Episode 127: Community Health Metrics for Commercial Open Source  ## Document Notes ## Highlights - **Community Health Predicts Business Value** - Community health correlates with stronger business outcomes like higher valuations and more contributors. - COSA wants measurements beyond vanity metrics to prove community value to investors. Transcript: Matt Trifiro Yeah, so COSA is a mission-driven organization. And the way I like to think about it is, if you think of like two circles, right? So you've got one circle, which is all the really well-run companies. And the other circle is all the really well-run open source projects. And there's a Venn diagram where they overlap. And those are the really well-run companies with really well-run open source projects. Oftentimes, those are venture funded. What I'm trying to do is I'm trying to grow that slice so that we have a rich world full of commercial open source companies with healthy commercial open source projects with great community Metrics and that all of the stakeholders, which I consider really the three most important, are the founders, the investors, and the customers are all at the same table and have a covenant With each other on how all the aspects work together. So they're aligned. Daniel Izquierdo Okay, that's interesting. And how do the community health metrics or the community, open source community health fit into COSA's mission? Matt Trifiro Yeah, well, a number of things. So there's a lot of data that suggests that community health is an indicator of a good business investment. And there's also a lot of indicators that investment enhances community health. So the Commercial Open Source Startup Alliance, Serena Capital, and the Linux Foundation recently published the State of Commercial Open Source in 2025. And that looked at 25 years of data across venture-funded companies that have open source projects at their center as compared to non-open source companies, proprietary companies. And they compared the two. And not only did the open source companies have higher valuations, in some cases, seven to 14 times higher valuations when they were sold or went IPO, but also there was a 27% increase In individual contributors, an increase in the number of individual organizations that contribute to a project, an increase in the release frequency. So a lot of the indicators that we find are important in a community go up in the right direction when venture money comes in. But we want to be able to prove that. And we want to look at deeper metrics. So for example, GitHub stars are one of the most common metrics that people point to, but it's sort of unreliable. They can be faked. It's a popularity contest more than a how healthy is the community. You want to start looking into more things like how long does it take them to respond to an issue to a pull request? What are the release frequencies? ([Time 0:02:05](https://share.snipd.com/snip/9aa11058-c172-4c1e-954c-d82f964d9dbe)) - **Collaboration Density Signals Project Health** - Dense collaboration networks indicate project health and sustained contributor growth. - Daniel Izquierdo says network entropy and collaboration density equal open source health. Transcript: Alice Sowerby Me bring an example of last week. I was invited to give a talk at the Open Compliance Summit in Tokyo. So that's basically supply chain. It's not that much about the startups. It's mainly about corporations, big corporations that are the end users of all of this technology. They want to have a healthy environment and a healthy bunch of startups producing all this knowledge and open source projects so then they can safely use the software. So simplifying the message from OpenChain is about how can we manage effectively and efficiently open source. And for this, they are creating specifically standards for security, for license compliance, and other things. So I brought the topic of open health, open source health, and then as another layer of defense when you are using all of this software. Because then, yeah, they are taking care of certain things, but the industry is so far not taking care of the sustainability of the software. And this is where we bring the concept of for how long this will exist. So if we go to the automotive industry, in certain places, by law, they have to maintain the software for the end user, basically me as a driver, for 10, 15 years. So how do I know if whatever is I'm using nowadays will exist in 10, 15 years? So then this is where we enter into the concept of project health and specifically the concept we can say of sustainability. And that's one of the main indicators. Let me go back now to the question itself. So then what are the very first things that we've seen in Vitergia? So at the very beginning of our history, when we started engaging with open source, that was mainly through open source projects and community managers. And what they wanted to do is basically to lower the barriers for contribution. So basically bring new people to the community. So that's one of the aspects, basically, from a project health perspective, have a continuous growth and sustained growth of the community over time. So basically, you can create super rich, from a diversity perspective of geographical locations, corporations, people, coming to the project. So there is a tipping point where suddenly, you know, everything does click. And then how to find that there are bottlenecks in all of these processes and friction. It's about all removing friction here and there. After all of these years, what I would say if we need to go into some very specific concepts of project health, I would start looking at the network of people, how people are collaborating In the project and the density of those collaborations. So basically the more people you are able to collaborate with and network with and deal with and discuss with, the better basically. So if you think about projects, well-known projects as CNCF, you will see that all the connections in the network graph, if you create a network graph of developers, will be super dense. Everything is like super noisy. So that's the beauty of open source is basically that noise. In reality, that entropy means basically health. And that's the big point here. ([Time 0:05:33](https://share.snipd.com/snip/7e4fa4ad-a2d8-49c1-837b-c35c0cc89d4c)) - **Deliberately Trade IP For Distribution** - Trade open IP for distribution and community-driven innovation deliberately. - Invest in community to convert trial users into qualified sales leads and IP contributions. Transcript: Matt Trifiro To simplify a little bit, there's really two kinds of value that you can trade with your open source community. That's essentially what you're doing. You're contributing your intellectual property, money that you spent that didn't go to your college fund or something else on code that you're then making available under some permissive Or open source OSI approved license, right? And in exchange for that, you're hoping to get something. And there's really two things. One is distribution. So the ability for people to try your product for free, your community edition, for example, is essentially the same. It's the analogous to what a SaaS product does a freemium edition. And so that is the source of your future customers. And the great thing about that is when your customers put your community edition into production and they start running up against the sort of enterprise features. So let's say SOC 2 compliance. Then they raise their hand to have a sales conversation. And the great thing about that is it's almost entirely an engineering conversation with some sales on top of it. And it is a very advanced conversation because you know the customer wants to buy it. And that's the dream of an organization is the incoming leads are excited customers who are eager to buy. And so it actually supports a very, very different relationship, potential relationship between the company and their customers. The second thing that you might look for, and again, every project's a little bit different. You might look for intellectual property contributions. So you may look to the community to build core functionality, to fix bugs, maybe to build important things around the periphery, to build drivers or integrations or that sort of thing. And so making, investing in your community so that it attracts intellectual property that makes the overall system more robust, both for the paying customers and the community customers, I think is the other thing that people look for from an open source community. ([Time 0:08:55](https://share.snipd.com/snip/cf700f3e-42b7-4b45-ad25-50bc21160f37)) - **Translate Community Metrics Into Dollars** - Convert community metrics into dollar-value formulas for investor conversations. - Ascribe value to active users and PRs so founders can show ROI from community investment. Transcript: Matt Trifiro Down to the education and the playbooks and the best practices, and then being able to measure it. Are we making money and building a healthy community? So we take the kind of data that Daniel and others pull from these projects. We put it into a set of formulas that we create openly and agree that these are reasonable measurements of community health. And we make that part of the metrics. And really my goal is to convert community metrics into dollars, right? So if you can actually ascribe value to each active user, to each participant, to each pull request, then the investors see it in terms that they understand. And it clearly has value, right? So I think bridging those two worlds by translating from dollars into community benefit, from community benefit back into dollars, will go a long way towards helping us arrive at this Ideal sustainability between those three stakeholders that I mentioned. Yeah. Daniel Izquierdo So I think what you're saying, because when you say you want to convert community value into dollars, my immediate thought was through sales. But I think what you're actually saying is there's value that's latent in the community. That's right. Matt Trifiro That's right. Daniel Izquierdo That you invest in as a commercial open source startup that needs to be recognized and brought into the conversations that you have with investors. Absolutely. Because traditionally speaking, particularly let's say if you've got a SaaS product, the things that you're going to be talking about with your investors are centered around a certain Kind of traditional set of metrics that don't include value that's being created in the open source community. Matt Trifiro I have yet to see a board meeting where a founder is presenting the value of their community in terms of dollars because they're investing in their community. They need to show return on that investment. And so, you know, how do we calculate things? This is difficult. So we need to come together as a community and this needs to be an open process. And that's part of what CASA's role is, is to bring these best thought leaders on this subject together. But can we ascribe a value to an active user of the community edition? And I don't mean like going after them for sales. But eventually we say, look, some percentage of those users are going to be so excited about using this product that they're going to integrate it into some enterprise system. And at that point, the CIO or the CTO or the procurement office is going to want an insurance policy, right? If nothing else, or maybe they want a SaaS delivery version of the product, or they want technical support or any of these things that a commercial company is really good at delivering. They can raise their hand. And that small percentage of companies then become paying customers. You can ascribe a value to that original use. And that's just aren't showing up in the board meetings. We're not looking at a common dashboard, the founders, the investors, and the community members. And I think we can get to that point. And that's a very good point, basically, is can we have that? ([Time 0:15:00](https://share.snipd.com/snip/231d611e-5da1-46d1-bb3a-ee07b6265e2d)) - **Build A Baseline Then Customize Metrics** - Start with a baseline metric framework, then customize by industry or company. - Publish common definitions so VCs, founders, and customers calculate health consistently. Transcript: Alice Sowerby But probably the main point is that there will be certain peculiarities coming from different industries. So I guess we'll be able to address like a basic set of metrics to define, okay, this is the framework for VCs and founders, and then this is a common understanding. So basically, first of all, probably we need those common definitions in one place. Cosa probably should play this role. And then after this, depending on basically the industry we are, this is embedded systems, if this is cloud ecosystems, that will be totally different what it means. Matt Trifiro Even down to the individual company. If you look at like SaaS companies again, and then I think the analogy with product-led growth, these are companies that give away a freemium product, customers come in, they use the Free product, and then they're like, oh, this is amazing. Or they start running up against boundaries. Oh, okay, I've used all my AI credits today. Maybe I should pay 20 bucks a month or 100 bucks a month or whatever that is. And that product led growth motion is really well understood. But every company ascribes different value. If a user does X, Y and Z, how much more valuable are they? How much more likely are they to become a paying customer? How can we make it more exciting for them to become a paying customer? We're useful to them to become a paying customer. So every company is a little bit different because their monetization model is a little bit different and their purchase price is different. It's very different if you're selling a $100 a month product versus a $50,000 a year or a quarter million dollar a year product. So they're all different, but I agree it changes based on industry and it changes by individual company, but we can have these standards on how you should think about it and how you should Calculate. So at least everybody knows this is how the calculation is being done. Transpartum. ([Time 0:17:50](https://share.snipd.com/snip/38fc4819-23a0-4b92-bca6-2a139139bcde)) - **COSA Began As A Bootstrap From Linux Foundation** - Matt Trufiro bootstrapped COSA after an Linux Foundation stint that funded eight months of work. - He plans membership tiers for investors, founders, and customers while seeking seed-style funding. Transcript: Matt Trifiro Yeah, thanks for that opportunity, Alice. So I am bootstrapping Casa. So I started this project as a passion project, let's say a little over a year ago. I did a tour through the Linux Foundation. Linux Foundation was generous to pay my salary for eight months to get this off the ground. I then spun it out of the Linux Foundation. I'm in the process of seeking my, let's call it seed funding to use the venture terms. But obviously, because this is a mission driven organization, it's the investment criteria is a little bit different. But I hope by the time this episode airs, I will have completed that funding and I will be a fully operational organization with three types of members, right? ([Time 0:19:52](https://share.snipd.com/snip/5f43196d-251e-484f-875a-8c642034b3bd)) - **Bridging The Investor–Community Language Gap** - Investors and communities speak different languages, causing misalignment and risky decisions. - COSA aims to be a Rosetta Stone so stakeholders share common metrics and covenants. Transcript: Matt Trifiro 100%. That's exactly right. Daniel Izquierdo So that might be happening contingent on funding, or do we think it will happen? Matt Trifiro I think it's going to happen. It's just a matter of us forming the working group and starting. Oh, that's very cool. Daniel Izquierdo That's a scoop for the podcast. We didn't know about that. Matt Trifiro We just decided yesterday, so it literally is a scoop. Daniel Izquierdo Okay. Nice one. Nice one. That's exciting. Yeah. I'll be interested to see how that pans out because personally, I think it's long overdue that investors have more insight into the role of open source. And just that these two communities that are interconnected, right? Matt Trifiro They're codependent or interdependent, maybe a better word. And they don't talk to each other. They don't use the same language. And so I think creating that Rosetta Stone that helps the investors talk the language of community and helps the community talk the language of investors will do nothing but good. Alice Sowerby To illustrate all of this. I remember we were doing analysis for OpenStack Foundation years and years ago, at the very beginning of their journey. And then we realized that, oh, there are some IBM developers doing something here. This has to be useful for something. Because first, might be for VCs, if they are interested in investing in some of the small companies here and there. This might be interested from a diversity perspective, because there is a new geographical location. Were coming specifically from China. But there is this big corporation called IBM that is participating here. And then this might be interested to learn exactly where they are participating there. Even more, you know exactly who they are. So perhaps through some other community members that have been, you know, code reviewing together or something, you can have that knowledge back home. So all of this is super useful from a metrics perspective. The point is how to put that in place. ([Time 0:22:34](https://share.snipd.com/snip/ed64662e-8e37-4e18-bc6b-96ad4a09c10c)) - **Rug Pulls Stem From Communication Failures** - Rug pulls often result from communication breakdowns and lack of agreed covenants, not only malice. - Writing commitments into charters forces investors to decide whether community value matters. Transcript: Daniel Izquierdo So is the hypothesis there then that rug pulls have been done through lack of understanding of where the value lies in the open source community? Matt Trifiro I think that is a reasonable hypothesis, yes, because I don't think it's intent-based. And even the founders, I talked to the founders that were their companies have done these license changes. And it was the most heart-wrenching decision they've ever made. They're like, I love open source. And I was making the decision because I have employees that have children that are going into college that need to put food on the table. And I love open source, but I didn't know how to do it any other way. And so I think we need to create that other way. Daniel Izquierdo Yeah, we need to get ahead of that situation. I look like a long way ahead of it. Yes. Yeah, we didn't get to that moment of desperation. Perhaps this is a strong word then. Matt Trifiro Yeah, it seems like a complete breakdown of communication that that would happen. You've got the stakeholders that aren't talking to each other. They don't have a common alignment. They don't have a covenant around which they've agreed. And that's the other reason why it's the commercial open source startup alliance is because in those early days, before a lot of these decisions be made, you can set these things down. You can write into your company charter rules that you won't violate. And the charters aren't easy to change. An investor that comes in and wants to invest in you, if you've got this written into your charter, they'll have to make a decision about whether they believe that community has value Or not. ([Time 0:26:38](https://share.snipd.com/snip/7acbbad3-5a6d-4610-96fd-25764284e18e)) - **Write Clear Covenants Early** - Create explicit covenants that state what a company will and will not do with core code and licensing. - Embed commitments in charters and templates so stakeholders have durable expectations. Transcript: Matt Trifiro An agreement. Like these are the things that we will do and these we don't do. So for example, let's say that your business model is an open core model. You can define what that boundary is and how you advance that boundary. And maybe you have community members on a board that help you advance that boundary. And maybe you have commitments that you will never change the license on these core aspects. So I don't know the actual answer. Like we have to work these things through. These things don't really exist in practice today, not to any large extent. The other thing we can do is, so for example, what does the company get out of making commitments, additional commitments to the community other than contributing the code? And that's, I think, the question we have to ask. And so what can the community bring early on? And I think confidence, the ability to know that your community is not going to rebel against you because you have a common understanding and an agreement, like literally a written Agreement, whether it's in the charter or not, it can be written down and it should be open. In fact, that I think is the root cause of most of the emotional distress on these rug pulls is the community had one understanding in their head, and that is, nobody's going to change The license on me, right? Why would they ever do that? That's a horrible thing to do. And then the company's like, we feel forced to do it. We have to do it because of these economic pressures or whatever the reason might be. And that's a breakdown that should have never happened, right? It should never have gotten to that point where the two parties aren't talking to each other constructively about how we advance both of our common goals. So literally a covenant. Yeah, I think these things need to be written down. I think we can build templates. ([Time 0:28:44](https://share.snipd.com/snip/afd47cb0-e128-48e2-8dbb-36ebd698288d)) - **Hosts Share Personal Value Adds** - Alice Sowerby describes attending an after-dark Christmas light trail to mark the season. - The hosts shared family milestones as heartfelt value adds at episode end. Transcript: Matt Trifiro Dark. That's excellent. That's mine. Daniel Izquierdo How about you, Matt? Matt Trifiro Well, first of all, I want to say this is my new favorite way to end a podcast. This is awesome because it really forced me to think about something that's meaningful in my life. And what I came up with is I have an 18 year old boy and he started his first semester of college. And literally yesterday he finished his final exam for the first semester. And I am so proud of him and he's so adult and so calm and did nothing to do with me. So I just am full of joy that he's accomplished that and all on his own. Daniel Izquierdo That's really great to hear. Daniel, have you got a value add? Alice Sowerby Yeah. So then I go with my son as well, that he's basically finishing his first quarter in the primary school. So I think it's three years and a half. Another graduation. Just imagine. Yeah, they have tomorrow some party or they sing some songs and everything. Families will be there, parents and everything. So that's going to be super, super funny. And I will add a second one if I can, which is this is kind of graduation as well. ([Time 0:32:24](https://share.snipd.com/snip/f6858947-5541-4a05-bb25-801ddd47b117))