Kevin Fleming interview

Thanks Kevin for taking the time to answer this interview. From what project or activity does this interview take time?

Good question... most of my time right now is being consumed by planning for the next two months of trade shows and other events (lots of travel, presentations, etc.) and trying to keep our ever-growing software development team moving in the right direction.

You work for Digium. Digium is selling hardware, but also services, and the pricing of the new Asterisk Appliance just moved to a 'subscription pricing'. Does that mean that Digium's income will mainly come from services and not from hardware ?

Well, we will certainly sell hardware (line cards, appliances and other related cards) as long as it makes sense to do so, but there are a number of factors that will make the line card hardware business become less relevant over time. We definitely are moving in the direction of selling 'whole product' solutions in addition to our existing business of selling technology components, so yes that includes software licensing, support subscriptions, custom development services and other sorts of 'intangible' add-ons that users of Asterisk need to be comfortable basing their business communications systems on our products.

Asterisk is an Open Source project and potentially has a great number of developers and contributors. How many people does the Asterisk core development team consist of?

Today there are thirteen people at Digium who have some responsibility for Asterisk and Zaptel development in all its various forms, but we are continuing to hire people from the community (and other places) when they become available as there is always more work to do than people to do it! In addition, there are six or seven prominent regular contributors from the community, and new contributors appear all the time. We also get small contributions from a large number of people... even patches as simple as typographical changes, documentation updates and other changes that seem 'minor' are important to us because they make the products better.

Is Digium mainly involved in reviewing code or producing new features?

Our open source development team splits their time roughly evenly between servicing our issue tracker at bugs.digium.com and working on new features and 'pet projects' they come up with on their own. Our commercial development team spends most of their time working on bug fixes and integrating third-party commercial products with our existing software.

Do you have a lot of requests for custom development?

Yes, we do! In fact Digium has a dedicated custom development team (currently consisting of six people) who spend their entire day building custom solutions for customers that need databases, web interfaces, scripting and other sorts of additional things around our core software products.

What is your primary activity at Digium?

My job is primarily directing our software development activities, acting as an interface between the open source community and Digium's commercial side and generally being a stubborn naysayer who has to be convinced that other peoples' ideas are the right way to do things before I'll proceed down that path :-)

Asterisk development is said to be influenced by its users. Do a lot of them contribute back?

In terms of numbers, no, because there are millions of users of Asterisk but only a small fraction of that group has ever contributed code, documentation, testing or anything else of that sort. However, we also pay close attention to the messages on our mailing lists and forums, traffic on Asterisk and VoIP blogs and wikis, and frequently those discussions will result in changes or improvements in Asterisk that we would not have thought of on our own. In that sense, everyone who talks about how they use Asterisk and how they wish it would be different is a 'contributor'.

Where's Asterisk headed?

We ask ourselves that every week! Asterisk has come a very long way since its 1.0 release, and we've seen that many people are quite satisfied with the feature set present in Asterisk 1.4 (and even in Asterisk 1.2) so they aren't in a hurry to upgrade unless there are really compelling reasons to do so. We had originally planned for an Asterisk 1.6 release in the fourth quarter of this year, but given the amount of time it has taken to stabilize Asterisk 1.4 and the lack of compelling new functionality, we have decided to take our time and let the product mature on its own; when the development branch has seen enough improvements to warrant a new major release, we'll know it.

For the longer term, we've got lots of ideas about what we want to do, but no concrete plans at this point. There is a great desire for Asterisk to be able to natively support transparent clustering for larger installations, for example, but getting there will require a lot of design work and discussions with the community. We plan on having some of those discussions at this year's Astricon and at other events like PROFOSS, and hopefully early next year we'll be able to formulate a plan for this project and start moving forward on it.

Does the way Asterisk is developed change?

It has changed quite a bit, yes. We've seen over the past 18 months or so that most of the 'core' Asterisk work (architectural changes and the like) is being done by Digium's development team, although sometimes in combination with developers from the community. Conversely, the community developers provide more new features and improvements in 'real-world' applications than Digium's team does, because we don't get to actually *use* Asterisk as part of our work, except for testing the code!

This is a normal maturation process that happens to many open source projects, and we expect it will continue.

Digium got $13 million Venture Capital last year. How has that changed Digium?

Digium has changed an enormous amount in the past year, but it's not really due to that investment directly. Digium has always been a profitable company and we've been able to fund our operations and expansion via our own means, but the venture capital investment provided access to a very talented group of business people who otherwise did not pay much attention to us. In the past year we've seen our management team change quite dramatically with a new CEO (and Mark Spencer moving to CTO), VPs of Marketing, Global Sales and Engineering, and the acquisition of Sokol & Associates has allowed us to bring a premier provider of Asterisk training (and the Astricon users conference) into our organization. These things are happening because we are 'growing up', in some sense, into a company that can provide complete end-to-end solutions for customers in a wide variety of markets.

Is Digium really moving from a technology provider to a solutions provider? If yes, doesn't that put you in competition with a lot of companies that have spread Asterisk?

Yes, it does. However there is an enormous amount of business opportunity in the world for Asterisk solutions and we don't have any notion that we'll be able to tackle 100% of it... but we'll certainly try! There is also the concept that by Digium entering these market spaces, we enlarge the market itself, and thus the other players benefit too from our brand recognition and the improvement in the products themselves.

A lot of companies build around Asterisk and VOIP. What's the relation of Digium with these companies?

That's not really an area where I get involved a great deal, other than with the companies that are contributors to Asterisk itself. Obviously we try to ensure that we maintain a healthy relationship with those companies, because the entire community benefits from that.

As a co-maintainer, have you already had a situation where a contribution from a third party didn't fit in Digium's development plan? How do or would you react? As the co-maintainer of a FOSS project, you have the responsability to do what's best for the project's development, but as a Digium employee, you have to respect your employers business.

We actually give our open source development team a 'free rein' to do what they think is the right thing to do, and it's very rare that something that they want to create (or accept from a contributor) would conflict in any way with Digium's commercial interests. Digium benefits most from Asterisk itself being stable, reliable, feature-rich and having a very widespread user community, and so there is little need for us to say 'no' to a contribution (except in cases where there are licensing concerns, of course).

Professionals often cite the possibility of a fork as a reason of prudence when using Free Software. What's your reaction as Asterisk co-maintainer?

There have been forks of Asterisk in the past, and one of them continues to be developed and has started to diverge from Asterisk in some significant ways. As an open source junkie I'm in no way opposed to someone forking Asterisk and trying to do a better job... because what that means to me is that we *aren't* doing a good enough job and we need to work harder to satisfy the community. Open source is very similar to pure capitalism; only the technology wins, not the brand name or the marketing muscle behind it. If we don't ensure that Asterisk has the features, stability and reliability that the users want, then they will go elsewhere.

Telephony system is of critical business value to companies. What do professionals discovering Asterisk fear most? Is the Open Source nature of Asterisk a source of fear? Are they hard to convince?

I don't know if I would use the word 'fear', but there is definitely uncertainty and concern. However, Linux, Apache, MySQL and other projects have 'paved the way' for us in that regard, and it's rare to find a medium or large business today that doesn't already use open source products in their critical business networks.

We've found that the real differentiating factor for Asterisk is that people don't want their phone system to be a 'technology project', they want it to be a phone system. They want to pick up the phone, dial a number, and get connected. The underlying technology that allowed that to happen is less important to them, so that means that an open source product has an even harder battle to fight to displace existing products that the customers already use and are comfortable with.

Some professionals have doubts about the perennity of a solution built on free software. It's certainly true for small projects: if the main developer stops, it's not sure someone will take over. Do you think Asterisk has now the critical mass necessary to ease those fears?

Absolutely; Asterisk's community is very active and if for any reason Digium was no longer able or willing to manage and sponsor Asterisk development I have no doubt it would continue on in the community indefinitely.

How would you characterize Asterisk's track record in security?

We've been quite good in that regard; in the past six months we've implemented a proactive vulnerability reporting process, and we've made quite a few point releases containing security fixes, most within 24 hours of being notified of the vulnerability. The developers have also become more aware of coding practices that can lead to security problems, so we are far less likely to introduce vulnerabilities when the code is modified.

How do you compete with big commercial vendors of PBX systems?

Well, today Digium is not yet competing with those companies, as we've just released our first complete PBX product, and it is targeted at small (50 users or less) companies. We will learn over the next three to six months what we need to do to provide a product (or products) that are successful in winning that business, so stay tuned!

Do you run load tests on Asterisk to make sure it is stable before doing a release, or are those tests only run on Asterisk Business Edition?

We do not do formal testing on open source Asterisk, other than to ensure that the code base compiles properly and produces what appears to be a working result :-) All of our load testing, functionality testing and regression testing is done for Asterisk Business Edition, but it is important to realize that ABE is nearly identical to open source Asterisk at the source code level, and every bug, problem or issue found during that testing is resolved in the open source version of Asterisk *first* before being integrated into ABE.

What do you think about vendors selling alternatives to Digium hardware, are they a threat for Digium? What are the advantages on using Digium hardware instead of other compatible hardware?

Well, competition is both good and bad; it forces us to improve our products to win customers, but it also takes away revenue. Again, though, much of what we do ends up expanding the entire Asterisk market itself, so even though we may not have 100% of the Asterisk compatible hardware market, we have the majority share of a much larger total market.

I'm not really in a position to speak about the advantages of our hardware vs. our competitors; I haven't spent any time looking at their products or comparing them to ours (I have plenty of other work to do already ).

Asterisk is a back-to-back user agent, how would you convince people that this kind of implementation is better than using only pure SIP proxies with external components like gateways? Isn't that a more modular approach?

It is, but it also is limiting in a number of ways. For example, Asterisk has another VoIP protocol (IAX2) that can provide a number of benefits over SIP when used to connect servers together, but using a pure SIP network would not allow for that configuration. It is also not clear where the 'call routing' functionality should live in a network of proxies, as the routing process is much more exposed to the endpoints than it is using Asterisk. Even with that in mind, though, large Asterisk networks are frequently fronted by OpenSER clusters to handle registration, load balancing and failover, and this seems to be a very powerful combination of products, each doing its job well.

Can you reassure Profoss participants that your talks won't be a commercial show?

Of course; even though I am in management at Digium, my heart is in the open source world and in the technology itself, and I can talk about it for hours and hours :-)