FOSSY (Free and Open Source Software Yearly) just wrapped its fourth year — this time at the University of British Columbia in Vancouver, BC. A few hundred developers, community managers, foundation staff, and advocates, people who care deeply about how free and open source software gets made and sustained.

I attended primarily for the Governance and Community Sustainability track. But as usual the hallway track was where I got the most value.

Here’s some of the talks that were particularly valuable.

Sustainability at the PHP Foundation

Elizabeth Barron from the PHP Foundation gave a talk that moved well beyond “we need funding” into specifics. The PHP Foundation (established 2021) now employs 13 contractors who produced 42% of all PHP commits in 2025. That was a pretty big surprise to me. At the ASF, we take the opposite approach – all code is by volunteers, but we staff infra and other operational things.

The PHP Foundation is at Open Collective, who, if you don’t know, are a fiscal hosting agency (ie, they just handle your money) and make both taking and spending money very easy for PHP.

One thing that she talked about that was particularly interesting to me was the idea of attempting to articulate how much it costs to run a project, and approaching sponsors with that number, so that they clearly understand where the money is going. This seems obvious in retrospect, but I don’t see many folks doing it.

She also mentioned thanks.dev which is a means to route funds down the dependency tree so that the less visible projects get some of the pie as well.

This felt like one of the more mature “here’s how it actually works” sustainability talks I’ve seen — less hand-waving, more spreadsheets.

The Art of the Fork

I gave a talk on planning for forks as a disaster recovery plan, and Edward Ly from NextCloud complemented it nicely with “Art of the Fork: Reclaiming Trust.” His framework for evaluating forks boiled down to three questions:

1. What distinguishes my fork from the original?
2. How hard is it to switch?
3. How will the original project change in response?

Simple questions, but the kind you want written on a whiteboard before you commit engineering resources to either side.

Code of Conduct Research — With Actual Data

Shurui Zhou presented research on what happens after a project adopts a code of conduct — not opinions, but data from 100,000+ projects, comparing contributor patterns 3/6/9/12 months before and after adoption against matched control projects that did not adopt one.

Key findings:

• 77.4% of CoCs were never updated after initial adoption
• Both short and long term: increased new contributors
• Short term: some disengagement of existing contributors (quantitative only — reasons not investigated)
• Transparency reports (incidents, resolutions, response times) help signal accountability

The conversation in the room about why existing contributors leave short-term was interesting, if speculative. Based on anecdote, a number of people in the room suggested that the initial disengagement of existing contributors wasn’t necessarily a bad thing, but was people self-selecting to leave because they didn’t want to have to behave.

The data itself is valuable for anyone making the case to adopt or improve enforcement.

University OSPOs and the Student Pipeline

Stephanie Lieggi from UC Santa Cruz talked about lessons from running a university OSPO. Two things I noted:

• CURIOSS.org — a consortium spanning 30+ university OSPOs internationally
• UC Open Summit — an annual conference on a UC campus focused on academic open source

The persistent question: how do real projects get in front of students in a way that leads to sustained contribution?

AI + Free Software Development

A panel on generative AI in free software surfaced the tension well:

For: Help maintainers handle the overwhelming flood of inputs. Do the mundane so developers can focus on creativity. Lower the barrier for new contributors who historically were gated by coding expertise alone.

Against: Unearned confidence in wrong solutions. Massive walls of LLM-generated text are hard for humans to review. AI-generated PRs may be increasing maintainer burnout rather than reducing it. And while contributor numbers are at an all-time high, the number of maintainers isn’t budging — which raises the question of whether we’re creating contribution without creating ownership.

This lack of ownership is, IMHO, just an acceleration of the drive-by PR phenomenon that Github started, and must be addressed if we want longer term sustainability.

Encrypting your server

Romeo Solano gave a great talk on practical ways to encrypt your filesystem on a server that might not be physically accessible to you.

This was of particular interest to me because Romeo attended my “How to give a better presentation” talk last year at FOSSY, and we had talked some about ways to improve his stage presence. Romeo was funny, engaging, and informative, and his presentation was impossible to look away from. I was truly impressed.

I attend a LOT of conference presentations, and I don’t often add one to my list of “This is how presentations should be done.” This was one of them, for sure.

Overall

FOSSY is small and opinionated. That’s the feature. The conversations you have here — with foundation directors, long-time maintainers, university OSPO leads — happen because it’s 300 people, not 3,000. If you work on open source governance, sustainability, or community strategy, it’s worth your time.

FOSSY 2026 took place August 6–9 at UBC in Vancouver, BC. More at fossy.us.

This article was just fascinating to me.

https://www.huffpost.com/entry/john-kennedy-trump-anxious-unexpressed-thought_n_6a6f91e2e4b03026f4f00de1

“He grows anxious when he has an unexpressed thought,”

When my son was little he struggled with keeping his inner dialogue inner. If he thought something, he had to say it. If he didn’t say it out loud he would become very agitated. If we were at an event where he couldn’t talk continuously, like a school orchestra concert, for example, he would become more and more agitated until he had to scream.

We left a lot of events early.

And once spoken an idea had to be defended forever no matter how ludicrous. If he stated his firm belief in an absurd concept and you dared to criticize that idea, you were calling him a liar. And this was true even after he discovered proof that he was wrong. Once spoken, the idea became a hill to die on, a core belief to defend.

But then, as children do, he grew up.

In this article, John Kennedy describes the president of the United States of America in every way identical to my 7-year-old son. Unable to keep a thought inside and contemplate whether it was true. Unable to change his mind once presented with truth and evidence.

On the one hand, it helps me understand what’s going on with this strange, sad, pathetic man.

On the other hand, it makes me all the more contemptuous that at 80 he has not learned what my son did at 8.

I also recorded a video version of this post if you’d prefer to watch rather than read: https://youtu.be/VPIf6dUKwKA

Last week I was at the United Nations Headquarters in New York City for UN Open Source Week — a gathering that, even just by its name, tells you something about how far open source has come. This isn’t a developer conference. It’s not a vendor expo. It’s the United Nations convening governments, NGOs, academics, and technologists to talk about open source as a matter of global policy.

The event ran June 22–25 at UN HQ in the ECOSOC Chamber, then moved on June 26 to the IBM Building at 1 Madison Avenue for a community-led “Open Source Community Day” hosted by Red Hat. It’s not the kind of event I usually attend.

The thread that ran through almost every session was technological sovereignty — specifically around AI. Who controls AI infrastructure controls the future.

Alberto Gago, Director General of Spain’s Agency for the Supervision of AI (AESIA), said:

“Decisions affecting all of society are being passed to organizations controlled by a handful of private actors answerable to no electorate. Transparency is not only not guaranteed — it’s not even possible.”

That’s not a developer complaining about vendor lock-in. That’s a government AI regulator saying the architecture of modern AI makes democratic oversight structurally impossible.

One of the more interesting ideas I encountered was the collapse of the distinction between Sovereign AI (nations controlling their own AI infrastructure) and Portfolio AI (diversifying workloads between hyperscalers and local compute). These are the same question at different scales. A country asking “how do we avoid dependence on foreign tech companies?” is asking the same question as an individual asking “can I run some of this locally?” The answer in both cases is open source — open weights, open models, open tooling. It’s the only path to that kind of independence.

The highlight of the event was the “OSPOs for Good” session, opened by Omar Mohsine (UN Open Source Coordinator) and featuring government ministers speaking about open source as a development instrument.

Amal El Fallah Seghrouchni (Head of Government in charge of Digital Transition, Morocco) said:

“Open source is the instrument of sovereignty.”

Angellah Jasmine Kairuki (Minister of Communication and Information Technology, Tanzania) talked about a national determination to

“Change from being a passive consumer of technology to an active participant.”

These are government ministers framing open source as national policy — as the tool that prevents their nations from becoming permanent technology colonies of whoever builds the largest proprietary models. The Next Einstein Initiative (“Will the next Einstein come from Africa?”) kept surfacing as a motif — talent exists everywhere; infrastructure and access don’t. Open source is positioned as the equalizer.

Another topic of great interest to me was The RGAF – The Responsible Generative AI Framework (RGAF), developed by the LF AI & Data Foundation, which defines nine dimensions for responsible AI: Human-centered & Aligned, Accessible & Inclusive, Robust & Safe, Transparent & Explainable, Observable & Accountable, Private & Secure, Compliant & Controllable, Ethical & Fair, and Environmentally Sustainable. It aligns with the EU AI Act, NIST, Singapore, and China frameworks and is an attempt to create a shared vocabulary across all of these, specifically for the open source generative AI context.

More info on RGAF:  https://lfaidata.foundation/blog/2024/11/18/responsible-ai-pathways/

UN Open Source Week isn’t a technical conference. You’re not going to learn a new API. What you get is perspective — a window into how the rest of the world sees open source and what they need from it. When Tanzania’s Minister of Communication and Information Technology stands at a podium in the ECOSOC Chamber and says open source is how her country avoids becoming a permanent technology colony, that reframes every commit, every pull request, every licensing decision.

More photos on Flickr.

When figuring out my read order for Bradbury Summer, I discovered a book that not only have I not read, I’ve never even heard of.

Dark Carnival was Bradbury’s first book, in 1947.

It’s a collection of short stories, some of which I’ve read in other collections (Homecoming, and Uncle Einar, are in October Country) but most I have not

I assume there are other things of his that I’ve not read, and I’m really looking forward to discovering them!

The preface to The Martian Chronicles says I should also read Winesburg, Ohio, by Sherwood Anderson. Books that recommend other books is perhaps my largest source of recommendations over the years.

I just finished The Illustrated Man, which I haven’t read in decades. I was worried it wouldn’t stand up, but it was every bit as amazing as I remembered, but with the extra depth of reading it as an adult.

Particularly wonderful was “The Rocket” in which a broke junk dealer arranges for his kids to travel to Mars in a scrap metal rocket.

Bonus, about half of these stories ended up as Twilight Zone episodes!

Next, The Martian Chronicles, which I have read many times over the past 40 years but is always wonderful.

I wrote a new book.

In 2006, I published The Definitive Guide to Apache mod_rewrite with Apress. That book is now nearly 20 years old, and the world of Apache HTTP Server configuration has changed enormously since then — new flags, expression engines, security considerations, and two decades of community questions revealing what actually confuses people.

So I wrote a new one from scratch: mod_rewrite And Friends.

It covers everything from regular expressions through RewriteRule, RewriteCond, RewriteMap, every flag, logging and debugging, proxying, virtual hosts, and access control — plus 40+ real-world recipes distilled from 20 years of users@httpd.apache.org questions. The “And Friends” part covers all the other Apache HTTP Server modules that often do the job better than mod_rewrite: mod_alias, mod_dir, mod_proxy, FallbackResource, expressions, and more.

Available now on Amazon:

📘 Kindle: https://www.amazon.com/dp/B00BSV4LO6

📕 Paperback: https://www.amazon.com/dp/B0GYKT6ZJ6

📖 Read free online: https://mod-rewrite.org/

If you order a copy *right now* you could bring it to Open Source Summit and I’ll sign it!

#ApacheHTTPServer #mod_rewrite #WebDev #SysAdmin #OpenSource

Whenever I hear Winds of Change, by the Scorpions, I get a little misty-eyed. Not because it’s great music – although it’s definitely catchy and I do like it – but because, for a brief moment in 1989 and 1990, we actually believed that the world was getting smaller, and that there might be a day when “we could be so close, like brothers.”

Of course, when the moment wore off, it turns out that people are still people, and now in 2026 the US is actively working to undo what little progress has been made in the years since 1989.

20 minutes.

From “Golden Apples Of The Sun”. Also appears in “R is for Rocket”.