Nicola Murino: [00:52:17.22] People are often worried about not real vulnerability. For example, I remember some people asking us to update net HTTP in x/crypto repository. But it was basically unused. So even if that package was vulnerable, that vulnerability is not exploitable in the crypto SSH. It was used only marginally in the package. This is very hard to explain to people, because they run an automatic scanner, and the automatic scanner triggers a vulnerability, and they are alarmed. They want all the vulnerabilities fixed very quickly. But by doing so, there is the risk that we introduce untested features, because we are always on the bleeding edge, or we always use a new package that people haven’t enough time to test, and about regression, and such things.

Gergely Orosz: Because there was a fast-forward for a while, where the whole world was locked down, and digital became a lot more important… But I think a good example that I think of, and I have a bit of insight into, is this company Hopin. Hopin is this video events company; so they do digital events. And they were founded in 2019, so a year before the pandemic. They raised I think like a few million dollars of funding, and then the pandemic started, and right as the pandemic started, they raised a bigger funding, to scale the scene, because it seemed okay; like, digital events will now be a thing, because there’s a lockdown… And they saw huge demand in both 2020 and 2021 for their solution.

I actually organized – you could organize online conferences with their tool. And I actually helped organize a digital conference, I think it was the fall of 2020, or something like that… Because it was lockdown, I didn’t have anything to do, and I was like “Let me do this.” And we looked at vendors, and we chose Hopin in the end; I think we paid like a couple thousand for their license, or whatnot… They had this licensing. And we ran the event, and it was a success, and people liked it… But what I noticed is – and then the company kept raising more money, and at some point they were valued at 7.8 billion, or something; I think that was the peak, as I recall. And this was like two years into the founding of the company.

And then what happened is – well, first of all, just from my personal perspective… I’m not gonna represent all their users, but I just really got burned of digital events. Like, I went to a couple of these digital-only conferences, and after a while I just started hating it. I was doing Zooms all day, every day… So I just didn’t want to go there. And as soon as the world started to open up, I’ve just been to my first proper conference. I love the normal conference format, and I would not – okay, maybe I would jump on to watch a video online, but I don’t think it’s really important.

And then with this company, Hopin, they saw their growth just first stall… And the thing that might save the company is they actually bought a bunch of different companies. They bought StreamYard, which is a streaming company, and they bought a few other video streaming companies… And what I’ve heard from people who work there is their events revenue, their flagship thing is just going down, because it’s really hard to sell right now. People just don’t need a digital-only solution anymore.

And my point is, they’re a bit of an outlier, but they’re a typical pandemic company, where it seemed the whole world would change, a lot of money went into there, and if the whole world would have changed and we would now be doing a digital-only conference, it would make sense, because they would probably be market leaders… But the world has gone back, and I think we’re seeing this backswing a lot of times.

I’ve seen a chart about e commerce adoption, where it spiked, and it did look like it’s jumping up ahead by 5 years or 10 years, but then it came back, and now we’re just on that normal growth. So this growth is back to where it was before, which means that everyone who expected that in 2022 or 2023 you’re gonna have similar growth as 2021 just over-hired, and now they’re all correcting, because – well, because also, don’t forget, there’s a second part here, which is not just the COVID is shrinking, but the interest rates are up, which means it’s a lot more expensive to borrow any sort of money, which a lot of tech companies had been doing… So they can’t borrow money, so they need to rein in their costs if they’re not profitable.

[14:29] And those are just a few things. We’re not going to be able to figure out exactly what’s happening, but the pandemic was – it’s just so strange, because for the rest of the world… Take an industry like hotels, or hospitality, right? You’re kind of working in a hotel, or managing a hotel… The pandemic was terrible, right? You got shut down, you had no revenue, you were trying to survive. For tech, it was the opposite. It was amazing, and it was great that time, because we had more jobs, more money… There were people quitting, because they – people had a lot of options, and it was a great time to be in tech. Now it’s the opposite. If you work in hospitality, things are great. More and more people are traveling; it’s going up. You’re gonna get more – hopefully, you’re gonna be earning more, getting more tips, whatnot. And now in tech it’s the opposite. It’s just not great if you’re in tech.

I mean, it’s not great to see the news… This is impacting people. There’s a question of how many people are really impacted in the sense of not just being laid off, but not finding a job. And I think that’s where we’re gonna see a long tail effect, or like a double down. People who are software engineers, experienced engineers who are being laid off at well-known companies - I think it’s hard. I don’t want to trivialize this. But they will have options to work somewhere. It might not be as great though as their current company in terms of maybe culture, or compensation, or both. But they will have options.

The problem is that all of this will trickle down. We’re now seeing thousands of really competent software engineers being on the market, so startups are really happy, these banks are really happy… I have some friends at Uber, former friends, who… I used to work – one of my first jobs was at JP Morgan, in London, an investment bank… And at the time, I really liked that job, because it was one of my early jobs, and it was a great place to be… But when I got my next job at Skype, I just realized JPMorgan was totally not a tech company. And I was so happy to finally work at a tech company, and I said i would never go back to a place like JPMorgan.

Uber also had a really good engineering culture, in the sense that it was one of the best places I worked at… And now I have some friends and colleagues who work at JPMorgan; and I talk with them and I say, “Dude, why did you kind of take a step down?” And he told me “So here’s the thing… Two things. First of all, it’s just really, really stable. They have super-profits. I get all my compensation in cash. None of that stock going up and down, and mostly down. Second of all, they actually want to create a tech culture, and finally, they can hire the people into this; they have a lot of these greenfield projects where it’s full of – they have ex-Facebook, ex-Google, ex-whatever people, and it’s actually pretty good.”

So I think the world is changing a little bit, and people are realizing that pre-IPO companies, or even any form of companies that give you stock - it has a massive risk. So traditional wisdom the past 10 years was if you are a publicly-traded company, you get like half of your compensation, if you’re a senior engineer or staff engineer, half of your composition in base salary, and the other half in equity, and that’s great, because equity will always go up. Well, equity for some companies has collapsed by let’s say 70% or 80%. And I talked with people who on paper they were earning $500,000 in Silicon Valley, and now it just went down to like 350k or 300k. And they’re saying “What should I do? Should I interview somewhere else? But now there’s fewer jobs… Or should I just stick it out?” There’s no good answer. But the point is, now you’re really seeing those banks - one of the reasons that people are going to these banks is they might pay, let’s say, for a similar skill, maybe they pay 350k or 400k, or less, or more; it doesn’t really matter. But it’s fixed. It just doesn’t move. And the people who I know who have families, and they just want stability, they’re like “You know what - it’s a good trade-off. It’s a rocky time, I’m gonna sit it out here.”

[18:09] And you know what - it’s kind of nice, because now those companies can hire people who would have never considered working there. So we might see the industry transform a little bit from the unsexy companies becoming a bit more sexy, and the sexy companies… Let’s give an example - Coinbase. Coinbase was such a hot company to go on and work for a year ago. They’re doing crypto, and if you’re into that - I’m not that much into it, but again, they’re doing something really interesting in that space, trying to give new financial instruments… And they were paying really, really good. Like, they were giving ridiculous stock packages to people who were accepting it. And now the company is not doing that great, the space is kind of – it’s unclear what the future will be, and their stock is not doing that great… So that company, or some of these hot startups have just gone from being one of the best places to work at, to “Oh, it’s a risky place.” We’ll see if they’ll be able to grow. And I’m not just talking about Coinbase, I’m just talking about the hot companies in 2021.

Evan Weaver: And we were kind of surprised… There were a few other companies that set out to solve this same problem around the same time, in particular Cockroach and Yugabyte. But they also found – a different technology than us, but they also found the market wasn’t really ready for this kind of interface model. But their solution was to fall back and build another SQL database. And that’s fine, I guess; there’s 30 cloud PostgreSQL things you can use, and it’s hard to differentiate among them… But if you can carve out a niche, you can make a business there.

We didn’t wanna replicate those old interfaces; we really wanted to build an interface which was for where the world was headed, where the new stack was being built; for people who were building this dynamic edge and mobile and SPA browser applications…

[48:11] In particular, we fit well with blockchain and crypto stuff. There’s no commitment to SQL in that world. People are looking for the newer, better language, the newer interaction model, and these kinds of things. It’s easy to adopt Fauna if you already use GraphQL in your organization in particular, because we offer a native GraphQL interface.

I think one mistake people sometimes make is they’re like, “Well, how do I migrate my existing Postgres cluster to Fauna?” You can if you really want, but it’s not what we’re really designed to be. We’re designed for new workloads and for augmenting the existing systems. So if you have a big Postgres cluster, whether it’s in the cloud or whatever, leave it alone. That’s okay. If it works, great. But maybe you don’t wanna continue investing in it, you don’t wanna run the risk of altering tables, you don’t wanna deal with provisioning more hardware for new use cases and that kind of thing. Use GraphQL in a federated system, like Apollo, to augment that with Fauna, and put your new data, your new applications, your new product features in the new stack, and let the old stuff alone. That’s more the Fauna model.

Perry Mitchell: Super-good question. That also relates strongly to the mobile application, which is built in React Native. It’s very much related to this topic, so… I think that, yeah – would we build them native if we had the had the resources in mobile? Absolutely, yes. I’m done with React Native. It’s a beautiful system to get off the ground, it’s a lot of fun to work with in the beginning, but to maintain over the long-term it’s been a huge pain in our neck, especially with crypto… And I’ll get to that later.

In terms of Electron - Electron has treated those really well, and it’s been very enjoyable, but I think that if we had the development resources, I think that we would definitely strongly consider building native, obviously, to reduce security risk… And also to reduce package size, because right now our installer is around 55 MB. It’s gigantic for what it does, and obviously that’s because you’re packaging a whole web browser and Node.js with it, so… If you could get rid of that issue there, you’d end up with a faster, smaller, more secure application… But obviously, that involves a lot more work than we’re capable of putting in right now, before we actually get funding and be able to work in this full-time.

Kelsey Hightower: So one thing I have to realize is that I think a lot of times when people get money, they believe that they’re smarter than other people that don’t have money. So they think that their ideas should rise at the top. They’re obviously right about something, because their bank account reflects just how right they are. That’s the mistake. To me, I know that I’m lucky, and a lot of things could have went in multiple directions, and it doesn’t end up with this particular number. And so one thing I’ve challenged myself for the last maybe 20 years, “Who am I, and why do I believe what I believe?” That’s it. Sometimes I believe things because I didn’t have time to research them, so I had to just take them at face value, they were taught to me, I didn’t have time to challenge them, so I took them.

So these days, when I look at it, I try to humble myself, and be like “Kelsey, do not fall into the lifestyle inflation. Do not over-index on showing people what you have. It is okay if people don’t think you’re in the top X percentage of anything.” Remind myself that “Yes, you could buy it, but you don’t need to. What’s caused you to want to do that kind of thing?” And that helps me avoid the conspiracy. For example, if you say “I need more money”, you will be really mad that you pay taxes, because people are taking away the very thing you want. I don’t mind paying for the bridges, the highways, the medical stuff…

[01:02:05.01] Do I like the waste? Absolutely not. I’ve seen waste in enterprise, so I’m not surprised that there’s waste in government. So I don’t over-index in that, because I also know that people are hard to be very good 24 hours a day forever. It’s not happening, folks. So I’m a pragmatist when it comes to that stuff.

But the conspiracy theories - whenever one pops into my mind, I say “Kelsey, it’s time to do some research here. Before you start running your mouth, before you go on Twitter just saying random stuff…” For example, when I wanted to understand inflation, I had to go read The Monster on Jekyll Island, how the Federal Reserve was formed… Buy some, Treasuries actually buy Treasuries from Treasury Direct, look at the interest rates, look at the curve… Why do people start feeling a certain way when it goes up, start feeling a certain way when it goes down? Who buys them, who doesn’t? How big is the Treasury market versus the stock market? Treasury market’s dramatically bigger. Why is that?

So these are the types of things that I go into to just try to resolve the conspiracy components with actual facts. And then I just talk to people. “Hey, explain to me how this works, please, because I don’t know.” And then people give me insight, give me something I don’t know, they close the knowledge gap. And then I’ll test. So if I’m really afraid of something, I’ll test it. When the whole crypto movement was going, I was so afraid, because I saw [unintelligible 01:03:25.25] It doesn’t matter if things are logically correct or not. It don’t matter. If the world decides that we should all jump off our roofs, with no helmets, then just people start doing it. It’s like “Oh, what are we doing?”

Nader Dabit: Yeah, no magic feeling… And again, how fortunate was I to even be able to say something like that, right? So I recognized all that stuff. But I was looking for something, the next thing to excite me. I’d been speculating as an investor in crypto since like 2015, so buying and selling Bitcoin back in the day, and then other things more recently… And one of the ones that I looked into was something called the Graph Protocol. And it was the first time I kind of looked past the token as an investment and tried to understand why it was there and why people were buying it and using it… And when I started kind of looking into that project, the first thing I realized was that they were using GraphQL, and that was kind of like a big part of it… And that was really the first big eye-opening moment for me as a developer, when I started realizing that these tokens and these crypto-economic protocols were actually there for something other than speculation… Because honestly, at that point, even 6-7 months ago, I didn’t understand how smart contracts work. I didn’t understand anything past just buying and selling.

[08:12] So I started diving into why they use GraphQL, and that kind of took me down what a lot of people call this rabbit hole of the entire ecosystem, and Web3, and all of the people, all of the communities, all of the projects and all of the stuff happening. Conferences, all types of stuff. And I became really, really fascinated, and I became really excited, and I wanted to continue doing research. I started reading and I started buying books, and really getting – I couldn’t stop thinking about it. It was one of those things, like “Oh, this is freaking cool.” The reason that these things have become popular isn’t just because it’s like another currency, but there’s actually other stuff… And when you start peeling back the layers and seeing all this stuff, it really spoke to me as an engineer, because the problems that they were solving and the stuff that they were doing seemed so much more fun and interesting than anything I’d worked on really in my career, ever.

So yeah, at that point I did start considering “What if I wanted to make a move in this industry?”, but it wasn’t really anything I took too seriously, because of a bunch of different reasons… One of those being it just seemed so risky to me to turn down a half a million dollar type of opportunity that I had on the table to maybe join an industry that I knew nothing about; and I had zero experience… Like, why would anyone hire me anyway? And if I did, would I be successful? That’s kind of where I was maybe a couple of weeks before I ultimately tried to get into the role I’m in now. So that’s hopefully an overview of how I decided to even consider this area.

Aaron Hnatiw: I think the point that you bring up about having the basics covered is really important. It is intimidating to think about all of the things you need to think about to be an expert in security, to know what different kind of vulnerabilities there are out there… And I’m gonna let you know a little secret - no matter how much you catch, there’s always gonna be something there. I don’t think it’s possible to have code that is completely secure, unless it’s maybe one line, developed in isolation, and has no callouts and no inputs. It’s almost impossible. I don’t think you can necessarily lose sleep over that. You have to look at it from the basics perspective, and then from there, I think what a good security person will do is understand – because the way to make something the most secure is to make it not functional at all. You have to have a tradeoff.

A good security person will look at something and understand the business risks and understand really what it’s trying to do, and find the best way to put the most security measures in place. But some of the basics – I mean, I can go over some of the basics you should probably know, as a reference, to cover the basics.

I think three main things stand out that you can easily do and keep in mind when you’re developing something, and then you’re covering a substantial amount of vulnerabilities. The first one is the patch. Just make sure your libraries are up to date as much as possible, especially if there’s a security vulnerability. So just be aware that the latest one is probably going to be the best for that. It’s not always possible to keep things up to date, I understand that. In an environment where you have so many dependencies, sometimes upgrading is not an option. From there, there’s other mitigations you can put in place - put something in front of it, or try to learn what the exact vulnerabilities are and find out the ways of mitigating it. So patching and keeping things up to date is probably one of the most important things and one of the easiest wins you can have. That applies to operating systems as well, and applications and libraries.

The second thing - and probably the most important thing - is input validation. Understanding that the input that you’re getting from a user is what you think it is, and checking that on the server, rather than on the client. Because client-side control can be bypassed very easily.

[28:01] In a browser, if you use a proxy like Burp or ZAP you can intercept the request, change the data after it’s left the browser, and then send it on and it completely by-passes any kind of client-side input validation. So checking that the information that you’re getting is what you think it is, and not some malformed input like a super long string to get a buffer overflow, or negative numbers when you don’t expect negative numbers, or special characters that you don’t expect… The best way to do that is to use a whitelist over a blacklist.

The difference between a whitelist and a blacklist means – a whitelist is looking for a set number of things that are allowed, whereas a blacklist is looking for a set number of things that are not allowed. The number of inputs that can be allowed through is significantly less when you use a whitelist, so you are much more aware and you’re much more in control about the data that comes through, as opposed to with the blacklist… Where there may be a ton of things that you haven’t even thought of that could come through and could get around your validation.

So input validation is probably the most important, because really any vulnerability, any exploit comes from user input. If you can control that, if you can find some way of mitigating that, you could probably reduce at least 50% of the vulnerabilities that you may have in place, which is huge.

The third one is output encoding, and this is more of a preventative measure. When you’re outputting data onto a web application, for example, if you encode it with HTML encoding, for example, by doing that you will then reduce the likelihood of something like cross-site scripting, which is essentially when an attacker can get JavaScript to run in a client browser through input they provided. So if you can encode those characters, then it won’t look like JavaScript and it won’t execute like JavaScript, it will just look like a string of gibberish, almost.

So doing patching, input validation and output encoding are three of the biggest things. There’s a few other things that I can just briefly mention, in case you’re taking notes and you want some more depth… One is hardcoded credentials in API keys. I think probably like four months ago it showed up on Hacker News that you could just do a search for password in Git pushes - you search that and you find thousands and thousands of Git commits that had a password in it, or had someone mentioning a password, or taking a password out of their application. So having those hardcoded credentials, especially in open source software, is trivial to find, and then someone could take that easily; they don’t have to have any skills, and they could just access your machine. So making sure you have a safe way of passing up strings and secure information and secrets to an application is important.

Then two other key things is authentication and authorization, so making sure that people are doing the things that they should be doing, and they’re allowed to do that and they’re gated from doing things they shouldn’t be doing. Then the last key point is encrypting data arrested in transit; making sure that you’re using a TLS over the web, you’re implementing a security certificate. Letsencrypt makes it super easy to do that now. And then encrypting it at REST, so using proven crypto, like AES or Bcrypt for hashing - just some examples.

I know that was a lot to take in, and I’m sure that a lot of people are probably gonna go back and review over that… But if you can just cover those things, just keep those in mind as you’re developing, I guarantee you’ll reduce at least 90% of the vulnerabilities that can be introduced in your application just from those things alone.

Anthony Eden: Cryptocurrency has become normalized now, right? Crypto is normal.

Anurag Goel: Exactly. Anyway, slight tangent… So yeah, so not having any of those emails, and having a work email makes sense. But we also have a lot of people using Render for specific things while working at large companies. We have people who have signed up with Meta.com, and we have Alibaba.com, and all these other… Even Amazon and Google… These are paying customers. People have signed up with their work email, who are not actually running a large thing from Google or Amazon on Render. It doesn’t make sense to do that. But they’re using – so these might be like data scientists, who want to run something in Python and they just can’t get the support they need from their DevOps teams. And this is very common in large companies, where you have enterprises where their main application is handled by the DevOps team, but then people want to build other things, whether it’s data scientists, or sales engineers… Even marketing engineers, they want to do stuff that they want to put out in the world, they want it to have a URL that other people can access, and they just don’t get the support that they need from DevOps, because DevOps couldn’t be bothered, and they’re a bottleneck, because they have all these other needs that they need to fulfill from the main application. So we get a lot of people like that.

But fundamentally, the people who we’re most excited about today are early-stage startups, because Render is a great fit for them. When you’re a startup, you want to move fast, and you want reliability, and Render gives you both of those things.

And then the second sort of serious customer segment is what we call tech-enabled businesses. So tech-enabled businesses are those where the core competency isn’t actually software. What they’re doing is something like they’re building a mortgage CRM, or they’re a law firm and they need technology to achieve a specific goal. Or they are in some cases also like a crypto company that needs something specific, and they need to host it online. But they’re not in the business of hiring DevOps engineers. They might not even be able to hire DevOps engineers. And so they are very, very happy with what Render and products like Render provide.

And then I think we’re increasingly seeing what I was talking about earlier, where there are these teams within larger companies that end up using Render because it gives them the same speed of iteration, velocity. We also just launched things like SSO, and SCIM…

Acon: One of the plushies there sold for 102 bottle caps, which is crazy. But yeah. And then after that, the value of bottle caps just massively dropped, and nobody cared about it. But… It’s kind of crypto, when you think about it…