Panel Discussion: The 5 Ws and...- Lori Lorusso, Jeremy Meiss, Andrea Frittoli, Aneesha Vallabhaneni
Outlines panel Discussion: The 5 Ws and...- Lori Lorusso, Jeremy Meiss, Andrea Frittoli, Aneesha Vallabhaneni and evaluates key implications for security practitioners.
Summary
### Overview This panel discussion, structured around the "Five Ws and H" (Who, What, When, Where, Why, and How), explores community building, contribution models, and strategic engagement within open source software. Moderated by Lori Lorusso (Outreach Chair for the CD Foundation and Head of Community at Percona), the panel features Jeremy Meiss (DevEx consultant), Anisha Vallabhaneni (Director of Cloud and Platform Engineering at Fidelity Investments), and Andrea Frittoli (Developer Advocate and Software Engineer at IBM, TOC Chair and Governing Board Member at CDF). The panelists discuss the learning opportunities and governance hurdles inherent in open source, ways to handle disputes, platforms for community interaction, the corporate value proposition, and actionable strategies for individual and organizational participation.
### Key Topics - **Benefits and Challenges (What):** Participating in open source serves as an invaluable learning platform where engineers can learn languages like Golang, understand code review workflows, and experience complex architectures. However, large, complex codebases present a steep learning curve that requires mentorship and starting with small tasks. For organizations, establishing a clear roadmap and maintaining active engagement prevents blind spots regarding upstream project changes that might impact internal operations. - **Navigating Conflict (When):** Community disputes must remain civilized and fall within codes of conduct. Unresolved conflicts cause contributors to disengage and stall project evolution. Rather than simply rejecting proposals that may not fit vendor-neutrality rules, project leaders should understand contributors' underlying motivations and find consensus or redirect their passions constructively. - **Collaboration Spaces (Where):** Maintaining community cohesion requires balancing synchronous and asynchronous channels. While conferences, hackathons, and local meetups provide high-value face-to-face networking and workshops, asynchronous tooling—such as mailing lists, Discord, and GitHub Discussions—is critical for global contributors spanning multiple time zones. Jeremy noted that Slack can be challenging for open source communities due to message history loss on free tiers. - **The Business Value and Sustainability (Why):** Open source underpins modern technology ecosystems, making isolationist internal development impractical. Businesses benefit from supporting open source through early access to cutting-edge tools, accelerated internal innovation, high-value industry networking, and direct talent recruitment channels by engaging with active maintainers and contributors.
### Technical Details & Actionable Engagement (How) - **Internal Steering Groups & Vulnerability Workshops:** At Fidelity Investments, internal steering groups unite interested employees to contribute upstream. This includes running focused security vulnerability workshops where developers identify and patch security vulnerabilities across open source dependencies to strengthen the software supply chain ecosystem. - **Direct Community Outreach:** Contributors should inspect project repositories on platforms like GitHub, review contribution guidelines, and reach out directly to maintainers on communication channels with a collaborative posture of "How can I help?" Initial contributions do not need to be code-heavy; triage and documentation improvements represent critical project needs. - **Manager Alignment:** Individual engineers seeking to contribute should explicitly request dedicated time (such as one hour or a hack day) from management by presenting the strategic business, networking, and learning benefits of project involvement.
### Takeaways Open source engagement succeeds through structured mentorship, clear roadmaps, proactive governance, and bidirectional contribution. For enterprises, contributing back—particularly through security vulnerability remediation and community steering groups—provides tangible competitive advantages in talent acquisition, collaborative innovation, and technology resilience.
Related talks
The Linux Foundation·26 min
Anand Kashyap · Marvin Tong · Erica Brescia
Discusses wrap-Up Session Panel Discussion: Quick Takes and evaluates key implications for security practitioners.
The Linux Foundation·29 min
Details regulatory Panel Discussion: Brittany Kaiser, Mark Bower, & Moderated by Aaron Fulkerson and evaluates key implications for security practitioners.
The Linux Foundation·28 min
Panel Discussion: A Balancing Act: OSPOs in Act... Ram I, Srividya G, Madhusudanan GK & Charudutta P
Reviews panel Discussion: A Balancing Act: OSPOs in Act... Ram practitioners, Srividya G, Madhusudanan GK & Charudutta P and evaluates key implications for security practitioners.


