Impactful Contributions to Open Source Security

Get the app

Episode 244: Jan Lehnardt & Alba Herrerías Ramírez of Neighbourhood.ie

Sustain

chevron_right

notes

CHAPTER

Impactful Contributions to Open Source Security

This chapter highlights the positive impact of correcting Common Vulnerabilities and Exposures (CVEs) in the open source community. The speaker emphasizes the pride in contributing to the Octo project and the collaborative efforts made to improve the accuracy of vulnerability management, ultimately benefiting all users of these software projects.

00:00

Transcript

chevron_right

Play full episode

chevron_right

Transcript

Episode notes

Guests

Jan Lehnardt | Alba Herrerías Ramírez

Panelist

Richard Littauer

Show Notes

In this episode of Sustain, host Richard Littauer engages with Jan Lehnardt and Alba Herrerías Ramírez from Neighbourhoodie, a consultancy company based in Berlin and the Canary Islands. The discussion delves into Neighbourhoodie’s work on sustaining open source projects, their collaboration with the Sovereign Tech Fund for enhancing open source project's bug resilience, and the technical and ethical facets of their consultancy services. Insights are shared into their past and current projects, including PouchDB, CouchDB, and their contributions to humanitarian causes, emphasizing their focus on creating a sustainable impact in the open source community. Press download now to hear more!

[00:01:55] Jan explains the origin of Neighbourhoodie, which began with the Hoodie open source project, how the company evolved, the decline of the Hoodie project due to timing and resources, and how CouchDB and PouchDB continued to thrive.

[00:04:27] Richard asks about the company’s name and its novelty domain, and Jan gives an overview of Neighbourhoodie’s size and slow and steady growth, and their focus on a positive work environment.

[00:05:51] Jan gives a detail explanation of CouchDB and PouchDB’s functionality, particularly their offline-first and synchronization capabilities, and how this has been used in critical projects like the Ebola vaccine.

[00:08:41] Richard asks about maintaining ethical work practices and avoiding projects that conflict with Neighbourhoodie’s values.

[00:09:53] Jan discusses how Neighbourhoodie balances reinvesting in open source projects and expanding the company, focusing on professional services around CouchDB and PouchDB.

[00:11:53] Alba describes her role in leading Sovereign Tech Fund (STF) projects within Neighbourhoodie, and how they engage with various projects to offer support.

[00:13:31] Jan explains the STF’s Bug Resilience Program.

[00:16:33] Richard asks about the potential ethical dilemma when third-party consultants like Neighbourhoodie might be taking work that could have otherwise gone to maintainers themselves. We hear how Neighbourhoodie, the projects, and the STF agree on statements of work, including milestones and time estimates, to ensure fairness and proper allocation of resources.

[00:21:23] We learn from Jan that dealing with low-quality bug reports isn’t a primary focus of their work, but improving test coverage, dependency updates, and CI/CD processes helps mitigate these issues as a side effect.

[00:22:54] Alba talks about the different types of projects they work in, such as OpenPGP.js, Sequioa, Yocto, PyPi, Systemd, PHP, Log4j, and reproducible builds.

[00:23:49] Jan discusses the challenges and learning opportunities that comes with working across diverse projects, each with its own set of tools, communication styles, and cultural contexts.

[00:25:29] Richard reflects on the complexity of open source sustainability and Alba describes how they research projects and identify areas where they can provide the most help, tailoring their approach to the specific needs of each project.

[00:27:25] Jan explains that they don’t dictate solutions but rather collaborate with projects to address their most pressing needs, often helping to mediate between different parts of a project to find common ground.

[00:30:07] Jan explains how they educate clients to take responsibility for the scripts they deliver, unless there’s a long-term support contract in place.

[00:32:00] We learn how the Neighbourhoodie transition was organic and not part of a grand strategy and how they continue to contribute to open source through their consulting work.

[00:34:54] Richard questions the choice of open source as the main focus given its limitations, and Jan explains that open source is widely understood and accessible, making it a practical choice for their work.

[00:37:35] Alba and Jan share some highlights and fun things from their work.

[00:39:32] Find out where you can follow Jan and Alba online.

Quotes

[00:02:19] “The goal was to have two separate entities so that when the company puts out an open source project in its own name, and then the company goes under, and the project goes away, we wanted to not have that.”

[00:24:08] “If you do software long enough, you realize that the technical problems are just the sideshow and everything else you have to solve things on the people layer instead of the technology layer.”

[00:25:06] “The current monoculture of everything is on GitHub is not the only truth out there.”

[00:35:34] “Open source is the thing that everybody understands.”