After reading “The Hidden Trust Problem in API Formats” Daniel Kocot wrote a comment on LinkedIn:

Bruno, I think there is an interesting distinction here.

You write:
“Trusting an API specification format requires you to first trust the people who maintain it.” I am not sure I would want to trust the people first. Shouldn’t a mature specification ecosystem be designed so that I don’t have to? People and companies will always have interests. The important question is whether the governance makes those interests visible and provides mechanisms to balance them. For me, trust in something like OpenAPI or AsyncAPI comes increasingly from the system around it: transparent decision-making, open contribution processes, independent implementations, interoperability and the ability of the ecosystem to continue even when individual people or companies change. In that sense, perhaps the real question isn’t: “Do I trust the maintainers?”

but:
“Does the governance make personal trust unnecessary?”

Curious how you see that distinction.

I don’t agree with Daniel’s perspective, and here’s my reply:

Great point, Daniel. We both agree mature specs need transparent governance, but processes don’t run themselves, they still need people.

See the case of OAuth 2.0 that I share in the article. After big companies joined the project, its direction was mostly driven by them. They still followed all the governance rules. Because of that, according to one of the OAuth 1.0 authors, “the resulting [2.0] specification is a designed-by-committee patchwork of compromises that serves mostly the enterprise.”

Or, see how some companies openly hire people to “foster influence across open-source, enterprise, and partner communities.” Or some other companies openly look for people who “hold positions of influence in open-source projects and organizations.”

If you have one of those jobs, wouldn’t you try to exercise influence according to what your employer asks? Wouldn’t you try to game the governance system? Wouldn’t you try to “buy” votes, lobby other members of the project, and even poison decisions? Or, would you quit your job?

In the end, it doesn’t matter the degree of governance (let’s call it a “harness” for lack of a better term now) that you have in place. People will always find a way to game the system.