Jerod Santo: Yeah, I think that’s been really nice, especially for podcasts where they are consumed, not just asynchronously, but like massively asynchronously, where there’s people who are living off of the fire hose, and they listen to the episode when you drop it, and there’s people who are like three months behind perpetually… And then there’s people who are like back catalog dwellers, where they’re like listening back through the catalog… And they may listen to it years later. Well, there was never a place where all those people could easily find “Here’s where that discussion is.”

And so the thing that I’ve heard the most, and which I’ve enjoyed, is people’s ability to hop back into an older episode and either strike that conversation back up, or even just read it, what people had to say, in the time between it shipping and you listening to it. So that’s really cool.

I do have, after living – anytime you live somewhere for a while, you see all the warts. I’m starting to have a little bit of the - not buyer’s remorse, but just like Zulip wart finding adventures, if I might call it that… The mobile app leaves a lot to be desired. I know they are rewriting it right now in Flutter, and so they’re working on that. There’s all kinds of little UI things that just bother me about Zulip… And the URLs - I’m a URL guy. I can’t believe some of the URLs these folks put together. Because it’s basically an SPA, and everything is like – go read the URLs. They’re just not pretty. And when you’re trying to deeplink in this stuff… I don’t know. That matters to me. It offends my sensibilities; when you’re deeplinking into something and you’re like “Look at this URL” I’ve got to go give somebody. Stuff like that. Just minor nitpicks.

But it’s definitely better. It’s better than Slack in many ways. And while we are all in pretty much on using Zulip, we haven’t done any sort of finalization in terms of like the blog post I was going to write… I probably still will… We haven’t closed our Slack… Probably can’t at the moment. There’s still conversations happening there, mostly in private team chats. Some with collaborators who we don’t want to just ask them to move to Zulip, because it’s just kind of odd, and strange to be like “By the way, from now on if you want to communicate with us, switch to Zulip.”

Michael Grinich: When I was an undergrad in college at MIT, I met a bunch of the folks that were working at Dropbox early on. And this is when Dropbox was pretty small. They were like 50 people, or something. Dropbox was started by MIT alums. So they would come to campus, and come to the recruiting fair, and throw parties, and stuff like that… And I ended up spending about six months working at Dropbox, doing some mobile engineering there and building stuff. This is back in 2011. So the company was just starting to grow faster. I think when I went back to school, it had like doubled in size. And the thing I really thought about when I was there - it was not just the mobile app, but how Dropbox was getting used by companies, really businesses, and the positioning we had against other products like Box. We’d actually hired a sales guy from Box back then, and just started thinking about why is it like Box is winning in these business contexts when me and all my friends used Dropbox and it was clearly a better product.

So I thought about that a little bit, but obviously not too much. I went back to school, graduated, and then after graduating, I had been working on this email project. It was actually like my capstone project in the computer science department. So the codebase was there… And it was this thing to synchronize email and build data kind of visualizations on top of email. And I’d always wanted to build an email client. I felt like the email client is sort of the view into the database of your life. At MIT everything runs through email, and I was just like obsessed with email clients.

And so I started this company to try to rebuild Outlook or Gmail with a much more modern take. And to build something that’s really fast, and elegant, easy to use, and something hopefully that would help people communicate and get their job done a lot better. So I figured if you can help people communicate faster, help people kind of structure their thinking better, and help teams work better together, you have this huge effect on productivity, and it’s a high-leverage thing you can do.

So I started working on that, took that codebase, and that became the core of the mailsync engine, and then built this app on top of it. And we obsessed around the design. Really obsessed around the experience of this app. I spent like three weeks looking at fonts, just typefaces – because email’s all text, right? The interface has mostly fonts. Working with a couple designers that – I really, really loved that time working with them, on every single individual icon.

I hired a musician that did sounds for video games, and went to their studio for a couple days and just listened to like notification mail sounds that we were going to put in the app… Because the new mail notification sound you hear all the time. So we really went deep on this, right? Like we went really, really deep on making the experience great. We did all this amazing engineering to make it extremely performant on multiple devices. We had everything from MacBooks to like little Surface tablets, underpowered, that we were making sure it rendered properly, and worked offline.

So anyway, we obsessed around the design of this product. We launch it, and people love it. And it was also open source. So developers loved it, it became a top project on GitHub, and we got all these people signing up. And I had just gone through the Dropbox playbook, right? Build a great experience, that people really like, that’s really useful, put it out there in the world, and people will start using it at work, as well as their personal life.

[07:46] So we started getting users everywhere from like NASA, to Uber, to Facebook, to the city of Minneapolis… Every single kind of imaginable type of user was just downloading it, signing in and using it. And the playbook I had was like “Hey, do the same thing as Dropbox. Just go find the organizations that are adopting this and we’ll sell it to them.” It’s kind of the bottom-up freemium type of business model.

And what happened is a few years later, as we started getting this adoption, I would go in those companies, like Uber, for example, and say, “Hey, there’s 100 people here using Nylas mail. Let’s get you guys on a team plan. Let’s get you to pay for it for the whole organization.” And this was the first time I really learned about any of these things around enterprise features. I had never talked to like a person in IT before that, that type of moment. And what I realized is the same thing that was constraining Dropbox’s growth back then, I was starting to have as well, which is that you could get this amazing adoption and really product-market fit, with the end users signing up and using the product, and using it every day, in many cases… But when it came to actually commercializing and building a business around it, there was this totally different audience, which was the IT admin, or the procurement team, and they didn’t care anything about the design of it, or the fonts, or the sounds I’d put in it, or why users liked it. They pretty much said that they can’t use it unless it had all these seemingly obtuse enterprise features. And in some cases, some organizations actually shut it down. They didn’t know people were using it, and after they’ve learned about it, because it wasn’t enterprise-ready, they shut it down.

Ultimately, this meant we didn’t commercialize that product successfully. We got some people to pay for it, but it really wasn’t growing in that means… And we’ve found that “Hey, in order to actually build this enterprise stuff, it’s going to take an incredible amount of time.” And during that moment, I actually went and talked to friends of mine working at companies like Asana, or Slack early on, and they were all building this enterprise stuff. They’d kind of stopped working on the product features.

So we ended up just fully open sourcing it, shutting it down, pivoting the company… Nylas is still around, and doing well, and growing… But that idea of building a mail client essentially stopped. That died. And I took some time off, and when I was really trying to think about what to do next, I just kept coming back to this problem. I was like “Why did we build the product everyone loved it?” I still talk to people who say “I used that app, it was really great. I really loved it.” Why did we build the thing that everyone loved, but that wasn’t enough?

Paul Graham famously has written and said “Make something people want. If you do that, everything else will take care of itself.” And it obviously didn’t. There was this missing step. And I realized that getting product-market fit - it’s necessary, but it’s really not sufficient to building a business. And if you don’t think about the business side, you don’t really think about how you’re going to commercialize, and who is the buyer, you get stuck. And it might be in year one, it could be in year five… You might be able to squeeze through for a little while, but ultimately, you’ve got to figure out how to go to those actual commercial buyers and satisfy them.

And what I realized was – why WorkOS exists is all this stuff that you need, you can really put it into a software layer. And that’s what we’ve done. So things like authentication, and user management, security features, things like audit logging… All this kind of under-the-hood stuff that IT admins need - it’s pretty complex to build, it turns out. It takes a lot of time, you have to have really good engineers to do it… But the features at Dropbox that they ended up building for enterprise are the exact same stuff that Slack built, it’s the exact same stuff that Asana built. People just kept doing it again, and again, and again. And so I was like “Hey, what if I could take all these features and turn it into a product, kind of like Stripe, or something like that? …they’ve done that for payments, but let’s do it for enterprise stuff.” And that’s WorkOS. That’s the idea.

So I’m not clairvoyant, or anything, I just looked at the hard thing that everyone was doing, the hard thing that I had struggled to do at my first company, and then said, “Hey, let’s just kind of go a couple notches down the abstraction chain and solve this from an infrastructure perspective for everyone.” And it turns out we were so far not too wrong. People are using it, and it’s helping people… But I kind of stumbled into this world of infrastructure for enterprise apps really through building an app myself.

Amal Hussein: Yeah. Well, I would say you’re definitely really good at hot takes. You’re also really great at – I feel like when there’s gasoline all over the floor, you’re really great at showing up with a match on Twitter, and then dropping the match… And it’s like BOOM! [laughter] There goes Twitter for today, you know…? Literally, three weeks later I’m still getting likes and mentiones on threads where Rich inserts himself into sharing a very reasonable opinion about JavaScript. For what it’s worth, I agree with you 99% – actually, 100% of the time, if I’m honest. But yeah, seriously, you’re awesome.

So kind of just to continue our hot topics… So React - I’ve been using the library forever; really, it helped me even be better at JavaScript. It helped really democratize the component model that we were kind of skirting around for a very long time as a community. So I’m very thankful for the way it’s helped push certain things forward. However, I think there’s certain things around performance and other things where I feel like maybe React has kind of stagnated. And for me, I think a product of its success in many ways, React is a product that really supports a wide variety of applications and platforms. And this reconciliation algorithm, and this virtual DOM, and the synthetic events, and all these things that are kind of like extraneous and not necessarily found in other projects on the web… You can look at Preact, Svelte - y’all don’t need a virtual DOM, y’all don’t need synthetic events… Extremely performant, much smaller bundler size… But the constraint that React has is we output to many DOM trees; or not DOM trees, but platformy trees… iOS and Android being the other two major platforms. So it’s got some bloat because of that.

[47:48] A friendly argument that I was having with a friend of mine a few weeks ago was like “Okay, is it safe to say at that point that maybe React is not the best choice if you’re writing for just the web?” We agreed, and he was like “Yes. If you’re just writing for the web, React is not the best choice.” Because I was just trying to say, I don’t think React is – like, if I was starting a project in 2021 (or 2022 now almost) for the web, I wouldn’t pick React. I wouldn’t. Just because it’s bulky. I would try to pick something that’s really gonna force me to use as little JavaScript as possible. And React is more than I need, it’s more engine than I need, if I’m just writing for the web. So I’m just curious, do you feel like Svelte is – like, how is Svelte tackling this problem? Because I feel like for me Svelte feels very web-first, web-only right now. Is there a mobile story? Have you tackled those constraints around multi-platform? Because if I’m working at a company and I’m trying to get my manager to adopt Svelte, my manager is gonna say “Well, is there a native library? How does that work? I don’t wanna have to hire folks to write Swift and Kotlin, or whatever.”

Mitchell Cohen: So there’s two parts to that answer… One is that we’ve been through several changes in user behavior on the web, in relation to their own privacy, security and digital identity, and we’ve always succeeded by adapting how 1Password works to how people actually think about their identity online.

[01:00:12.00] The first big transition was from an app to the web, and then to mobile, and then wanting it to become a collaborative sharing experience on the service… And now we’re seeing another transition to passwordless, for a lack of a better term. And we want to be there too, because we don’t wanna be telling people “Here is what you have to do to be productive, to be secure online.” We want to help them do it the way they already want to. So obviously, we’ve done a lot to make sure that biometrics are a first-class feature of 1Password, so that – it used to be all about what we used to call your master password, and now that’s like a minor detail. Most of the time you’re not even thinking of that password; you’re interacting with us through the biometric interfaces on your device, and we keep sort of making that more central to the experience.

Beyond that though, we also are very interested to see how people are using passwordless services and SSO, as you mentioned, Amal, blockchain services for identity. And we wanna help them do that, because the one thing that we’ve seen that will always be true is there are all of these services competing for people’s one true identity, but we’re always gonna be there as kind of the source of truth for all these things you have to keep track of and pay attention to to keep yourself secure online. We’re gonna be a safe place for you to store and use and interact with those services.

Mitchell Cohen: So there’s two parts to that answer… One is that we’ve been through several changes in user behavior on the web, in relation to their own privacy, security and digital identity, and we’ve always succeeded by adapting how 1Password works to how people actually think about their identity online. The first big transition was from an app to the web, and then to mobile, and then wanting it to become a collaborative sharing experience on the service… And now we’re seeing another transition to passwordless, for a lack of a better term. And we want to be there too, because we don’t wanna be telling people “Here is what you have to do to be productive, to be secure online.” We want to help them do it the way they already want to. So obviously, we’ve done a lot to make sure that biometrics are a first-class feature of 1Password, so that – it used to be all about what we used to call your master password, and now that’s like a minor detail. Most of the time you’re not even thinking of that password; you’re interacting with us through the biometric interfaces on your device, and we keep sort of making that more central to the experience.

[01:00:05.24] Beyond that though, we also are very interested to see how people are using passwordless services and SSO, as you mentioned, Amal, blockchain services for identity. And we wanna help them do that, because the one thing that we’ve seen that will always be true is there are all of these services competing for people’s one true identity, but we’re always gonna be there as kind of the source of truth for all these things you have to keep track of and pay attention to to keep yourself secure online. We’re gonna be a safe place for you to store and use and interact with those services.

Brian Leroux: No, no, no. I was there from the very beginning, for sure. That was created by a dude named Austin, and he’s got a company around that. I work on one called OpenJS Architect, which would be I guess technically a competitor, but I don’t really believe in that concept in open source. They take a different approach than we do, and they do good stuff.

But yeah, I always end up – this is an affliction of mine… I get interested in something probably prematurely, and then I go all-in. When mobile was happening, I was really excited about that. That was a big deal. Steve Jobs was like “Hey, you’re gonna build websites and they’re gonna run on your phone.” That blew my mind, completely. The idea of even seeing maps on your phone was novel at that point. And getting directions was a pretty weird idea. So we’ve absolutely come a long way in ten years, and in a sense I actually predicated the whole SPA thing.

And then yeah, when I saw serverless happen, I had been doing a bunch of cloud stuff for PhoneGap actually, up to that point, and I saw Lambda get demo-ed with API Gateway in 2015, and it’s like something snapped. I was like “Yeah, that’s how it’s gonna work. We’re not gonna build balanced containers. That’s a ridiculous proposition. Why would you do that? Let somebody else do that and outsource it to them.”

So for me, that was just immediately obvious in 2015. Here we are in 2021 and that’s still news to some people, but that’s kind of my curse and my blessing. I’ll see these things as they’re happening and get excited about them. I kind of [unintelligible 00:07:16.26] to it maybe a little earlier than I should…

Mikeal Rogers: [01:16:04.26] First of all, coming back to that, differentiating between problems that are current technical limitations versus things that we actually have an incentive to solve… Everyone has an incentive to reduce the energy consumption. It is only a cost center. And if you look at what’s happening broadly in blockchains, we have figured out how to get the energy cost down. Those algorithms exist, they’re implemented in several chains… Ethereum is planning on moving to one of them, so Ethereum will be on one of these that uses significantly less energy…

It is totally unclear to me how and when Bitcoin would ever do something like this… So Bitcoin may be just always using this much energy, and maybe that’s the downfall of the protocol. Maybe that’s why people stop using it at some point, if they can’t make that migration… But I think if you’re looking at the ecosystem overall and the technology overall, we’re already moving past that particular problem, and we’re getting the energy consumption much closer to just what you use in cloud computing and mobile and stuff like that.

I don’t know when your first computer was, but mine had a power supply the size of about 20 iPhones, and it consumed about as much power I think as 20 iPhones maybe, for a fraction of the compute. That went down, and this is all just kind of coming down over time.

Peter Cooper: There’s a lot of moving parts, and I guess this is one of the good things about being a developer myself - I’ve managed to just build these parts as I need them. I’m definitely one of those developers who spends two hours writing a script to save myself ten minutes. I’m very much in that group, just because I know what happens over time.

If you have a job that you need to do more than once, you generally need to do it 100 times, so building tools makes sense. So I ended up building tools for doing our booking system for our sponsors, and so on. I’ve built our billing system, because at the time I built it there was nothing that could handle all the different weird combinations of VAT and stuff like that that we have to do in the U.K. as a business. Those systems now exist, I could move on to them, but at the time they did not.

I built systems for keeping track of projects, for keeping track of different websites, for keeping track of RSS feeds - all of these different things. There’s tons and tons of tiny apps that we use here at the company. I mean, I don’t even touch a lot of them now. The booking and the billing system and stuff like that is pretty much for use by the people in the company that handle that stuff. Other than that, my curators lean heavily on some of the discovery things I’ve built, which kind of scrape different websites, and looks at different projects, and things like that.

Perhaps one of the most recent ones I’ve built actually was a tool that uses the GitHub GraphQL API… It’s like a 50-line GraphQL query, or something. I had to learn so much ridiculous nonsense to make it work… But what it does is it looks for projects that match a search query that I might give. I might say “I want all stuff that’s to do with Go” or “I might want all stuff that’s to do with MongoDB”, and then it looks for stuff that has a release or a tag within the past X number of days, and it brings out the information about the star count, who’s watching it, what language it’s in, or what secondary languages it’s in, all that type of stuff, and then works out the version number, and all that type of thing.

So I can find that literally within seconds now what are all the biggest releases of Ruby libraries on GitHub within the last two weeks. I have a lot of work to do to go through those and be like “Well, actually this is just a pointless minor release” or “This is a big deal” and so on and so forth… But at least it gives me the pointers to those things. So I have lots of tools of that nature.

Probably another one actually is the system that sends the email, which is quite an undertaking. The thing runs all the different websites, for all the different newsletters, so it’s actually one app. When you go to GolangWeekly.com, or JavaScriptWeekly.com, it’s actually hitting the same app… So managing all of that, and all the security certificates, and stuff… That’s yet another job.

The editor that we use to put issues together, which is now used by – well, three of us in the company use it. It’s basically a live text editor that we can all use at the same time if we wish, so we can actually work on an issue live. We have a kind of weird version of XML that we use to align all our newsletters on the left, and then on the right it’s the live preview, which we can resize to see what it looks like on mobile, and everything… But it’s completely live. So as I’m typing, it updates visually what it looks like immediately. That’s why we can do in the newsletter some interesting visual things, like we can include breakout boxes and stuff like that, that for other people – I’ve seen a lot of people do newsletters, but they’re very formulaic; they always look the same, every single week, whereas I can change the layout of the newsletter almost like on a whim. We don’t tend to, just because of time, but it’s possible to do.

[36:17] So yeah, I’ve pretty much built all the tools for this thing, and maintained them, and that’s pretty much what keeps me in the development world for sort of 50% of what I do - just mucking around with these tools… But there’s a lot of parts.

Yaw Anokwa: [11:48] I could talk a little bit about that… So I moved to Seattle in 2005. I was accepted to a Ph.D. program at the University of Washington in Seattle. I was gonna study AI, and I sort of abandoned that notion pretty quickly, mostly because I found I had a great relationship with a professor there, Gaetano Boriello, who really sparked my interest in – at the time it was called Ubiquitous Computing; this idea that you can have computing everywhere, and human-computer interaction, human interfaces to those computers.

So I started working with Gaetano, and during probably my second year I saw a talk at UDUB from a guy called Neal Lesh, who was at that time sort of a wandering guru. He’d travel from place to place, primarily in sub-Saharan Africa, and help hospitals or whoever needed help with whatever computing problems that they had. That really inspired me. I was going through a time in my life where I felt like the stuff that I was doing didn’t really have a broad impact, and it seemed like all this education for not a lot of value to the population at large.

So after listening to Neal, I got a chance to put a pause on my master’s degree at that time and go to Rwanda to work with a group called Partners In Health. At that time, they were deploying an open source medical records system called OpenMRS. They were doing it in a small town in rural Rwanda, and I saw during those six months that I was there how important an electronic medical records system could be to treating HIV and TB patients.

A lot of chronic care like HIV and TB is done on paper, and paper really limits how effective you can be at treating those patients. It’s not like malaria, where you get treated once and it goes away. Every few weeks, every few months you’re at the hospital. So electronic medical records definitely help.

So I had that experience and I learned from it, and I saw how important paper was to the process, and how critical electronic medical records tend to be to [unintelligible 00:14:11.22] method. So I kept wandering Africa at the time, and Gaetano sort of summoned me back to Seattle, and said “You’ve been wandering for a while…” He was going to take a sabbatical from UDUB to go to Google to work on a mobile data collection project. This was right before Android was released, and so Gaetano had this idea that a lot of his students were sort of working in the technology for development space, and that the common theme seemed to be removing paper and digitizing processes.

I thought this idea was terrible, to be honest. I was like “I’d rather just bum around in Tanzania for a little bit. I don’t really wanna be back in Seattle and working on this stuff”, but Gaetano and his students, friends of mine, Carl Hartung and Waylon Brunette, sort of convinced me that it was worthwhile… So the three of us went to Google as interns for a year and built out what became initially Open Data Kit. We did it open source from day one, because we’re researchers and grad students and we thought it was really important to make it open source, available to as many people who wanted to do research on it.

At that time Android just came out. We released the first version of ODK as soon as Android was publically released… And actually, funny story - at that time there were the Sidekick style devices; those initial devices, we took 20 of them. I think Carl and myself were the first people to bring Android devices to the entire continent of Africa, because it wasn’t released there yet. We stuck them in our bags and took them to Uganda to do a quick project… And that’s what kicked off the project. That was in 2008.

[16:01] From there, the three of us had a year at Google as interns, and then went back to the university and started to build out what became this entire ecosystem of tools. That was in 2008, and now it’s 2019, so it’s gone on to become the standard set of tools that folks use when they’re collecting data in a field environment, and it all sort of started from that project we started when we were interns.

Ron Evans: Oh, yeah… I ordered mine by violating air flight rules and actually doing it on my mobile phone while waiting for take-off on an international flight, and just managed to get my payment info in right before the flight attendants forcibly took the phone.

Henk Rogers: Yeah, so Blue Lava Wireless… Around 1999, I think, a friend of mine in Japan who was starting a new publishing company came to me and he said, “My publishing company is going to be based on one product. It’s going to be Tetris. The other product that I think could make it work is Pokémon, but Nintendo’s never going to license Pokémon to me. So I need Tetris from you. And I’m willing to bet a third of the money that I raise to start this company to get the rights to Tetris.” So basically, he made me an offer I couldn’t refuse. And by the way, everything he said came true. That company went on to become the number mobile phone game company, Tetris was their number one product, it was probably half of their sales… And with that ammunition in hand, I started looking around the US for a licensee. Okay, so who’s going to be my mobile phone licensee? And the biggest offer we got was $25,000. That was a joke compared to what I got out of Japan.

And so what I realized at that moment is that nobody in the US quite understood what was going to happen with mobile games, how big that was going to be. So I decided to do it myself. So again, I started another company called Blue Lava Wireless. We started I think in 2002, here in Hawaii. And basically, I’d moved to Hawaii because I had some line on financing… But six months into it, we were so close to profitability that we never needed the financing. So we never took any outside money. It was just my wife and I, and we built the company, and it was profitable. And when we sold it, we were still growing.

Autumn Nash: [00:24:03.22] I’d also love to talk to someone from Minecraft, mostly because we’d get street cred with our children, but also because the amount of hours I’ve put into Minecraft… But also, it has three different platforms, if you think about it, right? So you’ve got multiple platforms; you’ve got the Java edition, you have the mobile edition, and then they got acquired and they’ve tried different ways to like try to like melt it all together. So I think that would be super-interesting.

Jake Shirley: Yeah, it totally is. It’s using file extensions, which - all the extensions [unintelligible 00:15:30.15] because we’re in modern computing, where everything’s just a zip… But yeah, you can make a – basically, structure your packets, your zip a certain way, and then you just rename it to .McAddon, and you can actually deep-link it into Minecraft, iOS, Android, Windows… Console support’s a little out there. I don’t think it really works on consoles, just because of security implications on most consoles… But on mobile devices there’s actually a pretty shockingly large community of creators who exclusively develop their content on Android and iOS.

Yasir Ekinci: Yeah. My dad actually was a miner when he was younger. I don’t mean like “and then he grew up”, but he was actually in the mines, down in the pits… And he used to – yeah, he’d come home and he looked like he was wearing eyeliner, or guy liner, because he’d have like soot in his eyes, and stuff. Obviously, it’s not showered out properly, but… Yeah, he sort of looked like a seventies rock kind of glam star. It was great.

Adam Stacoviak: Right? Because that impacts your ability to give talks, and stuff like that, or show up on podcast… Like “What do you do?” “I’m an Oracle Data Miner.” “No, what do you do?” “That’s my title.” “Okay.” “That’s me. I do that.”

Justin Searls: But beyond a certain point, cognitively, we can only carry around so many in our heads. Like, if I’m talking to James about this and he doesn’t even remember writing that thing… Like, what we’ve seen when you take that to the extreme in npm is how critical security audits have become… Because all it takes is like a domain name expiring, or somebody coming along and buying a package from somebody else, and then like secretly injecting a cryptocurrency miner, or a keylogger or something… Taken to its extreme, what you’re really doing is you’re creating a chain of trust with a whole bunch of strangers. And you’ve got to be mindful of the fact that if you’re effectively opening yourself up to everyone, you could never hope to audit at all. Hopefully, GitHub Copilot will be security-scanning everything and it’ll catch most of the stuff. I would still never feel comfortable if I didn’t feel like I could get my arms around it, and look at every single one of my dependencies and have some idea of who maintained it, and what it was, and what it did.

Jarred Sumner: Yeah. No, he’s great. Probably what he’s referring to, I’m guessing, is that we don’t have an implementation of something like npm audit in Bun, which sort of is the thing that’s like – there are 42 security vulnerabilities in your dependencies, or whatever. That’s what it logs. We don’t implement that right now. But on the other hand – so yes, that is a feature that is missing. But on the other hand, we also don’t run post install by default for dependencies, which is very good for security, because this is a very common attack vector that normally, if you want to get a Bitcoin miner on somebody that, then you compromise a package, and then you do a post-install… That’s usually the attack vector, is like post install scripts, or something.

Jerod Santo: So where’s the BTC miner val? That’s my question.

Paul Smith: It was acquired by MSNBC in, I think, 2011. It was actually part of NBC News, because we had that news angle. Nowadays people take, I think, for granted things like NextDoor, and Facebook Local News about their neighborhood. So we were kind of one of the early pioneers of that. We sold the company, and kept working on it for a little bit… But we did some interesting things on Everyblock. In fact, one of the things I’m most proud about is we built our own map stack.

So at the time, if you remember back in 2006-2007, JavaScript engines and browsers were starting to get faster, Google Maps popped on the scene, and it was suddenly “Oh, you can do these native desktop app things in your browser’ for the first time. And in fact, Everyblock kind of came out of this idea, of sort of like a Google Maps mashup of taking Google Maps and then using its API and slapping data points on it. And when we started the company, we thought it would be great, since that’s going to be such a central part of this - you want to be able to look at a map of your neighborhood, drill into your block, see where news is happening… And when I say news, I’m talking about maybe your block is mentioned in the news, or maybe a building license has been issued, or a restaurant inspection, or things like that. Public records, crime information… And we would aggregate all that and put that onto a map.

So Google Maps was great, but we wanted to have control over the look and feel, and user experience, so we built a map stack from the ground up, using sort of open geospatial tools at the time, OpenLayers, Mapnik, some other tools like that, and then kind of combined that with a Django app server we were using to pull the data out of the database, and then present that on the browser. We worked with a great designer, Wilson Miner, to kind of come up with their own palette and design for the maps themselves, which - I thought they looked really beautiful. So it was a way of visualizing the data, and I think it was a pretty interesting accomplishment. And now, you’ve got things like Mapbox, and there’s just a lot more flexibility when it comes to sort of the in-browser custom map and geospatial experience.

Jack Dorsey: We learned a lot from the solar platform, such that Cash App is going to do something similar. And TBD is entirely a platform. That’s its only reason to be and to exist. So we’re definitely on the track, and we wanna make sure that we’re building more and more platform-type things forever more. Everything that we do in the future should have platform elements.

We’re building a Bitcoin wallet and a Bitcoin miner - we’re building it so that it’s open source; all the code will be available, and the hardware design will be available. Everything about it will be completely open for any developer to use. They don’t need to build on top of it, they can just steal all the code and the idea and just build whatever they want.

Liz Rice: [58:13] Yeah. And then on the security side - so Falco was probably the first security project, certainly in the CNCF, that was using eBPF. This project from my former colleagues at Aqua called Tracy… And then in Cilium we have a sort of Cilian family, we have a sub project called Tetragon, which is allowing you to create low-level security primitives almost in Yaml form, and apply them to your Kubernetes cluster. And you can do really cool things with Tetragon. I get a bit overexcited about this, because if your kernel is modern enough, you can not just detect that something is potentially malicious behavior, a process is opening the wrong file, or connecting to a cryptocurrency miner, or whatever malicious thing that you’ve detected - you can kill that process synchronously from within the kernel. And what that means is the process gets killed - to me it’s not like you have to go and tell somebody and then eventually your process gets killed… It’s happening right there and then, and it stops the attack before it happens… Which is super-fun to demo. I love it.

Gerhard Lazu: We could do. Or a Bitcoin miner. [laughter] We could. It’s there, we’re paying for it… But you know, to be honest, the reason why this is exciting is because we can spin up on-demand, and we can have maybe more than four CPUs. We only chose four CPUs because of the cost. It just hits the balance nice. But if we could use 16 CPUs on-demand, that would be a lot better. And with Fly machines we can, because they spin up so quickly… You don’t wait minutes for it to come up.

Gerhard Lazu: Exactly, you have to know. So it took me few weeks to understand how this crypto miner got in our infrastructure. I will not say where… [laughter] So what happened - those secrets that were committed to the repo, they were encrypted. We didn’t know. And this crypto miner appeared on this VM, with root privileges because of the key; there was the private key, an SSH key. If you have that, you can SSH into the VM, as root, set up whatever you want, and off you go.

[34:20] It was a very small DigitalOcean VM, so there wasn’t like any reason to run a crypto miner, but you know, people do it… I mean, not even a GPUs… Come on. Anyways, people do that, like a throttled CPU, 100% for weeks, and we couldn’t explain what the hell is going on. And then after a few weeks, we realized how the leak happened. And it was encrypted secrets. We had committed them, the key was leaked, we didn’t know, the private key was discovered, someone SSH-ed, they set up their crypto miner, and there you go. Good luck figuring out how that happened.

Jack Dorsey: We learned a lot from the solar platform, such that Cash App is going to do something similar. And TBD is entirely a platform. That's its only reason to be and to exist. So we're definitely on the track, and we wanna make sure that we're building more and more platform-type things forever more. Everything that we do in the future should have platform elements.

We're building a Bitcoin wallet and a Bitcoin miner - we're building it so that it's open source; all the code will be available, and the hardware design will be available. Everything about it will be completely open for any developer to use. They don't need to build on top of it, they can just steal all the code and the idea and just build whatever they want.

Shawn Wang: Well, first of all, I’m not the most informed person on security. Probably Feross would be a better person to talk to about this… I’m not optimistic or pessimistic. I’m just kind of neutral on it. I don’t think it’s like a focus of anyone, apart from Feross, who is the founder at socket.dev. [laughter] And his approach is “Let’s just audit everything and give you ten different reports telling you that–” And we have some of these automated audits as well. It’s not clear exactly how venture funding was gonna affect this either way. Obviously, you can have people who are paid better to maintain these repos, but supply chain attacks happen in perfectly well-funded companies as well. It’s not just like someone’s acting out in open source… Which has happened repeatedly, and just puts a Bitcoin miner in a repo, or something like that.

I think it really has to be fixed at the runtime level, or the toolchain level. Deno has an attempt at doing this by locking down the permissions. People are realizing, unfortunately, that it’s just not that useful. You’re just gonna enable all the flags anyway. So it has to be per-module, and as far as I know, nobody’s tackling that, except for a company that I’m hopefully invested in, that might be trying to solve that issue. But it’s kind of an open question right now. I’m not aware of anyone else really tackling sort of per-package permissioning and just reinventing the npm ecosystem. For better or worse, the npm ecosystem is what we have, and therefore the security defaults that they choose - which is none [laughs] - we inherit those decisions.

Feross Aboukhadijeh: Yeah. So that’s one example. But there was another example before that in November, and another one in October of last year… This seems to happen nearly monthly now. In October and November it was Coa, RC and UAParser.js that were compromised. They had a Monero miner added to the package, as well as some malware that stole passwords on Windows from over 100 different programs on Windows, and also the Windows credential manager… So if you were unlucky enough to install one of those packages during the period where the bad version was on npm, then you would be compromised; you would have lost all your passwords, and you’d need to reset everything, and install your keys, and everything like that.

And UAParser.js is depended upon by React Native. So these packages had a lot of dependencies. Each of those three I mentioned had 30 million downloads a month each. So we’re talking seriously popular packages that were compromised. And the UAParser one, just as an example - that one has 7 million downloads a week, and has three million GitHub repos that depend on it.

Jerod Santo: Bitcoin miner…

Paul Smith: It was acquired by MSNBC in 2011. It was actually part of NBC News… Because we had that news angle. Nowadays people take for granted things like Nextdoor, and Facebook, local news about their neighborhood. So we were kind of one of the early pioneers of that… And we sold the company, and kept working on it for a little bit, but… We did some interesting things on EveryBlock. In fact, one of the things I’m most proud about is we built our own map stack.

At the time, if you remember back in 2006-2007, JavaScript engines and browsers were starting to get faster, Google Maps popped on the scene, and it was suddenly like “Oh, you can do these native desktop app-like things in your browser for the first time.” And in fact, EveryBlock came out of this idea of sort of like a Google Maps mash-up of taking Google Maps and then using its API and slapping data points on it.

And when we started the company, we thought it would be great, since that’s gonna be such a central part of this – you wanna be able to look at a map of your neighborhood, drill in to your block, see where news is happening… And when I say news, I’m talking about maybe your block is mentioned in the news, or maybe a building license has been issued, or a restaurant inspection, or things like that. Public records. Crime information. We would aggregate all that and put that onto a map.

So Google Maps was great, but we wanted to have control over the look and feel, and users experience… So we built a map stack from the ground-up using open geospatial tools at the time. OpenLayers, Mapnik, some other tools like that, and then kind of combine that with a Django app server we were using to pull the data out of the database, and then present that on the browser.

We worked with a great designer, Wilson Miner, to kind of come up with our own palette and design for the maps themselves, which - I thought they looked really beautiful. So it was a way of visualizing the data. It was a pretty interesting accomplishment.

Now you’ve got things like Mapbox, and there’s just a lot more flexibility when it comes to the sort of in-browser custom map and geospatial experience.

Suju Rajan: Building off of the standardized version of us looking at the data that we have… Daniel, exactly to your point, we do have a notion of what a member embedding needs to look like. The data for LinkedIn comes from LinkedIn profiles. So in this sense, understanding that “Hey, this particular member has a – in that space, it looks like people who are in this technical industry, in this location, and here are the sorts of jobs that they apply to”, as much as we can represent them in that member embedding space.

Likewise, we have things that are on the job and they’re inside as well; someone asking for a data miner, maybe because they were under a rock, is also still asking for an AI scientist, so how can we bring that job embeddings view into it.

And in some senses, being able to scale this. Because if you think about where – there was an earlier question of “What are the different services in which we have AI?” There is the search aspect of it, and we also organically recommend jobs to people - something that we call instant jobs, where you want to be the first to apply… So members actually sign up for alerts, to say “Hey, the moment you see a job come into our system, then send me an alert right away.” So we need this to be high, high, high precision, as an example.

Then on the flipside, on the recruiter search as an example, it’s all about matching members to get jobs. So we’re trying to build this notion of what we call these two-tower embeddings, which represent the member side and the job side, and bring that together along with more near-line and real-time features, to sort of then personalize it to what that particular member is also looking for, to do ad matching.

Of course, if it’s on the search angle, then you also have the query context that comes into play. On the recommendation side it’s a lot more just based off of your activity signals, and so on and so forth. We try to infer intent, to be able to make those recommendations.

But to your point - yes, on the underlying surface we do have these embeddings, and we are going to be writing a blog post pretty soon about this particular data layer in our talent solution systems.

Adam Stacoviak: I was thinking about the last 100 years, because I’ve found this interesting… My hometown where I grew up was a coal miner town. I grew up in Pittsburgh, Pennsylvania… And very common for the idea of a company house to be a thing. A coal mining plant would establish its routes, have its company there, they’d have a company store, they’d have a company house, the entire neighborhood essentially is owned by the company, and the employees get a house for free, or paid for by their wages/work…