1 00:00:00,000 --> 00:00:03,020 Well, we were at sales kickoff last week. 2 00:00:03,100 --> 00:00:03,540 I'm sorry. 3 00:00:03,760 --> 00:00:04,100 I'm sorry. 4 00:00:04,260 --> 00:00:05,300 Field kickoff. 5 00:00:05,740 --> 00:00:06,060 FKO. 6 00:00:07,740 --> 00:00:09,300 And that was pretty fun. 7 00:00:09,520 --> 00:00:11,060 You gave a nice talk there, Richard. 8 00:00:12,940 --> 00:00:16,740 You mastered the art of the gigantic picture on one slide. 9 00:00:19,920 --> 00:00:24,420 Yeah, I tried not to go with the scary thing like a clown or something that would really mess people up. 10 00:00:24,440 --> 00:00:26,040 Although we did see clowns later in the week. 11 00:00:26,400 --> 00:00:26,940 Clowns in the woods. 12 00:00:27,040 --> 00:00:29,020 Yeah, we had a good crowd there. 13 00:00:29,160 --> 00:00:35,480 It's crazy to see how many folks are here at Pivotal and how fast we've grown over even these last few months from a sales perspective. 14 00:00:35,580 --> 00:00:37,040 It was nice to see you in person as well. 15 00:00:37,120 --> 00:00:38,700 We don't just have our digital experiences. 16 00:00:38,700 --> 00:00:39,380 That's right. 17 00:00:39,520 --> 00:00:40,700 Not just our digital experiences. 18 00:00:41,620 --> 00:00:42,220 I like that. 19 00:00:42,540 --> 00:00:47,720 Well, why don't you introduce yourself briefly, guest, before I regale the audience with more nonsense from my head? 20 00:00:50,720 --> 00:00:52,720 Hey, I'm Molly Crowther. 21 00:00:52,960 --> 00:00:55,620 I'm a senior technical program manager at Pivotal. 22 00:00:55,960 --> 00:00:58,800 I work mostly on security for Cloud Foundry. 23 00:00:59,900 --> 00:01:00,340 Fantastic. 24 00:01:00,800 --> 00:01:03,160 So here's what I wanted to ask you, Richard. 25 00:01:03,560 --> 00:01:07,460 Now, when you have the giant pictures in your presentation, I have found the following. 26 00:01:07,580 --> 00:01:10,040 And maybe you too, Molly, have had this problem. 27 00:01:10,160 --> 00:01:11,920 It's like, so you got a big picture. 28 00:01:12,040 --> 00:01:14,140 And the colors in the picture change. 29 00:01:14,560 --> 00:01:17,180 And then often they conflict with the text you want to use. 30 00:01:17,540 --> 00:01:21,420 And, you know, you can do the thing where, like, where, like, you got, like, a solid background. 31 00:01:21,640 --> 00:01:22,920 So you got that going on. 32 00:01:22,920 --> 00:01:26,420 Or maybe you can do, like, the thing where you mess with the transparency of it. 33 00:01:26,660 --> 00:01:28,060 Or, like, I don't even know. 34 00:01:28,120 --> 00:01:31,140 But, like, what is y'all's solution for the giant picture? 35 00:01:31,460 --> 00:01:32,980 And then you need to put a title on there. 36 00:01:33,180 --> 00:01:35,820 And then you can have it actually, like, be readable. 37 00:01:37,840 --> 00:01:39,720 Yeah, these are first world problems, aren't they? 38 00:01:40,200 --> 00:01:46,740 I either go, you know, it's tough to find pictures that always have, like, that one light area where you can put dark text on it. 39 00:01:46,780 --> 00:01:47,620 That's way too convenient. 40 00:01:48,180 --> 00:01:55,360 So I usually do end up, as you said, either I put, like, you know, dark box on top of it with a transparency and then put text on that. 41 00:01:55,580 --> 00:01:59,040 Or do, like, a black bar across the whole thing and put the text on that. 42 00:01:59,040 --> 00:02:07,360 So, yeah, there's just nothing worse than getting those slides up on the screen and everything's completely unreadable as you put, like, green text on a, you know, green background. 43 00:02:08,000 --> 00:02:10,080 So try to be considerate to the speaker. 44 00:02:10,220 --> 00:02:11,300 You seem to do the same. 45 00:02:11,340 --> 00:02:14,640 When I see your talks, sometimes you use pictures and the like. 46 00:02:15,440 --> 00:02:17,820 And, yeah, it seems like you use a mix of things, no? 47 00:02:18,120 --> 00:02:18,660 Yeah, yeah. 48 00:02:18,660 --> 00:02:20,420 I'm always very unsatisfied with it. 49 00:02:20,640 --> 00:02:20,920 I don't know. 50 00:02:21,200 --> 00:02:24,000 So, Molly, I've seen several of your presentations now. 51 00:02:24,140 --> 00:02:25,000 And by several, I mean two. 52 00:02:25,000 --> 00:02:29,520 I actually did some preparation for this episode, which is just to blow Richard's mind. 53 00:02:29,720 --> 00:02:30,000 Oh, great. 54 00:02:30,320 --> 00:02:31,720 But thank you. 55 00:02:32,680 --> 00:02:38,740 But would you ever be so bold as to only have a picture on a slide? 56 00:02:39,120 --> 00:02:41,760 Like, is that something you would go for and trust that it works out? 57 00:02:42,040 --> 00:02:42,520 Yeah, yeah? 58 00:02:42,660 --> 00:02:42,900 Yeah. 59 00:02:43,220 --> 00:02:48,660 So what would be your criteria, your sort of setup for, were you like, I'm going just picture, no text? 60 00:02:50,620 --> 00:02:56,880 I mean, I use emoji a lot, like, to copy Ansi and Justin Smith a bit. 61 00:02:57,640 --> 00:03:00,840 So just, like, one emoji that you can transition into another. 62 00:03:01,620 --> 00:03:05,840 I think I've used my dog as a single picture on a slide. 63 00:03:06,780 --> 00:03:13,680 So, yeah, it just depends on whether it can convey all of the subtlety that I need it to. 64 00:03:14,060 --> 00:03:14,820 Yeah, yeah. 65 00:03:15,160 --> 00:03:16,140 Maybe I should try that. 66 00:03:16,540 --> 00:03:18,600 I think I've only used a big picture like that once. 67 00:03:18,600 --> 00:03:25,520 Yeah, I mean, Molly, even with that style, too, not, like, my slide with four words on it is any better. 68 00:03:25,620 --> 00:03:28,700 But we've really transitioned to this, like, there's no crutches anymore. 69 00:03:28,860 --> 00:03:33,620 You can't just sit there with your nine bullets and read things and prepare, like, an hour before. 70 00:03:33,800 --> 00:03:37,840 Like, now, like, I practiced a lot for my keynote last week because I had no notes. 71 00:03:37,900 --> 00:03:39,140 Like, I had no words on the slide. 72 00:03:39,220 --> 00:03:41,260 I couldn't just stare at a screen deer in a headlight. 73 00:03:41,380 --> 00:03:45,360 So do you find the same thing when you did, like, your SpringOne talk, which was a lot of emojis and pictures? 74 00:03:45,840 --> 00:03:51,220 Was that just a ton of prep, or did you just feel like you had a good flow and you had two or three notes in the, you know, in the slide notes? 75 00:03:51,660 --> 00:04:01,740 I actually did exactly what you said that we can't do, which is I wrote out a whole bunch of prose, like, an hour before, but just used it in the notes instead of on the slide. 76 00:04:02,660 --> 00:04:03,340 It would be magic. 77 00:04:03,600 --> 00:04:04,100 There you go. 78 00:04:04,100 --> 00:04:10,260 I used to find that really helpful that I would write, like, a little essay before a presentation, and then it would kind of, like, stick in my mind. 79 00:04:10,980 --> 00:04:12,360 I guess I do that every now and then. 80 00:04:12,420 --> 00:04:24,100 I mean, I think, you know, I mean, one of the difficulties I have is another technique I've seen people use, and our buddy Andrew Clay Schaefer does this a lot, 81 00:04:24,180 --> 00:04:29,580 is you have, like, the single word or sentence on a slide, and you sort of, like, flip through it. 82 00:04:29,600 --> 00:04:42,500 But I figure, I think that would either just be reading the sentence, or, like, you would need an awesome amount of, ironically, for the format preparation to know that, like, what is the next sentence going to be. 83 00:04:42,500 --> 00:04:52,100 Because I find my problem is, like, I'll be on a slide, and then, as they say, I'll speak to the next three slides, and then I switch to them, and I'm always like, oh, I already covered that. 84 00:04:55,340 --> 00:04:56,220 Yeah, I know. 85 00:04:56,260 --> 00:04:56,720 It's tricky. 86 00:04:56,840 --> 00:05:03,580 I mean, last week, I knew the three points I wanted to say on each slide and just tried to make sure I memorized it and then forgot two of the three on at least half the slide. 87 00:05:03,660 --> 00:05:04,240 So it was perfect. 88 00:05:04,420 --> 00:05:04,760 That's right. 89 00:05:04,760 --> 00:05:09,900 Well, you had, you know, you had my favorite point in all presentations, which is Richard needs a raise. 90 00:05:10,340 --> 00:05:12,480 I think that was very, very thoroughly delivered. 91 00:05:12,880 --> 00:05:13,180 That was good. 92 00:05:13,180 --> 00:05:14,080 That is the only thing. 93 00:05:14,620 --> 00:05:16,560 The only thing everyone came up and asked. 94 00:05:16,620 --> 00:05:24,220 Like, nobody remembered the other nine and a half minutes of the slide except the one stupid joke slide about Richard needs a raise I had on the screen for 10 seconds. 95 00:05:24,420 --> 00:05:26,080 Like, that's the only thing anyone brought up. 96 00:05:26,220 --> 00:05:28,900 See, another successful marketing feat. 97 00:05:28,900 --> 00:05:36,760 You identified the most important stakeholder and prioritized their backlog, and everything else, just, you know, the other personas can wait in line. 98 00:05:37,260 --> 00:05:38,240 But that's good. 99 00:05:38,520 --> 00:05:39,280 The message got through. 100 00:05:40,160 --> 00:05:42,100 It's a subtle campaign of persuasion. 101 00:05:42,460 --> 00:05:43,700 Step one completed. 102 00:05:43,920 --> 00:05:50,280 So we have a few little news items, and we'll come back, or, you know, we'll talk with Molly about those presentations and more. 103 00:05:50,720 --> 00:06:05,880 But one of them, speaking of keynote-y things, somehow you dug up a fun – I like the format of this article because it uses, like, just sort of like this in-passing comment from Microsoft's Scott Guthrie, the red polo guy. 104 00:06:06,400 --> 00:06:14,260 And he's basically like, yeah, you know, in Azure, people are using blockchain, but it's – he doesn't say nothing burger, but it's basically a nothing burger. 105 00:06:14,620 --> 00:06:20,280 And then, boom, there's a whole rest of the article that someone builds stuff around, as I'm sure, like yourself, Richard. 106 00:06:20,440 --> 00:06:27,660 I appreciate the art of, holy crap, I was supposed to email my editor something in three hours, and I have nothing. 107 00:06:27,860 --> 00:06:36,840 So that's a good dressing up the nothing burger in a full-on burger, I think, including, like, some goat cheese and caramelized onions, maybe. 108 00:06:37,020 --> 00:06:58,460 But I thought it was a fun article in the sense of, like, it is worth pointing out that, like, yeah, you got whatever a Bitcoin is, and all of this theoretic awesomeness of what you could do with the, I don't know, not only distributed nature of, but sort of like this public record of promises that people made or things that they said that are verified with each other. 109 00:06:58,460 --> 00:07:07,580 But thus far, there doesn't seem to be a lot of actual uses of it, aside from, you know, making 50 cent and Kim.com rich and things like that. 110 00:07:08,900 --> 00:07:13,140 Yeah, I mean, I included it in the news this week because I think it was – I mean, you pointed it out well. 111 00:07:13,240 --> 00:07:18,180 I just – we get really excited about stuff, and, like, what moves the needle for public cloud? 112 00:07:18,260 --> 00:07:26,960 I would still bet you that if we looked at Amazon, we looked at Microsoft and others, they're making the vast majority of their money still on just compute, like IaaS. 113 00:07:26,960 --> 00:07:30,840 And, yes, I mean, they have great growth in the databases and great growth in these other things. 114 00:07:30,940 --> 00:07:40,080 We get excited about Lambda or functions and blockchain, and, I mean, I would just be shocked if it was any more than a half percent of their actual revenue, if that. 115 00:07:40,460 --> 00:07:47,560 So just I think those reminders, we get excited, but the bread and butter for every cloud provider is probably scarily their commodity stuff, which is infrastructure. 116 00:07:48,260 --> 00:07:49,960 Yeah, yeah, it's kind of – yeah. 117 00:07:50,240 --> 00:07:55,140 Well, you know, we don't often get a – we're not lucky enough to have a security perspective all the time. 118 00:07:55,140 --> 00:07:58,640 What do the people in the security world make of all that blockchain stuff, Molly? 119 00:07:58,860 --> 00:08:00,560 Like, it seems like – I don't know. 120 00:08:00,600 --> 00:08:04,080 It seems like you all would be like, yeah, we got fingerprints and PGP stuff. 121 00:08:04,140 --> 00:08:05,140 I don't know what your problem is. 122 00:08:05,180 --> 00:08:06,140 Although maybe – I don't know. 123 00:08:06,260 --> 00:08:10,360 Maybe it's, like, some revolutionary awesomeness that you could do something with. 124 00:08:11,020 --> 00:08:15,800 I think a lot of people are pretty skeptical. 125 00:08:16,340 --> 00:08:29,300 I mean, if you think about all the stuff that's been going on with, like, cryptocurrencies in the last couple weeks, like, the bubbles and the bursts and the – everybody just trying to make money from literally nothing at all. 126 00:08:29,300 --> 00:08:39,520 So, I haven't figured out yet how blockchain is actually going to help the vast majority of people other than, you know, maybe in some of the financial tech spaces. 127 00:08:41,500 --> 00:08:41,980 Yeah. 128 00:08:42,200 --> 00:08:42,380 Yeah. 129 00:08:42,440 --> 00:08:47,560 You know, all that weird tulip mania kind of puts a – did you say a pal? 130 00:08:47,700 --> 00:08:52,180 It puts a bad shadow over all of it, which is weird. 131 00:08:52,440 --> 00:08:53,140 That stuff's annoying. 132 00:08:53,940 --> 00:08:54,200 Anyhow. 133 00:08:54,320 --> 00:09:04,720 So, then, also, in exciting news, everyone's favorite thing that they've forgotten that they depend on every day, Dropbox, looks like it's going to IPO. 134 00:09:05,720 --> 00:09:15,700 And in that, in those things, like, I think on one of my other podcasts, we'll probably talk about it to, like, horse glue-inducing nausea of beating a horse. 135 00:09:16,200 --> 00:09:23,100 But, like, you know, one, they had, like, a $1.1 billion in revenue, which that's astounding, and lots of users. 136 00:09:23,100 --> 00:09:27,360 But then they also – like, who knew that so many normal people use Dropbox? 137 00:09:27,540 --> 00:09:38,640 I thought it was just a thing, like, nerds use to sync up their Markdown files, but it's apparently a big deal, which I guess you could know by the amount of apps that integrate with it on your phone land. 138 00:09:39,080 --> 00:09:46,800 But, anyways, they also said that they had moved all their infrastructure to their own infrastructure, out of public clouds, I assume. 139 00:09:47,340 --> 00:09:51,960 And then there was similar reports that Apple – the headlines were very deceptive here. 140 00:09:52,740 --> 00:09:55,040 I'm, like, cynical guy on this podcast today. 141 00:09:55,120 --> 00:09:58,820 But the headlines were, like, Apple confirms it uses Google Cloud. 142 00:09:58,880 --> 00:10:01,680 And then you read the article, and it's like – and they also use AWS. 143 00:10:02,200 --> 00:10:05,680 So, you know, I guess good redundancy is nice. 144 00:10:06,340 --> 00:10:11,420 And then I think also Spotify runs on Google Cloud, which makes sense because they compete with Amazon. 145 00:10:11,740 --> 00:10:17,320 So, just like the healthcare industry, retail, music, you wouldn't want to run on AWS. 146 00:10:17,320 --> 00:10:23,820 But, so, Richard, does it matter that Dropbox runs on its own infrastructure? 147 00:10:24,080 --> 00:10:25,880 Does this mean everyone needs to start doing that? 148 00:10:26,980 --> 00:10:31,220 Gosh, it seems like there were two violent hot takes with that news coming out. 149 00:10:31,300 --> 00:10:34,760 First was, like, see, public cloud isn't for everybody. 150 00:10:35,080 --> 00:10:36,560 Like, Dropbox is fine. 151 00:10:36,800 --> 00:10:37,920 They did all their infrastructure. 152 00:10:38,080 --> 00:10:38,820 Maybe you should, too. 153 00:10:39,200 --> 00:10:42,880 And then there's the other violent hot take, which was, they're a complete unicorn. 154 00:10:43,100 --> 00:10:44,980 You're an idiot if you ever do anything on-premises. 155 00:10:45,300 --> 00:10:50,480 So, it's like there's probably, as always, in the middle of – yes, Dropbox, and I think it was mostly storage. 156 00:10:50,700 --> 00:10:52,560 Because, obviously, Dropbox is a storage company. 157 00:10:53,040 --> 00:10:56,020 They got some benefits from their own storage infrastructure. 158 00:10:56,240 --> 00:11:02,720 And, again, there's reasons they want to own what they're putting on here for depreciation purposes or even sovereignty. 159 00:11:02,860 --> 00:11:03,220 Who knows? 160 00:11:03,660 --> 00:11:07,840 So, yes, maybe this is just good for Dropbox and not for everybody else. 161 00:11:07,860 --> 00:11:12,960 But there is still value sometimes in controlling your own destiny, and that's not always a bad move. 162 00:11:12,960 --> 00:11:19,620 And, yes, you might not have the flexibility you get from public cloud, but maybe you like the more predictability you get from owning it yourself. 163 00:11:19,780 --> 00:11:21,660 So, I think there's multiple lessons in there. 164 00:11:21,740 --> 00:11:24,480 Probably none of them are the whiplash-oriented ones. 165 00:11:25,000 --> 00:11:26,820 Yeah, it needs some lukewarm takes. 166 00:11:27,160 --> 00:11:31,180 Leave a glass of water on the kitchen counter all day, and that's the temperature your take should be. 167 00:11:31,660 --> 00:11:36,360 I mean, assuming that you've got good climate control in your house and it's not either really hot or cold. 168 00:11:37,700 --> 00:11:44,360 I was also looking through some of their financials, and they were talking about how they had slashed expenses. 169 00:11:45,440 --> 00:11:52,660 You know, I think, whatever, everyone has a different thing for it, but they slashed administrative expenses by a huge amount. 170 00:11:52,660 --> 00:11:59,300 And I was thinking, like, man, that must have been a rough year for per diems and travel if they had to cinch up their expenses. 171 00:11:59,860 --> 00:12:00,220 Tragic. 172 00:12:00,320 --> 00:12:02,280 A lot of snacks going out the door. 173 00:12:02,420 --> 00:12:02,860 That's right. 174 00:12:03,120 --> 00:12:07,500 So, you know, my heart goes out to the previously pampered staff of Dropbox. 175 00:12:07,620 --> 00:12:12,120 They're not going to have those thick, fluffy, white carpets at their conference booth anymore. 176 00:12:12,780 --> 00:12:14,280 Or, you remember, have you ever seen their booths? 177 00:12:14,520 --> 00:12:18,540 They've got, like, wood paneling, and they've got, like, really clean t-shirts on. 178 00:12:18,540 --> 00:12:21,360 Oh, I don't know if it's mahogany. 179 00:12:21,800 --> 00:12:28,100 I mean, you know, they're no Google or Facebook, but they have really nice booths. 180 00:12:28,160 --> 00:12:35,020 And they would have, like, those fake little square rectangular boxes of fake grass. 181 00:12:35,320 --> 00:12:36,740 It's very calming and nice. 182 00:12:37,320 --> 00:12:40,060 They probably still have a big booth coming up at South by Southwest. 183 00:12:40,780 --> 00:12:41,560 I'll have to check that out. 184 00:12:41,560 --> 00:12:46,740 So, over in y'all's land, we also, like, refreshed our website. 185 00:12:47,200 --> 00:12:50,280 Big industry-shattering news, as I recall. 186 00:12:50,740 --> 00:12:51,920 And it's very nice. 187 00:12:52,040 --> 00:12:56,640 Like, as I was telling someone, I didn't, like, load it ten times to see if it randomly does this or not. 188 00:12:56,680 --> 00:13:04,060 But there's, like, five of our customer stories, I think, like, right off the bat, which is good, I think. 189 00:13:04,900 --> 00:13:05,300 Yeah. 190 00:13:05,680 --> 00:13:09,340 Yeah, we spent some time, I mean, as always, trying to simplify messaging. 191 00:13:09,340 --> 00:13:17,640 Because it gets way too easy with every tech company to end up getting stuck in transformation hell and all these sort of, you know, digital business garbage stuff. 192 00:13:17,820 --> 00:13:19,980 Where you're just, like, what do you actually do? 193 00:13:20,320 --> 00:13:21,380 Like, what do you sell? 194 00:13:21,620 --> 00:13:26,660 And so, all of this is always an effort to get down to, like, hey, Pivotal sells software. 195 00:13:27,080 --> 00:13:29,020 We sell a methodology and, like, practices. 196 00:13:29,480 --> 00:13:33,120 And, hey, the software is a platform you run apps on and a bunch of cool framework-y stuff. 197 00:13:33,340 --> 00:13:33,580 Yeah. 198 00:13:33,760 --> 00:13:34,160 That's true. 199 00:13:34,480 --> 00:13:39,120 Because that's what people are looking for, not a manifesto about how you're transforming everything. 200 00:13:39,340 --> 00:13:40,100 And for everybody. 201 00:13:40,360 --> 00:13:40,520 Yeah. 202 00:13:40,640 --> 00:13:41,680 They want to know what it looks like. 203 00:13:41,720 --> 00:13:42,340 It reminds me. 204 00:13:42,640 --> 00:13:49,380 You ever read that, speaking of the hell of transformation, you ever read that Neil Gaiman short story where this guy, like, all of a sudden pops into this room. 205 00:13:49,380 --> 00:13:54,100 And there's sort of, like, this smooth-skinned demon in there who, like, tortures him for an eternity. 206 00:13:54,680 --> 00:13:59,100 And then he turns into the smooth-skinned demon and tortures another person who comes in. 207 00:13:59,240 --> 00:14:02,020 It's a regular, like, oh, I see what's going on here. 208 00:14:02,400 --> 00:14:05,120 I think that's what a lot of digital transformation marketing is like. 209 00:14:05,320 --> 00:14:08,840 It's just an endless loop with no point unless you enjoy the process. 210 00:14:09,240 --> 00:14:09,500 That's right. 211 00:14:09,640 --> 00:14:10,340 Yeah, that's good. 212 00:14:11,160 --> 00:14:11,900 That's good to know. 213 00:14:12,060 --> 00:14:12,440 That's right. 214 00:14:12,520 --> 00:14:17,780 Next time you need to inspire your staff to come up with some good content, Richard, you can use. 215 00:14:17,880 --> 00:14:19,160 I'll read that story to them. 216 00:14:19,860 --> 00:14:21,760 I need a strong intro for my next white paper. 217 00:14:21,920 --> 00:14:22,600 I think I found it. 218 00:14:23,020 --> 00:14:23,500 That's right. 219 00:14:24,100 --> 00:14:32,820 And then finally, also in Pivotal News, we have, like, a new sort of, like, PCF or Cloud Foundry on your desktop thing coming out. 220 00:14:32,880 --> 00:14:35,940 Now, I haven't gotten a chance to read up on this, but what's the story with it? 221 00:14:36,740 --> 00:14:43,440 Yeah, we've got, you know, if you want to do Cloud Foundry development, your choices are either pushed to public, which is how most public clouds work. 222 00:14:43,480 --> 00:14:45,480 They try to do some local simulators and things. 223 00:14:45,540 --> 00:14:48,460 But a lot of times you end up developing in the public cloud itself. 224 00:14:48,460 --> 00:14:56,600 And Pivotal customers have had, or all customers, have been able to use PCFDev, which is, like, the single virtual machine with all of PCF stuffed in there. 225 00:14:56,700 --> 00:14:57,620 And it's fine. 226 00:14:57,800 --> 00:14:58,580 It runs on your machine. 227 00:14:58,660 --> 00:14:58,960 It's cool. 228 00:14:59,020 --> 00:15:01,660 It has some other dependencies, though, that were a bit of a pain. 229 00:15:01,740 --> 00:15:04,600 So there's been an effort to continue to break things apart. 230 00:15:04,760 --> 00:15:08,820 And so CFDev is super early alpha, but people seem excited about it. 231 00:15:09,040 --> 00:15:14,720 And this just runs kind of native virtualization on your Mac or on your PC and others. 232 00:15:14,840 --> 00:15:17,340 And just brings all the Cloud Foundry components down. 233 00:15:17,340 --> 00:15:21,240 So as a developer, I can just see a push, and it's all just running in containers on my desktop. 234 00:15:21,460 --> 00:15:22,780 And then, hey, things are awesome. 235 00:15:22,880 --> 00:15:24,080 Now let's go push it to public. 236 00:15:24,340 --> 00:15:26,640 So there's going to be a few different tools here. 237 00:15:26,740 --> 00:15:29,200 The CFDev is just open source Cloud Foundry. 238 00:15:29,480 --> 00:15:32,360 We'll do some PCF kind of extensions over time. 239 00:15:33,020 --> 00:15:34,380 So just kind of early stuff. 240 00:15:34,460 --> 00:15:35,300 We're messing around with this. 241 00:15:35,380 --> 00:15:36,720 But I've already played with it. 242 00:15:36,760 --> 00:15:37,360 It works well. 243 00:15:37,660 --> 00:15:39,160 It seems like a bunch of people were excited. 244 00:15:39,320 --> 00:15:46,420 And the whole point is how are we making development a little easier when you are disconnected or you don't want to deal with the latency or dealing with public cloud? 245 00:15:46,420 --> 00:15:52,540 Or even if you don't have an environment yet publicly, your company hasn't set up your Cloud Foundry environment yet, are you frozen? 246 00:15:52,680 --> 00:15:54,620 Or can you actually do some simulation locally? 247 00:15:55,120 --> 00:15:56,460 Well, that sounds useful. 248 00:15:57,220 --> 00:16:02,640 So speaking of usefulness, it's another masterful transition. 249 00:16:03,260 --> 00:16:04,020 Well done. 250 00:16:06,020 --> 00:16:07,560 So security is useful. 251 00:16:08,000 --> 00:16:11,400 And you've given a couple of talks on that recently, right, Molly? 252 00:16:11,660 --> 00:16:19,740 What are those talks that you went over in the sense of how are they representative of what you work on around here? 253 00:16:19,960 --> 00:16:21,620 What do you spend your time doing? 254 00:16:23,220 --> 00:16:31,960 Yeah, so the first talk that I did last year was at Cloud Foundry Summit in Basel, Switzerland, back in October, I think. 255 00:16:32,600 --> 00:16:49,580 And that was mostly about how we do vulnerability management within Cloud Foundry, which is pretty interesting just because as a platform, it allows you to update your operating system images really fast and really easily. 256 00:16:49,920 --> 00:17:04,300 So we had, I think there was a lot of content coming out after Meltdown Inspector talking about how, like, Pivotal Web Services, for instance, updated all of their images in about a day. 257 00:17:05,260 --> 00:17:12,420 Where I'm sure we have, there's other people in the industry who are still struggling to update after Meltdown Inspector. 258 00:17:13,720 --> 00:17:18,120 So that's one of the things that I work on day to day is just vulnerability management for the community. 259 00:17:18,880 --> 00:17:37,400 And then the talk at SpringOne was more about trying to bring healthy security culture into your organization as a whole and the way that we've done that at Cloud Foundry and a couple of different ways that people can try to improve the security culture of their own organizations. 260 00:17:37,880 --> 00:17:52,380 It's interesting going through your stuff and realizing that basically, like, there's sort of, like, all the flashy, high-profile stuff of security of, like, you know, I found this chink in the armor of something and, ooh, a bug and I got a fancy name. 261 00:17:52,520 --> 00:17:58,280 Like, I forget the name of the one that had been in, like, the kernel for, like, 11 months, like some dog or elephant or something. 262 00:17:58,400 --> 00:18:00,380 Or I got a bleeding heart and all this. 263 00:18:00,380 --> 00:18:06,760 And then there's almost, like, the bigger effect that happens is, like, well, now what? 264 00:18:07,120 --> 00:18:13,140 Now we need to, like, have a process of, like, distributing that and notifying it and integrating it into here. 265 00:18:13,240 --> 00:18:21,780 It's almost, like, the difference between, I mean, it's sort of, like, just scouting something out and finding it versus, like, well, now we need to build an entire city over here. 266 00:18:22,300 --> 00:18:35,200 And a lot of what I thought was interesting about what you're going over from that perspective was how do we basically build up that process from not much process? 267 00:18:35,940 --> 00:18:40,620 And how do we track these things and make sure that they're integrated? 268 00:18:40,620 --> 00:19:01,860 And then the part that I thought was really interesting was it turns out it's really hard to get people to apply these patches in the sense that, and I'm kind of reverse engineering that, that, like, in the sense of how much effort y'all put in to notify people they need to update these things, it would seem to indicate that they don't just sort of, like, gleefully do it. 269 00:19:01,860 --> 00:19:10,020 And, in fact, like, it might be easier to get people to, like, update the apps on their phone than to, like, patch the stuff that they need to in production, it would seem like. 270 00:19:10,760 --> 00:19:12,300 I don't know if that's a bad generalization. 271 00:19:14,300 --> 00:19:15,960 No, I think that's definitely true. 272 00:19:16,520 --> 00:19:24,400 And it's just a different philosophy than people have been used to over the past, you know, 30 to 40 years in tech. 273 00:19:25,340 --> 00:19:41,800 And Justin Smith talks about this a lot, but kind of the old way of thinking before people were beginning to be cloud native was, you know, we have our infrastructure, and it needs to stay the same, because we know, you know, what we're getting ourselves into. 274 00:19:41,800 --> 00:19:59,580 And anytime it changes, that's when we're unsafe, where really, once we're getting into the situation where you're in a public cloud, or you're pushing apps all the time, it's better for you if your infrastructure is constantly changing. 275 00:20:00,300 --> 00:20:18,400 So, as, you know, you're tearing down your servers and building them back up with Bosch, and it's really easy to do, like, that's conceivably kicking out anybody who made their way into your network that maybe you won't know about until years later, even. 276 00:20:19,880 --> 00:20:35,740 So, we're definitely running into the situation where customers have long certification cycles, where, you know, we're trying to push updates to them, and they're like, well, we need to understand the security posture of this and everything. 277 00:20:36,160 --> 00:20:44,620 And that takes, you know, can take months, where it's like, we have this, we have the update ready for you, like, you can just take it, you'll be more secure if you just take it. 278 00:20:44,920 --> 00:20:49,320 And all of these certification processes are actually making you less secure in the meantime. 279 00:20:51,240 --> 00:21:16,920 So, you know, along those lines, I mean, I guess technically they're something of a competitor now, but whatever, like, how did, like, all the security community respond to, like, the, before they pivoted to Kubernetes, like, the core OS sort of theory of things, which, correct me if I'm wrong, but if I remember when I talked to Alex a long time ago, their CEO there, he was like, isn't it awesome how Chrome just auto-updates? 280 00:21:16,920 --> 00:21:18,920 And, like, why don't our servers do that? 281 00:21:19,040 --> 00:21:21,820 And then they had a bunch of auto-updating for the servers. 282 00:21:22,060 --> 00:21:24,200 Like, is that cool? 283 00:21:24,520 --> 00:21:31,460 Or is it, like, the worst idea ever that you would have your OSs updating in production without you really knowing about it? 284 00:21:33,180 --> 00:21:34,360 No, I think that's great. 285 00:21:34,540 --> 00:21:37,220 Like, that's exactly where we're trying to get to. 286 00:21:37,740 --> 00:21:38,400 Yeah, yeah. 287 00:21:38,780 --> 00:21:46,900 So, I know, yeah, there's been a lot of work with, like, PCF pipelines in the pivotal space, but also, like, there's been plenty of work. 288 00:21:46,920 --> 00:21:52,040 There's been plenty of talk at Cloud Foundry Summit on doing this in the open source as well. 289 00:21:52,280 --> 00:21:58,560 Like, whenever a new stem cell is available, just pick it up and roll it out as widely as you can. 290 00:21:59,100 --> 00:22:04,680 Because we're doing that kind of smoke testing for you. 291 00:22:05,080 --> 00:22:11,780 And the changes that actually come through, like, with a new stem cell upgrade, for instance, are usually pretty small. 292 00:22:11,940 --> 00:22:13,720 It's just packages getting updated. 293 00:22:14,060 --> 00:22:22,500 So, the more we can get people feeling comfortable in saying, like, I know I'm going to be more secure if I'm constantly updating. 294 00:22:23,260 --> 00:22:24,880 That's where we want our customers to be. 295 00:22:26,260 --> 00:22:26,620 Interesting. 296 00:22:26,780 --> 00:22:31,300 So, one thing you mentioned earlier, Molly, was kind of vulnerabilities in that area that you deal with. 297 00:22:31,400 --> 00:22:34,520 Can you – I don't feel like I'm super smart on how we handle all this. 298 00:22:34,580 --> 00:22:40,940 Could you kind of walk through maybe an incident or a day in the life of, like, where do vulnerabilities get reported from? 299 00:22:41,020 --> 00:22:41,840 Do we discover them? 300 00:22:41,920 --> 00:22:42,760 Do we hear them outside? 301 00:22:43,060 --> 00:22:43,860 What's a CVE? 302 00:22:44,200 --> 00:22:45,860 Do we submit those somewhere? 303 00:22:46,020 --> 00:22:46,940 What does that look like? 304 00:22:46,980 --> 00:22:48,480 How does that make its way into software? 305 00:22:48,640 --> 00:22:55,900 Could you kind of explain what it means to discover, report, and then patch a vulnerability, at least in Pivotal's world? 306 00:22:56,620 --> 00:22:57,220 Yeah, definitely. 307 00:22:57,220 --> 00:23:05,440 So, if we think of vulnerabilities that are discovered, like, within Cloud Foundry rather than within our third-party dependencies, 308 00:23:05,940 --> 00:23:11,300 so, like, something that we're actually responsible for fixing within our own code, 309 00:23:11,920 --> 00:23:24,780 generally, those reports come from either Pivotal customers, other customers that use different distributions of Cloud Foundry, 310 00:23:25,000 --> 00:23:28,040 or kind of trusted partners that we have in the community. 311 00:23:28,700 --> 00:23:33,620 And those generally get reported to us either through – we have two email addresses. 312 00:23:33,900 --> 00:23:40,480 There's security at pivotal.io and security at Cloud Foundry.org that basically end up in the same place. 313 00:23:41,240 --> 00:23:52,220 And we have a security triage team that's a few pairs of engineers in San Francisco paired with a support person from Pivotal. 314 00:23:52,480 --> 00:24:06,040 And they work to first make sure that they can reproduce the issue and that it actually makes sense to start working with the product teams to potentially fix it. 315 00:24:06,600 --> 00:24:18,540 And then they do some coordination with the product teams to make sure that any changes that they make are actually – actually fix the whole issue and don't introduce any other regressions. 316 00:24:19,380 --> 00:24:27,340 Because the security triage team is kind of tasked with understanding the actual security implications of the bug. 317 00:24:28,000 --> 00:24:37,440 And the product teams are fixing it, but also making sure it doesn't impact usability or basically create a breaking change for customers. 318 00:24:38,560 --> 00:24:50,560 And then kind of the next part, once we know that there is a vulnerability, we'll reserve a CVE number, which stands for Common Vulnerabilities and Exposures. 319 00:24:51,040 --> 00:24:56,460 There's like a national database that handles all of the CVE disclosures. 320 00:24:58,100 --> 00:25:03,680 And we'll actually notify the Cloud Foundry Foundation if there's a problem in open source code. 321 00:25:04,240 --> 00:25:11,780 And then some notification goes out to the different companies that have certified distributions of Cloud Foundry. 322 00:25:12,200 --> 00:25:23,440 And then from there, it's like basically just working as quickly as we can to get the bug actually fixed and pushed out to the open source and to CF deployment. 323 00:25:23,440 --> 00:25:28,760 And then to make its way back into, you know, pivotal closed source code as well. 324 00:25:29,860 --> 00:25:30,300 Yeah. 325 00:25:30,560 --> 00:25:32,720 So does everyone use that CVE registry? 326 00:25:32,820 --> 00:25:33,600 It sounds like no. 327 00:25:33,800 --> 00:25:35,420 That obviously gets up to discretion. 328 00:25:35,720 --> 00:25:38,140 So, I mean, how does someone choose to participate in that? 329 00:25:38,180 --> 00:25:39,340 What if they're not using that? 330 00:25:39,380 --> 00:25:42,800 Are they just distributing patches other ways or communicating other ways? 331 00:25:43,100 --> 00:25:45,200 Kind of how did we decide to go in with that? 332 00:25:45,660 --> 00:25:48,000 Yeah, I think it's an industry best practice. 333 00:25:48,000 --> 00:26:00,100 But there definitely are companies that either don't publish their CVEs publicly or they publish them kind of ad hoc to, like, various mailing lists. 334 00:26:00,840 --> 00:26:11,500 We've tried to be really, really good about both publishing our CVEs publicly as soon as possible so that customers know that there's something that they need to pick up. 335 00:26:11,920 --> 00:26:23,620 But also getting that information back to the national database so that other kind of alerting software that's based on that national database will let our customers know that there's a CVE. 336 00:26:24,320 --> 00:26:29,980 So it just kind of closes the feedback loop to make sure that everybody knows that there's something that needs to be fixed. 337 00:26:30,740 --> 00:26:46,840 And that's one of the ways that we've kind of built this culture at Cloud Foundry is that when you find a CVE, we obviously want it to be reported because it's usually in open source code and other people could conceivably find it. 338 00:26:47,520 --> 00:27:00,180 So we want teams, if they find things, to also report them to us, like, within their own product, which they've gotten really good at doing because teams know that they're not going to get in trouble if they find a security issue. 339 00:27:00,600 --> 00:27:04,920 Like, it's going to be another reason to encourage customers to upgrade. 340 00:27:05,600 --> 00:27:12,120 So there's that kind of, like, positive feedback loop when issues actually get reported to us. 341 00:27:12,840 --> 00:27:13,320 It makes sense. 342 00:27:13,460 --> 00:27:15,000 Remind me, how long have you been at Pivotal? 343 00:27:16,520 --> 00:27:18,280 Almost two years. 344 00:27:18,600 --> 00:27:20,600 Two years as of yesterday, actually. 345 00:27:20,700 --> 00:27:20,960 Nice. 346 00:27:21,180 --> 00:27:21,900 Almost like me. 347 00:27:22,020 --> 00:27:30,360 So a question for you is, on one hand, you know, from the outside looking in, someone could say, like, gosh, what are you advertising the fact that you have vulnerabilities? 348 00:27:30,700 --> 00:27:33,180 Isn't that kind of lousy PR that you're bragging about? 349 00:27:33,420 --> 00:27:36,020 Hey, look at all these vulnerabilities we have and that we've patched them. 350 00:27:36,380 --> 00:27:39,980 So, I mean, is there a cultural thing that you ever noticed that we had to get through? 351 00:27:40,040 --> 00:27:41,380 Or was it kind of built in from default? 352 00:27:41,480 --> 00:27:42,560 Like, no, this is transparency. 353 00:27:42,560 --> 00:27:44,060 These are things that need to be fixed. 354 00:27:44,220 --> 00:27:52,180 And regardless of where blame lies, whether that's in an open source thing that we have nothing to do with or whether it's our own code, like, this is the responsible thing to do. 355 00:27:52,220 --> 00:27:53,360 And we should celebrate that. 356 00:27:53,460 --> 00:27:58,720 Do you think there's ever any angst about advertising this sort of thing? 357 00:27:58,780 --> 00:28:04,360 And do you even see enterprises sometimes being skeptical about racist awareness because people will be blamed for something? 358 00:28:04,440 --> 00:28:07,360 Or do we gotten past that and say, no, this is just responsible computing? 359 00:28:08,580 --> 00:28:30,000 I think one thing that really helped when we first started kind of the really big push for more security in Cloud Foundry, which is about almost two years ago, I guess, was Justin Smith, who's kind of our head of security, said to me when we were getting started, like, I hope we find as many things as possible. 360 00:28:30,000 --> 00:28:37,160 Like, we can't set up any sort of cultural compensation around not finding things. 361 00:28:37,580 --> 00:28:40,800 Like, we should be happy anytime someone reports anything to us. 362 00:28:40,820 --> 00:28:43,200 And it doesn't matter kind of how big or how small. 363 00:28:43,800 --> 00:28:50,240 And I think that really helps set the tone for what our security program is going to look like. 364 00:28:50,960 --> 00:28:55,140 And that's a really important thing for organizations to think about. 365 00:28:55,260 --> 00:28:59,200 Like, how are you culturally encouraging people to report issues? 366 00:29:00,120 --> 00:29:06,100 There's definitely been a lot of philosophical discussion about how open should we be and how quickly. 367 00:29:06,900 --> 00:29:09,140 Because we definitely do have customers. 368 00:29:10,320 --> 00:29:12,100 Cloud Foundry has used a lot of big banks. 369 00:29:12,780 --> 00:29:20,640 And they've said, you know, I wish that we got to hear about this vulnerability before the public did, for instance. 370 00:29:20,960 --> 00:29:28,280 But we've been able to have conversations with them and explain that, like, secrecy only really helps the bad guys. 371 00:29:28,420 --> 00:29:36,020 It doesn't help the good people actually find out what's wrong and patch quickly. 372 00:29:37,200 --> 00:29:39,980 So I think we have built that in from the start. 373 00:29:40,400 --> 00:29:45,280 And that's been really important, like, as we try to make Cloud Foundry more secure. 374 00:29:45,900 --> 00:29:52,340 So just as you're doing, that's another thing you've spoken about quite a bit is the, I don't know. 375 00:29:53,360 --> 00:29:59,540 Like, you could call it, like, the culture or, like, you should have developers stop writing insecure code. 376 00:29:59,680 --> 00:30:01,440 Like, all of those kinds of ways of thinking about it. 377 00:30:01,440 --> 00:30:10,580 But you went through some actual, like, tactics you had to not be, like, the scary security person coming in and telling people how to live their life. 378 00:30:10,740 --> 00:30:18,580 And so, like, in your experience around here and elsewhere, like, how do you introduce that sort of, like, security hygiene? 379 00:30:19,080 --> 00:30:24,580 And in the sense that, like, you would like it to actually stick and not just be annoying for people. 380 00:30:27,600 --> 00:30:39,880 Yeah, I mean, one of the things that we've been doing lately, and I'm actually in Portland this week doing this, is security workshops with kind of as many product teams as we can get our hands on. 381 00:30:41,060 --> 00:30:46,960 And those workshops have been developed with the cognitive science pair that actually works at Pivotal. 382 00:30:47,260 --> 00:30:51,640 It's pretty cool that we have some scientists in residence that are helping us with this. 383 00:30:52,720 --> 00:31:04,280 And the idea is when people are scared about security or they don't feel knowledgeable about security, you obviously want to teach them. 384 00:31:05,160 --> 00:31:17,320 But we don't think it's super effective to either, like, sit them in front of a computer and make them watch a video for an hour or sit them in a meeting room as a team and just talk at them, 385 00:31:17,820 --> 00:31:22,240 which is something that we've tried previously, and we didn't find it very effective. 386 00:31:23,460 --> 00:31:34,440 So what we've been doing has been going around to product teams and doing exercises with individual pairs to help them just become a little bit more skeptical about their product. 387 00:31:34,940 --> 00:31:36,180 It's what we're trying to do. 388 00:31:36,420 --> 00:31:44,380 And then we actually teach members of the team to facilitate the same workshop with other people on their team, 389 00:31:44,500 --> 00:31:59,220 so that when we leave a location, that knowledge can kind of grow and scale more virally than having to fly people around and the only knowledge sharing happens when we're there. 390 00:32:00,660 --> 00:32:01,640 Yeah, I love that. 391 00:32:01,800 --> 00:32:05,380 So, I mean, I'm trying to map that to, you know, specific. 392 00:32:05,660 --> 00:32:10,700 I think I've watched enough videos in my life where it was like, hey, quick, take this SOP or training on security. 393 00:32:10,820 --> 00:32:11,640 Great, now you're secure. 394 00:32:11,760 --> 00:32:13,220 Get back to work as a developer. 395 00:32:13,920 --> 00:32:19,080 But, I mean, so let's, you know, you talk to enterprise customers or you see the work they're doing. 396 00:32:19,520 --> 00:32:26,140 How is security supposed to fit into even, we'll call it agile delivery of projects, but really projects in general. 397 00:32:26,140 --> 00:32:30,700 It's not scalable for security pros to be embedded in every team full time. 398 00:32:30,780 --> 00:32:33,320 That doesn't seem like there's enough of them across the enterprise. 399 00:32:33,780 --> 00:32:38,920 So, is it this sort of kind of pairing education sort of mode and then you cycle through? 400 00:32:39,060 --> 00:32:45,240 Is it hopefully not the code review at the end where everyone's breathing down your neck because you just have to say yes before it goes to prod? 401 00:32:45,560 --> 00:32:52,420 Like, what is the right place for security in a project delivery cycle, especially nowadays when it can't be an afterthought? 402 00:32:53,540 --> 00:32:56,520 Yeah, I think we think about it kind of the same way as design. 403 00:32:58,200 --> 00:33:06,060 Probably, you know, 10 years ago design was like pretty colors that got thrown in at the end after all the code was already built, right? 404 00:33:06,720 --> 00:33:11,600 But now we're trying to build usability into every story. 405 00:33:12,260 --> 00:33:17,560 So, as you write a story, you're trying to figure out how is this feature actually going to be used? 406 00:33:18,260 --> 00:33:20,120 What does it look like on screen to someone? 407 00:33:20,280 --> 00:33:21,500 How do they interact with it? 408 00:33:22,020 --> 00:33:34,620 And with the pairing exercises, we're trying to get the same parity as usability or high availability get, like, within Pivotal and Cloud Foundry teams. 409 00:33:34,880 --> 00:33:42,960 So that when you're sitting down and writing a story or working on a feature, you're thinking, what are the actual security implications here? 410 00:33:44,000 --> 00:33:58,700 Let's think about not just valuable information that someone might want to steal, but usable information that someone could get out of this component if they've already exploited a system and are trying to, like, move laterally through your network. 411 00:33:59,580 --> 00:34:02,760 Yeah, do you do something then after that? 412 00:34:02,840 --> 00:34:07,560 So, before a team ships, I mean, heck, we have another PCF release coming up here in a couple of weeks. 413 00:34:07,680 --> 00:34:09,780 I mean, is security part of pipelines? 414 00:34:10,040 --> 00:34:12,880 Is security a check that also happens at the end somewhere? 415 00:34:12,980 --> 00:34:15,200 Is that unnecessary if you've been doing it throughout the way? 416 00:34:15,480 --> 00:34:18,600 What happens after you feel like you've kind of coached a team up and they're in good shape? 417 00:34:18,840 --> 00:34:20,240 When else do you intersect with them? 418 00:34:21,840 --> 00:34:23,360 I personally don't. 419 00:34:23,360 --> 00:34:38,680 A lot of the different teams have their own ways that they go about this, either, you know, compliance pipelines that are helping them figure out whether they're PCI compliant or, you know, HIPAA compliant, things like that. 420 00:34:38,680 --> 00:34:44,900 A lot of it is done through actual customer deployments rather than on the product side. 421 00:34:45,900 --> 00:34:51,560 But at the moment, it's definitely up to individual teams to understand what makes sense for their product. 422 00:34:53,120 --> 00:34:53,740 And we found that that could be... 423 00:34:53,740 --> 00:34:54,460 So, like code analysis? 424 00:34:55,200 --> 00:34:55,420 Yeah. 425 00:34:55,420 --> 00:34:55,960 Things like that. 426 00:34:56,020 --> 00:34:56,780 That would be up to them. 427 00:34:57,200 --> 00:34:58,100 Yeah, there are... 428 00:34:58,100 --> 00:35:02,140 I know various teams are doing, like, static code analysis, for example. 429 00:35:02,460 --> 00:35:11,540 We're also doing vulnerability scanning for the platform as a whole and helping to integrate into, like, their current workflows. 430 00:35:11,740 --> 00:35:26,980 Like, everything that we're doing is just to try to make sure that the teams have ownership of it and to fit into their existing workflows so that security isn't something that's preventing you from shipping or slowing you down at the end. 431 00:35:27,660 --> 00:35:31,680 Like, the farther forward we can build it into the process, the less disruptive it is. 432 00:35:32,780 --> 00:35:33,140 Yeah. 433 00:35:33,200 --> 00:35:39,160 Can you give any examples of what you would tell a pair or even just in general, like, what should devs be looking out for? 434 00:35:39,220 --> 00:35:40,320 Like, I think it's really lame. 435 00:35:41,100 --> 00:35:43,640 I guess I did this on stage at Field Kickoff last week, too. 436 00:35:43,640 --> 00:35:47,360 But just saying, like, be more secure, like, that's not even useful anymore. 437 00:35:47,560 --> 00:35:54,940 So, like, what are some of those things specifically around whatever it is, coding techniques or practices around how you run or at least privilege? 438 00:35:55,300 --> 00:35:58,320 Like, what do you encourage teams to do to be responsible? 439 00:36:00,180 --> 00:36:02,860 Well, so there's kind of two parts of it. 440 00:36:03,080 --> 00:36:08,540 It's one part, as like I said about the workshops, it's just teaching teams to be more skeptical. 441 00:36:09,920 --> 00:36:21,980 So, one of the things about Pivotal and Cloud Foundry in general is that our development teams are very empathetic to our users and to people who want to do the right thing while using the system. 442 00:36:22,420 --> 00:36:29,300 And they just don't have as much experience thinking about people who don't have the best intentions or who actually want to break their product. 443 00:36:29,740 --> 00:36:42,300 So, just kind of switching that mindset, we found has been really helpful and ends up with teams, like, once they've been trained, actually reporting more vulnerabilities to us. 444 00:36:43,300 --> 00:36:45,860 Anecdotally, we don't have, like, data on that at the moment. 445 00:36:46,820 --> 00:36:55,580 But the other thing is just to help the teams understand that the security triage team especially is there to help them. 446 00:36:56,540 --> 00:37:02,960 If there's any, anytime they have a question about something, like, that's what, that's the sort of behavior that we want to encourage. 447 00:37:02,960 --> 00:37:14,200 Like, we want to help teams know that if they do have a question, there's someone to go to so that there's kind of that psychological safety. 448 00:37:14,440 --> 00:37:24,260 Because you don't want a pair to be working on a story and say, oh, I think if we do this feature this way, you know, somebody's social security number is going to get leaked. 449 00:37:24,380 --> 00:37:30,500 But no one told us to care about that, so let's just ignore that for right now and we'll just do this story and we'll deliver it. 450 00:37:31,600 --> 00:37:42,460 Like, that healthy skepticism is what we're trying to build in because we're not going to have a security person looking over the shoulder of every single pair who's developing a product. 451 00:37:43,960 --> 00:37:56,720 So you've covered this to some extent here and there, but I wonder, like, I don't even know the terminology for it, but, like, a fair amount of kind of what we talked about. 452 00:37:56,720 --> 00:38:03,180 And I think what y'all's team does is sort of, like, securing Cloud Foundry itself. 453 00:38:04,080 --> 00:38:13,920 And, like, a question that I often get is, so if we have these product teams and I've heard about, like, you know, DevOps and balance teams and all of this stuff. 454 00:38:14,060 --> 00:38:18,260 Like, do I actually have, like, a dedicated security person on that team? 455 00:38:18,400 --> 00:38:23,240 And then if I don't, am I doing the same thing that I'm doing now where I've got, like, security audits? 456 00:38:23,300 --> 00:38:27,080 Or, like, what do you, like, what do you do in that case? 457 00:38:27,120 --> 00:38:28,100 Like, what are the controls? 458 00:38:28,420 --> 00:38:30,100 I think that's a security term, right? 459 00:38:30,140 --> 00:38:38,680 Like, what are the controls that people have if they're just going to let these people, like, deploy multiple times a week instead of having to audit things? 460 00:38:40,220 --> 00:38:42,920 I'm assuming, you mean, like, on the customer side? 461 00:38:43,080 --> 00:38:43,580 Yeah, yeah. 462 00:38:43,700 --> 00:38:50,440 The actual application that people are working on, not, like, the platform that people are using. 463 00:38:51,280 --> 00:38:56,880 Yeah, I think it varies customer to customer and industry to industry. 464 00:38:57,460 --> 00:39:04,560 So, those, like, different customers have different regulatory things that are set up in place already. 465 00:39:06,040 --> 00:39:08,900 I'm just, like, less on the application development side. 466 00:39:08,980 --> 00:39:12,740 So, I don't know as much about how they're securing their applications. 467 00:39:13,680 --> 00:39:18,440 But there are obviously plenty of add-ons for Cloud Foundry that help with that. 468 00:39:20,180 --> 00:39:23,420 And plenty of work on certifications. 469 00:39:24,100 --> 00:39:32,600 So, for instance, John Field has gotten numerous Cloud Foundry customers through, like, PCI compliance for their foundations. 470 00:39:33,320 --> 00:39:36,540 And I'm assuming that ends up touching the development side as well. 471 00:39:36,740 --> 00:39:36,960 Right. 472 00:39:38,000 --> 00:39:44,760 But, yeah, it's all about, you know, vulnerability scanning the languages that you use. 473 00:39:44,860 --> 00:39:49,820 Hopefully, you're not using languages that let you get buffer overflows and things like that really quickly. 474 00:39:50,180 --> 00:40:02,320 But, yeah, I mean, third-party libraries and dependencies are just a huge part of keeping application development secure in kind of a cloud-native way. 475 00:40:02,700 --> 00:40:10,420 Yeah, I guess there's a layer of trusting yourselves and then also trusting, as you say, the third-party stuff you bring it in. 476 00:40:10,740 --> 00:40:18,020 And it sounds like, I mean, I get a lot of these questions, you know, to invoke our smooth-skinned demon friend of transformation, right? 477 00:40:18,120 --> 00:40:21,300 Like, sort of like the, well, what about this thing and what about that? 478 00:40:21,300 --> 00:40:30,740 And oftentimes, you know, people will – they'll give a lengthy answer of, like, why this stuff doesn't work for them, like all these dependencies they have. 479 00:40:30,940 --> 00:40:35,100 And maybe, as you're kind of alluding to, they have, like, very stringent security needs. 480 00:40:35,120 --> 00:40:39,420 And I feel like frequently the answer is, like, well, you should do that stuff. 481 00:40:39,900 --> 00:40:45,140 Like, there's no secret sauce of removing that kind of toil from what you have to do. 482 00:40:45,140 --> 00:40:54,720 So just put it into the mixture of other things that you've improved instead, which I guess is a little depressing of an answer because you always want to, like, remove toil. 483 00:40:55,060 --> 00:40:58,080 But then again, maybe it's a relief to know that you're not missing something. 484 00:40:58,260 --> 00:41:13,780 You didn't, like, skip those five pages in the Lean Enterprise book that solved your problem of how to integrate with, like, six different off-the-shelf systems and make sure that you pass your five-capital-letter security standards from, you know, the RAND Corporation or whatever you're freaking out about. 485 00:41:14,560 --> 00:41:17,520 Is RAND still around or have I been watching too many old movies? 486 00:41:18,160 --> 00:41:18,940 No, I think you're fine. 487 00:41:19,240 --> 00:41:19,560 All right. 488 00:41:19,580 --> 00:41:19,920 Thank you. 489 00:41:20,320 --> 00:41:25,560 I was wondering, Molly, because, you know, we talk a little bit about devs on the enterprise side. 490 00:41:25,620 --> 00:41:29,320 But if we go back to the Pivotal teams, I think you do help with a patch day we do internally. 491 00:41:29,460 --> 00:41:30,780 Am I remembering that right? 492 00:41:31,140 --> 00:41:31,340 Yeah. 493 00:41:31,900 --> 00:41:32,760 So what's that? 494 00:41:32,860 --> 00:41:34,160 I mean, how do we keep our own teams? 495 00:41:34,220 --> 00:41:37,060 And when there's a security crisis and everyone goes, hey, my backlog is set. 496 00:41:37,100 --> 00:41:38,220 And you say, haha, just kidding. 497 00:41:38,640 --> 00:41:40,560 Here's something we all have to take care of right now. 498 00:41:41,000 --> 00:41:42,640 What's a patch day like or a patch week? 499 00:41:42,660 --> 00:41:43,640 How does that work at Pivotal? 500 00:41:45,120 --> 00:41:48,240 We've definitely iterated on this process a lot. 501 00:41:49,500 --> 00:42:04,600 So patch days slash weeks usually focus on the Ubuntu stem cells that Bosch provides that are the base image of all your VMs if you're running Ubuntu VMs in Cloud Foundry. 502 00:42:06,800 --> 00:42:17,560 So the company that provides Ubuntu, which is Canonical, they periodically release security updates for Ubuntu. 503 00:42:18,120 --> 00:42:20,180 And those are classified by severity. 504 00:42:20,860 --> 00:42:24,560 So you'll have, like, lows, mediums, highs, and criticals. 505 00:42:25,880 --> 00:42:37,940 And if something is high or critical that gets released by them, we try to push stem cells and have all of the pivotal Cloud Foundry teams patch with that as quickly as possible. 506 00:42:39,540 --> 00:42:50,200 But if, for instance, we haven't had a high severity issue, there are a lot of lows and mediums that kind of sit around waiting for us to pick them up. 507 00:42:50,740 --> 00:43:02,060 So we'll do a scheduled patch week where Bosch will provide the stem cells and all of the pivotal teams will cut their tiles to use the new stem cell. 508 00:43:04,880 --> 00:43:12,300 That's changed, you know, because recently Bosch decided that they were going to start just cutting stem cells every two weeks. 509 00:43:12,680 --> 00:43:19,980 Because we have a lot of different customers that have different SLAs around CBEs that come out. 510 00:43:20,180 --> 00:43:27,720 So some will say, like, if a low CBE has been in the wild for 20 days and we don't fix it, we're out of compliance. 511 00:43:28,100 --> 00:43:30,860 Or other customers say, you know, two weeks. 512 00:43:31,180 --> 00:43:33,460 Or, you know, every other Friday. 513 00:43:33,800 --> 00:43:36,240 Or you have to patch on a full moon. 514 00:43:36,240 --> 00:43:45,460 And, like, all of the different requirements are often in conflict with each other because some customers want to patch CBEs very quickly. 515 00:43:45,660 --> 00:43:52,340 And some want to patch them very slowly because there's obviously risk every time you make an update. 516 00:43:53,920 --> 00:44:06,320 So the patch week is just a way to coordinate all of the pivotal teams that create tiles for Cloud Foundry to have them all patch the stem cells at the same time. 517 00:44:07,040 --> 00:44:07,860 Yeah, that's great. 518 00:44:07,940 --> 00:44:15,420 Hopefully, I mean, I would think some of our customers could benefit from that stuff, too, just because, I don't know, sometimes it just can't be like, hey, we're bored right now. 519 00:44:15,440 --> 00:44:16,540 Let's do security stuff. 520 00:44:16,540 --> 00:44:24,780 There's probably got to be a constant rhythm and somebody keeping an eye on it and making it somewhat interesting and beneficial, not just, crap, it's toil time. 521 00:44:24,860 --> 00:44:26,160 It's time to go patch stuff. 522 00:44:26,260 --> 00:44:40,600 So the last thing I had for you was, you know, as we look at ourselves, our customers, whatever, where do you see the kind of separation between what a developer is responsible for security-wise, an operator, what they should depend on platforms for? 523 00:44:40,700 --> 00:44:42,460 I mean, what's the ideal here? 524 00:44:42,460 --> 00:44:56,220 Because maybe the answer is everyone's responsible for everything, or maybe there's a take of, hey, developers have a certain responsibility at their app, operators kind of keeping a platform healthy, a platform should try to do, you know, secure by default computing, whatever it is. 525 00:44:56,320 --> 00:44:59,000 In your mind, is there a separation there? 526 00:44:59,100 --> 00:45:01,960 Are there clear things that all of those three parties are responsible for? 527 00:45:03,640 --> 00:45:16,820 I guess from two years of working on Cloud Foundry, the first thing is definitely anyone building their own platform these days who don't have, you know, hundreds of engineers working on it. 528 00:45:18,040 --> 00:45:30,960 I would say to definitely rethink that when it comes to security, just from all the interesting bugs that we've found in our own platform, I could imagine other people doing the exact same thing. 529 00:45:31,520 --> 00:45:36,400 And then you're not benefiting from, you know, a community building a secure platform for you. 530 00:45:38,480 --> 00:45:45,400 And then as you step it up to, like, actual operation of the platform, secure by default is definitely our philosophy. 531 00:45:46,660 --> 00:45:57,640 And I hope that we're trying to impart that to our customers as well, because there are definitely ways to configure any platform that are insecure that you have to worry about. 532 00:45:59,240 --> 00:46:13,740 So, from, like, the field teams to marketing to just everybody working on Cloud Foundry, I think everyone is trying to encourage customers to set up their own networks and platforms in as secure a way as possible. 533 00:46:14,280 --> 00:46:23,000 And I definitely think the platform can compensate for a lot of things that application developers might try to do. 534 00:46:24,600 --> 00:46:37,260 So, for instance, we have all sorts of networking layers built in that can help application front ends and back ends talk to each other without letting anyone else in, obviously. 535 00:46:39,000 --> 00:46:52,960 So, application developers have to be careful, but we have to assume that people in any system are going to make mistakes that could compromise your security. 536 00:46:52,960 --> 00:47:00,200 So, you want to take the actual individual judgment of a person out wherever possible. 537 00:47:00,900 --> 00:47:14,840 I think we've definitely seen lately that security incidents tend to happen when things are one person's responsibility, either to update something or to make a split-second decision. 538 00:47:14,960 --> 00:47:24,320 So, we want to take people and all their fragilities out of the security posture of the system as much as possible. 539 00:47:25,060 --> 00:47:26,020 Yeah, great answer. 540 00:47:26,400 --> 00:47:27,960 Well, I just have one more question. 541 00:47:28,200 --> 00:47:29,260 It's more of an advice thing. 542 00:47:29,520 --> 00:47:33,940 Now, if I figured out one thing about you, it's that you really like your dog, which is fantastic. 543 00:47:34,340 --> 00:47:35,480 I'm all about liking dogs. 544 00:47:35,520 --> 00:47:36,500 But now I've got a dog. 545 00:47:37,000 --> 00:47:39,400 Very, very different build, but I think similar size. 546 00:47:39,480 --> 00:47:44,380 And this dog, all she's interested in doing is basically, like, licking my face constantly. 547 00:47:44,720 --> 00:47:54,760 Now, is this something that I can work on with her or I just need to accept it and, like, have that be a thing that happens and just celebrate having my face licked by a dog a lot? 548 00:47:55,220 --> 00:47:55,960 What's your opinion? 549 00:47:55,960 --> 00:47:57,440 Yeah, that's tough. 550 00:47:58,880 --> 00:48:07,320 My dog, who's Rory, who shows up in my presentations as often as possible, she'll do that, but not forever. 551 00:48:07,900 --> 00:48:09,400 Like, it'll just be a nice, like... 552 00:48:09,400 --> 00:48:10,080 Just momentary. 553 00:48:10,360 --> 00:48:12,020 Like, you're welcome home. 554 00:48:12,060 --> 00:48:13,360 I'm going to kiss your face a little bit. 555 00:48:14,940 --> 00:48:17,000 Yeah, that's definitely a tough one. 556 00:48:17,080 --> 00:48:18,920 That might be just something you have to live with. 557 00:48:19,200 --> 00:48:24,620 Yeah, I mean, basically, I think the arrangement that we have is she has... 558 00:48:24,620 --> 00:48:30,780 You know that zone that, like, if a fire's in your house, you're supposed to, like, crawl underneath the smoke so you don't asphyxiate? 559 00:48:31,280 --> 00:48:33,780 I think that zone level is her zone. 560 00:48:34,020 --> 00:48:41,560 And so if you go into that zone, she can do whatever she wants to you, which means you can basically never sit on the floor if you don't want to be covered in slobber. 561 00:48:41,880 --> 00:48:48,700 And, I don't know, maybe that's the truce that will work out, and then I can just, you know, control when it happens. 562 00:48:49,200 --> 00:48:58,140 But, man, she's very excitable with the licking, which I should ask some vet people, not that I know any, but, like, what the deal with that is. 563 00:48:58,200 --> 00:49:04,680 Because, I mean, you know, dogs don't, like, taste things as a primary mechanism. 564 00:49:04,900 --> 00:49:06,580 They're supposed to, like, smell stuff, right? 565 00:49:07,100 --> 00:49:07,520 I don't know. 566 00:49:08,460 --> 00:49:09,480 Well, that's good advice. 567 00:49:09,640 --> 00:49:10,680 But they taste stuff, right? 568 00:49:10,760 --> 00:49:11,520 They're not snakes. 569 00:49:11,660 --> 00:49:12,300 Well, I mean... 570 00:49:12,300 --> 00:49:14,020 Their tongue isn't for smelling stuff. 571 00:49:14,020 --> 00:49:18,400 I mean, like, in the sense of, like, it's a primary functional sense. 572 00:49:18,400 --> 00:49:23,720 Like, you wouldn't say that us humans go around and, like, taste things to figure out the world, right? 573 00:49:23,880 --> 00:49:25,760 You can speak for yourself, but okay. 574 00:49:27,160 --> 00:49:27,820 That's right. 575 00:49:28,260 --> 00:49:28,660 Exactly. 576 00:49:29,300 --> 00:49:29,620 Yeah. 577 00:49:29,840 --> 00:49:32,820 Whereas, you know, we're more visual and tactile and, I don't know. 578 00:49:33,340 --> 00:49:35,920 I'm no human biologist person. 579 00:49:36,040 --> 00:49:37,660 Well, anyhow, thanks for being on. 580 00:49:38,320 --> 00:49:42,460 In addition to figuring out how to cope with my dog, we found out a few interesting things about security. 581 00:49:42,460 --> 00:49:44,500 But it's really that dog advice that I was here for. 582 00:49:45,100 --> 00:49:50,920 But if people want to follow up or see the presentations we were talking about or anything like that, where would you send them? 583 00:49:52,540 --> 00:49:56,920 So the SpringOne, 2017 website is great. 584 00:49:57,000 --> 00:49:58,320 It has all the talks. 585 00:49:59,700 --> 00:50:12,040 If they want to see it again, I'm actually going to be speaking in Austin on April 30th at the Deliver Agile conference that Richard so nicely invited me to. 586 00:50:13,440 --> 00:50:19,040 And then I'll be speaking at Cloud Foundry Summit Boston in April as well. 587 00:50:19,720 --> 00:50:20,440 Oh, exciting. 588 00:50:20,560 --> 00:50:21,400 All over the place. 589 00:50:21,940 --> 00:50:22,220 Well, great. 590 00:50:22,880 --> 00:50:25,120 Well, as always, this has been Pivotal Conversations. 591 00:50:25,380 --> 00:50:26,160 Thanks for listening. 592 00:50:26,340 --> 00:50:32,540 If you want to go find all the old episodes and find the RSS to subscribe to if you don't know how to do that on your own, 593 00:50:32,880 --> 00:50:37,720 you can go to soundcloud.com slash pivotalconversations, and it'll all be there. 594 00:50:37,720 --> 00:50:46,220 And about every Thursday or so, we post the full show notes, such as they are, the formal show notes, over at pivotal.io slash podcast. 595 00:50:46,500 --> 00:50:54,940 And then finally, just as one recommendation, you know, frequent podcast guest Jared, he had this post about three white papers that we had now. 596 00:50:55,080 --> 00:50:57,740 Don't stop listening yet, just because I said white paper. 597 00:50:57,820 --> 00:50:59,780 But three white papers that we had published. 598 00:50:59,880 --> 00:51:02,600 One of them is indeed on security and compliance. 599 00:51:02,680 --> 00:51:06,240 And there's probably some PCI talk in there, which would be interesting. 600 00:51:06,240 --> 00:51:15,140 And there's another one I read when I was flying back from the sales kickoff about, like, thinking about how value stream maps fit into all of this 601 00:51:15,140 --> 00:51:21,420 and how, like, there's an interesting emphasis on, like, waste removal from a lean perspective in the software development cycle that's neat. 602 00:51:21,980 --> 00:51:28,920 And then, you know, for those who are, like, really in the weeds of IT service management, there's a whole paper on chargebacks, 603 00:51:29,280 --> 00:51:33,120 which I think, you know, that's thrilling reading for people like myself. 604 00:51:33,320 --> 00:51:35,560 But it's definitely selective taste. 605 00:51:35,560 --> 00:51:38,880 But, you know, with that, we'll see everyone next time. 606 00:51:39,100 --> 00:51:39,540 Bye-bye.