I’ve been at State Of Open Con this week - it’s been great! There’s been lots of thought-provoking material, but there was one talk that my brain has refused to let go of. That was “The End Of The Beginning: Open After Regulation And AI” in which the speaker (the excellent Luis Villa) gave his take on what happens next for open source. In this post I want to share my take on that.

The talk

UPDATE: The talk is now on YouTube, go watch it. It’s very good!

I’m not (yet) aware of a recording of Luis’ talk (though if that changes I’ll update the post, you all deserve to see Luis in full flow :P)

For those who want the written version, let me briefly summarise his argument. He tells the story of his grandfather working in aviation, and how at the start of that career it was still permissible to build an aircraft in your garage and fly it. Over time, that develops into working on the Apollo program, and the incredible complexity that comes with it (compared to the early days) and how that necessitates new rules and regulations. Finally, he talks about how, when the industry flipped towards entirely new technologies, his grandfather took that shift as his cue to retire. The argument is that more regulation isn’t necessarily bad but it is different, and even if it’s needed it’s OK for some people to take their leave at that point.

The parallels to open source are clear - we also see increasing complexity in our supply chains, more scrutiny on our assurances of quality, and more interest from regulators to make sure we provide what we say we do. In other words, we’re at an inflection point from incoming regulation (I’m not sure I took much AI from this talk, despite the title), and some (with fondness and some sadness) might decide that this isn’t for us anymore.

Regulated industries

Now, I am no expert on regulation - I’ve been a sysadmin and a community architect for my career. However, walking out of that room, I couldn’t stop mulling it over - at face value, Luis’ points made sense, but I couldn’t seem to square it with the conclusion that regulation is coming for all of open source. I 100% agree that regulation is coming, but the extents of that seemed ill-defined to me.

Firstly, it seemed to me that the regulation Luis discusses is as much on the pilot as on the mechanic - technically you could build a plane in your garage today, just don’t try to fly it. That’s a good thing! We can tinker and learn, but regulations exist to improve conditions for the wider population, and we can see the same sorts of rules brought in for drone pilots too.

That’s not the only place regulation improved things from the “early days” of an industry - here are some others: - In the 1920s silent film Taxi Ride Babe Ruth pays a cabbie to get him across town as fast as possible, and a wild ride ensues. This may be a little sensationalised, but even looking the other drivers, lack of stop signals, etc, we’d have to conclude that better traffic regulation made roads safer in the intervening century. - The days of snake-oil “medical miracle cures” and the like was rife, with people selling anything they could cram into a bottle as cures for anything from hair loss to consumption. These days, you have to be approved by the GMC to be a doctor, and pharmacology has it’s own strict regulation too. - Law also had rough early days, with a lack of written law and people dealing out “justice” a (essentially) a mob. - Accountancy also has professional bodies such as the ACA, and the GAAP principle. I can’t speak to early days here, but the state of the industry has definitely evolved.

So, we have plenty of examples of professions where regulation came in, sorted out a bunch of “questionable” behaviours, and made things better for the populace. Fine, and in that vein I think Luis could be right - except that’s not the only way of looking at coding…

Creative professions

As a counter example, let me look at writing. While the above professions all require an external body that grants permission to work in that profession, writing does not. The only requirement is to put words on a page and put them somewhere for others to read. That makes you an author - but perhaps it does not make you a successful author! That requires people to buy your work (financially or ideologically) and spread the word. Having a publisher helps - but then you’re involving an external body again, one that can make choices about you and you “skills”. That’s similar to needing accreditation by the GMC or the ACA.

Crucially though, an author doesn’t have to do this, they can self-publish, or find a different publisher. Authors aren’t above the law (if you write libellous material, or break copyright, expect trouble), but beyond that there are no arbiters of a “good” book, only opinions. Indeed, there are many books that are of questionable value (in my view), but getting them pulled from sale because we think their ideas are “dangerous” would (rightly) cross lines of free speech. Regulation in the sense of restricting how the work is done, and how it is documented, in order to improve performance & safety, isn’t a thing in writing (I would argue). You can make similar arguments for graphic artists, musicians, film & game makers (although we do have age classifications in that case, so a little muddier).

Where does open source land here?

Thus, the question resolved in mind to “is coding a creative profession?” and I think I have to conclude yes. It’s an act of creating something that did not exist before - an algorithm, a UI, a process - rather than the application of a skill such as diagnosing a condition or navigating a course. I definitely don’t want my accountant or my chemist getting creative!

However, I said at the start that I do think regulation will come to open source, so how to square that with creativity? Writing or music is not a good enough analogy, so let me turn instead to one of the oldest comparisons for how open source works - baking. We’ve often explained to others that contribution to a project is like working together on a recipe; that if we make changes to the recipe we should share those changes back for the improvement of all - but I think we can take this further for regulation.

No one would disagree, I hope, that regulation of food companies is a good idea - in fact, Sam Johnston pointed out in another panel that the reason we can trust the nutrition labels on food is because of the regulators. Our health depends on enforcing that system. Even at a smaller level, the cafe down the street has to have hygiene and food preparation standards, so that I can eat there with confidence - again a regulated matter. But I don’t have to do that when I bake for the school fete, or for my friends enjoyment. No regulation applies to me in that scenario - and I think that is where I land with open source.

In much the same way as cooking/baking, I believe coding is a critical skill in the modern world, and that we should be teaching it alongside reading, writing, and maths. Simple Visual Basic or Python would enable so many people to be more efficient in their day-to-day, be they librarian or shop-owner. But in a world where anyone can learn to code from YouTube, can we really expect to regulate everyone?

The “big food companies” here are the distributors - GitHub, GitLab, etc - they provide much of the “ingredients” I might use in my project, and I can buy that they will face more regulation, and that much of that could get passed on to users (“do you have a license to upload code here, son?”). Some will be OK with that - but those that aren’t may well take their code to self-hosted platforms such as Forgejo or Gerrit. And smaller “bakeries” too already face requirements like SBOMs and so on, that won’t go away. But the passion projects, the scratch-an-itch tools … I don’t see how that works, any more than I can see how you’d regulate me baking for my friends.

Conclusion

I enjoyed Luis’ talk, I really did - but I hope he is wrong. Perhaps I misunderstood the premise, and he’s talking specifically about companies built on open source - that would also change the argument, somewhat. But I’ve spent a good chunk of my career as a community architect, and I’ve seen how many people just want to make a contribution to help others. The idea that they might face regulation, or that I (as the project lead) might have to turn them away because of regulation … that doesn’t feel like “The End Of The Beginning” - it feels like “The End”.