Transcript: The Future of Python - Deb Nicholson

hi welcome to another episode of django chat podcast on the django web framework i'm carlton

gibson joined as ever by will vincent hello will hi carlton hello will today we've got with us deb

nicholson from who's the executive director of the psf deb thank you for coming on joining us

yeah it's great to be here yeah thank you for coming on i it i i i thought that we had you

on already but that i think that's just because i've met you i met you at django con us this year

and you were very helpful talking to um to me and anna on the django software foundation board

or maybe it was heim one of us you've been very helpful with the django community and so

um it's great to have you on and uh and talk about your work and how python and django

interact because on our end sometimes people think that we are just we django is just a subset of the

psf oh i said i don't know if you you probably don't get that but i imagine people assume that

the psf is like this godlike thing that controls everything and has an infinite budget when in fact

oh maybe you could say like what's this what's the setup of the python software foundation for

those who aren't aware uh so um i have yet to find the godlike budget um if there is one uh it is

being hidden from me uh but i'll keep looking uh we do get uh we do get a lot of um people who

probably think we're in charge of other things i i hit this sometimes with numfocus like i'll

get notes and i'll be like hey can you hook me up with a pi data ticket and i'm like um no

um not because i don't want to but because it's not our conference um but luckily i know whose

conference it is so i can be like oh you should speak with leah she's great um and can talk to

you about pi data um not so much on django maybe because the name is a little different i guess um

Like all the NumFocus projects have, like almost all of them have Pi in the name.

So that probably makes it a little more confusing.

But I think for Django, like people, it has a different enough name.

Maybe from further out, but I've mostly been talking to people inside the community.

So I haven't hit too much of that confusion.

There might be a couple of people out there that think like you're a fiscal sponsoree of ours.

I don't know.

Is that available?

Yeah, we'll get into the fiscal sponsorship stuff later.

Okay, so Deb, there's lots of talk in the Django community

about how we need an executive director.

We need someone to do your job

because basically we're all like this,

juggling so many balls in the air

and we can't do it and lots doesn't happen.

But what on earth is an executive director?

It entirely depends on the size of the organization.

So like many years ago,

before I came to like open source nonprofits,

I was working in a small place with like three people and we hired someone who thought like she was going to sit around like madmen and dictate letters and people would bring her fizzy water and stuff.

And I was like, oh, there's only three people here and you're one of them.

I don't know. Like, I don't know who you think is going to take a letter.

So for a small organization, and before this, I was at the open source initiative as like the general manager, which is sort of like the executive director, but without the title.

And now they have an executive director, but it's the smaller the org is, the more hats you wear, basically.

PSF now has, so we have an events team.

We have like folks that work with the community, like all different parts of the community.

And we have infrastructure, and particularly with a focus on security, which is sort of a thing that we have all decided that we're going to finally pay attention to in open source.

Great.

So there's about 12 of us.

So it's a little, no one brings me a fistful of water.

But nearly, nearly.

But, you know, there are a few things that, like, I, you know, I can delegate to other people.

So my job, like, with that size of organization means I am paying attention to a lot of the staffing, making sure that, you know, kind of the, like, places where the different work meets, you know, isn't shifting and stuff in a way that's, like, confusing or not fair or too much for somebody to do in a regular healthy work week.

So there's that.

and then also i kind of like take on everyone has their like stack of things that they do and then

if something comes in from left field like then i i take a look at it um if it's high profile i'll

take it if it's like uh something that we should be doing i kind of figure out where it would go

in the organization uh or how to respond uh so i get like all the weird yes that makes sense um

which somebody needs to because otherwise people ever everyone is getting out of band stuff and

then you have a whole organization of panickers that are just like oh my gosh should we watch

twitter like uh with our teeth gritted like all day like the whole staff and it's like no like

maybe one person but not all 12 of us because that's not very good use of time oh yeah oh

in on x right so so in to give you um so in django we have the two django fellows so it's one and a

half um full-time roles basically and but but their role is very much like to look after the the code

side and to do the ticket um triage and the ticket report request review and really do the releases

and security things but quite often there'd be these kind of other jobs which oh well let's ask

the fellows or that's and it's and they pick it up but it's not the role and so that's kind of

and they don't have capacity to take on very much more so right

that's and on the admin side historically it's been the president and the treasurer who've

taken these up and actually i mean you know you when you when you spoke with us deb

um you know it was just this like oh my god that's exactly exactly what we need because

all the things you listed are all the things that I think any tech nonprofit of a certain size,

which the DSF is and PSF is, needs. And I mean, a big one that the DSF, the current board has

been working on is having working groups, because historically, on the DSF board, the members did

the work. And if they didn't do it, it didn't get done. Whereas I know the PSF has been a little

bit better about basically agreeing on what should be done and then delegating and maybe one person's

involved but it's more of a i believe overarching role rather than like oh and you're actually going

to do it all in your uh you know volunteer time yeah well and we've been looking at some of the

working groups too and um kind of realizing that most of them need like a staff person a staff

person to kind of like help them stay even keeled because um i mean volunteer involvement kind of

has a little up and a down to it and so um having that staff person that sort of like makes sure

It's like, oh, I set up this month's meeting, even if it's only like two thirds of the committee, like we're going to meet and report out on progress.

And if somebody's stuck or something or like, you know, people didn't want to like spend their own personal money to set up some account or whatever.

And it should be the or, you know, like all these weird little things that it's like, like volunteers are either don't want to do or don't know if they're allowed to do.

If you have a staff person that is meeting with them occasionally, it's like, oh, no, no, we're allowed to, you know, pay $10 a month for that thing that would make the work better and stuff like that.

But it also helps keep it, make sure like the meeting happens.

And so we're sort of looking at how to add that to like a lot of the working groups and get that support in there.

the other thing you said there was not one person not taking on too much because that often happens

is that you know they're the hero and then they take on another thing and then another thing and

then another thing and then yeah eventually they just blow up yeah exactly and so um the other

thing i think about with non-profits is uh like i don't know if it's like tai chi where you go

where the energy is right so like carlton does tai chi by the way so you're oh okay that's why

he's beaming you can tell me i've got a class just after this analogy um but so like if you

take a volunteer it's like oh i i love the community i love writing code and then you're

like cool can you learn how to do a 990 filing with the irs that's what i did for the dsf that's

actually i still i still got pinged i can say this i still got pinged for like finding an old

one for this current year is one so it's when katherine yeah it's hard because that one is uh

like you're using more of your uh like your store of volunteer enthusiasm by getting someone to do

something they definitely don't want to do and have never done before and are not interested in

learning how to do yeah then when you just ask people to do things they like doing and are good

at and enjoy or maybe you're on their personal growth roadmap like oh i always wanted to learn

how to like talk to people more or do more writing and it's like oh awesome that's great

almost nobody has like i've always been curious about filing 990s on their personal roadmap unless

will that's your kind of back though oh yeah i mean i'm an odd duck i'm an odd duck because i

have an mba and our um the the board's assistant katherine holmes actually has an accounting degree

but yes most people most people are like yeah i want to like community and code and it's like

oh no be a manager and and by the way don't don't mess these things up like um i don't know how many

how many skeletons in the closet i want to talk about publicly but you know it doesn't always

happen the way it should and then you have to uh there's a whole process for if you miss

you know not under my watch but if you miss uh filing a 990 there's a whole you know but yeah

oh yeah many years ago i was on the board of arts non-profit uh locally here in massachusetts

and um at some point like we had the person who was doing the accounting for us like we just were

not grateful enough and so she was finally one year it was like there's a bag in my closet you

can come by when i'm not home to pick it up and i was like oh wow that was the account okay oh i

can't wait to see what's in the bag oh we're really that's like the movie seven yeah what's

in the bag what's not in the bag um and so uh yeah so like and that was like someone who was

like i want to make art and we're like you get to do the accounting yeah i mean like that had

started before i got there but i was like really oh that's so weird is it sort of like a performance

art accounting no no it's real just regular accounting yeah well in that especially as an

organization you know as the jango software foundation it's sort of stayed the same but

the PSF has definitely grown. You know, you go from manageable to not manageable with these

things. I mean, like, I'll give you one example, and I'm sure there's a PSF equivalent where

the DSF has had a sitting cash budget or, you know, reserves of around, I think it was around

$200,000. And Pete Bumgartner, who was the new, took over as treasurer for me, though he's now

off the board, was like, hey, this is just sitting here. Interest rates are high. Why don't we put

it in a high yield account and get 5%. Um, so he did. So that's $10,000 a year that the DSF is

getting that they weren't before, but it's, you know, he just happens to know that cause he runs

a consulting business. And that's kind of why I was like, Pete, I really want you to have this

role. So there's, yeah, there's so many things like that, right. That are separate from community

and code, but are vital to running the thing, keeping it sustainable. And, um, yeah, so, uh,

it's it's a kind of a miracle the dsf is still as functioning as it is given all these uh concerns

yeah the other one i think people are surprised about is that uh like when you talk to sponsors

it's a little bit of a customer service relationship yeah and people are like what

and i'm and you know i don't like i have done customer service and so i'm like yeah no people

excited to be thanked a couple more times than maybe you think is strictly necessary

because they're not involved in your work and they're just writing a big check like that's

you know um and so uh so that when i've seen um like smaller projects without staff kind of choke

on and they're like why all the paperwork like they're writing you like a hundred thousand

dollar check like there's gonna be some paperwork get over it yeah well and that's the thing is that

I mean, the DSF has, I think, suffered from the fact that we're just so small because a larger,

like, let's pick a large company. A, they don't want to bother writing a check unless it's a

certain amount. And B, you know, yeah, they have, there's a whole well-established process for

asking for grants, maintaining those grants, thanking them for the grants. And, you know,

when it's just board members, you know, who are software developers, we definitely drop the ball

on that um so that's that's a scaling issue for sure yeah well and it's again it's probably

something that um you want to have staff doing again like most people don't have like oh i would

like to have a lot of high stakes meetings about money with strangers on their personal growth

roadmap unless fundraising is a skill they want to develop right right yeah yeah and it is a

separate skill that's the thing yeah it's not i went to public school in the u.s that's the cheap

one that you get to go to for free and um so that means we just like fundraise all the time so i

grew up like i'm sure the neighbors were like oh god it's that nicholson girl again because i'd be

like oh today we're selling wrapping paper for the elementary school hi today it's cookies for

girl scouts like tomorrow i'll be back for like with you know candy bars for the band like

everything we just like we're constantly like you're you're giving so much like i'll see you

get this chalky candy bar yeah my wife and i are in the pto here actually i'm the webmaster yay

um but um well i'm gonna resist going down political angle on that one but yes it is a

it's a whole thing in many places but maybe um yeah carlton we're just gonna jump all around

carlton mentioned the fellows the psf has some new fellows right i believe can you talk about

we call them developers and residents but it's like probably about the same thing

so uh so wukash like um i guess like before i got here it was like oh we should eventually have

three people doing that and then the pandemic came and was like whew wow what's going on with

our finances and it's like well we're not hiring two more people that's what's going on for the

first year or two um and then we're kind of finally back around again where it's like oh i think we

could do this so he he wrote a blog post a little while ago and um was like i could really use a

second person and so we had someone respond almost immediately at bloomberg was like we would like to

hire that second uh c python developer person and that's peter and then uh we also it was like

someone we got an anonymous donation like hey how much would it cost to just complete the set that

we talked about a while ago and uh so then we were able to also offer position to sir hey uh both of

of long history with the c python community like lots of people are familiar with their work so it

wasn't like surprise where these folks come from uh but it was just like oh finally they can just

like full-on work for us and instead of uh you know do a lot of unpaid work for us that's a little

less directed so it hasn't changed so much they both are sort of coordinating with wukash and uh

So the work is more directed, but also they're both able to work for us full time, which

is fantastic.

So Python's a much bigger thing than Django.

But I've always felt that the Django Fellowship Program was for Django, like the reason

why it was able to keep going over the the long run so jango's 18 this you know last year it's

going to be 19 this year 20 next year we'll buy the beer in a couple of years time but

there's no way it would have got there through that 10 to 15 year age group without the the

fellowship program coming on because you know it was in trouble and then the fellowship program

started and then all of a sudden actually jango's as strong now as it ever has been and that's just

because of the i guess the limits of volunteer effort and i'm is the do you know that is the

feeling the same there in python actually the the verb in residence is is about the sustainability

secures the sustainability of python yeah it's and it's about doing those things that aren't

really anyone's passion project but like really need to get done like yesterday wukash was working

on build bots which he's like there's no way volunteers would want to do this um yeah it's

his he was just like i yeah i'm like gonna be on this all day i'm like okay great um but like i and

i'm so glad you're doing it because there are a lot of things like that in c python so it's it's

just like there's also you know we have the pep process and um a lot of times the pep comes in

and it's like whoa we still have a lot of questions about this one um uh it seems like like maybe the

writer had the like has the answers but didn't share them or didn't know that we would want them

or how to share them or whatever.

And so, like, WCAG does a lot of work with people who are proposing PEPs

and, like, hey, so, like, just so you know,

like, when the steering council looks at this,

they're going to want to know how it interacts with this and this and this.

So if you include that, your PEP is going to have a much better chance

of being taken seriously and considered on its merits

as opposed to, like, whoa, I don't know what that would do.

Yeah, I can imagine that helps a lot.

i always joke that it's hard to get a feature into django but i watched the odd peps go through

and i think wow it's really hard to get something into python it's but as you said it's big and so

um everything that everything we change touches like a zillion yeah so many people yeah yeah and

then it's it's like even just dealing with the like you know people have thoughts about the the

things that are being changed you know we have a whole we have a whole forum for discussing them

um and which is good like i want you know i actually wish people would tell us you know

politely but like you know more about like how they're feeling about different pets because

then we could foresee more of the places that it touches um so that one's always a little

frustrating when it's like oh okay like on the on the forum or something it feels like we talked

about this for like a year and then someone's like hey it broke my thing and it's like oh we

were we've been talking about like how we're gonna make this change like forever and like there was

like a lengthy i i guess you didn't get your invite or i don't know why you're invited in

case anyone's listening to this and then like how do you get that invite you're already invited like

yeah just come and tell us about how uh changes coming down the pike will affect your code

but the people who are listening to this podcast or on the forums or on the you know the python

and ideas, they're such a small subset of the user base.

It's always the case, oh, we thought we'd done this right,

but it turns out we broke that, or this happened,

or that happened.

Yeah.

Well, or the classic thing with open source,

which is like, oh, we have been re-implementing a bug

that you fixed like five years ago internally,

because our stuff rests on it.

And we just didn't want to mention that,

because it's like our trade secret or whatever.

and then it's like oh we changed the we changed it so you can't even just re-implement the bug

anymore and then they're like kind of upset and i'm like how how are we supposed to know that

you've been secretly re-implementing a bug internally like um for like five years like

that's i just yeah there's no win there's no open it's and then we can help you but if you're if

you're doing it secret inside and not telling us then like we can't really account for it yeah and

then when those things do happen it's kind of a thankless task in that there was nothing you

could have done right in that case yeah well i think i'm not going to beat the drum too much

on jango's executive director needs because i've already talked about it but i think i'm sold how

do we get one well i was gonna say i think i mean i've talked i've talked a lot with um you know

jeff triplet for example who was on the psf board um and i think the easiest and we've had and i'll

just say we've had discussions of these at the most recent DjangoCon, DjangoCon US, DjangoCon

Europe, smaller groups. So I'll just share it around how would we do it if we were going to

have an executive director? And I think the easiest way is to get the fellows program funded by

Bloomberg, pick a place and say, for two, three years, do you want to sponsor the fellows? Because

for the DSF, our budget is two thirds or more fellows. So if we got a company that said, yeah,

for three years, I'll sponsor the fellows program, which is less than the, which is like the cost of

a single developer for a West coast firm. Um, and then they can get whatever marketing they want.

That would get someone in Ohio. Yeah. Right. Then they would get, then we, then we could have an

executive director for three years and, you know, see all these things that would happen. So I think

that's to the extent there's a magic bullet, I think, but you know, then it requires, uh,

someone within the dsf community who has the knowledge to go through that process with with

these big companies right and and to the customer service do you think it would necessarily have to

be someone from within your community to be the executive director personally no i think in some

ways it might be better if it's not actually yeah uh so i mean the first thing i would do if i was

to hire an executive director for an organization that hasn't had one before is make a list of

things that the board is doing and doesn't want to do or is doing and is often feeling like they're

too late. Like, oh no, I really need to be doing this every day and I can't, I only can do it once

a week. Like, so list off those things and then list off what you think the organization needs

to get to the next place where you don't have to worry about, so you get like a certain amount

of funding. And then, so I'm guessing fundraising is going to be on that list. That person is going

have to be doing a lot of fundraising and be really good at creating new connections and

bringing in money. I mean, there's low hanging fruit everywhere. I mean, one thing we should say,

I think maybe not everyone in Django knows that, you know, during COVID, we, DSF, was actually in

a fairly strong position because, you know, the PSF was conference-based largely, right? So no

conferences kind of blows up the budget, whereas the DSF, we do have conferences, but they are not

big fundraisers so um we were in a you know it was less of an issue for us but i know that was

i guess you came in midway through that right that was a little bit existential for the psf

when you say we have seven figure costs and then our main fundraiser goes virtual um you know was

that right what was the timing of when yeah it did it did work i came in um right before uh like

just a couple weeks before pycon in 2022 so i showed up and no one had met me or knew who i was

and so it was amazing because like uh like i had all these great conversations i actually remember

this young woman who uh i sat with at lunch and she was like can you believe it i've only been

doing python for six months and the people who run this conference paid for my travel to come here

and i was like wow that's great which i was like i i love that i'm so glad that we're supporting

you so early in your journey but i don't think she knew she was talking to the executive director

well isn't that great though like when people are just yeah they give it to you i know so i got to

it was a that was really interesting but yeah i did i joined during the pandemic and i and like

just like came on like three weeks before the first conference back in person okay yeah because

we did have i guess in 2021 we had eva on this podcast talking about her journey and you know

coming up as a conference organizer to um to where she was so yeah that was always something that was

like you know uh on the dsf board we like well at least at least our funding isn't all wrapped up in

this one thing that covid blew up because yeah that was well and we've been working on like sort

of like pulling you know so that we're not quite so dependent on the pycon funding um and like

you know working on more programmatic sources for uh income you know like all of the like folks that

fund um people that to work on c python or to work on security at the psf amazing like uh meta and

bloomberg uh aws and uh open ssf like all of those uh are program funding not python funding

carlton if you if you i have a whole list of questions so raise your hand

i'll jump in when i've you know well i wanted to say so um i i was in the audience for your

talk at jango con this year which we'll put a link to which i love that talk i love i guess

the softer talks um could you could you could you um like briefly describe that yeah because i it

was a really i love i love those kind of talks i should say actually i met carlton and i connected

because he gave a similarly non-code heavy talk

about growing old gracefully as a developer.

And I wasn't there in person,

but saw it online and reached out to him.

And then that started this whole thing.

So yeah, so your talk, what was it about?

Yeah, so it was about meetups

and it was really just a love letter to me.

So I used to be the co-organizer

for the Boston Python meetup many, many years ago

before i ever thought of coming to work here as the executive director um and i i love the meetups

i think uh it's it's so interesting to uh be able to like kind of have each community customized

locally to like what people are interested in learning what people are interested in doing

like what kinds of activities they want to engage in together um and doing that and then like what

i want to do is kind of strengthen the connection between uh those sorts of edges or uh like you

know all our little front doors all over the place to the community back up to the main to the psf

um so we do already like uh fiscally sponsor a couple of the large meetups including the boston

python meetup um and we run a big mega meetup account which like a lot of the django meetups

and python meetups are on so like we pay one fee and then we get unlimited meetups well not

unlimited but we haven't hit the limit yet um and then uh we you know are always like kind of

looking at what other ways could we help uh meetups do their work um and so that's a sort of

uh on my on my list of things that i want to do as you know is are there other resources or things

that we could provide besides the meetup account or for meetups that want to, uh, be a fiscal

sponsoree, uh, you know, a PECS card, which is like a debit card. So they don't have to buy pizza

with their own money. Um, so yeah, well, there is, um, I was meaning to tell you that the Django

Boston meetup was an active one pre COVID and it's actually getting back together. Um, and I believe

I'm going to be speaking at one of the first ones. And actually, they were like, who else

should we invite? And I was like, well, do you know Deb? So I don't know if they've reached out

yet. But if not, I'll coordinate that because that's another. And actually, I don't know if

they're aware of the meetup thing that maybe they could get under that umbrella. I'll reach out to

them. But yeah, you're completely right. I mean, especially in a city, you know, Boston's not a

huge city, but it's big enough. There's the Python one, there was the Django one, there's all these

different ones and there's yeah it's like it's the cross-pollination too is really great if you

like i for a while i was going to a whole bunch of react ones and yeah just to like see python

oh just it's like one of the largest meetups it's a like 10 000 people are on that mailing list

yeah it's great i mean and there's multiple ones right because there's like the yeah come to come

together and like get help with your project there's sometimes people give a talk they're

all run under the same umbrella by ned bachelor um but it's uh yeah like before like when i was

there we were doing um we were doing talk nights uh hack nights with like one beginner table and

then eventually two beginner tables because we had so many people coming in as beginners

and then puzzle night which was like two or three people would go and do the same puzzle and then

talk through their solution so that people could see like different ways to attack the same problem

um and then like once or twice we had like someone some author let us know like hey i'm

gonna be in town and we're like all right we'll just have like an author meet the author night

like a python a python author oh wow yeah so um now i can't remember their names i'm sorry that's

okay there's a few of them yeah it was it was like over 10 years ago so um but yeah we so we

were doing a lot of different things and then uh it's that the meetup in boston continues to evolve

the thing is is that boston for a smaller city i mean smaller than new york and los angeles i guess

but um is a huge python town because we have so much biotech like people are working to like to

cure cancer or and like uh like build solar energy and like all these like all this different science

stuff because we've got mit um so like everybody is in cambridge like when i took the job at the

psf everyone's like oh python i use python everyone told me they use python like everyone i met for

like a whole year was like oh yeah that's great i totally use python for this and they would tell

me what they use python for and all the students because python is i think the most popular it's a

huge student town too because like we've so we've got like not just i mean we have mit but we also

have harvard and uh which has a computer science program um seems funny because it's just on the

from MIT, but it does. And Boston University, Boston College. Yeah, Northeastern. I mean,

Wentworth. There's a whole ton of them. Yeah, there's a ton. And a lot of them are using Python.

So for the size of town we are, it's an extremely big Python town.

Yeah. You know, thinking out loud, I should host a Django Girls night for the Django Boston thing,

and I can talk to Ned about that, because there's probably some way to

joint do it because especially during the school year um i think it depends on the event you don't

always get college grad graduate students but there's so many people who are interested in this

yeah so oh yeah i think that'd be great and i just someone just told me the other day that

they thought the boston pie ladies meetup was maybe getting revived again oh okay which is good

like just a lot of meetups took a big hit during the pandemic it was like you know it uh

part of it was really meeting in person but there's as well post post covid or not even

post covid it's not gone anywhere it's still there it's like the the big conferences it's

like yeah you really want to go but also there's a can then we do a smaller meet up locally that

might be safer or easier and it might be more environmentally sort of sustainable this year

in pittsburgh is going to be masked uh we made a choice to continue to uh not pretend that covid

is finished and especially bringing people from like you know 100 different countries around the

world uh all coming in with the latest strains of whatever they got on the airplane it's like

maybe you know i mean like i don't know if you went to a lot of conferences in the before times

but you know i would get like a cold or flu or something every single one like a couple times a

year just like oh i guess that's just my job i go and i uh like kind of sample germs from like 50

different countries like every other month

and then see what I brought home

so

it's like being a preschool teacher

well they had

Well, you know, DjangoCon was masked.

And yeah, personally, I think it's a good choice,

but I know it's a difficult one for organizers.

Yeah, people are, it's interesting because like,

so on the one hand, we get these like,

oh my gosh, I'm so glad this is the only conference

I'm going to be able to attend this year.

Like, thank you, thank you, thank you.

You know, and then we get the other end,

which like sometimes goes from like a pretty sincere,

Like, I do find it really hard to socialize when I can't see all of people's faces.

And I'm like, I get that.

And we are, like, looking at, like, can there be outside spaces or, like, you know, that people can hang out in.

Because we're a little later in the year this year.

But then other people, it's just like, oh, you SJWs with your face diapers.

And I'm like, okay, okay.

I know when I click over to the rest of your profile on X, I'm not going to be sad that you aren't attending our event.

Yeah, yeah.

Just say thank you.

Thank you, next.

Yeah.

So it's, yeah, it's just, it's like, yeah.

And I get it.

It's like, I'm looking, we are looking for, like, ways that we could hold a safer event.

So, like, this is our first year in Pittsburgh.

So we'll be looking at some of the airflow stuff and seeing if, like, maybe we could just have the talk rooms or put, like, more airflow into the talk rooms and make it, like, more of an optional thing.

but still have like a good, you know,

like not a crowded telephone booth

with five people all breathing in each other's mouths

kind of situation.

I mean, yeah, in these times,

if you're all sat in a tight auditorium

and there's, you know,

I don't know, a hundred of you in a small room,

it doesn't seem too much for us to just put a mask on.

Yeah, yeah.

And I guess it's harder for the hallway.

Like, so that's like one of the other things,

like I know I've seen other conferences

that were like, oh, you mask in the talk rooms and in the hallway, which is huge and spacious.

Although I don't know how huge and spacious our hallways will be this year.

So if they are great, then maybe we'll do that next year.

Switching gears slightly, I did want to ask about, so the PSF has gotten involved in some

legal things, specifically the EU Cyber Resilience Act.

I wonder if you could speak to that and why is the PSF getting involved?

I would say more legislative than legal.

That makes it sound like we're discussing.

Okay, sorry.

Yeah. But yeah, it was just like I mean, understandably, European legislators were looking at this situation where there's this giant loophole where if you sell somebody software, you're just like, oh, if it gets hacked next week because we didn't do due diligence, like sucks to be you.

And it's like, oh, that's like not a nice feeling for European consumers.

And so legislators were interested in doing something about that.

I get it.

But then they also didn't quite have a grasp on how open source happens and how that gets developed.

And so they were like, anyone giving the software out like should be on the hook for making sure that it's liable for any product it shows up in.

And it was like, whoa, whoa, whoa.

so that's why i wrote on our website i was like you know uh so we provide all the code on our

site like both the c python side and the packaging index side uh free for anyone to use for any

purpose whatever nobody tells us when they're downloading it we don't create a contractual

relationship we just have like a little license and it's like good luck please don't bother us

about it if you put it in something dumb and um you know it's like okay um cool so you would now

change this so we would be on the hook for any product any of that code shows up in and they're

like well aren't you you know i think i think european legislators saw some of the business

models in open source and were like i mean you're providing that code because like you're gonna sell

support for it right or like you're selling the hardware and then like the code is free so you

want a free pass on the code that's absolutely part of your product and when like we actually

don't have a product here at all like and so i wrote like you know are people making money with

python absolutely is the psf making money selling python absolutely not so we are completely the

wrong place for this sort of uh you know like for the liability to sit uh so that was why i wrote

just like i think um some of the some of the larger players in open source that do have a product were

pretty well represented because they've you know like 16 lawyers on staff or whatever and someone

who can pay attention to policy um and some but the community driven projects like python were not

at the table and we weren't really being heard by the uh by european legislators because they were

like i mean i've seen this a bunch of times like in open source where like you tell someone like

oh we're making a lot of code which is a very valuable thing and then we are giving it away

to anyone at all for free and they're like okay and then what and i'm like no that's the whole

thing that's it okay wait but like there's gotta be you're gonna be coming back on the on the on

the side and i'm like no no we're it's a non-profit organization that just does this they're like

okay is there like a company next to it no there's not a company next to it so like

so it is a little you know it took some education and and talking um with a lot of different

legislators about like yeah some of those business models you've seen are happening some of them uh

but not all open source is getting uh created there and in fact a lot of the things that are

offered for free are sitting in like enterprise level stuff are running like all kinds of

applications that you've heard of uh are critically important to the like ecosystem and the way that

we uh you know we all understand computing so uh so there was you know it took some education

did did you get a result is there a yeah um so uh what happened with the legislation is that they

created another type of entity so they have like a commercial entity there's consumers and then

they created a third new kind of entity called an open source steward so an open source steward

and it's really about the activity of providing code for free without a contractual obligation

or a financial transaction.

So if you're doing that, you're an open source steward.

And that's absolutely what Python and PyPI are doing.

And that does not incur product liability.

Yeah, right.

Okay.

So now that said, like everyone else is using Python

is now on the hook for like a certain amount

of security and liability.

So I think the community as a whole

is going to want to see more software-built materials

like reproducibility, you know, that kind of thing

in the software they download.

But then they can contribute back

to the security developer in residence

who needs to build a...

I think we will have to take on some facilitation

because we can't take in 19 different ideas

about how to do security in the package index.

So we may try to synthesize folks' requests and ideas

until they've got a single strategy and vision.

Sure. I mean, Django has a security team

and we have a security process.

And I think next week there'll be a security release

and we do a good job, but it's all volunteer-based.

And it would be lovely if some of the companies

that are building products around Django felt,

do you know what, we're actually liable for this

and it would be nice to just contribute back

so that we could say that our liability was covered.

That would be a wonderful state of affairs.

We hired Seth Larson to do security here, and he's been great, like, writing about, like, his work, and he has us registered as a CNA now, and so, like, we can receive vulnerability reports better, and, you know, and he's just been modeling what he's doing and writing about it every week so that it's like any other project could choose any of those strategies and paths that he's taken to.

What's a CNA?

it is a what is it something rather numbering authority i forgot the cvc is it recursive is

a cve numbering authority yeah so it's got an acronym inside the acronym um yeah but basically

it's like you register and then anyone who's like oh i found a vulnerability like it comes back into

you but you're registered so that it's not you don't have to like know a person over here to do

it so when there's when django does a security release the blog post will be cve 2024 19258

and then it will say denial of service on something or other and that's that number is a

goes into a database of all exploits that are known and you know you can search that and it's

registered and patches can be attached this is reference that cve so you can look up fellows

don't have a cna or does someone at django have it okay so this is a this was a question is would

um is there a benefit to django setting up the cna and maybe the the thing is we sometimes have

people will try and report an issue and people are very good they go through django and but um

curl for instance has people registering cves against curl that are just bogus totally bogus

and then the curl maintainers need to um handle that so the the question is could if django were

to become its own one we would be able to say no because we'd be the only people who'd be able to

issue cves for django um and no one when we can dispute them if that were to happen but how much

of a pain is that what i'd really kind of like but i haven't spoken to seth about it was if we

could perhaps come under the auspices of the python's um authority cna there because there's

a bit of bureaucracy there which django perhaps doesn't have the capacity for but it would be a

known and a trusted thing and i don't know if that's on python's roadmap at all but it's something

that has crossed our mind is well you know now python has that authority maybe we could be under

that umbrella because it would save us it would give us a little bit more confidence in yeah in

some of the worst cases i would encourage whoever you think would be kind of responsible for

implementing that over at django to reach out to seth and talk with him about it okay i mean yeah

we do we should do that um but that was that's literally just a half idea in the back of my head

no no but it's it's like that was the point of documenting everything that he's doing is so that

other projects could be like hi i wonder what's the deal with that and it's like oh you could

actually just like see how it worked out for us and um and instead of doing all that research or

try it yourself and find out like wow that was a lot of work and not so great for us like um i don't

think that'll be the outcome but yeah yeah to register um like an actual cve it's not too hard

you have to the hardest bit is finding the right web form to do it because there's a there's a

website and there's all sorts of links and it's quite hard to find but once you've found it it's

not too hard to actually and python would you know python did offer that to other things they'd have

the same form you just you just you'd have a back channel to a human being you know to to talk to

that would be the only real well and then but then someone has to be on the other end to respond when

the things come in so you're basically putting out this big like security suggestion box and if

nobody's looking in the box then there's no point but exactly yeah exactly because it sort of

implies that you'll be looking at the reports yeah no exactly so it's yeah anyway that's just me

mind dumping so we mentioned pi pi and security there's been um i know e and their team have done

a lot about um two-factor auth which from my end went incredibly well but i know that was hard to

see that there was some negative pushback from people maybe who weren't really understanding

what was why why the reasons for that yeah so um and so uh ian dustin worked on the first like

you know initial like kind of test rollout with just the top 100 projects or so and um and then

what we realized is people just needed a lot more notice and a lot more like hey this is why we're

doing this so uh so mike fiedler who works on pi pi as our security engineer over there uh you know

he probably wrote like a like a dozen blog posts and things like getting ready getting people ready

like hey it's coming if you have questions that's why we're doing it like the whole thing he's been

really great about communicating and i think it went a lot better uh when we did the wider rollout

just like giving people a lot more notice a lot more time a lot more like why we're doing it um

and which makes sense it's community like uh some you know and and the other thing that we've found

out like as mike has been here is that like there are a few people that have a package on pi pi that

maybe forgot they had something over there like which is fine like it's been around for a long

long time and so and people move on it's like you you put something like you you gave your thing to

the world and then you moved on okay fine but um that's another kind of piece of mike's work is

looking at like what is on the package index, because there's definitely some stuff that's

deprecated and that like, you know, like it'd be fun to look at for educational purposes,

but maybe don't put into like a working live modern project or whatever. But stuff isn't

really labeled that way over there right now. But that's like kind of on the roadmap is to

make the package index a little bit more like verbose as far as like what tells people they're

downloading and like warns people off of deprecated stuff i mean but the the traffic i mean they've

the um your team has published blog posts on it the traffic is insane like and and still i think

still just kind of up into the right yeah um same with uh python gets down to downloaded like 300

million times a day uh a bunch of those are probably automated i hope good lord yeah but um

yeah it's it's um so when i say like infrastructure and you mentioned e and they do amazing work uh

like just is amazing uh but the infrastructure yeah it has been like a hockey stick and um

um it's it's a huge it's a huge thing even even with like a massive well-meaning polite users

there's still like just the like little questions and things that flicker down it's like still a lot

um and uh you know and then we also have like a lot of uh corporate users that are uh like oh

this is my my work and it needs to be like everyone else in my uh in my work sphere responds

like within five minutes on chat you know and uh and then the package index is like

we'll get to you uh so you know we're trying to match that up a little bit better with what

people want so 5pi slack discord channel coming soon is that what you're saying

i did not promise that um but we are looking to be more responsive we understand that people are

um you know like it is part of their their work and that was part of what uh you rolled out the

um organizations which is still coming it turned out the legal accounting and technical like tying

those up in a knot uh was a little bit more to untie but um but that's where uh some of our

corporate users would be able to have a little bit more control over their area um so because

when we built pi pi it was just sort of like everyone is the same like we don't care if you're

a team of 80 people at some mega company or like one person that's gonna drive by pi pi for two

hours on a bunch of red bull once in like 2002 and never return you're you're all equal to us and

it's so that's how the infrastructure is but um doesn't quite meet the needs of the community

today fine good good so one thing i wanted to ask you actually is so we talked about open source

as if kind of it's one phrase for many things i've often thought of open source as three buckets

where you have non-profits which is rare so like django is now a non-profit python is you have

corporate sponsored um sponsorship is a loaded term but like so let's say react or angular and

then you have more solo developer projects. So like Laravel, or Vue.js, where there's kind of

one person in charge, who generally also gets their funding through that way. Does that does

that track or am I like, how do you think about open source, right? Because we toss it around,

but it encompasses so many different things. And really, I think so many different business models

is really what it comes down to. Yeah, I do think there's something

different about community driven open source that's housed in a nonprofit like Django or Python,

uh, than, uh, corporate controlled open source where like all of the, uh, main contributors

work at the same company. Uh, it's just a little bit different. Um, I mean, uh, if everyone works

at the same company, they sort of have the same goal and idea about like the direction of the

software. And so is that maybe more targeted? Like, yeah, sure. But does that make it like

less of like a swiss army knife uh which is kind of how python operates yeah that too so like making

it so that the community can kind of build their own extensions and add their own functionality

means that you know python has become the the glue language we hear sometimes it's also uh like i said

it's a great language for people who don't consider themselves programmers like uh biologists and uh

and people working on the space program they're like oh like i use python every day but i'm not

a python programmer and it's like oh okay well i'm glad it's easy enough to help you get us to space

and help you cure cancer because those are really important as well um and you can just call yourself

whatever you want that's great work uh so yeah like but could you do that could like all these

academics and scientists use a project that lived inside of a corporate silo unless that corporation

decided that scientists were their customer base their main customer base probably not

so you know and then it's like the other thing with work where where people's work is always

evolving or uh you know maybe there's just one person doing like some kind of new thing like

some sort of digital humanities like specializing on letters from kings in the 1600s and it's like

do you think there are enough people for a large mega corporation to write some scripts for those

people i don't um i probably both of them uh are writing their own scripts to parse the materials

from those letters right it is it is wild that i mean just the example you just gave um so many

fields now like physics even even literature right like you you kind of have to be a side

python developer just to you know get through grad school let alone be a professor because it

it's this tool that is used i mean i was literally just talking to someone who was saying how he

wanted to he was thinking about getting a phd in physics but he was like i don't really want to be

a programmer i want to be a physicist and like you can't really do that or maybe if you're a

theoretical physicists but even then you know they're using ai to help out they're also using

yeah uh yeah the the the time frame where you could just be a guy that drops stuff off of the

leaning tower of pisa and called yourself a physicist is probably past yeah well one thing

about the corporate open source because i think i was certainly victim of thinking oh it would you

know grass is greener right especially in the non-profit world like it'd be great if there

with some corporate overlord who just like paid for everything. But I've heard publicly, like the

you know, the React team has said, you know, they had to fight Facebook meta just to open source it

like often, it's not some like, thing where, you know, Mark Zuckerberg's like, yeah, let's open

source things. It's like, you know, because that'll help with recruiting, which I would think

it would. It's like, no, it's like the team has to really fight to do it in the first place. And

then continually, you know, the needs of the for profit company come first. So many of these

corporate sponsored projects are, you know, kind of in spite of their corporate overlords,

actually, which makes me feel humanize the engineers behind it, right? Instead of being

like, oh, it'd be nice to get paid Facebook money and do open source. It's like, no, they're,

they're, you know, trying, really trying and fighting to keep it open source when these big

companies, you know, don't really want that, or they don't see that they're not going to prioritize

that i guess is the thing to say yeah and you're always like uh i mean that's the thing is that

like a corporation like is obligated to make money for its shareholders and so you you can

as long as they align make the world a better place empower people teach people uh have a nice

event like all these different things as long as they also serve that goal of making money for

your shareholders the minute those two uh unravel um all of the other things go out the window it's

going to be making money for shareholders and that's not like like you said it's not anything

about like the people working inside those companies or they're participating in those

systems it's how that system is set up like if you if you were going to create a new thing from

scratch now and you were like oh what i don't want is for us to uh have to do like ethically gross

things or whatever then setting it up as a for-profit company is gonna be and you're eventually

gonna have to pay that bill so if you want to if you want to build software to make the world a

better place and empower people and that's your focus then you either need to be doing it as a

501c3 charitable organization uh you might consider like doing a cooperative where uh you're all all

of you have signed like a contract saying that you're going to like keep community needs first

and not take certain kinds of clients that you find ethically objectionable, or you could set

up a B corporation. So there's a couple of companies like that in the US too, which is like

a social benefit corporation. So you are allowed to sort of split the difference between your

ethical goals and your financial goals without always raising the financial goal to the detriment

of any ethical goals that you have added.

One last question for me and then I'll let,

and I know we're coming up on time,

which is around, we talked a lot about communication,

like, you know, what the board does

and despite blog posts and all these things,

people still don't find out.

How does, how is the PSF thinking of communication?

And I'll give you on the Django side,

like we, for example, don't have an email list of users.

Like we don't track anything.

So, you know, yeah, there's the people on the board,

there's people at conferences,

There's a couple hundred people on the forum.

But, you know, we struggle with reaching the millions of people using it.

And so I'm curious if the PSF has found a solution to that.

I don't know if I would say we have found the one single solution.

There are, like, so many people using Python.

I don't know how we would ever get a hold of all of them.

But we have a couple of different channels.

So, like, for people that are interested in kind of, like, how the PSF is doing, we have a newsletter.

For people that just want to stay up to date on PyCon, there's a mailing list for that, and you can stay up to date on PyCon.

There is a forum for, like, general users.

There's one in English, and there's one in Spanish, where people can go and ask questions or talk about, like, things going on in their community or, like, announce stuff that they're interested in or thinking about or talking about.

There is also, like, a place where you can go and discuss the technical direction of CPython.

And so that is another forum that we have that is separate.

So, like, it's not one conversation.

It's at least six, but probably more.

And then there's other stuff, like, I know Reddit has a Python sub.

We're not in charge of it.

If you go there, you probably will be able to tell.

it's uh it's definitely like is there a discord community run for is there yeah so there's a

python discord and then there's um python and espanol discord are those official though or

are those unofficial no uh well they are we don't run them but we do talk with the moderators over

there because it is sort of a space that we want to make sure is nice yeah um but yeah so we we

maintain relationships over there the the discuss forum that uh is the steering council we do run

so that one's right yeah steering council to discuss peps and stuff

oh but with volunteer moderators so you know it's like run but with volunteers so yeah but lots of

channels is the is the take yeah and there's i mean people are still using irc like uh i know um

what's it ned is always answering questions from newbies over on irc i'm like that's amazing i

don't know how newbies are finding irc but that's great like before entropy takes over entirely the

final sort of information in the universe will be an irc message just it's a little bit like you

know with email addresses you could tell if someone had like an aol or a hotmail or gmail

you could kind of guess their the decade they were born in and i feel like preferred communication

channel i mean i think about this because i'm like i like email like i don't want you know i

don't want to be on slack or discord if i don't have to but you know young people are and they're

used to it in work and we've had some on the show talk about who are doing work to help jango in

that area because they say yeah it feels impersonal to people who are just used to communicating that

way and i totally get it and also i'm getting old so you know it's good to have to talk to people

where they are though i mean yeah yeah it's i don't know we've shifted a bunch of different

time like when i started at the free software foundation it was like free node irc um you know

and uh what we're using i think pigeon or jabber or something like interoffice um and then it just

keeps changing and we use slack at the psf um which is like oh everyone's like oh it's just irc

with more like emojis and like a gooey i'm like yeah it kind of is okay and it's expensive

yeah no comment i mean because that's a thing you know well yeah a separate thing on you know

newsletters right with with substack there's been talk but like it's it's wild like on mailchimp for

ours so which is into it now yeah yeah yeah yeah that's a big black hole we can't go further down

so deb um is is there anything else that we haven't asked you about that you saw oh do you

know what we can we can ask you like so we always asked um django guests like what would they you

know magic wand change about django so i guess to you magic wand for python are there some things

you're like oh if i could just change them i would and that can be code community legislative

whatever i don't know it's like because python's like different things for different people and so

uh and we largely sort of like leave each other alone so like even if there was something where

i'm like oh i don't know if we need that like someone needs it so like i don't think i would

change it um well what about the you know where do you see the psf in five years right oh okay

so where i see the psf in five years i want us to really kind of fully embrace the mantle of being

like everybody's beginner language um and do more to support that you know like if you haven't

downloaded python yet i don't want it to be because you didn't know like we're gonna come

find you uh and and like you know uh make sure that you know you could have access to programming

language um but that means like scaffolding a little bit more of like the way that we handle

newcomers i mean we do a really good job with newcomers who like come to us but um i want i

wanted to be a little bit more self-serve so that if you came to our website and were like huh maybe

i want to start using this python thing and and uh and and you could get pretty far on your own

like maybe on our website that's kind of what i'm picturing um maybe we're maybe we're teaching

python in elementary school like i don't know it's i i want i wanted to just be available to

everybody and uh and if you aren't using python it's not because you didn't know it's it's because

you are now using like six other programming languages um after being introduced to programming

via python that's a great goal yeah i think one thing i i don't think it's solved yet is that um

during COVID, all the kids in my school got Chromebooks. And Chromebooks, it's possible,

but still difficult to play with Python on the computer itself. You can do it through the web,

but you had to kind of go through a Linux thing. And I imagine there's work being done there. But

I think I'm often thinking, oh, everyone has a MacBook Pro, when no, a lot of people are on

Windows or Linux or these Chromebooks. And certainly for elementary school kids,

Something that, you know, so Docker is going to be a problem for kids to dive into in fourth grade, right?

But maybe Python would be a little bit easier once there's smooth Chromebook integration or, you know, and things like that.

I'll let you know when we start on our Chromebook integration and remember that you offered to help.

Yeah.

Don't bother Google.

They got enough going on.

I'm happy to do it for free.

Yeah.

Well, yeah, we'll just make you the fellow of that.

Yeah.

So if anyone, what can people do who are listening who say, I want to get involved in the PSF

more than I am?

Is there any action items?

Well, we'll have board meeting or board elections coming up in June.

You should come hang out with us in Pittsburgh at PyCon this year, which is in May.

And tickets are on sale now.

And if you don't want to do either of those things, then go find your local Python meetup and get involved over there.

Well, Deb, thank you.

Thank you so much for taking the time.

It's it's all every time I talk with you, I'm like, yes, like there is a happy place that Django and open source can be.

And, you know, I think it involves having some paid people who know what they're doing.

But, yeah.

Yeah, yeah.

Don't make accountants.

I mean, don't make volunteers be accountants.

Well, I think every organization feels like they're the only ones dealing with this.

And it's like, no, like these things are pretty similar across nonprofits and especially tech nonprofits and especially open source nonprofits.

So there's behind the scenes, you and the PSF over the years have been very, very helpful to the DSF.

So thank you for that.

Yeah.

And we'll continue to be pals.

Yeah.

Let me know when you want to hire an executive director.

I'll share your post.

Well, you know, the thing is, I'm not, you know, we've we were.

relevant when we started this podcast, but Carlton's no longer a fellow and I'm no longer

on the board. So we can just, you know, yell from the cheap sheets. We just throw tomatoes

from the back now. Hey, somebody should do, somebody should do something. But yeah, I think,

I do think there's some things happening there and thank you for the offer. I hope you'll be

able to be taken up by it. So thank you everyone for listening. We are at DjangoChat.com. We'll

have links to everything in the show notes and we'll see everyone next time. Bye-bye.

Bye-bye.