Lucy Lu Wang: Yeah, so the entire project is a coordinated effort by the White House Office of Science and Technology Policy. I think some time in early March a group at Georgetown, the Center for Security in Emerging Technology (CSET) reached out to us at Allen AI to help coordinate the release of this dataset, along with a couple of different organizations. You mentioned MSR (Microsoft Research), Chan Zuckerberg, Kaggle was also involved, and the National Library of Medicine, which is part of the NIH. So all these groups - we’re going to come together to essentially create this dataset to help create text mining and information retrieval tools that could assist medical experts in understanding more of what was going on with the epidemic.

For Allen AI, the way that we got involved is we had recently created a new pipeline to revamp our open research corpus. We had a pipeline for essentially taking these paper documents, which are traditionally in a PDF format, not very easy for text mining, not very accessible, and converting them into a structured full-text format, where you could run these natural language processing models on them more easily.

So that’s our major contribution to the dataset, is the pipeline for both harmonizing the paper metadata that we’ve collected over the years, and also producing these structured full-text parses, so that we can run our models over that text.

Feross Aboukhadijeh: I’ll just second what Tobie said… I think we’ve been super-lucky with the types of attacks that we’ve seen so far. It could be much worse than what we saw in this particular attack. I think we’re starting to see these kinds of supply chain attacks happen on a much more regular basis. It’s sort of picked up in 2021, and it hasn’t really let go since. I see a headline about something like this every two weeks, it seems like; sometimes even more frequently. And if you look at the kind of packages that are being affected, they’re all these pretty headline-grabbing numbers in terms of downloads.

So the two packages in this incident were faker.js, which has ten million downloads a month, and color.js, which has one hundred million downloads a month. But we’ve also seen attacks against UAParser.js and COA, as well as RC… And all of those packages had at least 30 million downloads a month each. When malware makes it into one of these packages, through whatever mechanism - you know, in this case it happened to be the maintainer themselves who added the malware. In the case of the three I just mentioned, UAParser.js, COA and RC - those ones were actually a third-party who got access to the modules and added malware to them.

In all these cases I feel like the attacks have been pretty naive and caught pretty quickly. We’re not really looking at super-sophisticated actors here. In the case of faker and color it was very obvious that something had happened, because the packages were outputting gibberish code, infinite loops, sort of outputting the Unicode text – it was very obvious that something had happened to the package.

And then in the case of the three I mentioned earlier - all of those were pretty obvious as well. There were crypto miners added to the modules, so when you updated, your CPU usage would just go straight to 100% and it would be mining crypto for the attacker. So this isn’t like a super-sophisticated thing; it gets caught within a couple of days. Someone notices, the malware gets removed from npm, and then we write a bunch of new stories about it and people talk about it.

There have been hints at much more scary attacks. If you go back to 2018 with event-stream. The event-stream incident was much more sophisticated. A bit of obfuscated code added to one of Dominic Tarr’s packages when he gave up the package to another maintainer to take over after he was done working on it… And in that case, that was an attack that targeted one very specific company. And it was a no-op for everybody else. And so that went undetected for much longer. I just think it’s interesting that we haven’t seen anything that sophisticated since 2018, which makes me think either people just have forgotten that those things exist, or maybe we’re just not finding them, which is the much scarier thought.

Francesc Campoy: It went really well, it was full all the way. That was very interesting, seeing so many people interested in talking about Diversity, and not only people that are members of minorities represented at GopherCon, black people and women, and LGBTQ etc., but there were also a lot of allies that were there to represent and basically to give support. That was very interesting.

We talked about many things. One of the things that I tried to propose and I hope is gonna happen - the same way there was this talk about mining the Go community, and that understands how Gophers do technical things, I was wondering if we could do something similar about who are those Gophers, where are they? Do they live somewhere in the States, in cities where they have meetups, or are they far apart? Do they have kids? Is it easy for them to attend conferences like GopherCon, or do they prefer things like the remote meetups organized by GoBridge? Is that useful for them? That was pretty interesting.

Then we moved into talking about how to make the Go community more approachable. There was a lot of discussion on basically improving the newcomers’ documents that we have right now. I could say they’re not bad, but we could definitely do much better. There were a lot of people talking about how to make those better, how to learn a little bit from the Ruby community. The Ruby community has a lot of funny examples; it is not only about technology, it is also about having fun while learning and things like that, and trying to apply that to the Go community. I think it’s very interesting.

There was also - I don’t wanna say his name wrong, Johnny Boursiquot. He pointed out that it is good to have those materials, but once we have them we need to go out to other communities and teach. He was talking how he’s going to schools that don’t have any technological plan, they don’t have a technical curriculum. And he goes there and volunteers to teach kids that otherwise cannot have access to programming classes, and he teaches that in Go. I think that is amazing, I’d like to see more of that.

I think that both things - having better materials for newcomers and then the Go community ourselves going out to reach into these communities that otherwise don’t have access to it could make our community much better, much more diverse and also much larger and welcoming.

Andy Walker: Great to be here. Alright, so let’s get into the topic. So today we are talking about conferences. And not just conferences in general, but sort of a new idea, a new way of doing conferences. For those listeners who haven’t been out there before, or haven’t been to conferences before, conferences are generally events that get held - you know, large to small, over the world, meant for people in the community to come together, where some people give talks, other people are just attendees to listen, and there are sponsors. So that is the general thing that we are referring to when we say “conference” throughout this podcast, or throughout this episode.

So to start us off, I want to start with an overview of the value proposition that conferences have had for – I’m just gonna say roughly the last 20 years. I don’t really know much before that, but this has certainly been the way it’s been during the 21st century, since around the turn of the century.

So I’m gonna go through kind of my thoughts on this, and then we’re going to have a little panel discussion about it, and then, after that, we’re going to move into this idea I have for a new style of conference, and the things that we could get from that basically shifting to a new value proposition. So with that, let’s get started.

So the way I’ve come to see conferences is that there’s a standard format, where you have kind of two main areas within a conference venue. You have your stages or your theatres, where speakers are giving talks, and you have this dining den/sponsor area, where you have sponsors setup, that are interacting with attendees.

So there are three main parties at most conferences - there are speakers, there are sponsors, and there are attendees. And speakers - so we’ll start here with the value proposition that conferences give for each of those parties. So in the past, speakers have gotten this ability to disseminate information rather widely by getting up on stage and giving a talk to hundreds to thousands of people. They also get the opportunity to interact with their community, and more or less build out their brand. So that, for the past 20 years, has been a big thing that speakers have gotten from conferences.

For sponsors, it’s been twofold. There are some sponsors who get opportunities to meet with candidates, who they can hire and bring on board, so it serves as a hiring opportunity or interview opportunity, and for sponsors who are selling something, it gives them access to an audience that they can talk to directly. So instead of having to go through a sales team, or procurement team, you can talk to developers directly in the case of tech conferences.

And then for attendees, the largest value proposition has been acquiring new knowledge. Before YouTube was a big thing, before Twitch, if you wanted to see the content that a specific speaker was giving, you would have to go to the conference and see them in-person. So it was very important that you a) attended conferences in person, and it was important that you also kind of took that knowledge back to companies. A lot of companies were sending people to conferences to gather information to bring back to share with their co-workers.

And in addition to all of those things that happen at conferences, there were also a few social events, like happy hours, welcome parties, and those sorts of things. So - panel, is there anything that I kind of missed there, anything you guys want to add to that description of the main parties of a conference?

Jerod Santo: [22:04] Just thinking about that timeframe, you brought me back, mentioning EC2, or Slicehouse as well, I was like “I haven’t heard that name in a long time.” Ultimately, I think Rackspace ended up buying Slicehost, and trying to provide some VPS services of their own through that acquisition… But I’m just thinking about all of the things that were burgeoning at this time that Heroku, that you guys started to execute. You had Git and GitHub around the same timeframe, you really had the birth of AWS, specifically the EC2 offering; I believe it was at the end of the 2000s; what do you call them, oughts? I don’t know. Like 2008-ish was EC2. S3 was a couple of years earlier… So you have like the actual – your guys’ access to that ability - you can talk about how you built the platform out, but building Heroku on top of that.

Then you had Ruby on Rails, of course, which had been around for a while, but it was becoming so successful that your potential customer base was exploding, and then the pain of deployment for Rails being kind of the sore thumb of what is otherwise an excellent building experience. There were so many things lining up for you; I’m not trying to take anything away from your execution, but when we talk about reasons why businesses, startups succeed, a lot of it is timing… And you guys were in a very fertile ground to build something like this.

Max Ogden: Yeah, because you have to have invested dozens of years into the nepotistic system of existing government procurement. It’s not a technical problem to fix procurement, but if somebody fixes procurement — and by the way, it is being worked on now, because like I mentioned this earlier, healthcare.gov was so bad that the silver lining around that — that’s actually pretty exciting — is that there’s two new organizations in the federal government that are hiring remote, and they’re hiring technologists, and they’re paying people to work on open source inside of government. One is called the US Digital Service, and the other is called 18F, or one-eight-F. They’re a brother-sister organization; one is inside the executive branch, and they’re the technology advocates. They’re almost like the role that the EFF plays. They have people come up with policies, and they get the different agencies to adopt policies. I have a friend that works there; he gets to go in the VA, or the Social Security office, and they’re like, “Hey, check out this new hundred-million-dollar database that we contracted. What do you think?” He used to build data centers at Twitter, and he’s like, “If I was building this, I could have done it for $5 million, and saved you $95 million. Why did you bill this for $100 million?”

And they’re like, “That’s what the vendor told us.” “Oracle said this was a great deal!”

[01:08:08.12] So that is a really important cause right now that has a fair amount of momentum. 18F is where you go to work if you actually want to build the solutions. They’re like an actual contractor that is government employees that like hires people to work on the actual projects. USDS is where you go to set the policy.

For instance, they are doing a lot of stuff around making all federal websites have mandatory SSL so that the NSA can’t snoop on what you’re browsing. There’s a lot of cool momentum in fixing that system.

So if I was going to place a bet on where all the grants are going to be in the future, it’s around delivering government services in more efficient way, and actually competing for government grants because that landscape is about to get a lot more accessible to open source stuff because of all the work that’s happening at the federal level.

Another way I would answer this question is… Procurement reform is one thing, and that’s happening, so keep an eye on that space. The other thing is, like I mentioned, we don’t know how to describe our project in terms of are we a non-profit, are we an academic project? We don’t know what our label is, and we’re trying to figure out with some other groups a model for supporting projects in this ecosystem. A great example to look at — I think they’re doing some great work — is if you look up this thing call the Substance Consortium, there’s this awesome text editor. It’s like a JavaScript, a rich text editor and editing environment called Substance. It’s really beautifully designed, and it’s all open source.

They had been working for this open access scientific journal, writing a journal article viewer and editor. They had all these other organizations… They were basically being contracted by this one journal called eLife, and they built this thing called eLife Lens, which is a really beautiful way to read papers. Because most people read papers on PDF, but trying to read a paper on your phone on a PDF, it has really wide columns and it’s like, “Why can’t I just have this be a web page?” They’re trying to fix some of these problems, but they had all these other organizations in this space, and they were like, “Well, we also want to invest together in better editing tools for science, or just editing tools for the web in general.” So they set up this thing called the Substance Consortium. There’s four stakeholders that all help pay for the development of Substance, but they’re not hiring exclusively the Substance team to work as employees on their projects. What’s really cool about it is Substance itself can still be its standalone project that can make reusable open source tools, but it has an open governance structure so any of the member organizations can help influence the project direction in a positive way, and work together to support the project without controlling the project. Their whole thing is cooperation without control. That work is being facilitated by a group called the Collaborative Knowledge Foundation, which is one of the stakeholders, or one of the people paying the Substance team.

Substance is just the editor components, but the Substance team doesn’t have a… They’re just two people, they don’t have the linkage to the social issue, they don’t have the grant-writing capability at this point. They want to get to that point, but they need incubating, and they need support for their project.

[01:11:45.01] Collaborative Knowledge Foundation is a couple of folks that started it that are really focused on fixing the scientific publishing ecosystem. They want every journal to be using open source publishing tools. So they have the social mission, that’s a huge social mission. Access to research is a really big cause right now. What’s cool is the Collaborative Knowledge Foundation has got some grants to work on fixing scientific publishing, and instead of hiring the Substance people as employees, they’re like, “Let’s support everyone in this ecosystem together, and have Substance still be standalone.” Because they think it would be toxic if they actually exclusively hired the Substance people that worked on their one thing. They would rather have Substance flourish and have a whole ecosystem, because…

That’s where open source works really well, when you have a bunch of interests that are supporting a factored-out, common infrastructure. I think the Substance Consortium model is really exciting; we’re trying to figure out how to… We need to come up with a cool name for that way of doing things. Ideally, the Dat project, since we are a distributive file system, it’s a pretty low-level component, and there’s a bunch of different interests… It would be awesome if we could get a similar thing for Dat, so we’d have a Dat Consortium. We would have the Dat project itself just be the technology, but then we would have all the different organizations that have a specific cause be able to support our work. Maybe we split up into two teams, like one of us is the science cause, and all the low-level people go and work on just the infrastructure stuff.

Jerod Santo: Yeah. And so Brian - a couple of things about Brian. First of all, he’s a very accessible guy. Usually, when you get up to that age - of course, he’s still teaching. But when you get to that age, there’s a certain point where you’re just like not interested anymore. Somebody who we’ve tried to get on Go Time over and over in different ways is Ken Thompson, of course, and to no avail. Now, maybe he’ll do a podcast, but he’s not going to do it with Go Time anytime soon, unfortunately…

Brian does podcasts. Like, he talks to people. He’s still mixing it up with people in the industry, which is so cool. Now, having said that, he had been on a few other shows prior to ours. This was not a Changelog exclusive. And so what I like about our particular episode… I listened to a couple of his other episodes; CoRecursive he was on, and he was on Lex Friedman as well. And so I went out and listened, just because we don’t want to create the exact same show that they create; like, we don’t want to ask kind of tired questions, and stuff… So you want to kind of have your own spin, or your own angle on it.

And I will say, this could have been like the day of the week, it could have been he just had a great meal… Who knows? Was it us? Was it him? He was genuinely enjoying himself talking to us. Like, he was lit up, eyes bright, he was laughing, he would have kept going, we talked to him for a long time… That was cool. Because that’s kind of your fear with a guy who’s talked to everybody, and had all the same questions before, and told the history of Unix, and he wrote it all in a book… And it’s like, “Are you gonna ask me questions out of my book? Like, go read this.” You don’t want to bore somebody, you don’t want them to be feeling like “Here I go again…” And that was my fear going into that show, was like, “Gosh, I really don’t want him to be bored, or disappointed, or whatever.”

And so what I really liked about that show - and you can hear it in his voice throughout. I’ve listened to it back. You could really see it in the video clips. He was leaning in, he was laughing, he was smiling… I think he really enjoyed himself. And that for me made for a really, really good show.

Marcin Jakubowski: But the initial level is “Okay, let’s get a house out there.” We know that you can make money selling a house, and we’re gonna invest that to refine the further developments. Now, we’re using our tractor to build it; we’re printing trim, plastic lumber and foundation forms, and plumbing fittings. And then we’re going on to “Now here’s your compressed earth block techniques. Here’s this sawmill, that if it’s readily accessible… Imagine a CNC sawmill; you drop a log to it and walk away, and then you’ve just got a pile of lumber. A techie person can do that.

So mixing the appropriate automation with within all this process and you can avail this unbridled productivity on a small scale. So that’s the vision, to just create more options for people, so you don’t just have Menards, or Lowe’s, Home Depot to go to… Because actually, right now there’s a real shortage of lumber, and the price of lumber went up three times.