 Woohoo! How many of you is this your first DrupalCon? Oh, the three of us. It's my first time here. Woohoo! Representing. My name is Josefa Hayden, and I am an advocate for digital literacy for women in STEM, and I happen to work on the WordPress open source project. I'm employed by automatic, but before I was doing that, I worked at a marketing agency that used Drupal along with a selection of other proprietary CMSs, and so I have a lot to say about this particular topic. Today, the most important thing to know about me is that I am just a fiercely pro open source person. So this is going to be pretty CMS agnostic. I do have two logos in it, and they happen to be WordPress logo and Drupal logo. So you'll see when that comes. The broad stroke sort of presentation today will absolutely be about the whole open source ecosystem. I do want to take a moment to explain my title. It's incredibly boring. Potentially the least snappy presentation title I've ever come up with. And so I gave it a subtitle, which is how to advocate for open source. My Twitter handle is at josefa hayden, and my presentation hashtag is sassy pickle in case you feel like using it. If you don't, you should use the DrupalCon hashtag, and technically you should use that regardless. I'm going to encourage you all to talk on Twitter, live tweet this as best you can, because I feel like this is a conversation that really aligns with Drupal's goals for the next two years. And it's unfortunate that there aren't more people here, but I think it's important that they be able to see the content anyway. Open source on everything, including information. I just want to make everybody smarter all the time. I used to say in presentations that knowledge is like light and not like a slice of bread, as in the more that you share it, the more light you have, as opposed to more that you share it, the less bread you have. And then I was told that was a really unclear explanation and to stop doing it, but I can't. I just love it. So I told you, see, I have jokes. So before we get much further, I do just want to let you all have an opportunity to introduce yourself to me as an audience, so I know what I'm working with. So how many of you are in an agency, work at an agency, own it, whatever? Okay. How many of you are on the marketing or sales side of that? Okay. How many of you are on the creative side of that, that being developers or designers, marketing, not marketing, but, you know, content folks? Cool. Okay, so we have an interesting group. This is good. I used to work at an agency and I was in either the development side or in the marketing side. I was in the data sales, data analysis part. However, oh gosh, that isn't what I thought was coming next, but it is actually what's coming next. I will tell you this. This is not a talk about design and function. This is actually going to be a talk about open source methodologies and the value that it has. Mid-market design and functionality needs haven't really changed much in the last few years. Your clients still need, I mean, need sliders. They still actually need legally compliant lead generation solutions and a better way to manage their media. And you all, as open source practitioners and people who are building websites for other people and apps for other people, still need more reliable ways to train your maintainers and fewer questions about the validity of your work and how much your work costs and content that is delivered to you in a more timely manner. Like that is still the case for design and functionality in CMSs across the board. So the conversation that I want to talk about today is this one. The difference between proprietary and open source and better advocacy for open source. One thing that we're starting to see is this is my other one joke for anyone who's coming in late. You missed my first joke. Over the past few years, there's been a growing feeling that proprietary software solutions might not be the most obvious choice after all. And there's currently a lot of chatter about whether or not open source methodologies and technologies are just primed to be taken more seriously. Those two CMS solutions are absolutely two sides of the same incredibly intelligent coin. And so that conversation is going to be increasingly important for the open source project, for open source projects in general, but especially right now it sounds like for the Drupal community and the Drupal project. I keep hearing over and over in these sessions that I've been attending the last couple of days, like, this is the space you all really want to excel in and need to excel in. And I agree. I mentioned early on that I work with WordPress and I want to be super, super clear. I don't think that that puts me in an adversarial space with you. And I hope that it doesn't make you all feel like you're in an adversarial space with me. The conversation is more important than that. It's open source advocacy, which is a tide that raises all boats. The bigger this high is, the more that everybody succeeds. I have to give you a side note, a little social commentary on this. I crowd sourced who should be the adversarial group that I show in here. And I went with this because they're intelligent people and, like, fictional and, you know, two sides of the same coin. But I want to share with you the runners up and why I didn't choose one of them in particular. First runner up, the doctor and the Daleks or the master. And I didn't go with that one for obvious reasons. Because again, not super adversarial. The next one was ET, the kids versus the government. And I didn't understand that at all. So I didn't go with it. And then this one, which I also didn't understand, the empire versus the rebellion. But I just knew that if I came into this room filled with incredibly intelligent and technologically savvy and also probably socially savvy people. And I said, this is a Star Wars thingy versus that Star Wars thingy. You all would have follow up questions. And spoiler alert, I would never have been able to answer any of them. So I didn't go with it. And now a story. Speaking of the doctor, the TARDIS and Doctor Who is close to my heart. So why don't you step in my TARDIS with me? We're going to travel back a number of years, about a handful. So many years ago, I worked at a marketing agency that had two different development practices. As I mentioned before, I was in neither I was in data strategy and analysis. However, one, one development practice was broadly considered enterprise and exclusively used CMS options like Ektron or Sitecore. Does anyone know about either of those? Well, yeah, oh good. Of course you do. The other was considered this development practice for small jobs and primarily used Drupal, but also sometimes WordPress. Just as a sidebar, they always hosted enterprise clients. This company never worked with anyone, any company that had less than 500 people in it. However, just about once a year, they would call me into the CEO's office and ask me to defend the continued use of open source to advocate for more WordPress sites. And as a result, just about once a year, I was told over a very uncomfortable cup of coffee with my CEO, well, we're just going to stick with Sitecore. I wasn't mad or anything, but also not being the kind of person who has ever known when to leave well enough alone. I always asked our leadership this incredibly irritating question. Okay, but why? Something that if you do not know me yet, you will learn I am basically the two year old of marketing constantly asking why the most irritating questions to all the leadership. And there were a selection of reasons. And they ranged anywhere from really, really made up to probably true. But it was generally a selection of scalability, quality, security, not enough legal liability and too much legal liability. So that's cool. Three of those probably sound familiar. They maybe made your heart just skip a beat and like, Oh, security again, quality again. Those last two that I mentioned, probably less so. But it's a really interesting thing to be aware of, because it's one of like those crux positions that non technical decision makers can't articulate very well to you. So you need to be able to help them understand that that's what they're worried about and come back to you on it. We're going to go through each one of these. So don't worry that I haven't gotten anything up here yet. There will be a scenic moment where you can take a photo of this list of five arguments. However, what we're going to do is take a look at all the underlying themes. They will be familiar to you all if you've ever had to advocate for the use of Drupal. And I don't know about you. But every time that I was in those conversations, the phrase with many eyes, all bugs are shallow just didn't have the same kind of mileage that it has in an open source community. I tried to explain that phrase to like 16 people my first day here before everyone was like, This is an open source progress too. Like our project is also open source. Like you're right. That's fine. I'll stop explaining it. And so the top five arguments against open source software, we're going to take each one in turn. And these are the things that we're going to look at. We'll look at the theme of each argument, the thing that that decision maker is trying to say to you, we're going to look at the assumptions that go into that argument that support it. And then we're also going to take a look at the conclusions that they tend to reach that make choosing open source seem so risky. We'll have a slight discussion about the general merits of the argument because they are rooted in reality. And then a few counter arguments for each of them as well. Don't be scared. It sounds like a lot, but we only have five arguments. I encourage you to be excited. But if you can't be excited and you have to be scared, edge over towards scare sided with me just a little bit. Joke number three. So the first one that we have here is scalability. And the theme that is coming up for all of these people who are having to make this decision is that it hasn't been tested at scale. And there are a ton of assumptions writing around in that one. The first one, of course, being that it hasn't been tested at scale, or that there's no readily available way to test it at scale. For all of the people who have that initial moment of, oh, it couldn't possibly handle the stress of our load, it's not a far cry to get into, okay, if that's the case, I would need someone who can quickly and easily work on a 17 year old code base that's completely written by volunteers, which already strikes fear into the heart of every administrator at every business. That's more than a small business. And then the final thing that really gets that that assumptive package in a terrifying halting moment is, okay, I have over 500 employees. And so therefore, I work in this structure that is not flexible enough to suddenly have to make major changes like that. And so the risky conclusion that all of those non technical decision makers have come to is almost always I need subject matter experts that can work on a really old open source software system who are also incredibly kind and will not tell our CEOs and CMOs that they are dumb at every other moment. And where do you find a unicorn like that? Where do you find people that are prepared to do that that don't cost an arm and a leg and that are not already sponsored to work by automatic or by Acquia or any of these other major companies in open source? And the counter argument for that I feel is pretty clear. The need for trained experts is by no means exclusive to open source. It doesn't really matter what sort of software you're using. At some point, you're going to need some variety of training. What sets open source apart is the fact that you can make that code work for you and you don't have to escalate your needs to some corporate entity and then hope that you have enough money or enough power to have your needs prioritized over the needs of other subscribers. That right there is a pretty excellent use case, not use case, counter argument for this particular argument that we hear often when you're trying to decide between a proprietary or an open source CMS. And just as a gentle reminder, if this is a non-technical decision maker, which so often they are in enterprise spaces and in mid-market spaces, remember that they lack the knowledge to assess these skills. And so when you lack the knowledge to assess them yourself, you have to look for something that makes it easy to identify, which almost always comes in the form of certifications and other assurances that that person's work is good. The second one is quality. This is a tough one, but it always comes out in the conversation as you get what you pay for. I don't think that's fair, but I wouldn't. I'm an open source advocate. One of the assumptions that goes into that, which is not incorrect, is that creation and maintenance is almost entirely volunteer driven. When I say creation and maintenance, I mean customer support is the maintenance side. These sprints that are having people look for bugs and fix small, just low hanging fruit problems. And then the creation absolutely is built by volunteer developers. The world over if you are a global project. And once you've gotten into that space of it's volunteers from all over the world, your next assumption almost always is that means that there is no central quality check. There's no way to advocate for better standards. And in general, who's doing this testing? And then once you've gotten yourself through this assumptive priority list of, well, I don't know who they are or who's looking after their work. The final assumption that you have is, so that means that on top of all of that, my new features are going to be prioritized, not by who has the most money, but by who has the most time and who has the most attention. This is going to get wrapped up in the fifth argument, that argument about how there is too much legal liability. It's a very interesting sort of relationship, so just be ready for that. The counter argument for that, I think most of you, how many of you have ever attended a sprint for Drupal? One of the dev days or anything? Yep. If you are a WordPresser, how many of you have gone to a contributor today? Yes, thank you. So the thing that makes this less compelling to me, and the thing that I think is the most accessible counter argument for the people that you are likely to be trying to sell this to, is that volunteers are primarily fueled by passion. And I know that in the conversation around burnout, that's problematic, but it is something that is worth mentioning in this space. They love what they do, and because of that, they often have this deep empathy and compassion for the problem that they're solving, the problem, not the solution. They're not a hammer running around looking for nails. So you get a collection of solutions that are created by people who have chosen to be experts about the problem, and then craft the right tools to solve them. There's almost no better way to ensure that you have really high quality software than to say, hey, you really hate that we do keyboard reading, like our screen readers are terrible. Help us figure it out. That's the best way to do that. If that's the whole scratching your personal itch thing, again, gets no mileage in corporate conversations, but this counter argument certainly does. I almost didn't put this in here, but then I would have been lying, so I had to. I don't know lots about the Drupal security practices, and so this one I'm just going to bring really close into home. The thing that I always heard when I was taking part in these conversations is WordPress sites aren't secure, just like a blanket statement. And yeah, I get it. It feels that way. The database structure is predictable. Open source users might not have the best security practices. These are the assumptions that these decision makers are kind of working themselves through. And once you've gotten to that's predictable, people are bad with their passwords. It is like this final nail in the coffin when you realize that in open source often the code is unencrypted and completely readable by humans, and therefore you can just display all of your code to people with malicious intent. People who want to do bad things. And once you've kind of gotten through all of that general assumption, the risky conclusion that your decision makers will always get to is if something goes horribly wrong with this site, there's no safety net, and also no one to hold accountable. And so they will immediately choose something where they have some recourse. And this one is a hard one to come up with a counter argument for, because that's not wrong either. Despite the existence of studies showing that the diversity of thought afforded by open source results in more secure software, you will find that it is incredibly hard to logic your way out of fear that is based in feeling unsafe. And so I don't have great counter arguments for you, but I do have two things that you should absolutely remind your decision makers of. The first one is locks only keep out honest people, which is to say that if you have people who are bent on putting malicious code into your software, if they're prepared to do bad things to the people who visit your website, they're going to find out how to do it regardless. That is always a risk. And the second thing is that we're only as secure as our weakest security practices inside your entity, inside the business entity. And that is nose to toes, my friends. That is passwords that your users choose and that is your posting platform and your software, everything, all of it, every point where you could be vulnerable. You are only as safe as the weakest security practice that you have. And so therefore, bravely choose one that has a lot of people looking at it so that we all have an opportunity to and then many eyes make all bugs shallow. Don't say that. It never works. No one understands it. If you're not an open source, find something that really resonates with your client and say that thing, which brings us to the fourth one. So these two were my absolutely hands down most favorite things to ever have to talk to to my potential clients about. Lack of legal liability. The theme there and the way that it will sound when your decision makers are talking about it is no one owns this software. Also super true. You have to use the software at your own risk is the first assumption that supports that. And the second assumption is like I said on where was I in quality. There is no single backing entity to hold accountable when things go wrong. Not that you ever technically hope that you have to hold somebody accountable because you don't want anything to go that badly. But it's true. And and the counter argument to that. Is a very a very fluffy please love your people sort of one. So buckle in because we're getting into a feelings car. The counter argument to it is that that is all the more reason to encourage your clients to invest in teams that they trust. Moving the service and relationships to be about the people you hire is one heck of a strong long term value proposition for any agency who's trying to do great work in the enterprise space. Instead of putting your trust in some inanimate piece of software put it in people who know your goals and value your company's mission. And just as a side note using open source software lets you continue to find local people who are doing new and exciting work that has a chance to be compatible with the software that you've chosen. Which brings us to this one excessive corporate liability. You may notice that there are too much liability not enough liability and they feel the same. They are related but it's not the same thing. The worry here the basic theme here is I will lose the people that I've invested so much in. I've trained them. I've made sure that they know how we work here. I've made sure that they have the right technology and the right hardware to get this work done. And this is one gigantic assumption that supports this and it's wrapped up in the way that open source projects work and that is that the expectation is you will give back to a project that you benefited from without the expectation of reciprocity. You are going to give back to a project that is making your livelihood possible without expecting that anyone is giving something directly back to you on a one-on-one basis. It's my big assumption. And then in case it's not clear how this shows up in mid-market in enterprise level spaces. For one I keep citing the number 500 in the United States you're a small business everywhere between one employee to 500 employees and then after that you're big and bigger. So I keep saying 500 because that's the small area for some reason. Small businesses in my mind are like 10 people but it's not. It's 500 and lower. So by the time you have 500 employees the likelihood that you have a conflict of interest policy and intellectual property rights all identified and how your employees are allowed to handle those things is incredibly high. You probably have one of those at the enterprise level. So convincing them that they should use an open source software which they will then be expected to give back to when they cannot pay their clients for that work and then also that work will technically belong to the company is a really complicated space to work in. I am told although I've never spoken to them that there is legal counsel that is particularly skilled in helping people navigate that. So you should put that in your back pocket as a thing to research later because I can't tell you where they are and your clients also won't know where they are but I'm told they do exist. So that's definitely a risk. You can't deny that. However there's always a risk of employees going to a different agency and not investing in your clients and not investing in the platform that you make your living with is not a savvy solution to I might someday lose an employee. For what it's worth I was never allowed to work on any of the open source projects that I worked on while I was at a marketing agency and I still wandered away into the mist and worked on WordPress one day. They were so sad because they're like we intentionally never sent you to one conference. And here you are and I'm like yeah goodbye. And so the only the only argument around that is that's not exclusive to open source and it is bad business practice to pretend that you should just never invest in your people lest they one day leave because the chances that your employees will one day leave and go to a different job is really high especially if you're hiring people who are currently coming right out of college because their way of getting more money is to be like see what I did at that company hire me to your company for more money and goodbye. That's how they do it. That's how I did it so there's that. So it comes down to this folks this is the big picture that we're talking about here. There are no dedicated resources. There are no assurances and very little formal training in open source. So if your client is a is making a major decision based on almost no information and almost no expertise you will find that the choice with more structure is more appealing because checking for certifications is way easier than trusting that someone really really knows what they are doing. And in the end it really is just a matter of trust. For the most part people trust what they know yet in the absence of knowledge people will always trust the familiar. So as people I see you like 15 of you now hello I'm so excited you're here as people who believe in the freedoms of open source. It's incredibly important that we take time to educate our clients because there's only one way that we get to that space where this pie is bigger for all of us and that is to constantly make sure that we are less scary more familiar and the thing that our clients end up choosing in the long run. This is in a terrible place for this and I didn't even think about it but there's a sprint tomorrow sorry. And this one thank you for having me. I can go back to this one in the event you would like to see more of it more than four and a half seconds there is a microphone here if you have questions about any of the things I talked about or about WordPress. Don't ask me questions about Drupal or Star Wars. Yes what do I think about the new female doctor that is a wonderful question good for you for hanging on to that little tidbit about things I like I am super in favor. I have been saying it was time for a for a female doctor for a long time super in favor. Good presentation. Question is you mentioned about two different CMS open source CMS one being WordPress and Drupal. Just curious if you happen to have any other thoughts on any other open source CMS that you see are doing well or kind of growing in market share. Yeah. The simple answer is no. However the harder part of that answer is I have I have specific thoughts and feelings about these open source CMSs that currently are able to really support enterprise level clients but still have that like really oh we don't trust you portion that that is open source. And I think that I so Ambraco is definitely one Drupal you all are winning in the enterprise space for real and you just need to figure out how to make open source less scary. I don't have any thoughts on other open source solutions except for those two specifically because this is a moment where you have the infrastructure and you just have to get the education out there so that people know that it's that you all have value and the work that you have that you have done has value and that Drupal is not scary open source is not scary. So that's not and did I answer your question. I started with a no which was technically an answer to your question. So I'm Bronco. I'm Bronco. You you M with the no this M a sign language. Any questions seeing no questions. I will tell you all thank you for having me. Thank you for having a word presser in your midst and there's like a plenary in Hall A Halby. There's there's an end of end of Drupal con thingy that we all are supposed to go to at some point three. Thank you closing sessions. Was the counting easier than expected or harder than expected. Oh nice. Nice. Do you find that you do most Drupal. It's a mix of both. I would say probably 50% of this 30% of Drupal is what we do. Nice presentation. Nice. Are you going to the word press camp at London and Atlanta. No but that guy back there is OK. I was planning to go from here. So. Oh good. Yeah. That's a wonderful event. It's it's a really great. Are you looking to hear. No I'm in Kansas City. Kansas City. Yeah. Come on. It's a national I will be back in national. No no I work for them. So automatic is the corporate entity behind word press. So that's the. I'm sorry you said automatic is the company. It's a private company. Yeah it's like the aquia of work. I didn't know that. It's a lot different. Oh good. Take notes. Yeah I lead their open source division which is why I have a lot of feelings about it. Just out of curiosity. Sure. You mentioned a few things that hurt my ears. Did you do much in higher education. I did. Because I've gone is like the most evil thing ever created and I see it all the time. So I don't know if you are familiar with pollution but we only do higher education so I support. And I do stuff and work for us. Andrew. I'm not a full on guy. But I pick up stuff here I'm going to work and I do sort of relate to a lot of that stuff and I give the same thing when I'm doing kind of I'm not a salesperson but I get involved. We don't have a little bit of sales and I have a lot of the same things that I bring up to one of the obvious ones you didn't mention that works for me a lot is sensitive one. You're talking especially in higher education. And I was I won't mention any other names but there's one I just I'll say lost a lot to them. Also the really interesting thing that prevents open source from thriving in higher education which no one talks about is that open source is semi-anarchical in nature and higher education doesn't support that theory. Like higher education needs people to like show up to class and learn the thing. And so the whole like you can teach yourself and do the thing and damn the man saved the entire 100 percent doesn't resonate in higher ed. And so there's that really difficult space because you have to be like no we're way safer than that. I promise you know you know they they're used to the open mind and they listen to us how we've had a lot of success and we can obviously deliver on it when the time comes right but these other ones always end up. This contradictory the pricing I just want you to point on the overall price because I really want to be hands off. And if these people promise what this is this will do everything for you. You don't need an IP person or we don't need to deal with it we'll just do it all for you. Now of course every time I ask for something the hourly rate kind of ends up you know you can tell them that decision a year from now you're going to pay twice as much as you would. Yeah I'm just looking for an angle because I spoke on Tuesday I wasn't sure. No someone came. That's interesting. I was in a situation where I had a prospect client. And we had proposed it's a health insurance. The champion was kind of pushing for approval. He was fighting against Oracle sales team. Oh yeah. And the client. Sometimes it's so easy if I said you know what I care for the million bucks I want to sign it. You don't get fired to be signing a protocol or something. And you have to think of it the amount of money it would take for them to implement the whole solution. Yeah they couldn't get anything. Yeah I mean you don't have to call the cost of the cost not a one license in here. Yeah I mean the implementation is much different. Face I guess. Yeah I'm just curious. One of the. If I want to point you said like one of the things that I run into. Is. The mentality of my. We're not a day to see like competing a lot of the other ages. Yeah we're just in our wheel now. Just. I'm never getting anything. And. We only work for clients that are already with us like our company makes the year. Higher. That's what we did. Yeah my team is one little small part of that they say hey can you help us with a website to. Like as a matter of fact. I have. Nice. Nice. Was hoping that you might enlighten me on to. Yeah. This doesn't leave a room. I said this in front of what's clearly a dribble guy here. No. Yeah. And I know I'm not. Yeah but like one thing that I would love someone to explain. He's WordPress. I'm a WordPress guy. But one thing I'm trying to be open mind is that can somebody show me something that you can do. Like you said you're winning this right. Right. Can somebody come. I will tell you and I didn't want to say this because this is this is a dribble. Afterwards this is a dribble guns I didn't want to say it but I'll tell you what I think it is. I think that. There's this feeling that there is value in arcane. Like WordPress can be done by anybody. The number of developers over the years that I've spoken to her like who are like well I don't use WordPress because WordPress is for babies and then I'm like great how did it go getting that set up and running and I was like well I couldn't like OK so what babies are it is it for my well just you know it's if I tell a client I'm using WordPress they'll think well I could have done that and then they won't want to pay me. I have a whole slide show and the clients where I say if you have this mentality that WordPress is just walking you're so wrong. Yeah. So I'm fascinated with that. It's interesting you said that the WordPress thing. I mean the way I sensed he was talking he just had a big notion that WordPress cannot and my thing is that if you look at what WordPress is about today and you know how to use it not as a marketing person not as a person but if you are interested in looking at every forms and you're looking at APIs and make up the whole thing you use ReactS and everything you think there's a lot of things going on. Well thank you. I think I have a business career I don't actually have one really I didn't plan on coming here to any sales or anything but no I would say you don't have a problem for me. No I was just Well you put a couple of the same thoughts to us on you and some grapple stuff. I was just kidding. It's a part from Moodle. Moodle. Moodle. Elements. You put the high-tech things right? Probably are you Moodle or not? No I'm not. I'm not. I've got weeks and months of people discussing the same piece that we should basically have this discussion through board and then I have halfway through a bunch of other people showing up. I mean I'm not having like one of your 10 of us to work in the office to work in.