Drupal Association blog: In the Open with Tiffany Farriss: What it takes to sustain the Drupal commons
In the Open is a weekly series from Drupal Association Interim CEO Tiffany Farriss, sharing what she is hearing across the Drupal community and where the Association is headed. In this episode: why Drupal's commons is under pressure, how the Drupal Certified Partner program is evolving, and what it takes to keep free software running for the next 25 years.
"Drupal is free. The code of Drupal is free forever. But those of us who run Drupal know that running Drupal has never been free."
The following is a transcript of Tiffany's remarks, lightly edited for readability.
What I'm hearing from the communityThe thing that's top of mind for me this week is reflection. I've spent a lot of time listening to folks, talking to folks, asking a lot of questions. I wanted to take a few minutes to share back some of the things I'm hearing, because these are the things motivating the changes in how I'm thinking about existing programs, and about how we might want to do things differently for the next 25 years of Drupal.
Whether it was the ecosystem survey, the business community survey, or conversations with the core release maintainers and other parts of the community, it's very clear to me that our commons is fragile. The technology of Drupal itself is a brick. It is solid. We are super proud of our security team. But the people and the funding sustaining it aren't yet in a sustainable place, and there's a lot of pressure.
That pressure is echoed in the business community. The businesses that have been very supportive of Drupal through the years, and I'm thinking not just of those 126 Drupal Certified Partners but of all of us, everyone is getting squeezed. The business survey data showed that the average deal size was down, and that pipeline expectations had gone negative for the first time in the Drupal business survey.
That creates a real impetus for us to make sure that people who aren't in our community are hearing about Drupal, because right now we don't think they are. We think the visibility and the curb appeal of Drupal is weak. It was one of the weakest scores in the business survey. And yet where Drupal is already in the mix, it continues to do really well. This is where you see our advocacy program trying to address this: getting the word out to people who may have a very dated view of Drupal, who haven't looked at us in a while. Because when people actually know Drupal, we succeed.
Rethinking the Drupal Certified Partner programI take all that feedback, and I've been thinking a lot about the Drupal Certified Partner program. One thing that stood out in conversations across the ecosystem is that calling it the Drupal Certified Partner program has created misimpressions that aren't serving us well. It lets some folks opt out: "Oh, that's not really for me, that's just for small agencies, just for the folks who are already there, who are already contributing." That's not true. It also creates the idea that we're some sort of trade association, and we're not. We're a 501(c)(3). We are a not-for-profit with a charitable and educational mission around the Drupal project itself, which has been recognised as a digital public good. So we need to reinvent what that message is and how we address it.
Free code was never free to runThere are things that always have to be true. Drupal is free. The code of Drupal is free forever. But those of us who run Drupal know that running Drupal has never been free. It requires security coordination. It requires testing and packaging and releases, and those cost real time and money. A small group has paid for that for a really long time, and I think this is the time when the wider world is waking up and realising that's not such a good idea.
Last week's security incident with PHP brought a lot of light to that. The PHP Foundation has one full-time staff person, my equivalent, Elizabeth Barron. She's amazing. But just one person, and 70% of the internet runs on that. She has twelve people she's able to fund part-time to do security and maintenance work on PHP. So I'm hopeful that the broader conversation about what it takes, about this open source technology that everyone depends on, that's in everything and everywhere, creates an opportunity for us to have that conversation.
What every Drupal site receivesA lot of what I've done is extend the work I did a few years ago on what the Drupal Association itself puts into supporting Drupal. It's about $10 a year per site, and $7.50 of that we're actually able to raise. Then when we consider the things that aren't scratching your own itch, like core release management or the security work, things done by the community, I think the community itself puts in another $30 a year. So every year, every site receives $40 of services that are simply donated to it.
And when we come back to that volunteer time, those 126 companies who are Drupal Certified are shouldering that burden today. That isn't fair to them, and it's not safe for Drupal.
Making contribution visible, expected, and recognisedWhat I want to do is make it easy and expected for everybody in the ecosystem, everyone who receives value from Drupal, everyone who uses it, to understand what it means to be a net neutral citizen of Drupal, and to give that back easily in ways that are appropriate. We have asked people to give back for a long time. That's gotten us here, but I don't think it gets us where we need to go. The next step is to make that contribution visible, expected, and recognised.
That's how I'm thinking about the Drupal Certified Partner program becoming the Drupal Certified program. What we can do is be a certified trust registry. What does the Drupal Association uniquely have to offer? We can reflect how you're giving: in what ways you are a maker, in what ways you are a patron, in what ways you are an advocate. And we can calibrate those so they're appropriate to the sector you're in and the ways you would naturally want to contribute to Drupal.
Certified organisations will be those who agree to a set of shared good practices: contributing fixes upstream, responding to our security team, tending the issue queues you maintain, and keeping sites current. Any organisation with a developer can meet those maintenance commitments in-house. And if not, we're going to set up a maintainers fund. Drupal has a lot of maintainers who would appreciate a little support, so if your organisation has modules you maintain, or that you need maintained, we can be a conduit for that. We can help you be a good Drupal citizen.
What will always be trueDrupal is GPL, and Drupal is always going to be free for everyone. Security patches and advisories will be available to everyone. No one can pay for that. You can join the security team, and I really encourage people to do that, because we know the volume of security issues is up tremendously. AI is both the culprit and the solution to that.
What you'll start to see over the next six months is a real evolution in how we take that responsibility as a public ledger very seriously, and make sure it's clear to people both inside and outside our community how you're engaging with this ecosystem. So that we can continue to have a really nice commons, a digital one at that, for the next 25 years.
Follow the conversationNew episodes of In the Open publish each week. Subscribe on the Drupal Association YouTube channel to follow along.
With thanks to Stephen Cross of Second Signal Media for producing this series.