need to see where it comes from and once we understand where it comes from assuming it's on this side that we mentioned which is one of attachment to materialistic world that I can detach from it but equally whatever the state that I am in whatever it's caused I need to ensure that I have the mindset that whatever it is that it is that lifts me out of this anguish that I then am able to in that state of freedom if you like journey towards Allah سبحانه وتعالى and when we recite this line perhaps going on to a different point now we reflect on this on who who are actually going those who are actually going through severe grief you know we really reflect on those people around the world or at least perhaps we should and we should because they're going through war perhaps or they're finding they're they're going through economic challenges or difficulties or sanctions or health pandemics we should really be reflecting on them however some people do come forward and say you know this isn't going to do much what's the point why should we even bother in thinking about those you know it's not going to do anything you know they're they're suffering they're in a different country it's not going to do anything if i'm reflecting on them and there's kind of three steps to this to respond to this notion of what's the point you know just forget about it then we're never going to see them in our life first of all is that our natural conscience should want to know the situation of our brethren and if we don't there is a question to be asked as to whether i've become that selfish and that obsessed with myself that i really don't have a disregard for any of those around the world that's a very worrying sign and one that we need to address very quickly if i really don't care about my brethren's state of anguish and grief due to you know unfortunate situations like an economic sanction like health pandemics like war afflicting just because i'm safe you know it's okay so we should really have a yearning to ensure that they are well and they are okay and if not what their situation is secondly they may say you know okay well we even if we remember them we can't do anything from you know a materialistic perspective you know i can't change how x country sees y country and i'm i'm i'm i'm just a you know i'm just this random guy living in london who what am i going to do you know pay my tax and that's it and i think it's a very defeatist mindset if we take that not only because there are things from a materialistic side that we could do and we'll come on to that but that we shouldn't neglect the first thing which is our دعاء and our prayer and this is something that we mentioned in uh earlier sessions which was around not forgetting that when you have a yearning for something when you want to supplicate for something first you go towards الله سبحانه وتعالى and then go and carry out your actions we usually do it the other way but first have that conviction in الله سبحانه وتعالى and then go about doing what you can so the doors of دعاء are always open and you should use them we should use them we should never neglect the power of دعاء and thirdly and this was the point that i mentioned about you know the physical side of it i also need to do a reality check on myself which is living in this comfortable situation that i'm in where you know i haven't got this war against me or these sanctions against me etc am i intentionally or unintentionally actually contributing towards the affliction of one of my fellow brethren now what could that look like yeah but it maybe we'll just say you know it's that's just you know hearsay but actually there's some concrete things that we could actually be doing that contributes to it first thing you know from the democratic right that i have am i exercising that in a way that is contributing to a party uh getting into power who then carries out such atrocities or that as a result goes and marginalizes certain communities therefore uh exerting affliction and grief upon them because if so i have to answer for that at some point i find there may be you know no true party to or clean party to elect for but am i actively trying or am i actively endorsing a party that is renowned for it is you know something i need to assess secondly for example with my business am i partnering with companies you know just to get for my revenue sake that i know are actively involved in uh in in affiliating with organizations and other entities that are then marginalizing certain communities and causing grief and affliction just for the sake of revenue for example thirdly with my purchases you know am i boycotting the right purchases am i am i boycotting purchases that i know are wrong and actually the companies that are behind those goods are actually actively promoting marginalization and grief upon certain communities that involve my brother and just for the sake of my satisfaction of my day today now these are all very you know practical things that also we need to reflect on that is this just the mere utterance of you know relieve the the anguish that these guys are going through or am i am i actually actively assisting in that albeit inadvertently but i've got an active role in it and we shouldn't underestimate the power of having people come together and uniting in in in this as a start it can really make a difference and look at the end of the day if you are watching this that means that you do have some level of power you are in a much more fortunate position than many you have access to internet you have access to a device that you can see this being broadcasted on so you are in a position of some financial i wouldn't call it might but some sort of financial stability that others would greatly benefit from and with that in mind we should therefore say you know what yeah i do have an ability and i do have a practical responsibility to try and extinguish this anguish of another of course quran tells us that you don't have to do more than you can handle we're not obliged to do what is beyond in our capacity and we see that in صورة البخرة verse 286 والله سبحانه وتعالى says بسم الله الرحمن الرحيم الله does not oblige a soul saved to the extent of its capacity so you can do something you don't need to go up and you don't need to do something incredibly beyond your capacity you know you just do something within your capacity that can actually make a difference for who are going through such deep anguish so if i can support a family for 10 pounds 10 dollars 10 euros 10 whatever per month yeah i should do so i should i should i should try especially in this month i should really give it a go in and try because that could really alleviate from a very difficult position that if i was in i would you know be be yearning for be yearning for and equally if i have 11 in an organization you know power i won't call it power but a level of leadership and authority in an organization am i trying to do something without to divert the attention and efforts towards helping this suffering and if not am i setting up organizations to help with that i need to do something active to try and do something about lifting the affiction from my brother as i said it needn't be beyond our means of quran tells us that otherwise if we don't again it's just back to this notion of mere lip service which we know is not going to suffice and we understand that there is so much beauty in actively going out to try and instill happiness within the believers and it's something that we should pursue attributed to the prophet the following hadith it says من صر مؤمن فقد صرني ومن صرني فقد صر الله whoever makes you believe a happy has indeed made me happy and whoever has made me happy has indeed made الله صبحانه وتعالى happy we have a second hadith attributed to the prophet إنه في الجنة دار يقال لها دار الفرح لا يدخلها إلا من فرحة يتامل مؤمنين surely there is a place in paradise called the house of joy and none would enter therein save one who had made the believers among the orphans happy there is great benefit in doing something that contributes to the happiness of those who are in a very tough position maybe الله صبحانه وتعالى is testing them maybe it's for other reasons but still we have a responsibility to go and try and help them to try and lift them out of this situation and just before we head to our summary one last point is that whilst we've spoken about lifting out of such moments of anguish and grief there are some situations where grief is very much promoted in our faith and it's it's important for us يمام عليه عليه السلام says صور المؤمن بطاعة ربه وحسنه على بمه معايز reported to have said this that the happiness of a believer in his is in his obedience and his grief is due to his sin his grief is due to sin the happiness of a believer is in his obedience and his grief is due to his sins when we are remorseful and in deep grief and worry once we've committed an act that is contrary to the sharia of الله سبحانه وتعالى and the displeasure of that grief that we then experience is one that is positive for us it's a positive grief that we should go into so we should feel shy to feel that grief when we wrong our creator again this comes back to what is the cause of the grief and in this case it's one that will then take us closer to الله سبحانه وتعالى and this is a beautiful place to be a place of repentance and Torah because we know الله loves the one who returns to him seeking forgiveness so to conclude we've discussed a few different points here all quite you know thin but uh you know once to ponder over and reflect on firstly we saw that this this makrub comes from kareb karebala which you know perhaps is the first comes from i had deep anguish this is coming from the line الله مفرج عن كل مقرب الله relive every deeply anguished one so firstly we saw that this makrub comes from kareb and therefore meaning deep anguish secondly that when we pray for this anguish to be lifted we pray for its causes to be lifted too and then we recognize that the causes can be very different the causes of say this ain't it was grief on ashwar are going to be very different to the grief of someone who is in love with the materialistic world and is unable to obtain what they want and they get more and more stuck in this state of grief and then when we yearn for being lifted from this state of grief we should ensure that once we are alleviated from it and we have that free head that we then journey back towards الله سبحانه وتعالى that that shackle has been removed from us that challenge has been removed for us and now we can journey back towards الله سبحانه وتعالى we then did a sense check to think am i actually uh actively contributing towards someone else's grief through my position of authority through my wealth through my day-to-day decision-making my purchase etc am i contributing to someone's grief thereafter we acknowledge that i do also have a duty to try and lift someone out of this affliction that it's very highly seen upon in our faith to be still happiness amongst those who are in a tough situation and it's a beautiful thing to do for a believer and finally we reminded ourselves that amongst all of this grief there is a type of grief that is highly recommended and that is the grief of the one who has wronged their lord and wishes to grieve and return to him in a state of repentance this is something highly recommended especially in this month and insha'Allah we ask الله سبحانه وتعالى to allow us to be amongst those who are in a state of repentance and turning towards him and of course we Allah ask الله سبحانه وتعالى أنت تفرج عن كل مكروبه ينقذ كل مكروبه جدًا جدًا جدًا one ان شاء الله سوف ترى لنا and join us for the next session as we go further into this دعاء والسلام عليكم ورحمة الله وبركاته


I will introduce myself in a bit more detail shortly, but I just wanted to give some context to the presentation today, and the title.because I know the title, the description, and what we're talking about today might all be a little bit askew. So we're talking about communities here as value drivers for business and the talk is going to be a bit consultancy of a high level, the stuff you might agree with, the stuff you might not agree with but it's certainly something that is working for us here in Ichanulwe. we wanted to share that with you.That's why this whole deep-dive hands-on approach. Everything we talk about today is derived from individual level as well. Everything that we're talking about is concerned with a single individual then how that builds up into the organisation. For the purpose of this presentation, we're treating OSPOs as entities in their own right. This idea that a single contributor drives a community and that community drives a business value. Dwi gofio'r gynhyrch a ddim yn gwneud o'r gwerthoedd, a'r ddweud o'r ddweud o'r unrhyw o Ospo ynglynfa yma, sy'n yn gwybod i gyd yn ddweud, a'i o'r ddweud o'r cyfnodau arall, gyda'r cyfligol o'r syniad ymweld ymlaen sy'n gweld, a'r ddweud o'r ddweud o'r ddweud o'r ddweud o'r ddweud o'r ddweud o'r Ospo, a'r ddweud o'r ddweud o'r ddweud o'r ddweud, Ond oeddwn ni'n gweld i'w ddweud, rydyn ni'n gydag i'w ddweud, felly rydyn ni'n gweithio. Rydyn ni'n Chris Howard, y Llywodraeth Fynghor ym Mhreifredig Ym Ysgol, ac rydyn ni'n gweithio ar y dyfodol yma. Rydyn ni'n gweithio i'r Twitter ac LinkedIn. Rydyn ni'n gweithio i'r LinkedIn. Ond rydyn ni'n gweithio i'r ysgol ar y bwysig, Great. Yep, so. So, you've seen how we're really putting data at the center of our operations. And we've heard a lot of talks this week around various platforms and metrics and open source solutions. We want to be transparent here. We built our own solution, we're an engineering company, this is our own internal tool, it's got a really awful name which we're not going to repeat, but we're looking, we are ultimately going to productise this and probably push it out to the market that, and that's putting our hands in the air and saying this was probably something we're excited about and we'll do. So, the next few slides we're actually going to show you three scenarios of how we're using this system internally to really tell these stories. We wanted to think back to that diagram of the three kind of flows around collecting and preparing, so why do we need the data, analysing it, how are we presenting that data to business leaders, really important, everything's got to be super clear and digestible, no kind of OSPO specific terms, and then thirdly, how can we then apply what we're learning from that data to then help us shape both our operations, so increase revenue, reduce costs or strategy, so achieving our ROKRs. First thing first, this is going to be a bit of a two person show now, and especially it's going to tell us about what we're seeing on the data, and then I'm going to talk about the exciting kind of business value. Yeah, this is the real example of the project maintained by E-Pump, so on the first graph we can see the velocity, so how many contributions our team does per month, we can predict here the next months we can see also the average, can see the gaps in the data, and for example if we want to look specifically in a specific months to see what's the difference there, why do we see a drop for example in August comparing to July, we can go deeper to the project activity graph showing us the actually the pulse of the project, so for example from the 20th of August we see the decrease in the number of contributions, and here where we actually can start our gap analysis to identify the reasons behind our ROKRs analysis really. Definitely what we're trying to say here is if we swap push events for story points and we think about all of these enterprise project management tools that we've all got in our organisation, so we've got GERA, we've got the Microsoft project, we've got all of these beautiful systems we're using, and we're asking our project managers, our delivery managers every day to provide status updates, rag updates, et cetera, but we're just not doing that for open source, so how are we reporting on our open source activity, how are we reporting that similar question we're asking all of our business leaders, how to qualify what they're delivering, the value, why are we not doing that for open source, so this is one view is exactly how we're delivering that quality, we're giving our project maintainers, our product owners, et cetera, who are in the open source space exactly the same tools because we want to be part of that conversation, we want to be delivering against OKRs so that when that quarterly business review comes along and we say to people, okay give me your project statuses, the open source team aren't there in the corner going oh well I don't really have the mechanism to present that to you, well now you do, we're expecting exactly the same thing from you, but similarly we're also going to come down hard if we're not seeing kind of the right level of velocity or we're not seeing the right kind of governance in place et cetera, and what this also does is it provides early indications around issues such as dropping cadence, now yes there's some conflicting ideas around there around community led kind of initiatives et cetera, but we're operating some of our open source projects as real kind of enterprise level programs and we want to be seeing kind of a real sustained development, so if we're starting to see drops in velocity and we're starting to see really interestingly that no one contributes on Wednesdays for example very, very peculiar then why, what are we identifying, what's the reasons behind this, so this is the kind of tool that's enabling our maintainers, our product owners to be able to pick up this kind of conversation that our delivery manager is having and we'd love to in the future start to integrate this into our other project management platform so it always comes into one, but at the moment this is the kind of visual, so to go back to that idea of delivering business value this is enabling us to kind of deliver quality products and solutions on time and on budget which is after all for an enterprise one of the most important things. Second example, yes contribution data also provides visibility of new languages being used within the organisation or in our case by open source enthusiasts at IPAM and on the pie chart we see here that this small piece of data showing that for example 0.1% of contributions made to a specific language so we can identify this, this is like a lighthouse for us right, but then we can go deeper and see what repos people contribute to and actually who are these people who are these individuals we can even compare their activity to each other this way we can identify early adopters of the language in this case we use for example rabbi but this can be really any language once we identify these adopters we compare them somehow we can actually this people can fit in particular area for every project not necessary open source one or they can even start building community within the organisation which is which they actually do. This is one I get really excited about obviously you can tell I get excited about a lot of things but um this one is really excited because how many of you I'm sure are familiar with the idea of your pre-sales teams your account are just coming to you and saying we've got a client inquiry and they want to know what competency we've got around X language or X technology this is live so we can log on to our system right now and we can see that these two people are contributing to this brand new dependency library language that's just come out we can immediately go to them and say look we've just had a query coming from a client we can react immediately to industry and we can say look we've got some response we've got these people working on this project etc otherwise what's the alternative well we're relying upon people to update their internal skills profile or we'll look at their LinkedIn etc in a 60 000 head count organisation can we really have can we really count on that reaction around people saying oh I've just contributed to this new language etc or I must go and update my internal profile etc yes they probably will but it's not that kind of immediate kind of responsive quick time and if we think back to that slide at the beginning one of the key values for kind of business leaders is around responsiveness that ability to flex to what the industry is looking that ability to demonstrate the latest capabilities and kind of technology adoption so for us this is really really important this idea that we can go right down as I said on slide one to the individual to Michael and Paul here and say look we've got this RFP that's come in this request for a quote or context around the specific language we can see you're working in this space can you jump on a call it and tell us everything you know and then the exciting thing as Anastasia says is that people then get really excited about it that we're recognising them then they say well how can you help us build a community and it's that whole cyclical thing it's that idea of like bringing people in we're showing we're excited and engaged with what you're doing they're excited that we're engaged and then we help them to nurture this and then thinking about that okay are around building a a rust centre of excellence well we've started the ball rolling now so we are we are moving that kind of thing forward we're getting excited about it we're showing our employees that we count and we value them and this is something that I'm in this system gosh every day the amount of requests that come in I'm always checking who who who isn't isn't and really important to say these repos I don't know they're real are they are they are real so do check them out here but Michael and Paul are not real and unfortunately and then our third scenario our third or final scenario yeah this is about the people who actually joined our community from the beginning of this year and who left it so come gun and in the like in the middle you can see the net change that allows us to like see see the exact picture visualise it and see how many actually people joined us and left the company we see for example the drop in starting from February and continuing in March and it reflects actually the the whole situation happens with our offices closures in Eastern Europe so which also reflects on the data but starting from June we see the increasing number of contributors joining the team and this is the right time when we started our education program for the developers and starting from started promoting our open source office for newcomers so this is actually how we qualify our value and what we are doing it at EPUM. So this is these numbers are quite small in a 60 60 000 people company so this is just specifically hires of open source engaged individuals that we know via a github ID so it's still quite niche we could expand it but we thought that might be a bit too a bit too transparent for for something that's been recorded so absolutely what's exciting here is it's just to dwell on what Anastasia's saying is that this this ever so slight peak here is what we're saying is that we can we know that this isn't fact we know there's other influences but what we're saying here is that this is a measure of our value we're able to say that things like our education program things like our rewards and recognition initiatives etc are retaining open source engaged engineers and that's the most important we're speaking at Finos a few months ago around talent acquisition and retention and one of the most important is around providing training and job security enrichment opportunities and what we're demonstrating here what we're seeing is despite all of those challenges around the invasion and the loss of employees etc we are we're confident that the initiatives that we're putting in place and the things that we're doing to retain employees particularly open source engaged as of course enterprise adoption of open source is growing we also want to be an organization that's retaining those people we don't want to be losing our talent to other organizations who are there for a few steps ahead of us so this metric is a really exciting one for me and i know that you know i'm logged logged in every month to look at this one and share this with the leadership because this is exactly the leadership language we're talking about this doesn't necessarily get as excited in the room as i suppose maybe it does does for me but it absolutely makes sense to our people functions it absolutely makes sense to our HR teams so when i'm going back to our leaders and saying we need some more money to get some more marketing out to to the github communities around ePam and why you want to come and work here this is a story i'm telling we want open source engaged engineers to put us at the front foot forward in terms of open source enterprise and helping our clients and this is the metric that's telling us and supporting us on that journey so what does this all mean uh ROI uh very exciting you can probably tell i used to be a consultant um so everything we touched on is really about delivering value and presenting it and there's two examples here very stretched out um but yeah we we're still not quite sure how we build a framework around this but if you like this whole conversation we're talking about today it's around demonstrating kind of ROI on open source so something that we have recently been under pressure to demonstrate that we had a growing team and we've really expanded our footprint within ePam but the best way i think to explain this and i've written it down to to get it accurate is that this whole conversation is about seeing visible results from the operational strategic decisions made as a result of open source community measurement so everything we spoke about the idea of a single individual a single contributor measuring that applying it to business centric thinking that can influence strategic decisions and achieve okrs then enables us to deliver business value so this whole conversation yes it's one single contributor one single individual writing one line of code or documentation or translating an issue etc ultimately can help achieve some of those real high level okrs that i think i suppose we should be waving the flag at and we got two walkthrough examples so the first one is around this whole idea of recruiting talent still very high level i appreciate there's lots of other influences but one is around let's hire in the very best open source engage talent so however we do that let's do it once we do that let's listen to them so we brought them in what's the problem what are we doing wrong how can we change our policy how can we enhance our process open source engaged engineers know what they want so let's do it and change it once we've done that then we can build better products we can start to deliver better quality we can start to enable more faster progress and once we've done that we can celebrate it and then we can repeat it so we go back to that kind of three three tid and repeat bring in more talent grow etc etc the next one bit more abstract but i love this one and we're definitely going to do it and we're really excited about the green software foundation if any of you are familiar with that organisation let's build a culture of open source consumption and contribution so leveraging people like the to-do group once we've done that let's educate people internally on on open source so strive for the idea of reusing of code over bespoke which is very difficult for an organisation like epam that's where we make our money building kind of bespoke solutions for our clients but let's educate people on the benefits the esg the environmental social benefits of open source once we do that let's try and reduce our impact so let's let's try and measure one line of code and it's carbon footprint for example and and let's say that we used x lines of open source code last year so this equates to and no x carbon whatever it happens to be and green software foundation are trying to build a model around that and then once we've done that let's celebrate that and influence our strategy change our operations and repeat the process and all of this is about building business value so a lot of us are sitting here thinking yeah but Chris this is this is kind of a few steps away from what we're doing on a day today or or this is a bit outside of my remit it might be at the moment but this whole conversation is about actually making it part of our remit so we're saying we want to be part of this conversation we want to be delivering this value we want to be in that kind of that board meeting when we're talking about these okay ours so please bring us to the table and this is how we're going to start to to demonstrate and deliver that value so that brings us to the end at 30 minutes before we jump into questions I want to say thank you all for listening but I also just want to embarrass Anastasia and say this is her first conference that she's ever spoke at so congratulations to Anastasia for getting through this yeah it's a really good question so we I'm not going to say we practice in a source and I think Claire for example from the source comments will probably agree with me and I don't think we can say that we do practice in a source we do practice code collaboration and sharing of code and centralised repositories etc but I wouldn't say that we're mature and I'm going out on a whim here mature enough to say that we've practiced that but of course in a massive engineering company there are there is benefits of sharing code and reuse and all of this so we definitely have ways of working that would align with some of those kind of inner source principles and we certainly through things like our NJEC's consultancy offering that we provide to our clients around great engineering practice DevOps etc educate our clients on what that looks like but we haven't yet wrapped that up as a kind of in a source label and I think we're close to it but but we're not calling it in a source no yeah but this is not this is not a this is not a business development opportunity so yeah chat chat to me afterwards about that one sure go ahead UK and Serbia but we knew this question was going to come up 100% and and you might not like the answer so two years ago we had the exact thing because our system allows every single colleague in EPAM to log on to that system and look at open source contribution so you can drill down you can say Chris Howard contributed 300 push events to these repositories on these specific times a bit like your github dashboard but of course it's identified exactly who it is and I can look at your profile and our German colleagues were going crazy like crazy so we went back to the lawyers we went back to our HR team we checked our contract and by working at EPAM you've signed a contract to say that basically we have access to that data so so we do our struggle now is if we turn this into an enterprise product and we start offering this to the market the key thing for us and I'm going to I'm going to reference this because we haven't heard this at all this week actually is that unlike some of the other metrics tools that we've demonstrated this week and we love those and we deterge your for example doing fantastic stuff chaos doing amazing stuff our key differentiators that we integrate with a HR platform so we're going to look to integrate with things like SAP work day our own HR platform and the onus then is on the employer to gather all of those IDs for github for bit bucket for et cetera so the onus is on the employer we're just providing the visualization the business value the the messaging around that so what how we feel we're escaping that is we're not we're not scraping from all of these websites and then aggregating it and saying oh here's here's Chris's profile Chris has actually shared his data with his employer all of his IDs and then we're mapping them across and saying oh well now we can do a one-to-one pairing you're going to answer the next question so the question was around are we doing kind of an end-to-end mapping of a talent acquisition so from the very first contact all the way through to now they've joined the company why did they join et cetera et cetera we do provide our talent acquisition team with like a one pager on why open source is important but what we're really excited about and we haven't yet explored it is this idea that I used it in the talk this kind of hiring for influence so like picking some really exciting maintenance in projects and bringing them into EPAM but maybe six months before we start to do that kind of get into their profile a little bit so the HR team put a little tag on to say oh we reached out to Mateus and we we spoke about this et cetera there's a little flag there and then we see what that journey looks like and then what happens is when they join the company we can then and that this is where this data point comes really contested actually is is then we can say did his contributions increase or did they decrease or him joining EPAM did that then limit his open source engagement or did it really rocket it forwards et cetera so of course that data wasn't ours pre-employment but it is in the public domain so how can we how can we answer your question how can we start to do that kind of whole long tail journey and even when they leave the company what happens let's say they go and join Red Hat for example and Red Hat's got all this a fantastic kind of collateral and ways of working in open source do they then get even better at their open source contribution okay what can EPAM be doing to learn and leverage that and retain our employees so I think we'd love to be able to build a model but there really is some data concerns around that one absolutely okay yeah I'll answer this question so for this presentation we used push event just like you know activity unit that we can actually present and since we talk with business people the most sense for them mean is actually make for them is the lines of code right push events as an entity because once you completed your let's say task you you pushed it this why we used push events but as for the rest like social engagement some social not for good network communication documentation and so on so forth yes it's also in our you know backlog for the implementation for EPAM especially but we just don't do it yet do you want to add something yeah yeah of course but you can always pick the you know activity unit that you are mostly interested in we just made the analysis and decided that this will make sense for EPAM because it does of course some of the contributors try to hack the system and you know just make one commit push it but we for example for our recognition campaign yes we we have say find this people who do this who violate the system and just not reward them that's it yeah even our own employees are trying to get a bit more money out of us yeah it does work and they and they actually the open source index the the public version which measures commercial organizations the same the same model works i'm not telling you all if you're going to have now and start doing kind of single commits give it after your ranking will climb it will but yeah it's based on we're not trying to cleanse the data we're trying to show a real kind of honest account of what activity looks like okay we've got I think we've got three minutes so one more question if there is one oh go ahead the real cost in terms of financial cost yeah yeah absolutely and and and we don't we're not we're not able to say okay well the Ospo cost a million pounds a year for example we're gonna we're gonna break even we can't we can't do that we we don't have a mechanism to do that explicit one-to-one so instead that's why we found ourselves in this situation of having to do that kind of long tail business value around one line of code can provide x strategic value towards achieving this okay are but that was never at the and hopefully it's brand new to some of you here that was never at the forefront of our leaders thinking so it was always around financial ROI it was around the bottom line of course that's a commercial organisation but actually for us what we're saying is a bit like some of your other non-revenue functions so perhaps your people team your legal compliance etc Ospo's can also be part of that in achieving these okay ars that yes in your annual report and your stakeholder reports etc contribute to that financial kind of prospect but they don't have a direct dollar for dollar mapping around you spent a million pounds here we've given you a million pounds back with we don't believe we're going to be in a situation and I find a point on that I think what we will be in a situation to do because I got one minute is I think we will be able to very soon get to a point and this is aspirational being able to say that one line of open source code equates to x in terms of different factors so it could be that carbon model it could be a carbon offset it could be a few cents of revenue it could be I don't know people hours or something and it would be great to come up with a model or a framework of what open source at EPAN means in terms of a line of code and how that applies to other kind of facets of our operating model but that's kind of for the future and once I get some more glossy slides to talk through that but it's been great to speak to you all today thanks so much and please do reach out to us on socials or come and find us before we'll fly back to our various destinations this afternoon thank you everyone


So, thank you. Let me talk about the Indian experience and the story which I am going to tell you is very different from the Chilean experience. What I am going to tell you is that India has never faced any banking crisis still today, including during 2007-2008. So why, what steps we have taken, how we have developed our financial system, that in brief I am going to tell you. The presentation has a lot more material than I can possibly cover in 20 minutes. So I will be skipping through most of it and talking about some of the central issues. Now basically growth with equity, this is the foremost objective of any economy especially for emerging market economies because emerging market economies have a vast population of poor people and also we don't have social security systems. Equity I would like to see in two perspectives. One is equitable distribution which has come in the limelight with Thomas Piketty's book and the other aspect of equity is inclusion, which is something which is very important about any economy, particularly the emerging market economies. So any financial sector policy has to be tuned in to subserve both these objectives. As far as role of finance is concerned, Lemay has already talked about it, a well-developed financial system is very important for promoting growth, even though among economists there are various shades of opinion, but the dominant opinion is that a sound financial system is extremely important. And the fact that a sound financial system is extremely important for a well-functioning economy is proved in a negative sense by the crisis. A malfunctioning financial system is at the core of the crisis. So that proves the point. Now the question is what should be the optimal size of a financial system? To that there are no answers. Even regarding the systemically important financial institutions, there are no absolute measures. These are all relatively speaking. In a broad sense one can say that a financial system should serve the purposes, should serve the objectives of the real economy, should not be oversized. And intuitively it is very easy to understand that if a financial system grows too large it takes away resources, both human technology, etc. from the real economy and therefore beyond a point, and this is the current research going on, beyond a point the financial system development actually takes away from growth. So in this broad perspective, let me now come to the points which are there on the slide. When we talk of importance of financial system, by financial system I mean three components and the development has to address all the three components. One is institution, other is market and third is financial sector infrastructure. So financial system serves many purposes as you can see. It provides intermediation, allocation of resources, risk management, liquidity to the savers, provision of information through disclosures, and thus contributes to overall economic growth. This is a broad indicator of the structure of the Indian financial system. Essentially I would concentrate on the commercial banking system, the public sector banks which are in number 26, which account for 70% of the financial system. Then we have private sector, there are 20, foreign banks 41, but these are most of them are small banks, only five large foreign banks are there. Then we have other varieties of, couple of varieties of banks that you can see over there, I'll talk about them slightly later. Then we have the cooperative sector, we have the non-banking financial company sector which in today's parlance is known as shadow banking. So we have a combination of banks, variety of banks and non-banks as far as credit intermediation function is concerned. So the point here is that we have a diversified banking system or financial system. As far as the institutional structure is concerned for overseeing the financial system, at the top we have financial stability development council, which is headed by the finance minister. This, of course, is a development after the crisis. But at operational level, there is a subcommittee which is headed by the governor RBI and then we have all the other sectoral regulator heads like capital market regulator, insurance regulator, et cetera, who are members of this committee. So this is FSDC, subcommittee of FSDC I have just talked about and these are the four primary regulators. RBI, SEBI is the capital market regulator, IRDA is the insurance regulator and PFRDA is the provident fund, a pension fund, sorry, pension fund regulator. And within RBI we have certain independent committees, both for financial supervision, both for payment and settlement systems. So these are the two large segments which are regulated through these committees, I mean, provide an overall oversight. So let me very briefly talk about what was the situation pre-1991. 1991 was the period when we really, Indian banking system, Indian economy was liberalized. Prior to that we were in a repressed regime. You can see the components of that regime. We had administered interest rates, large amount of preemption from the banking system, extensive micro regulations, et cetera. The consequence was that there was hardly any competition, therefore obviously there were low levels of efficiency and productivity, low capitalization levels in the banking sector and high NPAs that we will see slightly later. Because of large preemption there was credit shortage for private sector and the growth was stunted. In fact, India grew at the rate of what came to be known as Hindu rate of growth. It was 3% for years and years together till we broke free in late 80s and then substantially in late 90s. So banking sector reforms as a part of 1991 reforms. In fact, why did we go for reforms? I said initially that India never faced a banking crisis and it is true that even in 1991 we didn't face a banking crisis. But we did face a huge economic crisis in the sense on balance of payment and that spurred the range of reforms, economic reforms, financial sector reform was a subset of that. So we took a number of sequenced measures, deregulation of interest rates, reduction in preemptions, diversification of ownership in the sense that governments holding, as I said, the public sector banks account for about 70% today. In those days it must have in 80 or more of the banking system. So government ownership was reduced, private investments was brought in, new banks in private sector were allowed, foreign banks entry was made easier and all this resulted into enhancing of productivity and efficiency through competition. Then there was a wave of consolidation in the banking system so that the weaker ones could be weeded out, could be merged or closed. And then we had a number of institutional structures coming in, I have mentioned about these two committees, BFS, BPSS. And the one thing which we did was that we had, we always earmarked ourselves, or rather we converged completely with the international potential norms, whether it was Basel 1, Basel 2 and now Basel 3. Of course we chose our own pace, not that we were slow but occasionally we did, we did have our own pace, sometimes we had to have a carve out, not being in full conformity for various practical reasons but by and large we always implemented the international standards. Now the basic thrust of the banking reforms was financial sector reforms were undertaken early in the reform cycle as I mentioned. Reforms were not driven by any crisis and not an outcome of any multilateral rate. This was, this is the point which I made essentially in the beginning. And let me tell you that the world, I'm sure all of you know, has been going through crisis after crisis. In fact one can say that the period of peace is an intermission between crisis. And even as far as banks are concerned, about 43 countries faced systemic banking crisis during 1980s and 65 or so countries faced systemic banking crisis during 1990s. During all this period, somehow we were aware from that, we were away from that. Even though, as I mentioned earlier that we had a repressive regime, a closed economy, an economy which was not really growing very well but despite that, I think partly because of the simplicity of the system and partly because of the fact that there was a lot of emphasis on regulation and supervision, we did not face any banking crisis. And the two principles that we followed was non-disruptive progress and consultative process. We also undertook a whole lot of financial market reforms. In fact, the entire sequence of reforms did cover all segments of economy, the real economy in terms of budget deficits, in terms of current account balance, in terms of growth. That is we paid a lot of attention to the macroeconomic factors. And along with that, we did banking sector reforms. In conjunction with financial market reforms and when I talk of institutional and market reforms, I must also say, a lot of technological improvements were brought about in the system by leveraging technology, like having reporting systems, order matching systems, central counterparty clearing, information dissemination. The whole process was gradual, cautious and consultative. Financial inclusion that we talked about is something that has been at the core of the policies for quite a long time. In fact, India didn't have public sector banks till 1969. And all major banks were nationalized in 1969 and in a second wave in 1918. Now, what was the reason? The reason was, I mean, economy, the economic thinking also changes with time. In those days, India believed more in central planning. The country had just become independent. There were lots of problems and it was felt and found that credit was being cornered or likely to be cornered by the promoters, by the people who had set up the banks and therefore in order that the credit can be delivered in those directions where it was needed for wholesome development of the country, the banks were nationalized. Then we adopted several other schemes like service area approach, lead bank scheme. These are essentially schemes which look after the, which concentrate on the credit needs of specific geographical constellations. Where banks, where some bank would be made in charge, it will have to coordinate with the other banks. In order to have financial inclusion, we liberalized branch authorization with incentives to open in remote areas. And there is a compulsion. All banks have to open at least 25% of the branches in unbanked rural areas of the branches that they open in a year. Of course, there are certain incentives built into that. But we always had a large debate on whether financial inclusion can be achieved by smaller number of large banks or large number of smaller banks. And our experience with smaller banks was not good enough and therefore we went into large, we went for small number of larger banks, but then opening branches is not easy. It is costly. And apart from that financial inclusion unless the transaction cost can be brought down is something which does not make a business proposition for banks. And therefore we came up with the idea of business correspondent models. These are the agents which bank employ. And essentially the idea is by leveraging technology, by having handheld devices, by biometric identification, et cetera. Then we opening bank accounts because of KYC norms was becoming difficult. So a lot of relaxations were there.  I'll just be telling you the basic points. So this was the supply side in order to increase demand from the people who need to be included. Financial literacy drives were undertaken are being undertaken today with a lot of emphasis. Now while we were into financial sector development, the core was always keeping an eye on financial stability. And these were the approaches that we took. These are some of the steps that we took for ensuring financial stability long before macro potential regulations have become fashionable. In fact, we practiced from 2004 both to contain the interconnectedness as well as to contain the exuberance in the credit markets from 2004 onwards. The method that we adopted was time varying, provisioning and capital requirements for certain segments of the economy which were overheating like your housing markets, commercial real estate, consumer loans and non banking financial sector. So these were the four sectors that were targeted. So potential framework much like what was listed by our Chilean colleague, many things we did. Now this table, I'm not going to be able to explain but I'll just tell you what it is. But before that, let us come to this. This is a graph which tells you the credit boom in the commercial real estate in early stages. On the left side, you can see the red line tells you the movement of capital adequacy requirements. I mean capital requirements for this sector. No, sorry, this red line tells you the provisioning requirement for this sector and the green line tells you the time varying capital requirement for this sector. Now when there was a high boom, then provisioning and capital requirements both were raised and then when the crisis struck both were simultaneously brought down. And then again after some time when they again started overheating both were raised. You can see the effect. There is a sharp decline in the credit growth and this is what was intended to be achieved through a macro potential policy. But when it was reversed, the effect was not the same. So our experience is macro potential policy does not work symmetrically. And the other two slides, the first slide gives you the movement of provisioning and capital requirements with time. And the second slide, this tells you that the monetary policy measures and the macro potential measures were absolutely in alignment. When monetary policy was tightened, macro potential norms were tightened and vice versa. So when the two policies were reinforcing each other, then there was a good effect which you saw over here, but not that we were successful in all segments. We were successful in housing segment, not so successful in NBFC segment. So this could be attributed to calibration issues because those were the early days. Now here is a list of how did we respond to crisis by moving the monetary policy and the macro potential measures. You can go through it later on. It had a combination of fiscal stimulus also by the government. And these are the graphs which tell you the story of the financial sector reforms. The capital adequacy you can see from 2001 onwards. You can see the gross NPA levels, how they have sharply declined. Of course, of late they have shown some increase. In fact, of late, there is some pressure on asset quality.  And the most remarkable thing you will find is that from 2003 onwards up to 2007, even the actual stock of not only the percentage, but the actual stock of non-performing assets also came down consistently. These are the figures. This is the story of net interest margin. It hovers around between 2.5 to 3% consistently over a long period of time. Now coming to the current concerns, we have certain concerns now today because India developed our GDP growth rate was 8.5 plus from 2003 to 2008. In the year of the crisis, it dipped. But in the next two years, it rebounded sharply. It again became 8.5%. But after that, the growth has gone down substantially. In this year, it was 4.7. Next year, it is expected to be between 5 and 6 for various reasons, for various macroeconomic and administrative reasons, for which I don't have time to go into. But it has led to deterioration in asset quality when the economy does not perform well. It is bound to happen. It has put pressure on capital adequacy. Basel III issues are there. Capital raising is going to be a substantial problem. In fact, the requirement, as estimated, is about 4.15 trillion rupees. And this is a conservative assessment. It could go much more. And the pressure on equity raising can be much more because the instruments, the non-equity instruments, have certain features under Basel III for which if the market is not there, particularly in emerging market economies, the pressure is going to be on more equity raising. Financial inclusion, a lot of efforts have been made. As I mentioned briefly to you earlier, but even then, the level of exclusion is high. You can see the figures. What is not given over here is that in this MSME sector, that is Micro, Small and Medium Enterprises sector, even today, the financial exclusion is 93%. So this is the story of GDP growth. You can see how we have come down of late because of various reasons which I mentioned. Now how we are tackling all this is we have adopted a five pillar approach, strengthening our monetary policy framework because inflation has become a problem. It has become quite entrenched. Strengthening banking structure through new entry, branch expansion, encouraging new varieties of banks and moving foreign banks into better regulated organizational forms. Here the idea is that we have been following a universal banking model and we find, particularly from financial inclusion perspective, that we need more varieties. Our total reliance on small number of larger banks has yielded results but not to the extent that we want and now we are veering around to the view that we need local feel and therefore we are going to promote small banks, large number of small banks and a variety among them. Broadening and deepening financial markets and increasing their liquidity and resilience, expanding access to finance, to small and medium enterprises, et cetera. Now here are a couple of things which I can mention apart from what is being done for individuals, for SMEs for example, factoring has been is being promoted and then an electronic exchange we are thinking of creating where the small and medium enterprises which get squeezed by the large corporates, they can sell their receivables into the market.  So if they are able to sell it to others who are willing to wait for some time, there should be a market for that and that will substantially ease the problem of SMEs. Improving the system's ability to deal with corporate distress and financial institution distress by strengthening real and financial restructuring as well as debt recovery. A number of very practical steps have been taken which I would not be able to enumerate. Maybe if you ask any questions, I may be able to tell you, but what are the lessons? What are the lessons from this? I have deliberately not put it in the slides because it is for you to draw the lessons. But from my perspective, my perspective what are the policy recommendations? The gains from the reforms in the post-1991 period have clearly shown the high cost the economy had to bear and therefore liberalization of economy and financial sector has great potential and it must be undertaken also to increase the human welfare. As the economy liberalizes domestically and externally, risks in the system increase and they have got to be managed properly and therefore there has to be what we feel is, our own lesson is that a sequenced and a measured pace of reform is far better than a big bank reform. At least this is what we have learned and it has been very useful to us and the reforms cannot be only a financial sector. The reform has to be of the entire economy including the real economy. You have to pay attention to macroeconomic fundamentals also. If you don't do that, then it will spill over into the financial system and the financial sector development will not be complete. Financial stability should be of overarching consideration in designing liberal financial sector policies. The financial sector should develop a diversified range of institutions. The regulatory policy should not stifle useful innovations due to the crisis but at the same time we have to keep an eye on what we call or what is generally known as socially not relevant financial innovation. The regulatory and supervisory institutional framework for the financial sector is of paramount importance so a part of the financial sector reforms has also to address the institutional aspects of there are many questions. Whether regulation and supervision should be with central bank or outside. Should you have a unified regulator or fragmented regulator? If you have many regulators, how do you coordinate? So there are several such issues which need also to be tackled. Thank you.


Hello everyone So next up we have Richard Brown and he's going to resurrect some dinosaurs for us And let's see what can go wrong with that Thank you. Thank you very much Yeah, so I'm here from the open-suser project to talk about our containerized applications so things like snappy flatback etc Like resurrecting dinosaurs Jurassic Park eating our users how it's all going to be terrible So Yeah, those who can't remember the past I doomed to repeat it. So before I get into the history lesson I'm going to talk a little bit about my history I've been working in in linux now for Let's say 12 years, maybe even a little bit longer mostly contributing to the open-suser project Qa distribution building package building. So I'm a you know, a real distro guy, you know, I'm really interested in Dealing with all of these upstream projects how those how to then package that software and then redistribute it to users You know, traditionally in the form of a distribution, you know from suzer And so and so I have kind of been looking at this problem from from very much that perspective Before that or you know alongside that I have also been, you know working as a system administrator So I've been actually dealing on the you know hard end of things with users in the real world dealing with software and you know Dealing with operating systems other than the wonderful ones that work in open source So starting at the very beginning I never thought I'd be presenting at foster and are having an opening slide of a windows 95 architecture diagram But this is the place to start with really back in windows 95 windows windows 3.1 The traditional dependency problem is best exemplified by dl or hell You know windows 95 windows was trying to You know solve all these wonderful dependency problems and their solution was pretty much Okay, let's have these things called dlls and let's shove all these libraries and dump them in c windows or c windows system And every application will just consume them from there and everything will be wonderful But of course it's windows so it wasn't You know, it's even even down to Absolutely nobody not even Microsoft taking care of any kind of a bi backwards compatibility Every single update either from an application or from the system Goes and touches those dlls And then every application that required on it all end up magically breaking Even if you had people who took care of that and dealt with that and actually had Certain run times and libraries prison, you know, take it, you know well maintained and patched carefully and reservedly You still had nonsense like the global com com class IDs So, you know a single application ends up stealing the resources from another If any programmer wanted to create an instance of that class it just always broke. It was a mess. It was a nightmare And as a developer Working with that stuff In real terms, it was a nightmare to work with, you know, every single application had to be Developed with every single combination of every single set of libraries that every user might have and whichever version combination they might have And then deved that way and tested that way And then of course you need to do an upgrade to your application So your patch you have to then retest everything And then of course your various upstream and other projects are changing their dlls And they're having you have to repatch all of that and then even if you did everything perfectly You still end up crying because it's still ended up breaking And then Windows 2000 came along and Microsoft claimed they fixed it And in many ways they did It came along and they said okay, we realize this is a mess We're gonna stop putting all of our shared libraries in one big dumping ground in the system in the you know The root file system in c windows or c windows system And we've got this wonderful thing called side-by-side assembly Which is basically containerization. I mean obviously with the lack of sandboxing But generally speaking it completely changed how you practically delivered applications on a windows files on a window system Then all the developer had to do was take Their exe and the dlls that they cared about And they deliver them in an in an application folder On the user system and windows would give it a nice separate memory space load up those dlls only in that memory space Private to that application So you didn't have to worry about what the system dlls were going to do or mess around with that If you were relying on the system dlls You could be way more certain that no third party was going to go messing around and breaking them on your user's machines Because windows was now protecting every single system dll with their WSFP or WFP And for those handling the whole transition between 95 and 2000 they even had this wonderful tool dups So you could take a nasty old school application with everything scattered all over the place And run dups against it. It'll figure out where all those dlls hooks are and then you could just bundle all of that into your application folder Migrate everything along and everything was happy and everything was wonderful And you didn't even have to do it necessarily with a A windows 32 application. I mean, you know, they had run times in there four pozzics run times in there for os2 I don't know anyone who ever really used them in anger, but you know, they were there. This is the windows 2000 diagram So the problem was solved right nonsense. This is microsoft. We're talking about It was and is and remains an absolute security nightmare From me, you know, how many exploits are out there that are some random security dlls sitting in some random application folder That's security relevant that everybody is having a wonderful time exploiting because So and so hasn't updated that dll in their application It's constantly constantly happening and it's happening because also there is no centralized way of updating these applications So every single windows application developer then has to worry about, okay, how are we get we've got it? Okay, we've got this security issue. We fix this dll or we fixed our own application How do we then deliver that to our users? Oh, fine We'll just make an update and then you end up with the adobe update and steam and blah and blah and blah One issue that doesn't get talked about a lot, but especially in the open source side of things. I think gets Yeah, at least far more lights to print on it as well is when you're bundling these libraries Do the licenses actually Permit that use I mean, yeah, how many how many gpl cases do we have of some License just bundled in with application because nobody realized actually that can't be thrown away in there And this is something that happened more and more often in the windows world Of course, it wasn't terrible storage vendors love it because This ended up needing to be used more and more because you're putting on a whole bunch of dlls on the system But you know, they're the only people who are happy and you know I guess people like spending money on more hard disks Meanwhile, about the same time in linux land We were looking on smugly Because we thought we'd already fixed this Kind of and we'd fixed it because we delivered our software in distributions And I could talk about all the technical details of which distributions better and blah blah blah But purely from sort of a philosophical and organizational perspective Every distribution dealt with these issues And actually resolved them just by doing the work they were doing Regardless of their technical choices of package manager and build tool and other such things Because Any responsible distribution at least had a care about the security of the software they were delivering to their users They have security teams. They're auditing the packages. They're putting in their distribution They're monitoring cvs for the packages. They're putting in their distribution They're rolling out security updates when it goes wrong In the case of of enterprise or commercially linked distributions You know, you're also likely to have them on the embargoed security lists and therefore getting Information about those cvs before they end up being public So you've got a chance of at least getting an update out on the day of the announcement broader than that just not worrying about the security side of things You've got package maintainers who are, you know, they're out in the community wanting to package their software Keeping it updated putting it in the distribution. So the whole how do we maintain this stuff is partly handled by these Maintainers doing it just because they want to run their software On their distribution of choice And of course, like I said any responsible distribution as well also has a legal team Looking at their packages making sure that the license the licenses of the software that they're delivering Are compatible with each other? So you're not delivering it in a way that is invalid with the the desires or the requirements of the developer in question And just, you know, generally compliant.  Um, you know, this space doesn't matter now anyway. Everyone's got bigger disks But when you start looking at the real work of maintaining everything Shared libraries have another benefit, you know, it's not just about the disk space Distributing fewer libraries means you've got less work worrying about that security the security implications You've got one set of libraries to worry about auditing one set of libraries to worry about patching Less manpower to maintain it And it's easy to view that legal compliance, especially when Despite everybody's best efforts, you know, projects love changing their licenses And there is nothing worse than One version of a product being project of on being on one license and then changing to another and figuring out Okay, can we can we ship both are they compatible? You know, we've we've seen that before where projects end up actually, you know We have to move because their license isn't actually compatible with their old one. It's it's you know So shared libraries do solve a lot of those issues by at least giving you one Contain, you know one integrated base once you've done the work to actually put that base together So mission accomplished. Well, no, you know the traditional distribution model also has its flaws And these are the flaws which containerized apps really Sell promises trying to fix You know, improving the compatibility so developers don't have to rewrite their application for all these different chosen bases of the distribution Obviously portability also so you can just do it once and then have it work everywhere And distributions typically like to do that work at a certain cadence And that cadence is unlikely to actually match the application developers cadence. So therefore The issue of pace of chains comes up, you know a new upstream release has happened And no distribution is shipping that new version because you know their release schedule says they'll do it in eight months or whatever But the reason they do that is because it doesn't yeah, they want to make sure it works. So There we are Like I said a little bit like the windows 3.1 situation the compatibility problem The containerized apps are trying to solve Really boils down to these simple points, you know, we we have lots of distributions You know, maybe too many of them With many different libraries different apps and different modifications in there The applications themselves require different libraries And application developers don't care and they don't want to care and they're never going to want to care They just want to build something that works and push it out there Which is fine But most people But we've solved this problem in the in the distribution world already We have maintainers who deal with all that work. It's not upstream packages putting stuff in distributions most of the time It's distribution packages figuring out what crazy stuff upstream have done and then distributing it in the distribution And it works wonderfully when it comes to free and open source license applications obviously Provider applications whole different story On the portability side of things much the same story much the same problem You know, if you're doing all of this work to get the thing working You only want to do it once you don't want to have to repeat this three times four times five times And with a very diverse distribution ecosystem Having a nice application that built ones and runs everywhere definitely has a certain appeal but again Does it really matter if somebody's rebuilding it anyway? And then the pace of change problem Like I say distributions generally have fixed release schedules And those release schedules generally mean the package versions are frozen in there any changes are very reluctant if they are going to be in there So that holds back to new versions new innovations new things Projects have released from users. That's a bad thing Rolling distributions are becoming more and more of a trend In my in the case of open suzer, we're now running, you know, we're now doing tumbleweed as one of our main distributions And this totally solves that problem In fact, in many cases, we're now not only keeping pace with upstream projects In some cases we sometimes outpace it and then have to actually slow things down So we're not shipping their next release before they are Yeah, because it's all in git. So we just tell plug our build service into git and everything's fine and wonderful kind of But that's the distro side of things Containerized applications want to solve these same problems And when I'm talking about this, I'm talking really about app image flat pack and snappy Of course app image started in 2003 flat pack 2013 and snappy So, you know flat pack have been doing this for a very sorry app image have been doing this for a very long time I'm not going to go into the ins and outs of you know, how they all individually work or compare them I'm talking in general terms because these issues are shared across all of them. So, you know, generally speaking They're but they produce a bundle Be it a tarball or some other way of packaging things up Containing an application and all the dependencies all of the libraries that it requires And then they run it in some kind of container or ch root or sandbox And they make huge promises these are all ripped straight from their website straight from their documentation You know all the compatibility problems are solved. You just put everything in there. Everything's going to work fine You know the portability problems are solved. You just put everything there. You can run out on every distribution Everything's absolutely fine and wonderful Pace of change. Well, you're the one doing it. You're doing the the upstream source You then can do your app image or flat back everything's fine and it's just going to work everything's perfect And then you get architecture diagrams like this Or like this one from flat back And Actually, it's a bit too fuzzy. So I'll stick with this one What you end up with these Tool sets actually doing if taking the application The set of dependencies which in the case of snappy and flat pack actually include frameworks or run times where there's effectively pre Pre-curated bundles of these applications all sitting there And then below that there's just the operating system and you don't have to worry about that You know in the case of snappy, it's you know, they're always going to say a bunch of I quite like flat pack because they just say an operating system, which is if you're going to do this That's how it should be The problem is You're making assumptions about what is actually Below that line Soon, you know, you've you've taken the dependency problem of okay, my application needed this library And now it's my application and all of its dependencies need This version of glibc or this kernel or whatever And no one's quite defined where that line is yet And there's no common base every distribution is different Even debian distributions in that family are different rpm distributions in that family are different We package things in different ways because we've solved these problems differently in our environments over the years So sooner or later as you start crossing that line between the containerized application And its run times and whatever it's getting from the base system It's gonna start breaking Like I said app image have been doing this since 2003 And they know this problem. They don't lie about this. They don't do graphs like this Instead in their documentation They outright say that the only way you can build a portable image with app image Is decide which distributions you're targeting And then look at every dependency you need that's not in any of those And put them all in there It'll work, but that's a huge amount of work But that's what you have to do to actually avoid this issue We're seeing this in open suzi with like steam which is doesn't quite fit into this model But you know steam is effectively Delivered on on Linux as a Ubuntu runtime with steam running on top. So, you know kind of following this same model Again that runtime makes assumptions as soon as we change something in our base system That isn't compatible with what they're expecting from a you know their Ubuntu one times expecting it all breaks You need to worry about the dependencies You've just shifted the problem from higher up the stack to lower down the stack So if you really want to make a portable application you have to put in every single dependency you might need If not expect crashes your users will not be able to use your application So what's the point? Well, like I said in the case of flatpack and snappy They're trying to mitigate this problem by doing runtime. So at least you say With flatpack you have like the gt the gnome runtime in there You effectively have all of the libraries all of the dependencies to do a gnome application sitting in that runtime So as a developer you can at least target that runtime know that's going to be there Generally hope that everything further down the stack is sane and okay And just get on and do the work and it does mitigate the problem But at the same time you've generated a whole nother one, which I'll talk about in a minute And the responsibility of that kind of middle distro becomes You know really hard to do their job right They have to then make sure that runtime is keeping up to date with everything that that runtime is secure that runtime is all patched And those answers are something which is still in a very gestative state at the moment I'm not sure about the real solution But looking at it from a distro perspective, you know way back when we had this concept of a linux standard base of you Know a common linux that every developer could just assume is underneath there um Of course, that was a pretty hard and pretty impossible agreement to make But now with these applications with containerization becoming more maybe it's time to revisit that idea Because like I say the dependency problem gets shifted around by these technologies Maybe collectively the distributions should be to get around the table and find out okay, you know, here's the new line Here's where we're going to tell every Container developer, you know, we'll worry about this and we'll do this in a roughly standard kind of way And then work on from there. So, you know, maybe we need a new lsp that actually works So the reality of the big promises of containerized applications is well, they're not going to be compatible You do you know, unless you're going to worry about every single dependency, it's not going to necessarily work They're not going to be portable unless you do every dependency for every distro Which you might possibly want to have a user running it on The pace of change thing that's solved it does solve that real problem But you can't say it's just going to work now You can maybe say it's going to work on certain distributions like app image suggests you should be saying But you can't guarantee it's going to work everywhere And this is just like you had in Windows 2000 We're repeating history with this Because even if you say this is still worth it and still worth going ahead With these technologies and still doing that way We're going to end up with security relevant libraries in all of these containers, you know You're bundling all those dependencies in there to make this work Who's going to be making sure they're valid? Who's going to be making sure they're secure? Who's going to be patching them? When they're in there How are you going to patch them? You know, okay, most you know snappy does have the concept of app stores But how do you guarantee then that everybody with your snap from every app store gets the right version at the right time? I mean that's going to be a bit of a mess You know, how do you how do you handle the package management for flatpack with app image? They don't even have a rough answer for that now as far as I can tell It's you know, just download a new bundle from the website That's you know, they're going to have to have people creating updated apps for this thing Who's doing the legal review for all of these bund all these by these dependencies in these bundles Who's making sure that they all can be distributed at the same time? Especially when you look at certain licenses where The the runtime aspect of the license is fine. I mean, you know, oh, we can plug into anything and everything's fine But we care about how you distribute or redistribute the software That's where our lawyers inside open suzer really spend a lot of time and effort paying attention to you know Making sure that we can legally redistribute this software Who's going to be doing that for your application for these containerized applications? You know, if you've got thousands of people using these these tools to build all these applications Do you need thousands more lawyers? But of course, it's not all bad storage vendors are going to be even happier because you're going to be buying even bigger discs These tools are really powerful They are really cool But with great power comes great responsibilities And I think with with these athletes with these tools like snapback and flappy flappy flat pack and snappy the the only real solution If you're using them is to start thinking like a distribution developer and maintainer You're going to have to deal with the same responsibilities that we deal with in the distribution world You're going to have to consider How you bundle this how you maintain it? What is your update cadence? How can you how do you deal with the update cadence of all your dependencies? Do you therefore end up doing regular releases every few months?   Where do you draw that line? Which of course is something like I say the the new base might be an answer for You're still going to have to develop and test everything on every possible distro Unless you bundle every dependency that you need from anywhere You're still going to have this problem of making sure that does your bundle work on these distros You're still going to have to if you're if you're doing some kind of regular update cadence You're going to have to worry about all your patches and making sure they all work again And I suspect you're going to end up crying because it's all going to break anyway And you're going to have to worry about the security side of things you're going to have to worry about Auditing all not just your code, but all of the code of every dependency you've chosen to put in your bundle And you're going to be monitored have to monitor the cvs for those bundles. You're going to have to audit those libraries And as you heard in the previous talk You can't necessarily assume sandboxing is going to be enough You know sandboxing is a great safety net that some of these tools do recommend and do use But it should be thought of as a safety net not as a solution to these problems Security is something that should be integrated by design And then you have a safety net to cover your ass when it screws up You're going to have to have a nice fast way of getting that update through and out to users very very quickly And in a relatively efficient way And of course that gets tricky if you've got all these big bundles full of all of these big libraries many many times over And you know, let's just imagine that you know, everybody's got a copy of open as a cell inside there Inside their container How many times you're going to have to download a whole new bundle, you know on the same machine Does a user really want to download 40 gig just because you know, we fixed one issue in one lib That's happened to be in 40 different applications It's going to be painful And yeah Legal side of things We're going to have to you know Anyone using these tools is going to have to review the licenses going to have to make sure that what they're doing Is the both board is work is compatible And it's compliant with the licenses that not just the original software is included But all of the dependencies and libraries are involved I think distributions can and should be part of this solution You know, I've been up here now. I've been ranting about why all this technology is bad I actually like this idea. I like the idea of containerized applications because from a distribution point of view I'm going to have less work You know if application developers are doing all of this stuff and worrying about all of this stuff and distributing it I have less packages to worry about in my distribution. I have less responsibility for those packages I I actually want to encourage this idea because I think it is If done moderately and sensibly A more sustainable model than everything being centralized on a distribution But I just want to make sure my users don't get eaten by broken dangerous apps in the process So like I said, I think distribution should be Coming together thinking about a common base for where that line is between The you know underlying distribution side of things and all of the libraries on top Otherwise the portability promise is never going to be achievable unless that exists I don't really see everybody bundling everything in every application. That will just be crazy And I also think this you know with some of these tools is kind of a Tendency to kind of paint the distributions as a with it. This is the evil that the tool is expecting You know try to get rid of oh, you don't have to worry about sending your package submission anymore You don't have to worry about this crazy view. You don't have to worry about that Distributions have these tools and these processes and these techniques because we've been dealing with these problems in the real world for years So actually looking at our tools looking at how for example the open suzer-build service works looking at how open qa works Has a surprising relevance to these technologies and you don't have to necessarily reinvent every wheel The solution might be a simple case of patching in a new package format into those tools To then handle Yeah, flappy or Snappy or flatback One last final thing for this I'm not sure despite me liking the idea and thinking, you know, I like the idea of less work I'm not necessarily sure it's actually a that a sensible way of going along Because it comes from this concept of like I say traditional distributions are too slow But they're not if it's a rolling release And in the case of open suzer with tumbleweed we have a rolling release now That isn't just some nice fancy dev branch which anybody can go on and play But is actually usable for real work it gets tested and only gets updated when the thing has been tested And not just tested from a crazy code perspective But actually automation tools firing up vms and on real hardware and running the thing like a real user will use it So you know it installs right and you know the applications work, right? And we do all of that at a pace where we can still deliver the upstream projects on top at the same pace Those upstream projects work kde plasma on the same day of release known 48 hours that kind of thing Maybe that's the better model to actually fix this app delivery Maybe rolling releases are the way to actually go with all of this and just you know Reuse that knowledge we already have reuse the tools we already have we use the infrastructure We already have in these communities in these distributions And just angle them way faster And yeah way more We're well an awful lot faster than we've ever done in the past And with that I have time for questions There's one guy here There you go No but they're Keeping the base of the distribution static and Keeping the applications updated only might be a good middle ground for example Let's imagine using Ubuntu with a bunch of ppas To update just the applications and keeping a stable core so that we avoid Big differences and big changes break the users experience I really wish you'd been in my earlier talk in the distro dev room this morning because Yeah, I basically discussed that The problem I see with that idea is You end up with that same problem with the You know that line, you know the line between the fast moving containerized thing Just becomes a line between the fast moving applications and a static distro below And you end up with compatibility and reliability problems with that line In reality, if you want to do a rolling release properly, you have to be prepared to move everything Your application is going to want to change dependencies right down the stack Have the tools to change everything right down the stack and Yeah, you have to find some way of preserving its stability, but you can do that So, um When we're talking about moving the line, why don't you just move the line down And include the distribution with the whole container. So actually is really a virtual machine Well, then it's a virtual machine Yeah, then you end up with the issues of you know nice big applications lots of patching I mean you can But it's not exactly a very efficient way of doing things Yeah, I have Hi rich Hello So, uh In the past we've had several libraries and things like that that end up with the binary till mostly wire related issues Uh, especially With one application using one version not being able to load files or talk over the sockets with the other application This is not something that containers are solving.  Nope Uh, is it something we can fix? I'm not asking for the fix. I'm asking if we actually can fix it I don't think it's something we can fix and I mean Basically that example you just gave and the example of non open source software Our two examples where I think this technology is awesome and should be used full stop no caveats You know as long as somebody takes care of all the responsibilities You know, that's that's where these actually solve a real problem But using saying this is a universal packaging tool for everything I am not convinced Here I have a question. I don't see where The the rolling release model, uh, how the really rolling release model could, uh Fix the test matrix problem. This is one of the problems we have in distributions is that An application may rely on several libraries with different versions and another one another Application would rely on other versions. You can test everything It increases complexity and that's why this is all put in containers Because you have the control as an application developer on which versions are used So I don't see how the rolling release solves the problem Is it supposed to solve that problem? I don't know I I think rolling releases go some way to solve that problem because they So assuming assuming your rolling release isn't just a collection of packages But is a a cohesive distribution that it's like built with for example, you know Dependency consistency and you know, you make sure it actually works So like with open suzer obs make sure all the dependencies actually work together and the distribution, you know is cohesive and works There's not just random packages all over the place So so in that case your build process is found we'll find out where you have these, you know multiple applications fighting for different libs Um, and then it's a case of either packaging or dealing with those upstreams It's these okay. This might help. This was kind of the example he gave there Of you know, there are there are cases where these tools helped, but I don't think they're universal Yeah, but for example in the GNOME project, we had some problems with changes in the CSS management in different gtk3 versions and so several versions of gtk3 are not Come to be installed in parallel So one application may rely on an older version And they're more recent and another version of gtk and You have to choose which version you will install so If you're really on a distribution model, you only have one of those versions installed and I don't see how it can solve without containers Don't I think the problem needs to be libs library maintainers need to stop actively supporting multiple versions that can't be installed in parallel Shifting the blame slightly. I know Hello On the first slide, I think the first value point you wrote was that with windows 3.1 And the shared library model system all libraries dump sucy windows system One of the major problems with it was and it really was in fact one of the major problems The missing backboard compatibility of the abis But the idea of that concept even back then was That you have backboard compatibility as long as the dll names taste the same So if you just use the newest dll with the same name or in linux You use the newest shared object with the same as own name. It should be abi compatible Yep So um and as you said Things break and we use this container stuff because We have abi breakages Although there should be none So how but how is defining a new standard base helping against the In my opinion real cause of the problem that we have applications relying on Properties of the abi that are not guaranteed and specified or library writers unintentionally Breaking their abis Well the idea my idea for the standard base would be when you had those abi breaking changes You know that would require a new standard base version So at least you're tracking when those changes are you know around It's another dependency problem. I admit it, but you know We we need to spend a bit of time thinking about this and you know Well, or the alternative is every single application developer using these tools has a lot more work to do Um, and I I'm I'm not sure either solution is wonderful But I don't think people really realized how much extra work they're putting on their shoulders just throwing everything into these tools So, uh, do you have already a plan to go forward? Like which of the suggestions that you proposed, uh, you think is the best way forward Like is open suze is like trying to propose a new linux standard base Well, this is the first I've said about it.  I mean, you know, it needs as many from as many places I wanted to start the conversation here first Guys no more questions Thank you. Thank you. Thank you very much