Amal Hussein: Okay. So I hear that. Here’s where I’m coming from. And I’m sure there’s many people who would disagree with this, but… I don’t know, maybe not that many, actually. But ultimately, your code has to be compliant. If you’re running software for any business, any business that’s doing anything meaningful, whether it’s finance, education etc. there’s some level of compliance that you have to adhere to. And so if you don’t actually know what’s in there, and you don’t have a human in the loop guarantee, you can’t certify guarantee… For me, there’s just a giant compliance problem that I see.

And then there’s also just lots of code that’s sensitive, whether it’s financial algorithms, and, and, and… There’s just a lot of kind of many critical software that is dealing with sensitive transactions.

Ilya Grigorik: I think it’s context-dependent. I think there’s definitely a class of commerce in certain types of transactions where I know exactly what I want, there’s very low risk, and it’s kind of a predefined flow where I just say “Look, I need another carton of milk. You know exactly what I’m looking for, you know where to shop, and please go finish it. I just want it on my front door.” And then there’s other types of experiences where maybe this is your first time engaging with a merchant, maybe merchant has a set of rules where they actually require the agent to decelerate, because “Hey, for compliance reasons, I may need to verify your age” or “I need you to read this disclaimer on this product before you purchase it.” You can’t just have the agent blindly ignore that context, or click approve, and then proceed with the transaction.

[00:59:56.20] So I think we’ll need to define some protocol or shared mechanism to signal to agents that “Hey, in this particular case, I need you to pause and ask for a human to either confirm or take over control and complete the transaction.”

Beyang Liu: Yeah, so there’s two things here. One is the context awareness, building that in as a first-class citizen. I mentioned that we were first to market for that, and we actually have a way of delivering that really effectively into the enterprise. Sourcegraph has been self-hostable for many years now, because a lot of our early customers were very large enterprises. And so we’ve built all this DNA around delivering the best context for human developers in the form of code search and code navigation into all these different deployment environments… And we can essentially offer those same context fetchers as a kind of game-changing tool or capability for LLMs, as well; any sort of AI code generation or question asking.

[01:04:01.08] The other facet of this is just the security and compliance requirements that a lot of these larger enterprises have to comply with, or are constrained by. So in terms of being able to deliver something into a purely self-hostable environment, I think we’re basically the leader in being able to do this. Even Microsoft, or Copilot, with all their enterprise branding, there’s still components of their infrastructure that have to be tied to their Claude… And that essentially rules them out for a lot of, frankly, the largest software engineering organizations in the world. They’re ones that you haven’t heard of, but they’re literally powering half the economy, and they have very stringent security and data privacy constraints.

Adam Stacoviak: I guess what’s next? I mean, you’re spinning up marketing, you’ve crossed or are in the process of crossing the enterprise chasm, which is to offer SOC-2 compliance etc. Letting this series C be the financial boom, let’s just say, or fuel to the fire, as well as the legitimacy to attract newer types of customers… I guess, how do you go from here? Where do you go from here? This raise was just last month, and your job is reinventing itself time and time again. I imagine this raise may give you one more variation to your personal role of reinvention.

Arun Gupta: Yeah. My first question anytime a team comes to me that “We want to open-source this”, my question is “Why? Why do you want to open-source this? What’s in it for you to open-source this?” Are you looking to gain mindshare? Are you looking to get more engineering contribution? Is that a mandatory requirement? …say the partners are telling you “We would not adopt this technology until it is open source, because then we are not just relying upon you, but we can fork it if we need to, or we can contribute to it directly.” So I think there are several reasons. And if I go through the book, essentially… You know, this is the book that we were talking about. There are several Why that we talk about. Is it a faster innovation? Is it a more sustainable codebase? Because then, essentially, you’re not just reliant upon your engineering teams. You could do fun things, but then in the project you can also create Good First Issue, where you can encourage developers from around the world to help contribute over there. It could be cost savings, as a matter of fact.

For example, I may not want to run CI/CD infrastructure, and a hyperscaler may be interested in contributing credits for you to give those infrastructure. It may be a strategic initiative for the company.

[00:24:04.14] So for example, when Google launched Kubernetes, it was made very clear - if you keep it as a Google project, even though open source, nobody would care about it. That’s the reason they ended up contributing Kubernetes to a foundation, so that it’s now a neutral governance body etc. And then everybody else kind of jumped onto the bandwagon and became a success.

It could be a compliance and security, as a matter of fact, or community building. Or it could be sheer market visibility, that “Hey, this company–” Apple, for example, launched Swift, and they just want market visibility, because the only way to build developers around that is getting Apple’s name out there and bringing all those students and those developers who can then contribute directly to the language.

The reason Intel contributes to these open source projects – I mean, we contribute to 300+ open source projects. You pick an open source project, and we likely contribute to it. The reason we do that is because our customers, for example, who use our Intel Silicon - whether it’s a hyperscaler, a laptop, a network, an edge, whatever it is, they download these open source projects, and they expect them to work in an optimal manner. So the Why really is “Because our customers expect these open source projects to leverage the latest chipset. That’s the reason we contribute back to these projects.”

I think whether you are contributing to an existing project, or you are open-sourcing an existing project, the Why, the business alignment is fundamentally critical on why you want to do that.

Break: [00:25:50.18]

Adam Stacoviak: You were talking about Tigris, and correcting yourself… Tigris is basically like the promise of object storage, but it allows you to actually build a CDN. Like, you can basically run a – you can write some JavaScript, use Tigris, and you have a CDN baked into your application. You couldn’t build anything like that before. You could try and do this with S3, but it’s so complicated to like manage multiple regions of data that it’s impossible. Supabase for Postgres is like this. Supabase is a Postgres that lets you build new kinds of apps, or build apps faster. It really gives developers power.

And so the Rebel Alliance idea was if the future is developers are picking cloud platforms, the best possible cloud platform for developers is 10 companies that have built a very special version of infrastructure, that makes developers more powerful by itself… And then obviously, developers would just use those 10 to 50 things together. Like, why would they use my object storage when they could use Tigris? Why would they use my Postgres when they could use Supabase? Why would they use my GPUs when they could use Replicate, for example? And I think it’s like – I don’t know, it’s one of those things that I could still rationalize it. It seems like a thing I’d really enjoy, but there’s actually huge structural problems with it, which is what people tend to want when they launch an app, is actually a really consistent UX, that solves a higher order problem than they can solve by themselves. So a PaaS like Heroku – Postgres isn’t a product. It’s actually part of the product. It’s a feature of the PaaS. And so you can do cool things like do PR reviews with your existing Postgres data, for example. And so there’s a UX issue here, where you can’t actually solve problems as well with 10 to 50 different companies as you could if you were just doing it all yourself. And there’s weird compliance issues…

One of the things about getting a HIPAA BAA, so you can do a healthcare app, is you actually end up having to sign with each of those 10 companies. You can’t just do one HIPAA BAA with us… Which I think is a real burden for developers. I don’t think they wanna do – even if you can unify [unintelligible 00:26:52.14] I don’t think they wanna do multiple contracts with companies, you know? It just creates more and more friction.

So there are actual practical issues with like a Rebel Alliance cloud. But also, I think that a lot of it is just politics. There’s just very few companies who have a low enough ego to give up a big chunk of potential revenue like that. Us saying “We’re not gonna take the Postgres revenue” is pretty big, because EC2 – I mean, most of AWS’es profits come from RDS. That’s like a huge market, that we just said “Hey, we’re not gonna have this. You can have this.” And that’s not a thing most companies would be saying. In some ways, we needed a company to come back and be like “Fine, then we’re gonna give up the compute revenue”, you know? And that was actually relatively rare, to find people who were that… Communist? I don’t know. [laughs]

Marc Boorshtein: Exactly. But in that particular instance, I was like “Look, you can either hand everybody their own username or password, or you’ve got to get an exception to this rule.” That was the one instance where security won out. But Autumn, to your point about security versus compliance, why is this a thing - because a lot of the compliance rules aren’t written with our integration ideas of today in mind. They’re written on a very narrowly-focused. But when you look at it from a broader picture, it’s like “Well, that’s not going to work.”

And so that’s been a big part of our fight, when we work with the Feds especially… We had one federal agency - that’ll go unnamed - that they were originally going to integrate us as an identity provider to make it easier for the localities to access their systems. So we have federal users that access locality systems. But because we already have all the localities integrated, this one group wanted to go the other way. And they’re like “Are you guys level four certified?” “No, not at all.” The cost to do that is through the roof. And they’re like “Yeah, no, we’re not going to do it. We’re just going to hand out usernames and passwords.” And it’s like, “But there’s no MFA there.” “Yeah, but your compliance is going to be too much of a pain for us to deal with, so we would just rather do it with usernames and passwords.” And we’re just like “Really? This is what you want?” They’re like “Yeah.” “Okay…” So it happens all the time, and it’s painful to watch.

Break: [00:27:22.17]

Carl George: Sometimes the RHEL maintainers will say “Yeah, we also have customer pressure to get it in these older minor versions”, and then they can do that part internally. But then the after effects is it’s still all open source, it’s still all published, all compliance with all the licenses. Once you have RHEL, you have access to the source for every package, even the ones with licenses that don’t require it, like MIT or BSD license. So it’s fully open source, top to bottom.

Adam Jacob: Yeah. I mean, look, if you don’t, then you don’t. What are you going to do? But it was the same thing as when people were like “Well, I can’t put an agent on anywhere, and I want configuration management. What can I do?” And I’m like “You can’t.” And they were like “Well, what if I used Ansible?” and I’m like “How many things do you have?” And they’re like “700,000.” And I’m like “You still can’t.” Welcome to agents, you know? But it doesn’t matter what you say to me; agents are your answer, and you’re just going to have to cope. And what’s cool about it is - think about that question you just asked. I have this SOAP API I need to use in order to automate my application. Or to deal with my infrastructure. Because it updates the CMDB that we built in 1998, that has all the data in it, and we use it for compliance, and it’s the only way anything could work. Imagine trying to wrap your Terraform or your Pulumi so that it writes to that SOAP API, and keeps it in – just no.

Alya Abbott: Yeah, I’m not so sure, because we do provide different ways to export your data, including like compliance exports, or you can just export it and – I don’t know. Okay, okay.

Simon Wijckmans: Yeah. I mean, if there’s an npm version available of the open source package you’re importing, that’s always my personal choice. I would prefer using that over a third-party script that’s client-side fetched. The great thing is that you can use a tool like Socket by Feross, who I’m sure has been on this podcast at some point… Those kinds of tools are really good at what they do, because they have the added benefit that they actually work off a registry. And the registry is static, unless if it’s an install script, of course; if it actually fetches a script through that. But when the script is static, those tools can do an incredibly good job at making sure nothing bad happens. So that is something you can do to reduce the attack surface.

So I’d say - yeah, it’s like a step plan. Go through the scripts you want to use, make sure that you add the ones that are more technical inherent companies than others. If you can self-host them, self-host them. If any of those third-party scripts actually have an npm version, then use the npm version. Use a tool to protect that. If any of the scripts are really dynamic and must be dynamic, add them, make sure to check them, make sure to keep an eye on domain ownership, make sure that those companies have a certain level of compliance in place… Those are things you can do.

And by the way, this is another fun, little segue… As a security company, of course, we care about our own compliance, and we’re going through all of these things, but you’d be surprised how many third-party scripts are out there that are by companies that aren’t even SOC2 Type 1 compliant. And they are still present on very big companies’ websites, very sensitive data handling companies’ websites as well. So yes, this is a real problem. Check the compliance of the third-party scripts you add. That’s another thing you can do.

Autumn Nash: Compliance is so important.

Jerod Santo: Right. Yeah, that’s how you can become a hero inside your organization, is when that hammer drops and all of a sudden everyone’s like “Oh no, we need to be in compliance with this stuff.” You’re like “Hey, we’ve already been doing our due diligence all along, so you’re good to go.” Do you have any idea of the form of that, the actual nitty-gritty of like what it will mean, what you’ll have to provide, what you’ll have to do and what the consequences are going to be? Or is it too early for that kind of stuff?

Adam Jacob: Yeah, it was nuts, right? And it was really condensed. And the Ruby-based Chef server just couldn’t do it, and I remember going to Facebook with the Erlang Chef server on a USB key that had a little – whatever, it was like a little bear’s head on the end of it. And I brought it to Facebook, and we installed it and ran it, and we thought that it didn’t work at all, because the load was flat, and there was no utilization, and then everything finished and it was fine. So the Erlang just literally ate all the load and just didn’t care [unintelligible 01:09:43.18] It was incredible. The first time that we’d used it outside the lab, it was truly incredible.

So we were like “Hey, if you want the good one, pay us for the good one.” And then it becomes hard to maintain both, so then you’re like “Well, maybe we should just open-source the good one too, but then we’ll hold back some features. Maybe it’ll be security features.” Then maybe it’ll be – well, and then what we actually should do is… Like, you can’t hold back basic security. That makes you kind of a jerk. So maybe we’ll build like a dashboard, a better web UI, we’ll monetize that… Maybe it’s security and compliance, we’ll do that, we made some acquisitions, brought in the [unintelligible 01:10:19.12] folks… That was great. They were awesome. Their code was incredible. They helped. We tried every variation of open core possible, and then in the end switched to a model that looked like Red Hat’s, which was the most efficient by a dramatic margin.

Abubakar Siddiq Ango: Right from you pushing your code. Scanning. Container scanning. Static application security testing. DAST, Dynamic Application Security Testing. Compliance scannin, license scanning… All the things to ensure that the code you are pushing to your application is safe and secure. And also, if your organization has certain policies, “Oh, this has certain dependencies that you can use, these are certain licenses that you can use”, maybe GDPR, or maybe, “Okay, we use Apache internally”, or we don’t. Those policies can be said. So all those scans can be done on GitLab, to ensure that your application meets every regulation, especially for regulated industries. They have more policies or more things they need to ensure are in place before the application gets to production. So all those can be done on GitLab.

Matti Ranta: And actually, just a point of clarification, this is just gitea.com. So we don’t have any customers of this site. So there’s no paid SLA. There’s a managed SaaS that is offered through a company, that’s gone through the SOC 2 compliance, and has redundancy, has dedicated instances per customer, and it has all that fun reliability. But yeah, gitea.com - even though we don’t have paying customers, it’s part of our reputation not to have downtime. And there’s no failover, nothing… It was cost-effective, but it wasn’t really great, because we did have issues like dealing with denial of service attacks, people just uploading their entire Dropbox, and scooping up all of our space…

Daniel Whitenack: [00:20:14.02] I guess there was a sharp increase in that in this past year that you saw… There’s probably some people out there, as you mentioned, there’s a variety of mixed opinions about this, of whether that actually kind of drives more market share for these closed providers who have already built up some of that market and maybe have some of that influence, and open access, or open source community, that maybe doesn’t have the ability or the willingness to put in a lot of effort into this compliance side.

Was there any thought amongst the group around how not only this would impact – so regulations would come down, and they would be maybe enforced, potentially, in impactful ways, but how that would kind of shape the development of this technology moving forward?

Predrag Gruevski: I actually have some hard data to share on this… So about a year ago, four enterprising college students and I embarked on a journey to figure out how good the state of SemVer compliance is in the Rust ecosystem. Now, Rust - statically compiled language, biased toward systems; you’d expect if anyone is very hardcore about it [unintelligible 00:28:31.06] properly, it should be Rust, right?

Jerod Santo: Well, a good example is EU with Apple, and the way Apple approached their compliance with a lot of the EU regulations was localized to the EU. And of course, I’m in there – as an engineer, I’m in there with the Apple engineers thinking “How fractured is this codebase now?”, where they have very specific and completely different rules based on region. How many if statements are in this codebase that don’t need to be there? They’re just there for regulatory purposes.