Avoiding Maslow’s Hammer: Or the Problem of the Birmingham Screwdriver in Open So... Stephen R Walli
Demonstrates avoiding Maslows Hammer: Or the Problem of the Birmingham Screwdriver in Open So... Stephen R Walli and evaluates key implications for security practitioners.
Summary
### Overview In this talk, Stephen R. Walli explores the intersection of open-source software, standards bodies, and nonprofit foundations. Drawing on Abraham Maslow’s adage—"if all you have is a hammer, everything looks like a nail" (complemented by the colloquial "Birmingham screwdriver")—Walli cautions against the industry's reflex to assume that simply spinning up a nonprofit foundation or copying a governance template will magically yield another Kubernetes. Through his perspective working in product management and the outbound open-source ecosystem team at Microsoft, Walli deconstructs the differences between core software maintainership, community building, and nonprofit legal structures, advocating for intentional governance, mentored cultural transference, and realistic metrics beyond raw growth.
### Key Topics - **Separation of Concerns:** Walli distinguishes three distinct layers: core project maintainership (sharing outbound innovation), community building (capturing inbound innovation), and nonprofit foundations (providing legal and governance structure). Each requires distinct skill sets, from software engineering to people management and legal fiduciary oversight. - **The Role of Nonprofits:** Projects in the wild eventually run into ceilings caused by personal liability (event insurance, handling bank accounts) and the need for IP neutrality and corporate stability. For corporate open-source projects, nonprofits solve antitrust concerns and allow equal-partner collaboration without bilateral agreements. - **Infinite Games vs. Finite Competition:** Open-source foundation spaces operate as infinite games requiring trust, cooperation, and absolute transparency among competitors. Competitive behavior in these rooms destroys trust rapidly; the competition belongs outside in the market. - **Mentorship and Cultural Transference:** Documentation alone does not create governance. Successful ecosystems—such as those observed at the Eclipse Foundation, IEEE, IETF, and OpenStack—succeed by wrapping staff and Day Zero onboarding around participants to actively transfer operational culture. - **Critique of Vanity Growth Metrics:** Walli challenges the obsession with rapid growth and vanity metrics such as downloads, GitHub stars, landscape card counts, and aggregate member market cap (e.g., in CNCF and OpenStack landscapes), arguing they fail to guide healthy technical governance or project sustainability.
### Technical Details & Governance Models - **Project vs. Foundation Governance:** Early project governance merely documents the engineering practices of maintainers, whereas foundation governance deals with fiduciary duties. Walli highlights the Eclipse Foundation model: working group steering committees define program plans, while the foundation staff and board hold fiduciary responsibility, aligning budgets with strict auditing and D&O insurance. - **Standards vs. Open Source:** Standards organizations (like IEEE and posix) and open-source projects use different economic tools and processes; confusing specification development with code collaboration leads to organizational friction. - **Small Specialized Communities:** Walli cites a historical Linux video driver community where nine specialists handled the codebase; having hundreds of "freeloaders" for every active patch contributor is a natural and sustainable ratio rather than a flaw. - **Fiscal Hosts:** In Q&A, Walli endorses nonprofit fiscal hosts (like Open Source Collective) for solving early liability, brand asset holding, and financial mechanics for long-tail projects.
### Takeaways - Nonprofit foundations are essential tools for scaling ecosystems past liability and antitrust barriers, but they cannot fix broken projects or replace absent community cultures. - Governance documentation must be paired with structured mentorship and cultural onboarding (such as dedicated staff liaisons and Day Zero training) to avoid chaos. - Chasing arbitrary growth figures and GitHub vanity metrics misleads open-source projects; leaders should focus on defining clear on-ramps for contribution, establishing transparency, and playing the collaborative infinite game.
Related talks
The Linux Foundation·37 min
Michael Semb Wever · Apache Software Foundation
Demonstrates popular Apache Cassandra Problems & How to Fix Em and evaluates key implications for security practitioners.
The Linux Foundation·26 min
Christophe de Dinechin
Discusses the Five Big Problems with Confidential Containers and evaluates key implications for security practitioners.
The Linux Foundation·40 min
Bernhard M. Wiedemann
Demonstrates reproducible Builds: Unexpected Benefits and Problems and evaluates key implications for security practitioners.


