[OSPO Book] Test-read the OSPO Book and give structured feedback

[alice-sowerby]

We are looking for people to read the book and give structured feedback on how useful it is.

While we welcome all feedback, it would be most helpful if you are within our target audience, and can provide your feedback to the questions below.

Self-Screener Question

Is this book for you? You'll be a good fit for test reading if you can answer "yes" to at least one of these:

• Have you worked with open source software in a professional capacity?
• Are you involved in open source governance, compliance, or community management?
• Do you have experience with or interest in establishing open source strategies within organizations?
• Are you curious about how companies can effectively engage with open source communities?

Feedback Questions

When providing feedback as a comment to this GitHub issue, please consider these questions:

1. Clarity: Which sections or concepts were unclear or would benefit from additional explanation?

2. Practicality: How applicable is the content to real-world OSPO challenges you've encountered?

3. Gaps: What important topics, examples, or perspectives are missing from the content?

4. Structure: Does the organization of chapters and sections flow logically? If not, what improvements would you suggest?

5. Most/Least Valuable: Which chapter or section did you find most useful? Which was least useful and why?

Give feedback by adding a comment below

This will help us to collect them all in one place.

[ashleywolf]

Overall, the chapter organization is sound and well suited for readers who are new to OSPOs. In future editions we might consider adding dedicated chapters on:

• Governance & Policy
• Community Engagement & Growth
• Sustainability & Business Models
• Tooling & Automation
• Case Studies & Lessons Learned
• Advanced Topics (Emerging tech, AI)

Chapter 0: Introduction - https://ospobook.todogroup.org/00-chapter/
– Be sure to explicitly include security professionals, OSPOs can report into or partner closely with security teams.

Chapter 1: The Value of OSPOs - https://ospobook.todogroup.org/01-chapter/

• Add data from TODO Group and the Linux Foundation showing that open source comprises over 90 % of most companies’ codebases.

OSPOs can vary across organizations
What matters most is not the title or org chart location, but the OSPO’s ability to influence engineering, policy, legal, and security stakeholders.

Overall, gather input from stakeholders on these areas by asking the following questions:

• Checklists would be really great

https://ospobook.todogroup.org/02-chapter/

• Emphasize that any organization using software even very small startups needs an open source strategy. Early planning can smooth later M&A or acquisition processes.

--

At the end of each chapter, consider adding a “Key Questions” or checklist section. For example:

1. Which teams must we partner with (engineering, legal, security)?
2. What governance policies are already in place, and where are the gaps?
3. Who are our current community champions and what incentives exist for new contributors?
4. What metrics will we use to measure OSPO success?

[reshamas]

In my review, I prioritized some sections that have been on my mind based on my observations in open source.

[section] OSPO End User Journeys

George Washington University may be interested in adding a case study. Their OSPO is quite active. Reference: LI post: https://www.linkedin.com/posts/lorenabarba_gw-open-source-program-office-hosts-inaugural-activity-7313217250407182337-7Y2G

We hosted our inaugural conference on open source strategy, software, and initiatives! The two-day event brought students, faculty, researchers, industry leaders, and open-source advocates to explore innovation, collaboration, and security in open source software.

cc: @labarba

[section] Chapter 2: The Value of Open Source Program Offices
"How the OSPO Helps" = = > add: "Acts as an educator" (providing training and education)

I think another way OSPO's can add value is by "education", by providing training to their staff on open source. In open source interactions, I often observe incidents that are driven by what I would refer to as "open source illiteracy".

1. One example is where a contributor makes a feature pull request without discussing it with the maintainers, the PR is closed and the community contributor is quite unhappy.

2. Another example is when a contributor is discouraged by length in time of the review process.

3. OSPO offices or company employees asking for assessments or documentation from maintainers, which uses up valuable maintainer time.
   source: https://bsky.app/profile/fernandoperez.org/post/3lc4tfkqy5c2w
   text:

PSA for the umpteenth official contacting
@projectjupyter.bsky.social
asking us to fill out some kind of "security vendor assessment" - please read this. We're an open source project, not a vendor. We don't hold your data, we don't sell you anything: https://jupyter.org/security#vendor-assessments

cc: @fperez

[hfukuchi]

Comments regarding the relationship between Chapter 1 'Introduction to Open Source Program Offices' and Chapter 3 'Creating Your OSPO'.

In Chapter 1, under 'Applying This to Your Organization', an assessment is being conducted: that is, 'Understand the Role of Open Source in your Organization'.

This assessment could serve as a preliminary process for Chapter 3, 'Creating Your OSPO'.

How about describing the relationship between Chapter 1 and Chapter 3? For example: The assessment in Chapter 1 could serve as a preliminary process for Chapter 3.

Additionally, would it be appropriate to mention that the results of the assessment in Chapter 1 could be used as reference material for planning strategy in Chapter 3?

[Pizza-Ria]

First, I'll echo the laudatory comments - the more resources that the world has emphasizing the importance of "OPEN" offices (OSPOs or just Open Program Offices like HPE has), the better. I also like the clean format - very easy to follow and consume. I'll also echo the previous comment on checklists - awesome idea @ashleywolf. But I'll add in a summary box (perhaps at the beginning of the chapter or the end that highlights 2-3 tips for quick consumption and orientation as to the value of the chapter ... you don't have to give everything away as we still want people to read the rest but a little teaser might be helpful).

Overall, I would say the content is more focused to an early-stage/early-experience level of open. That is just fine ... it is really nice to have a holistic but basic set of principles in one place! You do a set the stage well by stating "This book provides a clear introduction for anyone who wants to understand how OSPOs help organizations manage open source. It’s also a helpful resource for people already working in OSPOs who want to strengthen their role in shaping and managing open source strategy and operations."

If there is another section though that I would consider adding, it might be a list of the foundations/conferences that are so immensely valuable for learning more, developing relationships, getting inspired, etc. If I had a tagline for open it would be "Endless Learning Opportunities". I need to clone myself a dozen times to do all the open things that I would like to - on that subject, there may even be another opportunity to emphasize the importance of strategic alignment within your organization so you can effectively pick and choose which of these provide the most value-add without burning out on trying to do too much. I also realize that this is a challenging section as conferences/foundations may change or refocus in a different direction.

Here are some specific commments:
Chapter 1

1. Defining an OSPO: - As I just mentioned, we have an Open Program Office because we include open artificial intelligence in our mission. I think we may not be unique in this but Open AI issues will require new processes, frameworks, license reviews, etc. so this could be an area to explore. You mention dropping the "program" from the title a little further down but we drop the "Source" as AI has many facets not just software.

• Our OPO actually rolls up to the Legal department which is yet another home where such a department may sit.

2. How an OSPO Works Inside an Organization

• As part of either sideways or maybe even looking internally - include efforts vis-a-vis InnerSourcing.

3. Resources: Nice set of resources at the end of the chapter (making a mental to look at these at some future time when I'm not trying to get through the book review!).

Chapter 2

1. Introduction: One value that is not listed might be "Encouraging Best Practices". I often feel that our OPO can "float" above the day-to-day needs of a product team and do a little more of seeing the "forest for the trees". Also, because we see open soruce utilized across the company, we can connect dots that others simply don't have the visibility to do.
2. FN7 re Redis changing its license, it has changed back to include AGPL again so this FN could be updated for complete accuracy even though the original point is still valid. https://redis.io/blog/agplv3/. It is like my hometown - if you don't like the current weather, just wait and it will change back.

Chapter 3

1. Flower - I think someone already mentioned this but I'll +1 the add of security. Also "Internal Ecosystem" does not appear to be defined. Not sure if this was intended to include consumers of open sources in addition to the other petal "contributors". Might need something about engagement with Standards in here too.

Chapter 4
No comments.

Chapter 5

1. Consider adding https://www.cisa.gov/sbom to the resources.
2. Consider adding https://orcwg.org/ to the resources.

Chapter 6
No comments except that I love CHAOSS.

[alice-sowerby]

I am leaving this issue open so that others can also lodge their feedback at any time in the future.

Feedback logged to date (2025-07-15) will be addressed in a separate issue #657

[alice-sowerby]

@Pizza-Ria @ashleywolf @hfukuchi @reshamas Thanks for your feedback! I will be processing it and logging actions/comments in #657

[LuluNwenyi]

hi @alice-sowerby is this still open to feedback?

[alice-sowerby]

@LuluNwenyi yes! I will address new feedback periodically as it is received.