[Pandas-dev] Tidelift

Thu Aug 8 12:51:49 EDT 2019

FYI, we've been accepted by tidelift. I'm going through their tasks now.

1. Adding Tidelift to .github/funding.yml (
https://github.com/pandas-dev/pandas/pull/27823)
2. Adding a security disclosure plan (
https://github.com/pandas-dev/pandas/pull/27822)
3. Install the Tidelift GitHub application (I've requested the install,
Jeff, can you approve?)
4. Publicize (https://github.com/pandas-dev/pandas-website/pull/78)
5. Setup 2FA on PyPI (I'll reach out to all our members on PyPI in a
followup)

Tom

On Thu, Jun 13, 2019 at 2:07 PM Pietro Battiston <me at pietrobattiston.it>
wrote:

> I agree with Jeff that having the money gives us options that we don't
> have otherwise. So I'm generally +1 on the Tidelift offer.
>
> As to how to spend it, I think
>
> - we can certainly create topic-specific grants for freelancers when it
> makes sense, we just do not want the pressure to necessarily create
> grants just because we have the money
>
> - for what is not spent on grants, I suspect a simple online sheet
> where each core dev each month states a) number of hours devoted to
> pandas and b) use for the money ("in my pocket" vs. "in personal
> Python-related tickets/expenses" vs. "in a fund for pandas expenses" -
> although the latter options would probably be the same from the
> project's side) would I think solve the hassle-profit tradeoff in the
> simplest way.
>
> Pietro
>
>
> Il giorno mar, 11/06/2019 alle 21.34 -0400, Jeff Reback ha scritto:
> > I
> > > One risk to be aware of is that if a high profile
> > > project like pandas take's TL's money and none of the maintainers
> > > pay
> > > themselves with it, then the monthly number may not have as much of
> > > a
> > > chance of increasing (since current or prospective TL customers may
> > > observe that the subscription dollars aren't being used in the way
> > > that is being pitched).
> >
> > I actually see the exact opposite here. A project of pandas stature
> > that decides to better the project is a pretty respectable goal.
> >
> > I believe we would be in the letter and more importantly the spirit
> > of Tidelift for the pandas project itself to take this burden &
> > receive the income. Having the project itself with the combined
> > force of multiple maintainers actually would be much more comforting
> > (from the customer's perspective), than a single maintainer (who may
> > not always be there).
> >
> > Furthermore, we could use these funds for the combined benefit of the
> > project, mainly I think for gatherings like the upcoming sprints. I
> > am not sure many of you know, but pandas has not actively solicited
> > *any* monies, and only received 2 largish contributions over the
> > years, which are the majority of our current funds. The tidelift
> > agreement looks to provide a stream of income which we currently do
> > not have. With an income stream we have options; without we don't.
> >
> > We can always decide to remunerate maintainers who contribute to this
> > effort, though, this should be a separate discussion.
> >
> > Jeff
> >
> > On Tue, Jun 11, 2019 at 5:10 PM Wes McKinney <wesmckinn at gmail.com>
> > wrote:
> > > On Tue, Jun 11, 2019 at 2:26 PM Andy Ray Terrel <
> > > andy.terrel at gmail.com> wrote:
> > > >
> > > >
> > > >
> > > > On Tue, Jun 11, 2019 at 12:51 PM Wes McKinney <
> > > wesmckinn at gmail.com> wrote:
> > > >>
> > > >> hi,
> > > >>
> > > >> On Tue, Jun 11, 2019 at 11:16 AM Ralf Gommers <
> > > ralf.gommers at gmail.com> wrote:
> > > >> >
> > > >> >
> > > >> >
> > > >> > On Tue, Jun 11, 2019 at 4:56 PM Andy Ray Terrel <
> > > andy.terrel at gmail.com> wrote:
> > > >> >>
> > > >> >> While the original lifter agreement was an individual
> > > contract, in our negotiations with Tidelift, NumFOCUS has
> > > explicitly sought a model that allows the project to split the
> > > money how they prefer. This was always Tidelift's intention, it was
> > > just faster and easier to scale to focus on paying individuals.
> > > >> >
> > > >> >
> > > >> > +1 the project decides for themselves is the intent and a good
> > > principle.
> > > >> >
> > > >> >>
> > > >> >> I do like the idea of paying for maintence work, I would
> > > recommend we set up folks as contractors with NumFOCUS rather than
> > > just pocketing money. It will give a lot more legal protection.
> > > Then if some folks don't want to take the cash you they can donate
> > > their time and be recognized as in-kind donations, which might have
> > > some tax deductions.
> > > >> >
> > > >> >
> > > >> > Keep in mind that this has a lot of potential issues.
> > > Examples:
> > > >> > 1. Who decides who gets paid, and how? The pandas repo has
> > > 1500+ contributors. Lots of potential for friction over small
> > > amount of $.
> > > >>
> > > >> More or less the _entire_ point of Tidelift is to incentivize
> > > people
> > > >> to do more maintenance work. I think it's worth at least
> > > attempting to
> > > >> use this money for its intended economic purpose.
> > > >>
> > > >> The maintainers are, as a first approximation, the ~10-15 active
> > > core
> > > >> members listed on
> > > >>
> > > >> https://github.com/pandas-dev/pandas-governance
> > > >>
> > > >> IMHO those are the people that should get paid (going forward)
> > > -- if
> > > >> contributors are more motivated to become core team members /
> > > >> maintainers as a result of the Tidelift money, then it has had
> > > the
> > > >> desired outcome.
> > > >
> > > >
> > > > I would suggest leaving the decision to the project core team
> > > with the project Numfocus committee to be the overseer of the
> > > implementation.
> > > >
> > >
> > > Yes, of course, that's the governance that we have in place. I am
> > > just
> > > stressing that we should try to honor the intent of the asset that
> > > is
> > > being purchased by Tidelift customers. Tidelift is telling their
> > > customers that the money they are paying is going to end up in the
> > > pockets of the project maintainers
> > >
> > > https://tidelift.com/about/lifter
> > >
> > > If the pandas core team wishes to deny themselves the income
> > > (which,
> > > divided up, isn't going to be a life-changing amount of money)
> > > that's
> > > their prerogative -- I just wanted to be clear about where I stand
> > > on
> > > it, and there's nothing immoral about wanting to be compensated for
> > > one's time (given how much volunteered time has already gone
> > > uncompensated). One risk to be aware of is that if a high profile
> > > project like pandas take's TL's money and none of the maintainers
> > > pay
> > > themselves with it, then the monthly number may not have as much of
> > > a
> > > chance of increasing (since current or prospective TL customers may
> > > observe that the subscription dollars aren't being used in the way
> > > that is being pitched).
> > >
> > > >>
> > > >>
> > > >> > 2. Many people have employment contracts, those typically
> > > forbid contracting on the side. So inherently unfair to distribute
> > > only to those who are in a position to accept the money.
> > > >>
> > > >> This is true -- at least Jeff and maybe others fall into this
> > > >> category. In such cases their "cut" of the maintenance funds can
> > > go
> > > >> into the communal fund to pay for other stuff
> > > >>
> > > >
> > > > Yes such accommodation will need to be worked out.
> > > >
> > > >>
> > > >> > 3. You're now introducing lots of extra paperwork and admin,
> > > both directly and indirectly (who wants to deal with the extra
> > > complications when filing your taxes?).
> > > >>
> > > >> Hopefully we're talking just a 1099 from NumFOCUS with a single
> > > number
> > > >> to type in, but I'm the wrong person to judge since my taxes are
> > > more
> > > >> complicated than most people's =)
> > > >
> > > >
> > > > Generally it is done that way for US based folks and for folks
> > > out of the US we tend to let them handle their own taxes. We would
> > > need to work that out.
> > > >
> > > > Additionally, as in all dealings with businesses, we do the extra
> > > paperwork for the other benefits such as limiting the liability of
> > > a maintainer.
> > > >
> > > >>
> > > >>
> > > >> > 4. It may create other weird social dynamics. E.g. if money is
> > > now directly coupled to a commit bit, that makes the "who do we
> > > give commit rights and when" a potentially more loaded question.
> > > >>
> > > >> I think this is where the honest self-reporting of time spent
> > > comes
> > > >> in. The goal is to increase the average number of maintainer
> > > hours per
> > > >> month/year. It's sort of like a crypto-mining pool, but for open
> > > >> source software maintenance =) Obviously maintainers are
> > > accountable
> > > >> to the rest of the core team to behave with integrity
> > > >> (professionalism, honesty, etc.) or they can be voted to be
> > > removed if
> > > >> they are found to be dishonest.
> > > >
> > > >
> > > >>
> > > >> >
> > > >>
> > > >> > And, dividing it into N chunks, the funding becomes nice beer
> > > money and a thank you for volunteering. Could be exactly what you'd
> > > prefer as a team. But that's imho more in line with the current
> > > version of Patreon or GitHub Sponsors rather then with what
> > > Tidelift is aiming for.
> > > >> >
> > > >> > I'd like the idea of "paying for maintenance" if there were
> > > enough money to employ people. But realistically, that will take
> > > many years. The Tidelift slogan on this is unrealistic for a
> > > project like Pandas where maintenance effort is many FTEs; it's
> > > perhaps feasible for your typical Javascript library that's popular
> > > but small enough for one person maintaining it part-time.
> > > >> >
> > > >> >>
> > > >> >> It is something I would volunteer to help manage in order to
> > > learn how other projects might use the same techniques.
> > > >> >>
> > > >> >> -- Andy
> > > >> >>
> > > >> >> On Tue, Jun 11, 2019 at 9:13 AM Wes McKinney <
> > > wesmckinn at gmail.com> wrote:
> > > >> >>>
> > > >> >>> > How you allocate the money to each other is something you
> > > can debate privately
> > > >> >>>
> > > >> >>> On this, I'm sure that you could set up a lightweight
> > > virtual
> > > >> >>> "timesheet" so you can put yourselves "on the clock" when
> > > you're doing
> > > >> >>> project maintenance work (there are many of these online, I
> > > just read
> > > >> >>> about https://www.clockspot.com/ recently) to make time
> > > reporting a
> > > >> >>> bit more accurate
> > > >> >>>
> > > >> >>> On Tue, Jun 11, 2019 at 9:09 AM Wes McKinney <
> > > wesmckinn at gmail.com> wrote:
> > > >> >>> >
> > > >> >>> > Personally, I would recommend putting most of the money in
> > > your own
> > > >> >>> > pockets. The whole idea of Tidelift (as I understand it)
> > > is for the
> > > >> >>> > individuals doing work that is of importance to project
> > > users (to whom
> > > >> >>> > Tidelift is providing indemnification and "insurance"
> > > against defects)
> > > >> >
> > > >> >
> > > >> > Actually that's only partially true. Tidelift is paying for
> > > very specific things, that allow them to do aggregated reporting on
> > > licensing, dependencies, security vulnerabilities, release streams
> > > & release docs, etc. - basically the stuff that helps large
> > > corporations do due diligence and management of a large software
> > > stack.
> > > >> >
> > > >> > It is explicitly out of scope to work on bugs or enhancements
> > > in the NumFOCUS-Tidelift agreement (and working on particular
> > > technical items was never their intention). So "insurance against
> > > defects" isn't part of this, except in a very abstract sense of
> > > making the project healthier and therefore reducing the risk of it
> > > being abandoned or a lot more buggy on the many-year time scale.
> > > >> >
> > > >> > Cheers,
> > > >> > Ralf
> > > >> >
> > > >> >
> > > >> >>> > to get paid for their labor. So I think the most honest
> > > way to use the
> > > >> >>> > money is to put it in your respective bank accounts. If
> > > you've getting
> > > >> >>> > a little bit of money to spend on yourself, doesn't that
> > > make doing
> > > >> >>> > the maintenance work a bit less thankless? If you don't
> > > pay
> > > >> >>> > yourselves, I think it actually "breaks" Tidelift's pitch
> > > to customers
> > > >> >>> > which is that open source projects need to have a higher
> > > fraction of
> > > >> >>> > compensated maintenance and support work than they do now.
> > > >> >>> >
> > > >> >>> > How you allocate the money to each other is something you
> > > can debate privately
> > > >> >>> >
> > > >> >>> > On Tue, Jun 11, 2019 at 8:42 AM Joris Van den Bossche
> > > >> >>> > <jorisvandenbossche at gmail.com> wrote:
> > > >> >>> > >
> > > >> >>> > >
> > > >> >>> > >
> > > >> >>> > > Op di 11 jun. 2019 om 15:31 schreef Ralf Gommers <
> > > ralf.gommers at gmail.com>:
> > > >> >>> > >>
> > > >> >>> > >>
> > > >> >>> > >>
> > > >> >>> > >> On Tue, Jun 11, 2019 at 3:03 PM Tom Augspurger <
> > > tom.augspurger88 at gmail.com> wrote:
> > > >> >>> > >>>
> > > >> >>> > >>>
> > > >> >>> > >>>
> > > >> >>> > >>> On Tue, Jun 11, 2019 at 7:58 AM William Ayd via
> > > Pandas-dev <pandas-dev at python.org> wrote:
> > > >> >>> > >>>>
> > > >> >>> > >>>> Just some counterpoints to consider:
> > > >> >>> > >>>>
> > > >> >>> > >>>> - $ 3,000 a month isn’t really that much, and if it’s
> > > just a number that a well-funded company chose for us chances are
> > > they are benefiting from it way more than we are
> > > >> >>> > >>
> > > >> >>> > >>
> > > >> >>> > >> "it's not really that much" is something I don't agree
> > > with. It doesn't employ someone, but it's enough to pay for things
> > > like developer meetups, hiring an extra GSoC student if a good one
> > > happens to come along, paying a web dev for a full redesign of the
> > > project website, etc. Each of those things is in the $5,000 -
> > > %15,000 range, and it's _very_ nice to be able to do them without
> > > having to look for funding first.
> > > >> >>> > >>
> > > >> >>> > >> Tidelift is a small (now ~25 employees) company by the
> > > way, and they have a real understanding of the open source
> > > sustainability issues and seem dedicated to helping fix it.
> > > >> >>> > >>
> > > >> >>> > >>>> - There is no such thing as free money; we have to
> > > consider how to account for and actually manage it (perhaps
> > > mitigated somewhat by NumFocus)
> > > >> >>> > >>>
> > > >> >>> > >>>
> > > >> >>> > >>> Perhaps Ralph can share how this has gone for NumPy. I
> > > imagine it's not too work on their end, thanks to NumFOCUS.
> > > >> >>> > >>
> > > >> >>> > >>
> > > >> >>> > >> NumFOCUS handles receiving the money and associated
> > > admin. As the project you'll be responsible for the setup and
> > > ongoing tasks. For NumPy and SciPy I have done those tasks. It's a
> > > fairly minimal amount of work:
> > > https://github.com/numpy/numpy/pulls?q=is%3Apr+tidelift+is%3Aclosed
> > > . The main one was dealing with GitHub not recognizing our license,
> > > and you don't have that issue for Pandas (it's reported correctly
> > > as BSD-3 in the UI at https://github.com/pandas-dev/pandas).
> > > >> >>> > >>
> > > >> >>> > >> So it's probably a day of work for one person, to get
> > > familiar with the interface, check dependencies, release streams,
> > > paste in release notes, etc. And then ongoing maybe one or a couple
> > > of hours a month. So far it's been a much more effective way of
> > > spending time than, for example, grant writing.
> > > >> >>> > >>
> > > >> >>> > >>>
> > > >> >>> > >>>>
> > > >> >>> > >>>> - Advertising and ties to a corporate sponsorship may
> > > weaken the brand of pandas; at that point we may lose some
> > > creditability as open source volunteers
> > > >> >>> > >>>
> > > >> >>> > >>>
> > > >> >>> > >>> Anecdotally, I don't think that's how the community
> > > views Tidelift. My perception (from Twitter, blogs / comments) is
> > > that it's been well received.
> > > >> >>> > >>
> > > >> >>> > >>
> > > >> >>> > >> Agree, the feedback I've seen is all quite positive.
> > > >> >>> > >
> > > >> >>> > >
> > > >> >>> > > Additionally, I don't think there is any "advertisement"
> > > involved, at least not in the classical sense of adding adds for
> > > third-party companies in a side bar to our website for which we get
> > > money. Of course we will need to mention Tidelift in some way, e.g.
> > > in our sponsors / institutional partners section, but we already do
> > > that for some other companies as well (that employ core devs).
> > > >> >>> > >
> > > >> >>> > >>
> > > >> >>> > >>
> > > >> >>> > >>>
> > > >> >>> > >>>>
> > > >> >>> > >>>> - We don’t (AFAIK) have a plan on how to spend or
> > > allocate it
> > > >> >>> > >>>>
> > > >> >>> > >>>> Not totally against it but perhaps the last point
> > > above is the main sticking one. Do we have any idea how much we’d
> > > actually pocket out of the $ 3k they offer us and subsequently what
> > > we would do with it? Cover travel expenses? Support PyData
> > > conferences? Scholarships?
> > > >> >>> > >>>
> > > >> >>> > >>>
> > > >> >>> > >>> Agreed that we should set a purpose for this money
> > > (though, I have no objection to collecting while we set that
> > > dedicated purpose).
> > > >> >>> > >>
> > > >> >>> > >>
> > > >> >>> > > Indeed we need to discuss this, but I don't think we
> > > already need to know *exactly* what we want to do with it before
> > > setting up a contract with Tidelift. It's good for me to alraedy
> > > start discussing it now, but maybe in a separate thread?
> > > >> >>> > >
> > > >> >>> > >>
> > > >> >>> > >> For NumPy and SciPy we haven't earmarked the funds yet.
> > > It's nice to build up a buffer first. One thing I'm thinking of is
> > > that we're participating in Google Season of Docs, and are getting
> > > more high quality applicants than Google will accept. So we could
> > > pay one or two tech writers from the funds. Our website and high
> > > level docs (tutorial, restructuring of all docs to guide users
> > > better) sure could use it:)
> > > >> >>> > >>
> > > >> >>> > >> My abstract advice would be: pay for things that
> > > require money (like a dev meeting) or don't get done for free.
> > > Don't pay for writing code unless the case is extremely compelling,
> > > because that'll be a drop in the bucket.
> > > >> >>> > >>
> > > >> >>> > >> Cheers,
> > > >> >>> > >> Ralf
> > > >> >>> > >>
> > > >> >>> > >>
> > > >> >>> > >>>
> > > >> >>> > >>>>
> > > >> >>> > >>>> - Will
> > > >> >>> > >>>>
> > > >> >>> > >>>> On Jun 11, 2019, at 4:44 AM, Ralf Gommers <
> > > ralf.gommers at gmail.com> wrote:
> > > >> >>> > >>>>
> > > >> >>> > >>>>
> > > >> >>> > >>>>
> > > >> >>> > >>>> On Tue, Jun 11, 2019 at 10:15 AM Joris Van den
> > > Bossche <jorisvandenbossche at gmail.com> wrote:
> > > >> >>> > >>>>>
> > > >> >>> > >>>>> The current page about pandas (
> > > https://tidelift.com/lifter/search/pypi/pandas) mentions $3,000
> > > dollar a month (but I am not fully sure this is what is already
> > > available from their current subscribers, or if it is a prospect).
> > > >> >>> > >>>>
> > > >> >>> > >>>>
> > > >> >>> > >>>> It's not just a prospect, that's what you should/will
> > > get. NumPy and SciPy get the listed amounts too.
> > > >> >>> > >>>>
> > > >> >>> > >>>> Agreed that the NumPy amount is not that much. The
> > > amount gets determined automatically; it's some combination of
> > > customer interest, dependency analysis and size of the API surface.
> > > >> >>> > >>>>
> > > >> >>> > >>>> The current amounts are:
> > > >> >>> > >>>> NumPy: $1000
> > > >> >>> > >>>> SciPy: $2500
> > > >> >>> > >>>> Pandas: $3000
> > > >> >>> > >>>> Matplotlib: n.a.
> > > >> >>> > >>>> Scikit-learn: $1500
> > > >> >>> > >>>> Scikit-image: $50
> > > >> >>> > >>>> Statsmodels: $50
> > > >> >>> > >>>>
> > > >> >>> > >>>> So there's an element of randomness, but the results
> > > are not completely surprising I think. The four libraries that get
> > > order thousands of dollars are the ones that large corporations are
> > > going to have the highest interest in.
> > > >> >>> > >>>>
> > > >> >>> > >>>> Cheers,
> > > >> >>> > >>>> Ralf
> > > >> >>> > >>>>
> > > >> >>> > >>>>>
> > > >> >>> > >>>>>
> > > >> >>> > >>>>> Op za 8 jun. 2019 om 22:54 schreef William Ayd <
> > > william.ayd at icloud.com>:
> > > >> >>> > >>>>>>
> > > >> >>> > >>>>>> What is the minimum amount we are asking for? The
> > > $1,000 a month for NumPy seems rather low and I thought previous
> > > emails had something in the range of $3k a month.
> > > >> >>> > >>>>>>
> > > >> >>> > >>>>>> I don’t think we necessarily need or would be that
> > > much improved by $12k per year so would rather aim higher if we are
> > > going to do this
> > > >> >>> > >>>>>>
> > > >> >>> > >>>>>> On Jun 7, 2019, at 12:53 PM, Joris Van den Bossche
> > > <jorisvandenbossche at gmail.com> wrote:
> > > >> >>> > >>>>>>
> > > >> >>> > >>>>>> Hi all,
> > > >> >>> > >>>>>>
> > > >> >>> > >>>>>> We discussed this on the last dev chat, but putting
> > > it on the mailing list for those who were not present: we are
> > > planning to contact Tidelift to enter into a sponsor agreement for
> > > Pandas.
> > > >> >>> > >>>>>>
> > > >> >>> > >>>>>> The idea is to follow what NumPy (and recently also
> > > Scipy) did to have an agreement between Tidelift and NumFOCUS
> > > instead of an individual maintainer (see their announcement mail:
> > >
> https://mail.python.org/pipermail/numpy-discussion/2019-April/079370.html
> > > ).
> > > >> >>> > >>>>>> Blog with overview about Tidelift:
> > >
> https://blog.tidelift.com/how-to-start-earning-money-for-your-open-source-project-with-tidelift
> > > .
> > > >> >>> > >>>>>>
> > > >> >>> > >>>>>> We didn't discuss yet what to do specifically with
> > > those funds, that should still be discussed in the future.
> > > >> >>> > >>>>>>
> > > >> >>> > >>>>>> Cheers,
> > > >> >>> > >>>>>> Joris
> > > >> >>> > >>>>>> _______________________________________________
> > > >> >>> > >>>>>> Pandas-dev mailing list
> > > >> >>> > >>>>>> Pandas-dev at python.org
> > > >> >>> > >>>>>> https://mail.python.org/mailman/listinfo/pandas-dev
> > > >> >>> > >>>>>>
> > > >> >>> > >>>>>>
> > > >> >>> > >>>>> _______________________________________________
> > > >> >>> > >>>>> Pandas-dev mailing list
> > > >> >>> > >>>>> Pandas-dev at python.org
> > > >> >>> > >>>>> https://mail.python.org/mailman/listinfo/pandas-dev
> > > >> >>> > >>>>
> > > >> >>> > >>>>
> > > >> >>> > >>>> _______________________________________________
> > > >> >>> > >>>> Pandas-dev mailing list
> > > >> >>> > >>>> Pandas-dev at python.org
> > > >> >>> > >>>> https://mail.python.org/mailman/listinfo/pandas-dev
> > > >> >>> > >>
> > > >> >>> > >> _______________________________________________
> > > >> >>> > >> Pandas-dev mailing list
> > > >> >>> > >> Pandas-dev at python.org
> > > >> >>> > >> https://mail.python.org/mailman/listinfo/pandas-dev
> > > >> >>> > >
> > > >> >>> > > _______________________________________________
> > > >> >>> > > Pandas-dev mailing list
> > > >> >>> > > Pandas-dev at python.org
> > > >> >>> > > https://mail.python.org/mailman/listinfo/pandas-dev
> > > >> >>> _______________________________________________
> > > >> >>> Pandas-dev mailing list
> > > >> >>> Pandas-dev at python.org
> > > >> >>> https://mail.python.org/mailman/listinfo/pandas-dev
> > > _______________________________________________
> > > Pandas-dev mailing list
> > > Pandas-dev at python.org
> > > https://mail.python.org/mailman/listinfo/pandas-dev
> >
> > _______________________________________________
> > Pandas-dev mailing list
> > Pandas-dev at python.org
> > https://mail.python.org/mailman/listinfo/pandas-dev
>
> _______________________________________________
> Pandas-dev mailing list
> Pandas-dev at python.org
> https://mail.python.org/mailman/listinfo/pandas-dev
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mail.python.org/pipermail/pandas-dev/attachments/20190808/51cedc9a/attachment-0001.html>