►
Description
Presented by Tal Niv, GitHub.
Developers build and ship software in a complex environment governed by laws, regulations, norms, and standard practices—policies. Policy decisions directly impact software every day. This talk will walk you through what GitHub defines as policy, why we do policy at GitHub, how we do policy, what we aim to achieve for all of us, and will focus on a couple of current examples.
About GitHub Universe:
GitHub Universe is a two-day conference dedicated to the creativity and curiosity of the largest software community in the world. Sessions cover topics from team culture to open source software across industries and technologies.
For more information on GitHub Universe, check the website:
https://githubuniverse.com
A
Hi
everyone,
my
name-
is
tan
Nev
and
I'm,
the
VP
of
land
policy
at
github.
Welcome
to
this
session.
It
will
be
all
about
how
tech
policy
is
shaping
the
future
of
software.
As
you
can
see
almost
every
day,
we
as
developers
as
software
companies,
make
news
or
wake
up
to
news
about
some
aspect
of
tech
policy
that
directly
affects
us.
A
Tough
questions
about
the
optimal
tech
policy
arise.
All
the
time
get
up
in
its
policy
team
aim
to
make
a
meaningful
contribution
to
those
debates
that
shape
all
of
our
futures.
This
talk
will
try
to
explain
what
we
refer
to
when
we
talk
about
tech
policy.
It
will
highlight
recent
policy
debates,
some
of
which
are
vital
to
software
and
to
all
of
us.
A
So
when
we
talk
about
tech
policy,
we
mean
much
much
more
than
the
thin
layer
of
public
policy.
When
we
talk
about
tech
policy,
we
mean
the
complex
environments
of
laws
of
regulations,
of
norms
and
standard
practices
and
their
interplay
with
one
another
within
which
developers
build
and
ship
software.
A
These
are
all
policies
whether
their
source
is
public
or
private,
centralized
or
dispersed
that
impact
our
work
every
day.
We
have
to
take
them
into
account
when
we
make
design
and
resources
decisions
when
we
ship,
when
we
build
when
we
offer
support
services
at
the
end
of
the
day,
policies
are
there
for
the
instrumental
value
and
should
be
tuned
to
help
us
obtain
optimal
social
outcomes,
as
technology
continues
to
evolve
and
delivers
new
products
and
services
into
the
market.
A
It
challenges
the
existing
regulatory
institutions
and
big
bigs
for
changes,
but
the
fact
is
that
the
best
changes
to
policies
are
not
always
immediately
apparent
and
almost
never
easily
attainable
and
wrong
decisions
can
weigh
heavily
on
us.
For
example,
one
policy
that
has
led
to
good
outcomes
for
us
in
developers
as
developers
and
as
consumers
is
net
neutrality.
A
So,
let's
just
stare
at
it,
because
it's
so
beautiful
and
there's
no
other
context
to
show
it.
This
is
the
gift
that
we've
produced
for
the
net
neutrality
campaign
just
this
year,
as
many
of
you
know
and
enjoy
in
2015,
the
FCC
established
the
open
Internet
order,
which,
among
other
things,
prohibits
ISPs
from
blocking
or
throttling
access
or
creating
slow
and
fast
lanes
paid
prioritization.
A
This
policy
that
was
put
in
place
is
what
we
commonly
call
network
neutrality.
What
we
are
seeing
now
is
the
smashing
sequel
of
the
network
neutrality
debate
of
2015.
That
ended,
then,
with
the
adoption
of
the
open
Internet
order.
Earlier
this
year,
the
FCC
announced
its
intention
to
reverse
that
order.
What
would
that
mean
for
a
work
or
for
companies
starting
to
offer
online
services?
A
Well,
it
would
allow
ISPs
to
eye
up
charge
for
fast
access
to
their
services
and
it
would
allow
incumbents
to
create
barriers
to
entry
in
a
difficult
environment
for
smaller
companies
to
compete.
So
humor
me
as
I
try
to
make
a
point
about
collective
action.
Please
I
hope
I
make
it
so
how
many
of
you
knew
that
this
is
happening?
Show
of
hands?
A
Okay,
very
good,
good
answer
for
the
first
question,
how
many
of
you
think
the
taking
away
the
open
Internet
order
is
perhaps
not
the
optimal
policy
outcome
excellent
again,
and
how
many
of
you
have
taken
action
to
influence
to
influence
the
policy
outcome?
Okay,
substantially,
less
right,
my
column!
A
Another
example
that
I
want
to
highlight,
because
it's
so
important,
I,
don't
know
if
you're
all
aware,
but
the
EU
is
getting
ready
to
vote
on
a
copyright
reform
package.
One
of
the
measures
on
the
table
will
require
monitoring
and
filtering
of
anything
that
European
citizens
upload
to
information
society
services.
A
A
Those
filtering
algorithms
would
ultimately
decide
what
materials
developers
should
be
allowed
to
share
and,
as
a
result,
every
user
would
have
their
entire
code
monitored
and
potentially
blocked
from
being
uploaded.
This
proposals
motivation
is
driving
content
sharing
platforms
to
enter
into
licensing
deals
with
content,
publishers
which
isn't
practice
about
for
many
types
of
content,
among
which
software,
if
it's
implemented
it
will
now
our
steps
and
prevent
developers
from
using
specific
software
components
and
tools.
A
A
We
contribute
content
to
it
and
you
can
still
sign
it
if
you
like,
it
has
been
submitted
to
the
European
Parliament,
but
it
would
still
be
effective
if
there
are
more
voices
that
are
heard
on
this
matter,
so
there's
still
an
opportunity,
so
other
examples
for
how
policy
matters
to
us.
So
many
of
the
previous
iterations
of
this
deck
included
a
slide
that
contained
references.
A
A
Policy
is
not
a
hundred
percent
determinative,
but
technology
isn't
either.
So
we
need
to
remember
that
policy
is
there
and
impacts
the
outputs
that
we
produce.
So
let
me
just
exemplify
the
role
that
policy
is
taking
in
the
talks
where
it's
very,
very
near
the
surface,
so
the
earlier
session
in
this
room,
which
I
hope
you
did
not
miss,
including
you
included
the
very
interesting
panel,
talk
about
how
the
regulator
regulated
industries
remain
innovative
despite
having
to
meet
straight
compliance
requirements.
A
This
talk
made
obvious.
The
pre-existing
policy
becomes
software
policy
when
regulated
industries
and
all
industries
are
regulated
industries,
some
just
more
than
others,
but
that
regulated
the
industries
become
software
driven
the
pre-existing
software
shapes
how
they
become
software
driven
and
software
will
surely
shape
the
continued
evolution
of
the
policies
that
apply
to
them.
A
Next
example
happening
today
at
4:00.
We
all
know
the
providers
of
zests
to
a
diverse
community
of
users
have
responsibilities
around
the
safety
of
the
products
right,
just
as
traditional
software
vendors
do
just
like.
Toaster
manufacturers
do
the
upcoming
talk
that
is
about
to
take
place
in
this
room
again
about
platform.
Balancing
of
identity
and
privacy
makes
apparent
that,
in
addition
to
the
traditional
responsibilities,
zaz
platforms
have
responsibilities
around
the
safety
of
the
community
of
users
from
themselves
from
itself
and
from
external
threats.
A
In
this
sense,
the
service,
an
internet
platform,
is
from
the
service
that
it's
providing
includes
infrastructure
and
governance.
In
other
words,
a
platform
has
government
like
roles
this
as
platforms,
policies
shape
the
community
and
vice
versa,
and
the
platform's
policies
are
shaped
by
public
regulation
and,
in
turn,
contribute
to
shaping
it
tomorrow
at
12:00,
there
is
a
talk
about
algorithmic
biases
in
AI
and
machine
learning.
This
talk
is
a
great
example
of
what
happens
when
its
software
itself
that
regulates
when
this
is
the
case.
A
There's
a
talk
that
discusses
government
use
of
open-source
as
a
means
to
encourage
reliance
on
and
contribution
to
open-source
by
all
of
us
how
the
government
uses
software,
how
it
procures,
how
it
implements,
how
it
maintains,
how
it
creates,
how
a
deploy
software
is
obviously
a
subject
of
policy.
Also
over
the
long
term,
it
helps
determine
what
the
government's
capabilities
are
and
how
those
capabilities
are
used
to
serve
the
public
interest
next
example
and
I
want
to
mention
Microsoft
here
again.
This
talk
already
took
place.
A
That
was
a
previous
talk
in
this
room,
never
mind
you
missed
it
by
the
way
I
mentioned
Microsoft
and
open
source
here,
because
the
talk
freely
admitted
and
even
celebrated
the
fact
that
the
company's
is
changing
views
and
practices
and
open
source
which
at
times
have
been
major
parts
of
the
public
discourse
on
open
source
and
innovation
policy.
No
doubt
that
this
change
was
involved.
A
So,
hopefully,
by
now,
it's
blatantly
clear
that
policy
outcomes
for
each
ongoing
debate
goes
to
the
heart
of
what
we
do.
Sometimes
they
mean
career
or
business
success
or
lack
of
and
determines,
who
succeeds
or
fails,
could
be
developers,
and
it
could
also
be
lawyers
right.
Natural
we're
optimizing
policy
for
lawyers
could
be
incumbent
companies
or
could
be
up
starters
other
times.
A
So
some
additional
examples
will
your
startup
have
to
build
automated
content
filters,
hire
an
army
of
human
monitors
or
negotiate
with
incumbent
right
holders
or
authorities
is
a
condition
for
building
or
providing
the
application
and
services
that
you
really
want
to
build.
Can
you
bring
your
knowledge
and
skills,
thus
value
to
new
employers,
to
a
new
startup
you
found
to
a
new
jurisdiction?
Can
you
contribute
to
open
source
projects
to
build
your
skills
or
reputation?
Do
you
have
the
opportunity
to
do
genuinely
interesting
work?
Is
the
industry
innovative
or
are
you?
A
Are
your
opportunities
drastically
curtailed?
What
price
do
you
have
to
pay
to
keep
your
service
running?
How
much
you
have
to
pay
pan
roles
to
claimants
of
so-called
API
copyright?
What
compromises
do
you
have
to
make
to
avoid
being
blocked
in
various
places
around
the
world?
And
can
you
keep
your
developers
and
your
users
safe?
A
So
why
do
we
think
that
it's
supported
it
github
weighs
in
on
all
of
those
debates
as
you've
seen
earlier,
it
takes
a
lot
of
resources
to
monitor
for
the
impact
of
different
policy
conversations
that
are
happening
all
over
the
world.
Then
then
analysis
in
itself
takes
a
lot
of
resources
and
inquires
a
broad
reach.
In
addition,
it's
a
fact
that
not
all
voices
are
the
same.
A
The
richness
of
the
github
community
in
its
use
of
a
platform
enable
us
to
bridge
across
stakeholders
with
common
interests
as
they
arise,
and
when
legislators
and
decision
makers
want
to
seek
input
from
stakeholders,
they
often
come
to
ask
to
us
to
ask
what
our
view
is.
This
makes
the
value
over
having
our
own
people
speaking
and
educating
on
tech
issues
obvious
and
finally,
because
policy
outcomes
are
so
essential
to
the
day-to-day
of
developers.
We've
come
to
understand
that
writing.
Favorable
policy
outcomes
is
part
of
providing
github.
A
The
platform
policy
is
a
service,
if
you
will,
which
brings
me
to
my
next
slide.
So
what
are
we
doing?
We're
aiming
towards
policy
optimization
for
developers
in
three
distinct
ways,
which
I
think
makes
our
efforts
unique
and
interesting,
unique,
very
unique
and
very
interesting.
First,
we
try
to
voice
as
effectively
as
possible
the
desirable
policy
outcome
in
order
to
figure
out
what
the
best
policy
outcome
is.
We
do
an
analysis
of
what
different
results
would
mean
for
our
different
users.
A
We
try
to
build
coalitions
with
other,
similarly
interested
parties
and
civil
society,
and
we
try
to
build
an
optimal
communication
strategy.
Second,
and
here
we
believe
that
we
can
make
a
large
contribution.
We
do
our
best
to
dig
deeper
to
understand
the
proposed
solutions
on
the
table
to
analyze
the
different
alternatives,
craft
solutions
and
develop
strategies
to
implement
them
and
explain
everything
to
the
different
stakeholders.
A
So
in
that
third
point,
I
want
to
elaborate
on
the
relationship
between
driving
new
standards
and
best
practices
and
our
oldest
private
regulators
and
our
aspirations
for
public
policy,
properly
implemented
and
adopted
standards
and
best
practices
service,
industry,
self-regulation
of
both
substan.
It
matters
and
transparency,
these
reduced
the
need
for
aggressive
and
possibly
bad
public
regulation.
Bad
I
mean,
is
extremely
costly,
not
achieving
its
intended
outcomes
or
subject
to
capture
good
self-regulation
lights,
the
path
for
further
self
regulation,
innovation
and
because
policy
regulation
is
deeply
informed
by
how
industry
best
practices
and
standards
work.
A
Good
self
regulation
also
increases
the
probability
of
good
public
regulation
and
platforms
are
a
very
good
example
of
this.
Their
self-regulation
informs
the
debate
over
the
role
of
private
platforms
that
provide
government
like
services
and
society
and
contributes
to
those
platforms.
Legitimacy
note
that
another
hot
topic
that
complements
platform
regulation
is
algorithmic
regulation.
Indeed,
it
is
hard
to
separate
the
two
algorithms
always
work
in
some
policy
in
influence
context,
often
on
platforms,
platform
policies,
mediate
relationship
between
users
and
employees
as
much
as
with
platform,
software
and
so
policy.
A
Transparency
is
a
form
of
algorithmic
transparency
and
vice
versa,
so
now
examples
for
how
we
exercise
our
responsibility
to
drive
new
standards
and
to
put
in
place
policies
and
processes
of
policymaking.
I'd
like
to
discuss
two
examples
that
we're
all
very
proud
of
of
projects
of
projects
that
have
been
open
sourced
this
year.
A
A
A
So
earlier
this
year,
we
open
source,
21
policies
that
mediate
relationships
with
our
site
users
and
call
the
project
site
policy
I
think
it's
a
very
fitting
name.
In
other
words,
we've
open
sourced
the
governing
for
how
we
regulate
our
platform.
Those
policies
were,
of
course,
public,
but,
as
we
know,
merely
public
material
is
an
open
source
either.
In
definition,
it's
not
provided
in
editable
form,
with
permissions
to
edit
and
reuse
or
in
process.
It
doesn't
live
in
a
public
repo.
A
These
were
both
hoped
for
outcomes.
We
believe
the
github
platform
and
our
user
community
are
much
stronger
as
a
result,
it's
a
well
studied
fact
that
most
users
don't
read
Terms
of
Service
that
they
accept
to
use
a
platform.
The
minority
that
does
in
fact
read
them
might
raise
issues
that
would
get
resolved
one
way
or
another
without
the
knowledge
of
the
other
users
of
a
platform
inside
policy.
A
Those
issues
can
be
raised
and
addressed
publically
by
the
github
legal
team
that
maintains
that
repository
and
they
access
to
all
those
debates,
and
their
resolution
is
open
and
continuous.
So
give'em
now
has
been
around
for
close
to
10
years.
It
had
time
to
develop
policies,
and
it
has
resources
to
do
so
and
to
continue
to
do
so.
A
Sometimes
when
a
platform
needs
to
adopt
a
policy,
the
policies
that
site
policy
contains
can
be
used
with
all
the
necessary
and
appropriate
edits,
of
course,
still
helpful.
We
believe
that
over
the
next
decade,
adoption
and
iteration
on
these
policies
by
other
platforms,
will
make
our
industry
stronger,
not
least
by
contributing
to
the
industry's
legitimacy,
trust
and
transparency.
A
The
other
policy
endeavor
that
we
undertook
this
year
is
the
Barents
employee,
intellectual
property
agreement
project
or,
as
I
called
it
earlier
paper
of
a
mouthful
so
as
part
of
the
description
of
site
policy.
I
just
spoke
of
platform
policies
that
mediate
relationships
with
users.
What
about
policies
that
mediate
relationships
with
employees
and
contractors?
A
Employment
is
heavily
regulated,
and
such
regulation
clearly
shapes
the
opportunities
and
conditions
available
for
work
for
all
of
us.
Employment
policy
impacts
not
only
the
conditions
at
any
one
employer,
but
the
ability
of
workers
to
move
among
employers
to
work
on
non
employment
projects
to
found
their
own
companies
in
the
new
cognitive
property.
A
You
should
read
that
paper,
human
capital
law
and
the
reach
of
intellectual
property
early
Nobel
documents
how
knowledge
experience,
creativity
and
network
are
all
becoming
subject
to
no
commodification,
a
litigation
contractually
mediated
by
IP
and
Siemens,
and
non-compete
non-solicitation
non
dealing
and
non
poaching
agreements
that
ultimately
suppress
innovation
in
harm
career
opportunities.
Smart
companies
and
workers
can
change
your
arrangements
to
optimal
to
optimize
for
innovation
and
more
on
that
in
a
moment.
I
just
want
to
underline
that
this
is
an
important
public
policy
issue.
A
If
it's
not
clear,
these
kinds
of
agreements
are
now
being
used
to
restrict
the
mobility
of
many
professions,
including
fast-food
workers,
not
just
developers,
and
they
exist
in
the
variable'
public
policy
context.
The
non
enforceability
of
non-compete
contracts
in
resulting
rapid
knowledge,
diffusion
in
California,
has
been
a
widely
studied
factor
behind
the
emergence
of
Silicon
Valley
first
pointed
out
in
1994
github
ZP
Agreement
goes
further
than
the
California
default
law.
In
optimizing
for
innovation
in
particular,
it
recognizes
the
device.
A
Ownership
is
a
blunt
in
unnecessary
way
to
assign
control
over
IP
when
it
was
being
developed.
Our
goal
was
to
have
an
agreement,
the
technologists,
how
developers
actually
work
and
that
minimize
and
minimizes
creative
friction
paper
was
started
as
a
reusable
version
of
github
employee
IP
agreement
named
for
what
we
believe
is
it
balanced
approach
to
assigning
control
of
intellectual
property
that
is
created
by
an
employee.
A
company
using
vapor
doesn't
try
to
claim
control
of
a
developer's
free
time
knowledge
production.
A
Nor
does
it
try
to
extend
company
control
past
a
period
of
employment
we
were
in.
We
were
and
are
continuously
aware,
that
the
IP
ownership
is
a
topic
that
is
closed
to
developers,
hearts
since
it
impacts
your
mobility
as
employees,
their
ability
to
found
startups
and
their
ability
to
contribute
to
open
source.
We
were
and
are
also
continuously
aware,
that
IP
ownership
is
close
to
company's
hearts.
It
is
definitely
close
to
ours,
we're
continuing
to
develop
this
project
and
we
hope
to
find
even
more
balance,
even
more
win-win
that
keeps
control
and
freedom
to
operate.
A
That
companies
need,
while
further
optimizing
for
innovation
within
companies
and
the
industry,
and
we
know
that
society
is
an
industry
in
process.
Industries
prosper
when
there
is
clear
and
fair
and
therefore
efficient
and
legitimate
property
ownership
in
high
labor
autonomy
and
mobility,
employer
control
or
attempt
to
control
of
all
IP
created
by
employees
even
created
during
their
free
time
and
not
related
to
the
business
sets
up.
Conflict
is
perceived
as
unfair,
not
surprisingly,
and
has
employees
and
their
ideas
trapped.
A
Broad
adoption
of
paper
should
have
similar
beneficial
effects
for
the
communities
and
industries
in
which
paper
is
adopted,
and
it
should
have
this
effect
because
it
encourages
disruptive
innovation
exactly
where
it
wants
to
occur
at
margins
of
the
day-to-day
work
driven
by
passion
and
by
curiosity.
This
is
good
regulation
that
serves
the
industry's
reputation
for
stalls,
bad
regulation
in
lights,
a
path
towards
good
public
regulation,
and
we
know
that
the
Vella
pers
feel
and
feel
and
understand.
All
of
this.
A
This
is
the
all-time
number
one
hacker
news
item
about:
github
and
IP
agreements
non-competes
and
under
mobility
and
contribution
restrictions
are
hot-button
topics
that
require
expertise
to
run
tango
and
that
not
much
progress
has
been
made
on.
Despite
the
compelling
role,
mobility
and
knowledge
diffusion
has
had
in
the
making
of
Silicon
Valley,
and
you
might
wonder
if
optimizing
innovation
policy
faces
collective
action
problems.
A
A
We
can
ensure
that
we
maintain
an
open
and
an
open
and
free
internet.
We
can
engage
in
emerging
debates
in
Europe,
like
around
article
13,
as
we
discussed
earlier,
like
around
GDP
are
like
around
other
forms
of
platform
regulation
and
we
can
rethink
our
values,
our
rights
and
mitigating
biases,
as
github
or
community,
and
customers
deepen
our
work
in
machine
learning,
artificial
intelligence
and
automation.
A
So
now
that
I've
said
everything
that
there
is
to
say
I'm
sure
that
you're
convinced
that
it's
a
lot
of
work,
so,
if
you're
interested
in
getting
involved
in
collaborating
with
us
or
if
you
have
any
thoughts
that
you
would
like
to
share,
please
reach
out
to
us.
This
is
the
email
or
to
me.
Please
reach
out
to
me
and
thank
you
so
much
for
the
opportunity
to
speak
to
you
all.
A
Yes,
oh
definitely
I'm,
so
glad
that
you
asked
that
so
even
around
the
network
neutrality
discussion,
we
were
hosting
a
bunch
of
tools
that
were
used
for
the
battle
to
create
assets
to
place
them
where
they
need
to
go.
We
were
very
proud
of
that
role
that
we
took
in
that
campaign,
because
that
was
unique
to
us.
The
fact
that
we
could
offer
these
tools
and
to
make
sure
that
they
gained
traction.
So,
yes,
definitely
and
I
can't
see
a
debate
where
that
won't
be
true.
A
B
A
You
to
take
a
look
at
the
repository
to
see
how
we
found
the
solution
to
that
question,
among
others,
because
it's
a
very
tough
question.
That's
exactly
what
companies
think
about
when
they
draft
those
agreements
and
that's
why
I
often
the
solution
is
either
to
leave
things
ambiguous
and
then
to
see
what
happens
and
that's.
We
don't
think
that
that's
a
good
decision
sometimes
there's
a
decision
to
draw
the
boundary
some
someplace
and
we
think
that
that's
better,
that
place
needs
to
be
the
right
place.
A
So
take
a
look
at
what
we
have
in
the
repository
and
see
if
you
think
that
it
makes
sense.
As
I
said,
that
is
the
point
of
the
repository
to
continue
iterating
to
find
solutions
where
they
weren't
found
before
so.
I
would
love
to
hear
if
you
think
that
it's
the
right
that
the
boundary
is
placed
at
the
right
place
and
obviously
different
companies
have
different
needs.
Different
employees
have
different
needs
and
so
I
think
that
the
work
that
we've
done
conveys
that
to
many
I,
don't
question.
Yes,.
B
A
C
A
C
C
A
Great
question-
and
it's
so
great
because
tomorrow
there's
a
talk
that
you
should
all
go
to
about:
the
legal
teams
use
of
github
it's
given
by
two
colleagues
of
mine
and
it's
gonna
talk
about
how
we
use
github
for
our
internal
legal
needs,
and
certainly
there
are
different
use
cases
that
require
private
repositories
and
private
work,
but
github
allows
for
that
and
you'll
hear
all
about
that
and
the
processes
on
top
of
that
tomorrow.
If
you
come
now,
law
firms
are
a
different
story.
Obviously
there
are
many
reasons.
A
Some
of
them
have
to
do
with
the
profit
model,
to
keep
things
in
private,
not
make
them
public,
and
so
you
know,
different
different
parties
make
different
choices
and
obviously
there
are.
There
are
many
reasons,
but
tomorrow
tomorrow's
conversation
will
also
touch
upon
that.
So
thank
you
for
the
question.
I
hope
I
answered
it.