Audio Podcast Version

Find all of our podcasts at Anchor.fm, Apple Podcasts, Spotify, and all podcast platforms.

SHOW NOTES 

Transcript

Aaron Griswold 00:03
Good morning. Good afternoon. Good evening, wherever you are. This is Grizz Griswold, Head of Marketing of FINOS and this is the Open Source and Finance podcast. And on this episode of the podcast, I interview Ana Jiménez Santamaría, who is the OSPO Program Manager of the TODO Group. This is the first podcast in our new series of Open Source in Finance 101. And it's about the value of Open Source Program Offices or OSPO in financial services. So sit back and hit the music.

Now, all right, is everybody in? Okay, cool. All right. So as I said in the intro, we have started a new series on Open Source in Finance 101. We really wanted to give a baseline to our FINOS community and our FINOS ecosystem of you know, here are some 101 topics, things that you really should know about within open source in financial services. And kind of ironically, we probably almost start with a 201 instead of a 101 level, talking about open source program offices or OSPOs. And I say that because OSPOs are maybe a finite point in the open source writing this journey of maturity that a, let's say sellside bank would take as they are first consuming, then contributing, then working out licensing agreements, and then really deciding you know that they're going to be an active participant within open source, not only in their projects that are key to them, but maybe even outside of that in other projects, as well. However, this is part of our 101 talks, because you kind of have to see it's not the end, OSPOs are not the end of the journey, but they are pretty far up there and take some time to get to and achieve. So we you know, start with the end, not the end, we start with the end in mind, in order to see where we are and where we need to get to. And Ana is the perfect person to talk about this because of the work that she does, with OSPOs not only in financial services, but in all types of companies. Medium, Large, even small. So I'm going to let her talk more. And I hope you enjoyed the podcast.

Good morning. Good afternoon. Good evening, wherever you are. This is Grizz Griswold, Head of Marketing for FINOS. So if you're doing well, today, on the podcast, we have Ana Jiménez Santamaría. Ana, how are you today?

Ana Jiménez Santamaría 02:58
Hello. Hi, Aaron. Thanks for inviting me. Doing great.

Aaron Griswold 03:01
Yeah, you know, this is your second time on the podcast, and I'm glad that we get time to have an extended session and we're talking about OSPOs today. I feel like we're always talking about OSPOs. But I'm looking forward to kind of diving deep into some of the work that you do for the TODO Group as the OSPO Program Manager, which is also part of the Linux Foundation. And let's start with the human side. Um, you know, let's talk a little bit about Ana - who you are, what you do, and, and then we'll eventually get into the work part as well.

Ana Jiménez Santamaría 03:47
Okay, yeah. So I'm right now I'm Program Manager at the Citigroup, as you were saying, part of my work as has been the community deals for community to grow, have been the organizations that are there that has OSPO to better implement best practices, sorry, to others, to have other OSPOs to being implemented worldwide. Previously to that I used to be on company called Bitergia for software development analytics firm also really related to OSPOs to provide metrics and so on. So I got a lot of knowledge there. And then these learnings I was able to put it into TODO Group and also things with the community I have that I keep learning more and more things about OSPOs in different regions and in different areas.

Aaron Griswold 04:46
Cool, and then obviously, you just spoke at OSFF in London. And you talked about OSPOs and OSPOs in financial services. And we will get into that in a little bit. But first of all, thank you for sharing that. And I heard it went well, I finally got a chance to watch all of the videos from all of it because I never got the chance to actually go to half of the talks. But it was well received. And it had some good comments on it as well. So I appreciate that.

So let's do this, let's talk about what OSPO is. Can you tell me, you know, what you see as an OSPO, what it is? And then, you know, let's, let's get into the Why have you why you'd have it OSPO.

Ana Jiménez Santamaría 05:53
Sure. So the OSPO definition that, by the way, you can find in one of the TODO Groups that are referenced, is basically a centralized place, where organizations are putting all the open source efforts in one single place.

So what is that? I always think that this definition is great. But for people to better understand, let's say that you are dealing with a lot of open source activities like you're, you need, as you get into open source that you need to be more open source first company or become an open source first company, you need to take care of the open source compliance, the open source strategy, start building policies around open source, start building, maybe community when you decide to release open source project, not only using but contributing. So that it's a long process that takes time and way that organizations sees as a way to accelerate that adoption and, and try to organize this better, is put a strategy on top of this open source efforts.

And that is what an OSPO is. Put in a strategy taking care of these policies, and see it more as an open source best practices that is not just for big corporations, software corporations, we're seeing it now in a lot of different a lot of different sectors, including the finance sectors, that that's why I wanted to present the tech in finance because in TODO we are seeing more and more organizations from the finance and banking sector being created, not only to the members that those the general members, the organization that has an established OSPO, but also banking in Europe, or also in the States that are trying to build one and they want to really understand how, how can I put this bet OSPO best practices into my organization to accelerate open source adoption?

Aaron Griswold 08:15
Yeah, and what we've seen, really, in the past five years is is that, you know, first of all the the legal hurdles of, of not only, like you said, not only, you know, consuming, but then going back to, you know, how did they have their developers and then technologists contribute? You know, that is that a young stage in the development of open source for financial services firms, but but, you know, looking at the OSPO, it is, it is gathering all of the the open source things together in one place. And so it I believe that it shows a, a maturity of the industry in you know, let's call it, you know, first dealing with open source.

Ana Jiménez Santamaría 09:11
Actually, some organizations have asked us like, should we start an OSPO. That that's usually one of the questions and I usually reply, like, it depends, like, first, try to see where, where you're organization is, like, are they really understanding the value of open source first? Are they, do they have coordinated efforts around open source? Or is there a lack of alignment in the organization's goals and the open source calls? Are they just using it, or are they willing to contribute too.

So if, for instance, if there are no clear understanding of open source, if the organization doesn't have an open sourcing strategies or they are not working on policies, they are just using open source. I talk and trying to get more into open source, don't create an OSPO, I mean, I will say, first get, spend time to let the organization do you understand the value of open source and contributing to it. And once you're there, and when the organization tries to say, okay, how can we start implementing this in, you know, with with some kind of alignment and a strategy, is when you can start thinking about OSPO and put strategy, policies, and what is more important, build these, matrix of experts that tries to infuse open source into the whole organization. That is one of the core objectives of many OSPOs.

Aaron Griswold 10:51
Yeah, definitely. And so you're telling me that, that OSPOs can kind of take different structures and different shapes? You know, you know, as as this building up, can you? Can you talk a little bit about the different types of structures that you might have for an OSPO?

Ana Jiménez Santamaría 11:09
Yeah, so we've seen, not all organizations are the same. And since it happens the same with the OSPO and how how organizations decide to structure and that depends many times on the sector, because there are organizations that they really, for instance, somewhere on organizations really understands, at the very beginning the this, this need of open source and have this to take place, so they don't have a lot of barriers. But for instance, there are other sectors, more traditional ones, for instance, finance sectors, retail sector, also happening automotive, it's also one of those that you need to be some quite careful when building new things there. So that's one of the one of the constraints and what defines, like when organization decides to build an OSPO, what is a better structure.

And also, the size of this organization is not the size is not the same like building an OSPO when you have a lot of resources from big corps. And when you have a small company or a middle company that is completely different. So for instance, in the case, now that we are in the finance sector, I will focus more on that area.

So for restrictive sectors, such as finance, or traditional sectors, such as finance, and maybe more small or so small or medium organizations, many, many organizations, what they're doing is build like virtual OSPO. So you're not saying, Okay, from one day to another, I have a huge team of people in OSPOs, and I have a dedicated team of people working on that, but maybe just one person managing open source efforts, and that person, should be communicating with the different teams across organizations, because an OSPO is a cross functional activity. So you need to deal with the legal team, you need to deal with marketing team, with HR, and so on. So this person is this linchpin, and will be is this virtual OSPO because I'm just one person, well, you're not just one person, because I OSPO, as I was mentioning, is a best practices to adopt decelerate open source and needs to be in in top of mind on the organization's mind.

So that is one thing that people that organizations can start from. Of course, there are other structures, when you have a OSPO inside the CTO office, or you have an OSPO inside of the HR office, but those are like for, in my honest opinion, for bigger organizations, organizations that have big resources and had already a clear understanding of open source and they can spend resources on building this team in inside a team. Right. So yeah,

Aaron Griswold 14:18
Right and then, and well, I think you're right too that, that even a large organization may, you know, may not want to start with just, you know, having 10 FTE full time employees working on this. They they might want to incrementally add, start with the virtual and then you know, it I think we see this too, in actual, you know, in the open source projects that are out there that, that, you know, you have developers that are working, you know, 20% of their time on a project, you know, and then as that project becomes more important to the company, then their time goes from 20% to 50%. And all of a sudden, they're a full time employee just working on that project because it, it has the impact on the company. You know, that hits their bottom line, right, you know, somewhere. Um, but but, you know, I think your your structures of starting with the virtual OSPO and then leading to full time OSPO with with more and more employees is they have to see the value of it, as well.

Ana Jiménez Santamaría 15:29
Yeah, and it needs evidence sometimes. And that's why I think having these OSPO communities, building resources and sharing also the work that other organizations are doing, sometimes the OSPOs are found, because their competitors are having an OSPO. And this is like, Okay, I, I've seen that that works for this organization, why not having, why not having a OSPO. So I think that having this evidence, not only within your company and proving it within your company, thanks to the virtual OSPOs, that can be a step to go, but also to see outside things with this communities that serves this work in a transparent way. I think that also accelerates this.

Aaron Griswold 16:18
Right. Right. So can we go back to, I was looking at, I believe, an article that you wrote with them? Chris Aniszczyk. Make sure that I said that, right. I've I've known Chris for a long time, but I've never known if I've actually said his last name correctly, is it Aniszczyk? If he hears this, he can let us know. But, you co authored a blog post recently for open source? Was it opensource.org?

Ana Jiménez Santamaría 16:57
Yeah. Opensource.org.

Aaron Griswold 17:00
And on, you know, what is the OSPO, basically. And I thought that was pretty interesting. There's a mindmap in there. And, and is that something that that you folks have worked on in the TODO Group?

Ana Jiménez Santamaría 17:15
Yeah, absolutely. That is also right now we have published it under a topology that is one of the repos from the TODO Group, that for those who once you just start in their OSPO journey, or start to learn more about OSPOs, I really recommend this repo because it has like a lot different set of articles, it has this OSPO mindmap to understand the different OSPOs responsibilities. Also, well we there you can find also different community calls where we discuss OSPO use cases from companies, for instance, on Sony, OSPO at Sony, OSPO Spotify, OSPO Avon, and more. And we have they're also the the model, the OSPO five states model, that the main goal of that was to try to be used as a framework for others to use within their organization when setting up an OSPO and understand in which, in which area, are they in terms of their OSPO journey, because when when you start an OSPO, you are moving from open source ad hoc to more strategic decision making partners in your organization of the open source decisions and the technology stack your organization might adopt or contribute to.

So there are different stages that we've seen in many OSPOs to do. That traditionally, is something that is kind of normal to happen, like moving first from the legal driven estates because the first thing that happens in many organizations are we need to take care of the inventory, the software inventory. We need to take care of the licensing issues. How can we educate developers to contribute to open source in a secure way? So that is like the first layer.

And once that layer is covered, usually, OSPOs can start taking action into the community-driven state. They they can now understand the policies and the processes on how to contribute to which open source projects so they can actually contribute to. So build this education of how can developers contribute to open source within their organization and also encourage them, motivate them, to contribute to open source and let them understand why it's benefit for not only for the organization, but even for them, to contribute to open source projects.

Later, they can, the organization can start seeing open source projects that were under development under the organization, and maybe it's useful to been released as open source and have been the open source sustainability, and the open source ecosystem. And finally, once they have this clear understanding of open source, and they have built in matrix of experts around open source, the final states are more towards open source leadership, like how the OSPO becomes these leaders of the open source within the company, and they become the strategic partners, this advisors on open source.

Aaron Griswold 20:40
Cool and, you know, kind of, it's interesting with they they become leaders, I want to go to like the leader part, too. You know, in, in the OSPOs that you've seen, worked with, researched, and whether it's within financial services or not, you know, how important is it to get, in many times an open source, like, especially in a technology company, I've always been used to seeing, like, a lot of the support for open source comes from the ground up first. But then you also have, you know, the top down as well, that, that, you know, they all kind of get it, they get the the benefits of open source that, you know, comes, you know, very naturally, I guess, and so, having an OSPO in the technology company, especially large technology company, you know, it just makes sense, because everybody's kind of on the same page. You know, but let's think about financial services, you know, would you have a guess of, you know, who really has to maybe first come up with, with the idea of, hey, maybe we should be, you know, starting to form an OSPO. But how important is it to have the, the, you know, from the bottom up, the developers and the technologists, be on board? And how important is it to have the top down, the C suite in the larger organization? You know, that your CTO, your CIO. Maybe, you know, what, is there, is there importance to having different people championing it, I guess?

Ana Jiménez Santamaría 22:30
Yeah, actually one of the main characteristics of the OSPO is that one is building a matrix of experts assignments in it, and that involves the high level managers and also working on on the, the low level. Sorry, the low level team as well. So it's more about how, how can we infuse to the whole organization, this clear understanding of open source. If you're just focusing on educating developers, that's gonna be, that's fine. It's, it's, it's the right way to do. But you also need to educate the the high level managers as well, and vice versa.

And that is something that I think the OSPO can ease. Like, when you don't have a OSPO, many companies and organizations says like, yes, my, for instance, developers are pretty, they pretty understand the value of open source, the problem is that the manager didn't understand that. Because you're doing open source ad hoc, the developers might have, may had a problem in the past with a vulnerability, for instance, because they are using open source, everyone is using open source. And if you don't take the open source seriously, there are going to be problems.

So when that happens is when developer says "Hey, we might need to take care of open source licensing compliance. What's going on?" But the developers understood, but not the middle managers, because there is a gap of communication. So I think OSPOs can break this gap. Because there is a centralized place. There is alignment of let's, let's start to take open source in a serious way, take open source in a more mature way, and build this matrix of experts not only from top down, but also from bottom to top.

Aaron Griswold 24:42
You know, and it's kind of interesting, you said about middle managers too. That, so I've been around this industry now for about five years. And one of the things that I was told and still have been trying to research over time, you know, is that usually the developers get open source and sometimes the leaders get open source, but it's really the middle managers that, you know, they may not get the value of it, because and I think because, you know what you said that it has been so ad hoc, and they don't see the value to their teams that they're managing. Because it's like, oh, it, you know, kind of like, oh, is this thing that, you know, this developer is doing? As opposed to, you know, no, there's, you know, there's, there's something from the top down that, and from the bottom up, that the OSPO is, you know, helping have an umbrella of information, you know, to give to middle managers is saying, you know, this is why this is important.

And, and so, it's not just a champion is also, you know, kind of a fount of information, as well. So that, you know, you know, as a middle manager, you know, I would want to know, how, you know, why do I want to do this? How is it impactful to my team, you know, we can use open source? Great, but, you know, why should my team be giving back to, to, to open source projects at all? Because, you know, as a middle manager, I wouldn't necessarily get, you know, not necessarily judge, but is that part of, you know, is that part of my, you know, key results that I have to deal with? I guess, so. So, you know, hoping that that OSPO, and an OSPO leader would would be able to kind of suss that information out.

So, let's see, I think, you know, we will put the article, the mind map, the repo, TODO Group. But you have something coming up in September, I believe. Do you want to talk about that as well?

Ana Jiménez Santamaría 26:55
Yeah. So TODO we are, we have different resources, we tried to create resources on education, to education, also on survey and research, and try to provide networking spaces to lead others to learn. And that last one, it's it's a OSPOlogy, one of the many different networking spaces we bring every year and is event under Open Source Summit. And it's for any open source management, open source from office manager or any organization willing to learn more about open source program offices that they might be thinking of creating one or advancing in the OSPO journey. Where we will be serving best practices, OSPOs journeys, experiences from other OSPO leaders, across sectors, regions, and that will be happening in Dublin. For Open Source Summit Europe, it's going to be a three day event, full of talks and discussions and panels. And I really hope to see you there, I know, some OSPOs in finance will be also attending and presenting as far as I know. So everyone is more than welcome to join!

Aaron Griswold 28:23
Yes. And that is September 13, through 16th. In Dublin. I believe it's also part of it is also virtual for the Open Source Summit Europe, but OSPOcon. I'm assuming you'll be there. Good, good. Good.

Ana Jiménez Santamaría 28:43
And for those who go in person, we might have some cool new swag.

Aaron Griswold 28:51
Nice, very cool. Well, I know that I'm sending team members over there. I think I told you that, you know, our Director of Community have kind of tasked him with like, you know, be a tour guide and and, and have FINOS you know, have kind of curate for FINOS members where they should be going but but, you know, honestly, most of them should just be going to OSPOcon. So we will definitely make sure that we're sending folks there to see what you're talking about.

So, Ana, I appreciate your time today. And I hope that, I won't say where you're going, but I hope that you have a great vacation.

Ana Jiménez Santamaría 29:39
Thank you too, you too!

Aaron Griswold 28:51
Wait, I'm not going on vacation. I hope you have a good one. No, no, but I hope you have a great vacation and and get out of the heat and get to a cooler place soon. So Um, again, thank you. And like I said, we'll put everything in the show notes and and if there's anything else that we should be including just let me know. But other than that, hope to see you soon in September, and appreciate it.
And with that, I'm gonna say Good day. Good night, wherever you are.

Ana Jiménez Santamaría 30:20
Thank you, bye bye.

Aaron Griswold 30:25
All right. Well, we hope you enjoyed that podcast with Ana Jiménez Santamaría, who's again the OSPO Program Manager at the TODO Group for the Linux Foundation. I will add a link to her talk at OSFF about OSPOs in financial services as well in the show notes.

Now get involved with the finance community by signing up on FINOS.Org, either for our newsletters or for our This Week in FINOS so that you know what's happening within the community on a continual basis. Get involved with our Slack channels. Follow us on LinkedIn and Twitter.

And if you enjoy this podcast, please rate us five stars on whatever podcast platform you follow. And we're always looking for great interviews. So contact us at marketing@finos.org if you have any ideas, plus if you need to get involved with the community help@finos.org gets you to any of us at FINOS as well. So with that, I'm going to say Good day, good night, wherever you are.


-=-=-=-=-