1
00:00:00,000 --> 00:00:01,020
Why don't you introduce yourself?

2
00:00:01,320 --> 00:00:01,960
Yeah, sure.

3
00:00:02,140 --> 00:00:03,000
Pleasure to be here.

4
00:00:03,080 --> 00:00:03,660
André Vannebalk.

5
00:00:03,760 --> 00:00:06,740
I'm one of the global CTOs in Tanzu, VIMR.

6
00:00:06,880 --> 00:00:09,280
I primarily focus on a lot of the executive advisory roles.

7
00:00:09,420 --> 00:00:11,720
So I work with a lot of the Fortune 500 companies

8
00:00:11,720 --> 00:00:14,820
and their executives around transforming their organization.

9
00:00:14,980 --> 00:00:16,580
I actually came from a customer originally

10
00:00:16,580 --> 00:00:18,240
from when I joined Pivotal.

11
00:00:18,420 --> 00:00:20,500
I worked with Charles Schwab as an executive role

12
00:00:20,500 --> 00:00:22,100
primarily in the technology space.

13
00:00:22,300 --> 00:00:23,400
So all the core technology,

14
00:00:23,620 --> 00:00:25,420
so all brokerage, retirement,

15
00:00:25,880 --> 00:00:27,600
and stock purchase programs as well.

16
00:00:27,600 --> 00:00:29,160
So the topic we were going to talk about,

17
00:00:29,280 --> 00:00:30,460
basically, I don't know,

18
00:00:30,540 --> 00:00:33,040
a grander idea behind DevSecOps,

19
00:00:33,160 --> 00:00:35,200
a phrase that we in Tanzu land use a lot.

20
00:00:35,360 --> 00:00:36,580
When we use that word,

21
00:00:36,780 --> 00:00:39,900
a huge part of what it means is basically,

22
00:00:40,200 --> 00:00:40,980
as you would say,

23
00:00:41,100 --> 00:00:42,620
having a trusted supply chain,

24
00:00:42,720 --> 00:00:43,480
which is essentially,

25
00:00:43,740 --> 00:00:45,940
I have this piece of software that I'm running.

26
00:00:46,240 --> 00:00:48,920
I want to make sure I trust the provenance of it.

27
00:00:49,040 --> 00:00:50,440
I want to trust everything that happened

28
00:00:50,440 --> 00:00:53,240
and I can make sure to not only patch things,

29
00:00:53,400 --> 00:00:56,020
but I also want to like be able to figure out

30
00:00:56,020 --> 00:00:58,700
how much do I trust this piece of software

31
00:00:58,700 --> 00:01:01,320
based on what I know about where it came from

32
00:01:01,320 --> 00:01:03,820
and who built it and all of that sort of stuff.

33
00:01:03,820 --> 00:01:06,580
Yeah, it's an interesting time.

34
00:01:06,820 --> 00:01:08,440
And that's why I want to step back a little bit

35
00:01:08,440 --> 00:01:10,800
and put it in perspective what these things mean.

36
00:01:10,940 --> 00:01:12,880
If you think of the whole DevOps motion

37
00:01:12,880 --> 00:01:14,320
that people have been talking about,

38
00:01:14,480 --> 00:01:16,360
it's the code du jour currently what's going on.

39
00:01:16,440 --> 00:01:17,940
Everybody loves talking about these things.

40
00:01:18,140 --> 00:01:19,540
And can I add any more words to it?

41
00:01:19,640 --> 00:01:20,700
Seq is now part of this.

42
00:01:20,840 --> 00:01:22,340
And I was reading another book the other day,

43
00:01:22,440 --> 00:01:23,200
but FinOps.

44
00:01:23,340 --> 00:01:25,000
So now we're going to add financial pieces to it.

45
00:01:25,040 --> 00:01:26,660
So you keep throwing at the same thing,

46
00:01:26,700 --> 00:01:27,600
but you have to stop back.

47
00:01:27,620 --> 00:01:28,120
And what does it mean?

48
00:01:28,160 --> 00:01:29,920
Like, what are you trying to really accomplish?

49
00:01:29,920 --> 00:01:34,500
So the analogy I tend to use is similar as if you go to the grocery store

50
00:01:34,500 --> 00:01:37,160
and you look at a product that you pick up,

51
00:01:37,340 --> 00:01:40,920
you can rationalize as an individual over what is in the product.

52
00:01:41,060 --> 00:01:44,020
So it has a set of ingredients that tells you and informs you,

53
00:01:44,060 --> 00:01:44,780
I eat this product.

54
00:01:44,960 --> 00:01:46,940
Am I allergic to the nuts that is in my Nutella?

55
00:01:47,080 --> 00:01:48,740
To use some of your video analogies.

56
00:01:48,920 --> 00:01:50,300
But so can you rationalize over that?

57
00:01:50,360 --> 00:01:50,780
What's in it?

58
00:01:50,900 --> 00:01:52,820
But then also you want to have a level of

59
00:01:52,820 --> 00:01:55,100
when they actually say things that are in there,

60
00:01:55,300 --> 00:01:56,260
can you trust it as well?

61
00:01:56,260 --> 00:01:58,420
So there's like, for example, organic.

62
00:01:58,880 --> 00:02:01,060
The vendor can say it's organic, but is it organic?

63
00:02:01,240 --> 00:02:05,060
So do you have ways of kind of rationalizing over the product?

64
00:02:05,260 --> 00:02:06,700
What's happening more and more in the industry,

65
00:02:06,820 --> 00:02:07,760
like back in the day,

66
00:02:07,960 --> 00:02:09,840
you only have maybe one or two vendors

67
00:02:09,840 --> 00:02:13,140
that you have an implicit trust in the software industry, right?

68
00:02:13,200 --> 00:02:15,520
You could go, for example, VMware or Microsoft

69
00:02:15,520 --> 00:02:17,400
or fill in the blanks and I pay them a check.

70
00:02:17,840 --> 00:02:20,520
So I implicitly trust what they're doing.

71
00:02:20,660 --> 00:02:23,240
But more and more, the supply chain has exploded

72
00:02:23,240 --> 00:02:25,960
because you have so many different more vendors

73
00:02:25,960 --> 00:02:28,000
and also open source contributors

74
00:02:28,000 --> 00:02:30,440
from countries that you might or might not

75
00:02:30,440 --> 00:02:33,380
have a positive reaction to

76
00:02:33,380 --> 00:02:35,100
that software came from those industries.

77
00:02:35,420 --> 00:02:37,260
So that's why I've been touting more of this notion,

78
00:02:37,400 --> 00:02:39,480
like you need to create trust in the supply chain

79
00:02:39,480 --> 00:02:42,220
because by default, we use it just implicitly trust.

80
00:02:42,460 --> 00:02:45,460
But now with all the vulnerabilities that have happened,

81
00:02:45,900 --> 00:02:46,940
SolarWinds being an example,

82
00:02:47,280 --> 00:02:50,400
is you need to have a way of rationalizing that trust.

83
00:02:50,400 --> 00:02:52,520
Can you actually trust what has been done

84
00:02:52,520 --> 00:02:54,860
and what's been said in that particular space?

85
00:02:54,980 --> 00:02:57,400
And it gets to the question of what are those things

86
00:02:57,400 --> 00:02:59,720
that allow you to trust those things, right?

87
00:02:59,780 --> 00:03:01,480
The same way that you walk in the grocery store

88
00:03:01,480 --> 00:03:03,260
and then the vendor says, yeah, this is in there.

89
00:03:03,480 --> 00:03:04,860
Sure, do you trust the guy

90
00:03:04,860 --> 00:03:07,700
or is there a way of verifying what you've done?

91
00:03:07,840 --> 00:03:09,620
The classical way that people have done this

92
00:03:09,620 --> 00:03:11,580
is in security space is,

93
00:03:11,700 --> 00:03:14,180
okay, I'll install hundreds of different scanners

94
00:03:14,180 --> 00:03:16,080
and then maybe I can then find things.

95
00:03:16,280 --> 00:03:17,840
But what if you can turn it around

96
00:03:17,840 --> 00:03:19,520
and instead of doing things upfront

97
00:03:19,520 --> 00:03:22,160
where you look at an artifact

98
00:03:22,160 --> 00:03:24,620
or look at the attestation of an artifact

99
00:03:24,620 --> 00:03:27,940
and say, yes, I trust what the vendor has said

100
00:03:27,940 --> 00:03:29,500
because I have a way of verifying

101
00:03:29,500 --> 00:03:31,500
and to test it to these pieces.

102
00:03:31,740 --> 00:03:33,220
So that's how I've been thinking about this

103
00:03:33,220 --> 00:03:35,320
is that you have a set of concerns

104
00:03:35,320 --> 00:03:36,720
that you're really trying to address.

105
00:03:36,820 --> 00:03:38,360
So let me step this forward in the industry,

106
00:03:38,480 --> 00:03:39,900
for example, in financial services.

107
00:03:40,100 --> 00:03:41,340
We were chatting about this a little bit earlier,

108
00:03:41,340 --> 00:03:43,640
but big concern is things around compliance

109
00:03:43,640 --> 00:03:45,980
and regulatory concerns.

110
00:03:46,420 --> 00:03:48,120
Most of those really look at

111
00:03:48,120 --> 00:03:49,780
what are the steps that you have done

112
00:03:49,780 --> 00:03:51,680
to make the sausage per se?

113
00:03:51,960 --> 00:03:54,020
And what they want is a way of verifying

114
00:03:54,020 --> 00:03:56,540
that you have done what you said you would do.

115
00:03:56,700 --> 00:03:58,360
It's like Sarban actually kind of approach

116
00:03:58,360 --> 00:03:59,380
in a manual way.

117
00:03:59,500 --> 00:04:01,400
But how can you codify those concerns

118
00:04:01,400 --> 00:04:03,220
into your supply chain?

119
00:04:03,380 --> 00:04:04,060
Because at the end of the day,

120
00:04:04,120 --> 00:04:06,580
your supply chain is just the flow of materials

121
00:04:06,580 --> 00:04:07,920
that you're working with.

122
00:04:07,980 --> 00:04:09,040
But you have also other regulatory

123
00:04:09,040 --> 00:04:11,040
like the HIPAA, PCI compliance

124
00:04:11,040 --> 00:04:12,440
that's trying to rationalize

125
00:04:12,440 --> 00:04:13,880
over these set of concerns.

126
00:04:14,140 --> 00:04:14,620
In the United States,

127
00:04:14,760 --> 00:04:16,260
there's the NIST Institute

128
00:04:16,260 --> 00:04:17,980
that has started to articulate

129
00:04:17,980 --> 00:04:19,980
what things should you be looking for

130
00:04:19,980 --> 00:04:21,980
from your software to say,

131
00:04:22,320 --> 00:04:24,580
is this a good thing or a bad thing?

132
00:04:24,700 --> 00:04:26,300
And currently, we don't have the tooling in place

133
00:04:26,300 --> 00:04:28,320
for beyond scanning, essentially,

134
00:04:28,540 --> 00:04:30,080
to rationalize over something

135
00:04:30,080 --> 00:04:31,400
arriving at your doorstep.

136
00:04:31,560 --> 00:04:32,620
So the way I break this down

137
00:04:32,620 --> 00:04:35,040
is you have a set of phases

138
00:04:35,040 --> 00:04:36,020
in the supply chain.

139
00:04:36,320 --> 00:04:38,200
Each of it, you can rationalize

140
00:04:38,200 --> 00:04:39,020
over what's happening.

141
00:04:39,040 --> 00:04:40,160
So if you break it down,

142
00:04:40,260 --> 00:04:41,300
like first, you start up

143
00:04:41,300 --> 00:04:42,760
with the basic things in supply chain.

144
00:04:43,000 --> 00:04:44,560
Supply, like where is the supply

145
00:04:44,560 --> 00:04:45,980
of the raw materials coming from?

146
00:04:46,200 --> 00:04:47,580
So you open source projects,

147
00:04:47,940 --> 00:04:49,200
vendors, et cetera.

148
00:04:49,540 --> 00:04:51,000
And thinking through that,

149
00:04:51,080 --> 00:04:52,580
like where did they get the pieces from?

150
00:04:52,740 --> 00:04:53,740
Have they done testing?

151
00:04:53,880 --> 00:04:55,080
Have they done scanning?

152
00:04:55,360 --> 00:04:56,340
What are all the components

153
00:04:56,340 --> 00:04:58,660
that are inside of the raw materials?

154
00:04:58,880 --> 00:04:59,640
So this is what we typically

155
00:04:59,640 --> 00:05:00,040
have been calling

156
00:05:00,040 --> 00:05:01,220
like the build materials,

157
00:05:01,500 --> 00:05:02,680
even in the physical side

158
00:05:02,680 --> 00:05:04,040
or digital build materials.

159
00:05:04,200 --> 00:05:05,800
It really specify things

160
00:05:05,800 --> 00:05:07,580
around what's in the product,

161
00:05:07,580 --> 00:05:09,320
like using a Nutella example.

162
00:05:09,500 --> 00:05:10,220
What is in there?

163
00:05:10,260 --> 00:05:11,300
What nuts are in there?

164
00:05:11,360 --> 00:05:12,500
What chocolate is in there?

165
00:05:12,580 --> 00:05:13,480
Where is it coming from?

166
00:05:13,600 --> 00:05:14,440
Have they tested it?

167
00:05:14,500 --> 00:05:15,460
What is the quality assurance

168
00:05:15,460 --> 00:05:16,220
that they have done

169
00:05:16,220 --> 00:05:18,060
around this particular piece?

170
00:05:18,180 --> 00:05:19,080
So you can then define

171
00:05:19,080 --> 00:05:20,280
that in the build materials

172
00:05:20,280 --> 00:05:20,900
in a way.

173
00:05:21,100 --> 00:05:21,460
But you also,

174
00:05:21,700 --> 00:05:22,740
the other key ingredient with that

175
00:05:22,740 --> 00:05:24,380
is you have to make sure

176
00:05:24,380 --> 00:05:25,420
that you attest

177
00:05:25,420 --> 00:05:26,820
to those things as well.

178
00:05:26,820 --> 00:05:28,020
So beyond just saying

179
00:05:28,020 --> 00:05:29,840
I put a label on my product

180
00:05:29,840 --> 00:05:31,000
and say this is in it,

181
00:05:31,100 --> 00:05:32,900
you need to actually sign off

182
00:05:32,900 --> 00:05:33,860
on it the fact that

183
00:05:33,860 --> 00:05:34,860
yes, it is in there.

184
00:05:35,040 --> 00:05:36,260
There's maybe a third party

185
00:05:36,260 --> 00:05:37,500
that's verified

186
00:05:37,500 --> 00:05:38,560
that those things

187
00:05:38,560 --> 00:05:39,600
were in there as well.

188
00:05:39,680 --> 00:05:41,020
The reason you really do that

189
00:05:41,020 --> 00:05:42,380
is so that when you take that

190
00:05:42,380 --> 00:05:43,700
into inventory in a company,

191
00:05:43,980 --> 00:05:44,940
you take a piece of software,

192
00:05:45,100 --> 00:05:46,440
you can quickly inspect

193
00:05:46,440 --> 00:05:47,300
that build materials

194
00:05:47,300 --> 00:05:47,840
and say,

195
00:05:48,000 --> 00:05:48,320
you know what?

196
00:05:48,360 --> 00:05:49,640
I like what you have here.

197
00:05:49,780 --> 00:05:50,920
I am allergic to nuts,

198
00:05:51,060 --> 00:05:52,280
so I'm not going to do this.

199
00:05:52,360 --> 00:05:53,960
Or there's CVEs in it

200
00:05:53,960 --> 00:05:54,820
that I don't care for.

201
00:05:54,880 --> 00:05:56,000
Or you haven't done enough testing

202
00:05:56,000 --> 00:05:56,980
to do these things.

203
00:05:57,140 --> 00:05:58,040
Which is an interesting notion

204
00:05:58,040 --> 00:05:59,060
because this part is

205
00:05:59,060 --> 00:06:00,060
the regulatory bodies

206
00:06:00,060 --> 00:06:00,860
in the United States

207
00:06:00,860 --> 00:06:02,320
are starting to make

208
00:06:02,320 --> 00:06:03,140
some suggestions

209
00:06:03,140 --> 00:06:04,820
of companies should really

210
00:06:04,820 --> 00:06:05,900
provide a bill of material.

211
00:06:06,080 --> 00:06:06,880
Just like what they've done

212
00:06:06,880 --> 00:06:07,480
in the food industry.

213
00:06:07,600 --> 00:06:08,600
Like you should really say

214
00:06:08,600 --> 00:06:09,200
what's in it.

215
00:06:09,300 --> 00:06:09,960
And we've done it

216
00:06:09,960 --> 00:06:11,380
as in hardware for a long time.

217
00:06:11,540 --> 00:06:12,520
So why doesn't software

218
00:06:12,520 --> 00:06:13,220
have this concept?

219
00:06:13,440 --> 00:06:14,720
Let's go in reverse order here.

220
00:06:14,840 --> 00:06:15,920
So as you were just mentioning,

221
00:06:16,360 --> 00:06:18,580
there's this idea that

222
00:06:18,580 --> 00:06:19,380
the reason you have

223
00:06:19,380 --> 00:06:20,380
a bill of materials,

224
00:06:20,700 --> 00:06:21,060
you know,

225
00:06:21,280 --> 00:06:23,200
to slightly go off

226
00:06:23,200 --> 00:06:24,740
the food analogy,

227
00:06:25,100 --> 00:06:26,100
being allergic to something

228
00:06:26,100 --> 00:06:26,860
is a good metaphor

229
00:06:26,860 --> 00:06:28,520
for security concerns.

230
00:06:28,660 --> 00:06:29,520
But in anyone

231
00:06:29,520 --> 00:06:30,400
who might want to consume

232
00:06:30,400 --> 00:06:31,200
a piece of software,

233
00:06:31,300 --> 00:06:32,140
let's say a bank

234
00:06:32,140 --> 00:06:33,220
gets some software

235
00:06:33,220 --> 00:06:34,100
that does whatever.

236
00:06:34,260 --> 00:06:35,260
Let's pick my favorite

237
00:06:35,260 --> 00:06:36,080
benign example.

238
00:06:36,340 --> 00:06:37,720
It's a pagination system.

239
00:06:37,860 --> 00:06:38,540
They have a framework

240
00:06:38,540 --> 00:06:39,680
that paginates

241
00:06:39,680 --> 00:06:41,040
its tax collecting season

242
00:06:41,040 --> 00:06:41,700
in the U.S.

243
00:06:41,700 --> 00:06:42,560
You got to go find

244
00:06:42,560 --> 00:06:43,300
all your expenses.

245
00:06:43,620 --> 00:06:44,440
You need some framework

246
00:06:44,440 --> 00:06:45,640
that paginates everything

247
00:06:45,640 --> 00:06:46,740
for you in the UI.

248
00:06:46,740 --> 00:06:47,800
And no one should write

249
00:06:47,800 --> 00:06:48,920
that framework on their own.

250
00:06:49,080 --> 00:06:49,900
That's a bad idea.

251
00:06:50,100 --> 00:06:50,920
So that's right.

252
00:06:51,060 --> 00:06:51,940
So you're going to go find

253
00:06:51,940 --> 00:06:53,240
some pagination framework

254
00:06:53,240 --> 00:06:54,040
in whatever language

255
00:06:54,040 --> 00:06:54,760
that you have.

256
00:06:55,220 --> 00:06:56,160
And that's displaying

257
00:06:56,160 --> 00:06:56,920
to the end user

258
00:06:56,920 --> 00:06:57,820
critical data.

259
00:06:58,220 --> 00:06:58,880
So that could be

260
00:06:58,880 --> 00:07:00,580
a point of whatever,

261
00:07:00,940 --> 00:07:01,320
leakage,

262
00:07:01,580 --> 00:07:02,420
some bad things.

263
00:07:02,700 --> 00:07:04,120
One would want to know

264
00:07:04,120 --> 00:07:04,600
when we're looking

265
00:07:04,600 --> 00:07:05,920
at this pagination framework,

266
00:07:06,160 --> 00:07:07,100
can we trust it?

267
00:07:07,320 --> 00:07:08,320
And one of the things

268
00:07:08,320 --> 00:07:08,920
as you were saying

269
00:07:08,920 --> 00:07:09,660
is it's good to have

270
00:07:09,660 --> 00:07:10,580
a bill of materials.

271
00:07:10,880 --> 00:07:12,900
Probably the pagination framework

272
00:07:12,900 --> 00:07:14,260
uses other libraries.

273
00:07:14,600 --> 00:07:15,380
And those libraries

274
00:07:15,380 --> 00:07:16,320
use other libraries.

275
00:07:16,420 --> 00:07:16,800
There's a bunch

276
00:07:16,800 --> 00:07:17,360
of dependencies.

277
00:07:17,760 --> 00:07:18,680
So you need to have

278
00:07:18,680 --> 00:07:19,760
this bill of materials

279
00:07:19,760 --> 00:07:20,180
that says,

280
00:07:20,320 --> 00:07:20,940
what is everything

281
00:07:20,940 --> 00:07:22,420
that it contains

282
00:07:22,420 --> 00:07:24,500
and what version are they?

283
00:07:24,800 --> 00:07:25,660
And then as it's,

284
00:07:25,760 --> 00:07:26,640
okay, so that's me

285
00:07:26,640 --> 00:07:28,220
defining it for myself.

286
00:07:28,620 --> 00:07:29,300
You're doing a great job.

287
00:07:29,500 --> 00:07:30,500
And so in that area,

288
00:07:30,500 --> 00:07:31,120
as you're saying,

289
00:07:31,220 --> 00:07:32,180
talk to this idea

290
00:07:32,180 --> 00:07:34,160
that we've done this

291
00:07:34,160 --> 00:07:34,940
for hardware,

292
00:07:34,940 --> 00:07:36,420
but not for software.

293
00:07:36,540 --> 00:07:37,020
What is that?

294
00:07:37,140 --> 00:07:38,360
Like when you get a chip,

295
00:07:38,360 --> 00:07:39,320
is there like a bill

296
00:07:39,320 --> 00:07:40,240
of materials that comes

297
00:07:40,240 --> 00:07:41,060
in it or storage?

298
00:07:41,180 --> 00:07:41,720
Or what does that bill

299
00:07:41,720 --> 00:07:42,640
of materials look like

300
00:07:42,640 --> 00:07:43,260
for hardware?

301
00:07:43,540 --> 00:07:44,020
Yeah, it's interesting.

302
00:07:44,200 --> 00:07:44,940
If you look at a lot

303
00:07:44,940 --> 00:07:45,380
of hardware,

304
00:07:45,700 --> 00:07:46,360
a lot of them have,

305
00:07:46,640 --> 00:07:47,460
even when you order it,

306
00:07:47,480 --> 00:07:48,920
it has a list of SKUs

307
00:07:48,920 --> 00:07:49,740
that tells you

308
00:07:49,740 --> 00:07:50,840
all the different parts.

309
00:07:51,180 --> 00:07:51,980
And you can actually

310
00:07:51,980 --> 00:07:52,680
rationalize that

311
00:07:52,680 --> 00:07:53,360
where some of the,

312
00:07:53,420 --> 00:07:54,080
like where does the

313
00:07:54,080 --> 00:07:54,840
silicon come from,

314
00:07:54,940 --> 00:07:56,240
which Intel provided,

315
00:07:56,420 --> 00:07:56,540
right?

316
00:07:56,860 --> 00:07:58,040
So you can have

317
00:07:58,040 --> 00:07:58,920
some pieces of it.

318
00:07:58,960 --> 00:07:59,900
It's still not perfect

319
00:07:59,900 --> 00:08:00,700
in all sense,

320
00:08:00,740 --> 00:08:01,800
but to use your analogy,

321
00:08:01,920 --> 00:08:02,600
which you have

322
00:08:02,600 --> 00:08:04,220
for some of the UI components,

323
00:08:04,380 --> 00:08:05,000
currently a developer

324
00:08:05,000 --> 00:08:06,180
that has implicit trust.

325
00:08:06,300 --> 00:08:07,480
It's just an NPM,

326
00:08:07,880 --> 00:08:08,820
install the package,

327
00:08:09,220 --> 00:08:10,100
poof, it's there.

328
00:08:10,180 --> 00:08:11,120
But you have trusted

329
00:08:11,120 --> 00:08:12,140
all the things

330
00:08:12,140 --> 00:08:13,960
that the package contains.

331
00:08:14,260 --> 00:08:14,880
And most of the developers

332
00:08:14,880 --> 00:08:15,660
don't know what's

333
00:08:15,660 --> 00:08:16,600
inside of the package.

334
00:08:16,820 --> 00:08:17,540
They just know like,

335
00:08:17,600 --> 00:08:18,360
I need this library

336
00:08:18,360 --> 00:08:19,440
and magic happens.

337
00:08:19,680 --> 00:08:20,400
On the hardware side,

338
00:08:20,560 --> 00:08:21,140
to a certain extent,

339
00:08:21,240 --> 00:08:22,360
you can rationalize over

340
00:08:22,360 --> 00:08:23,220
because there is a,

341
00:08:23,280 --> 00:08:24,420
an actual piece of paper

342
00:08:24,420 --> 00:08:24,840
that says,

343
00:08:24,920 --> 00:08:25,660
well, there's all the stuff

344
00:08:25,660 --> 00:08:26,360
that's in it.

345
00:08:26,460 --> 00:08:27,300
And so it creates

346
00:08:27,300 --> 00:08:29,080
this direct acycle graph

347
00:08:29,080 --> 00:08:30,480
per se that shows

348
00:08:30,480 --> 00:08:31,380
this component uses

349
00:08:31,380 --> 00:08:32,020
this component

350
00:08:32,020 --> 00:08:33,020
of this version.

351
00:08:33,340 --> 00:08:34,240
And you can walk

352
00:08:34,240 --> 00:08:35,400
that piece to understand

353
00:08:35,400 --> 00:08:36,760
like at each component,

354
00:08:37,020 --> 00:08:38,020
where did it come from?

355
00:08:38,120 --> 00:08:39,040
Who created it?

356
00:08:39,180 --> 00:08:40,280
What were the vulnerabilities

357
00:08:40,280 --> 00:08:41,820
in that particular component?

358
00:08:42,200 --> 00:08:43,660
Is there licensing concerns?

359
00:08:43,820 --> 00:08:44,620
Because this is another part

360
00:08:44,620 --> 00:08:45,320
that people forget.

361
00:08:45,500 --> 00:08:46,180
Like certain libraries

362
00:08:46,180 --> 00:08:47,160
have licensing

363
00:08:47,160 --> 00:08:48,400
that actually requires

364
00:08:48,400 --> 00:08:49,280
you to contribute back.

365
00:08:49,460 --> 00:08:50,360
So to your example,

366
00:08:50,480 --> 00:08:51,480
so if you use

367
00:08:51,480 --> 00:08:52,520
that particular library

368
00:08:52,520 --> 00:08:53,360
and you make changes

369
00:08:53,360 --> 00:08:54,460
and now you have to contribute

370
00:08:54,460 --> 00:08:55,300
your code back

371
00:08:55,300 --> 00:08:55,900
to the community,

372
00:08:56,160 --> 00:08:56,900
well, bank might not

373
00:08:56,900 --> 00:08:57,480
want to do that.

374
00:08:57,660 --> 00:08:58,480
And so do you need

375
00:08:58,480 --> 00:08:59,140
to be able to say,

376
00:08:59,260 --> 00:09:00,480
okay, is this license conducive

377
00:09:00,480 --> 00:09:01,920
for me to do business?

378
00:09:02,160 --> 00:09:02,660
There's two other things.

379
00:09:02,780 --> 00:09:03,300
There's scanning.

380
00:09:03,520 --> 00:09:04,640
And that seems to be like,

381
00:09:04,720 --> 00:09:05,840
especially when it comes

382
00:09:05,840 --> 00:09:06,420
to licensing,

383
00:09:06,420 --> 00:09:07,300
as you just mentioned,

384
00:09:07,400 --> 00:09:07,560
right?

385
00:09:07,580 --> 00:09:08,500
There's companies like,

386
00:09:08,600 --> 00:09:09,640
I think they're still around,

387
00:09:09,700 --> 00:09:10,420
like Black Duck

388
00:09:10,420 --> 00:09:11,500
and Palomita.

389
00:09:12,220 --> 00:09:13,620
Way back when I was an analyst,

390
00:09:13,620 --> 00:09:14,900
I used to know them better.

391
00:09:15,080 --> 00:09:16,040
They'll literally like,

392
00:09:16,200 --> 00:09:17,280
and it's great for open source

393
00:09:17,280 --> 00:09:17,880
because you actually

394
00:09:17,880 --> 00:09:18,580
can get the code,

395
00:09:18,660 --> 00:09:19,900
but they'll scan your code

396
00:09:19,900 --> 00:09:21,120
and even your compiled code

397
00:09:21,120 --> 00:09:22,020
and generate fingerprints

398
00:09:22,020 --> 00:09:22,640
of everything.

399
00:09:22,960 --> 00:09:23,820
And they can tell you

400
00:09:23,820 --> 00:09:24,600
what you're using,

401
00:09:24,820 --> 00:09:25,180
essentially.

402
00:09:25,740 --> 00:09:26,540
And so when it comes

403
00:09:26,540 --> 00:09:28,300
to like scanning,

404
00:09:28,420 --> 00:09:29,520
because scanning is like,

405
00:09:29,720 --> 00:09:30,580
what would you call it?

406
00:09:30,800 --> 00:09:31,660
Post facto?

407
00:09:32,000 --> 00:09:33,040
What's the English for that?

408
00:09:33,140 --> 00:09:34,400
It's after the fact.

409
00:09:34,580 --> 00:09:35,560
Is that good enough?

410
00:09:35,860 --> 00:09:36,440
Or like what,

411
00:09:36,580 --> 00:09:37,980
how good is scanning things

412
00:09:37,980 --> 00:09:38,600
versus not?

413
00:09:38,700 --> 00:09:39,480
Like where does it fit

414
00:09:39,480 --> 00:09:40,500
into this idea

415
00:09:40,500 --> 00:09:42,180
of really understanding

416
00:09:42,180 --> 00:09:43,220
your supply chain?

417
00:09:43,360 --> 00:09:43,480
Yeah,

418
00:09:43,540 --> 00:09:44,300
I think more and more

419
00:09:44,300 --> 00:09:45,040
the scanners

420
00:09:45,040 --> 00:09:46,640
definitely do a good job.

421
00:09:46,800 --> 00:09:48,000
But the problem is that

422
00:09:48,000 --> 00:09:49,840
if your CPU cycles

423
00:09:49,840 --> 00:09:50,960
in your environment,

424
00:09:51,080 --> 00:09:51,600
there's more about

425
00:09:51,600 --> 00:09:52,580
scanning continuously,

426
00:09:52,800 --> 00:09:53,320
taking it away

427
00:09:53,320 --> 00:09:54,800
from actually doing actual work.

428
00:09:55,140 --> 00:09:56,640
So I have to have an hypothesis

429
00:09:56,640 --> 00:09:57,540
that you,

430
00:09:57,940 --> 00:09:58,820
if you have the right

431
00:09:58,820 --> 00:09:59,880
at a station,

432
00:10:00,220 --> 00:10:00,740
a trusted,

433
00:10:01,040 --> 00:10:01,660
you can eliminate

434
00:10:01,660 --> 00:10:02,660
actually a lot of scanning

435
00:10:02,660 --> 00:10:04,380
because what you can now do

436
00:10:04,380 --> 00:10:04,580
is say,

437
00:10:04,620 --> 00:10:04,760
yeah,

438
00:10:04,780 --> 00:10:06,340
I have a level of trust

439
00:10:06,340 --> 00:10:07,800
with some risk parameter

440
00:10:07,800 --> 00:10:08,940
that I allow things

441
00:10:08,940 --> 00:10:09,780
into the environment.

442
00:10:10,000 --> 00:10:11,000
It doesn't take away

443
00:10:11,000 --> 00:10:11,840
all the scanning.

444
00:10:12,000 --> 00:10:12,760
Don't get me wrong.

445
00:10:12,840 --> 00:10:13,760
There's always some level

446
00:10:13,760 --> 00:10:14,340
of piece.

447
00:10:14,480 --> 00:10:15,440
But to use an analogy,

448
00:10:15,620 --> 00:10:17,160
like if I take the Nutella,

449
00:10:17,260 --> 00:10:18,420
if you go to the grocery store

450
00:10:18,420 --> 00:10:19,620
and you can take it home

451
00:10:19,620 --> 00:10:21,180
and spread it out on your table

452
00:10:21,180 --> 00:10:22,100
and then get a lab

453
00:10:22,100 --> 00:10:22,620
and say,

454
00:10:22,740 --> 00:10:22,900
hey,

455
00:10:22,960 --> 00:10:24,040
take a look at my Nutella

456
00:10:24,040 --> 00:10:24,920
before I eat it,

457
00:10:25,000 --> 00:10:26,220
if you have to do that

458
00:10:26,220 --> 00:10:27,220
every single time

459
00:10:27,220 --> 00:10:27,980
to understand like

460
00:10:27,980 --> 00:10:28,840
what are the ingredients

461
00:10:28,840 --> 00:10:30,620
and that just takes away

462
00:10:30,620 --> 00:10:31,680
of what you're really

463
00:10:31,680 --> 00:10:32,380
trying to accomplish

464
00:10:32,380 --> 00:10:33,800
is to use the software.

465
00:10:34,080 --> 00:10:34,240
And then,

466
00:10:34,320 --> 00:10:35,120
so the next thing,

467
00:10:35,220 --> 00:10:36,360
let's continue the analogy.

468
00:10:36,560 --> 00:10:37,360
We'll stick with,

469
00:10:37,480 --> 00:10:38,220
apparently you have

470
00:10:38,220 --> 00:10:39,160
a Nutella obsession.

471
00:10:39,280 --> 00:10:39,900
I don't know why.

472
00:10:40,080 --> 00:10:40,960
We joke because I have

473
00:10:40,960 --> 00:10:41,800
these little videos

474
00:10:41,800 --> 00:10:43,200
where I put Nutella

475
00:10:43,200 --> 00:10:44,380
on things and taste them

476
00:10:44,380 --> 00:10:45,780
and see what it's like.

477
00:10:46,060 --> 00:10:46,380
Anyways,

478
00:10:46,500 --> 00:10:47,160
this brings together

479
00:10:47,160 --> 00:10:47,740
another thing

480
00:10:47,740 --> 00:10:48,780
I wanted to talk about

481
00:10:48,780 --> 00:10:50,320
is that I'm always interested

482
00:10:50,320 --> 00:10:51,180
in why are we talking

483
00:10:51,180 --> 00:10:52,160
about this thing now?

484
00:10:52,400 --> 00:10:53,360
Like this is security

485
00:10:53,360 --> 00:10:54,460
is like one of those things

486
00:10:54,460 --> 00:10:55,140
where things have

487
00:10:55,140 --> 00:10:56,200
always been secure

488
00:10:56,200 --> 00:10:56,640
or not.

489
00:10:56,680 --> 00:10:57,540
It's always an issue.

490
00:10:57,540 --> 00:10:59,300
And I was thinking like,

491
00:10:59,560 --> 00:10:59,760
let's,

492
00:10:59,880 --> 00:11:00,380
I'll see how far

493
00:11:00,380 --> 00:11:01,540
we can stretch this analogy.

494
00:11:02,080 --> 00:11:02,580
One of the things

495
00:11:02,580 --> 00:11:03,440
that comes up nowadays

496
00:11:03,440 --> 00:11:04,860
with doing like cloud

497
00:11:04,860 --> 00:11:05,620
native development

498
00:11:05,620 --> 00:11:06,880
or let's just call it

499
00:11:06,880 --> 00:11:07,940
development nowadays

500
00:11:07,940 --> 00:11:10,360
is you can go through

501
00:11:10,360 --> 00:11:11,840
a coding deployment cycle

502
00:11:11,840 --> 00:11:12,540
so quick

503
00:11:12,540 --> 00:11:13,560
that to your point,

504
00:11:13,840 --> 00:11:14,540
scanning wouldn't

505
00:11:14,540 --> 00:11:15,920
necessarily be feasible

506
00:11:15,920 --> 00:11:17,580
to scan the entire stack,

507
00:11:17,640 --> 00:11:17,800
right?

508
00:11:17,880 --> 00:11:18,420
over here.

509
00:11:18,420 --> 00:11:19,420
As I'm sure you're

510
00:11:19,420 --> 00:11:19,920
familiar with,

511
00:11:19,960 --> 00:11:21,000
there's booking.com

512
00:11:21,000 --> 00:11:22,000
and they're renowned

513
00:11:22,000 --> 00:11:23,440
for doing like thousands

514
00:11:23,440 --> 00:11:24,540
of tests a week

515
00:11:24,540 --> 00:11:25,120
or a day,

516
00:11:25,240 --> 00:11:26,240
like different variations

517
00:11:26,240 --> 00:11:26,760
of things.

518
00:11:27,020 --> 00:11:27,560
If you were doing

519
00:11:27,560 --> 00:11:29,140
like 2,000 deploys

520
00:11:29,140 --> 00:11:29,920
a week,

521
00:11:30,200 --> 00:11:31,060
like that would be,

522
00:11:31,300 --> 00:11:32,080
scanning would start

523
00:11:32,080 --> 00:11:33,080
to take too much time.

524
00:11:33,260 --> 00:11:33,460
Similarly,

525
00:11:33,460 --> 00:11:34,460
if I came home

526
00:11:34,460 --> 00:11:35,600
and I made

527
00:11:35,600 --> 00:11:37,060
100 Nutella sandwiches

528
00:11:37,060 --> 00:11:38,140
and it took me

529
00:11:38,140 --> 00:11:39,040
like three minutes

530
00:11:39,040 --> 00:11:40,260
to lab scan them,

531
00:11:40,360 --> 00:11:41,060
each sandwich,

532
00:11:41,220 --> 00:11:42,520
that would be impractical.

533
00:11:42,740 --> 00:11:43,920
Never mind the practicality

534
00:11:43,920 --> 00:11:45,220
of 100 Nutella sandwiches.

535
00:11:45,560 --> 00:11:46,660
It's almost as you're saying,

536
00:11:46,720 --> 00:11:47,520
you need another way

537
00:11:47,520 --> 00:11:48,120
where you can

538
00:11:48,120 --> 00:11:49,300
more deterministically

539
00:11:49,300 --> 00:11:50,940
not have to scan something.

540
00:11:51,280 --> 00:11:52,040
And so scanning

541
00:11:52,040 --> 00:11:52,720
reaches a limitation

542
00:11:52,720 --> 00:11:53,580
if you're deploying

543
00:11:53,580 --> 00:11:54,940
multiple times a day,

544
00:11:55,100 --> 00:11:55,500
essentially.

545
00:11:55,980 --> 00:11:57,220
And at the very least,

546
00:11:57,220 --> 00:11:58,360
when it comes to code,

547
00:11:58,360 --> 00:11:59,220
you need to know

548
00:11:59,220 --> 00:12:00,220
a smaller amount

549
00:12:00,220 --> 00:12:01,200
of things to scan

550
00:12:01,200 --> 00:12:02,520
than the entire stack

551
00:12:02,520 --> 00:12:03,620
of software that you have.

552
00:12:03,840 --> 00:12:03,900
Yeah,

553
00:12:03,980 --> 00:12:04,680
it just becomes

554
00:12:04,680 --> 00:12:05,720
a complex problem

555
00:12:05,720 --> 00:12:06,100
at the point.

556
00:12:06,240 --> 00:12:07,580
It's like Intel famously

557
00:12:07,580 --> 00:12:08,800
said a long time ago,

558
00:12:08,860 --> 00:12:09,820
it's like if we had to

559
00:12:09,820 --> 00:12:10,940
scan and test

560
00:12:10,940 --> 00:12:11,880
every permutation

561
00:12:11,880 --> 00:12:12,980
in the Intel processor,

562
00:12:13,220 --> 00:12:14,120
we would never release

563
00:12:14,120 --> 00:12:15,000
a new processor

564
00:12:15,000 --> 00:12:15,840
because it takes

565
00:12:15,840 --> 00:12:16,660
them so long

566
00:12:16,660 --> 00:12:17,480
to do this stuff.

567
00:12:17,680 --> 00:12:18,620
So companies forward

568
00:12:18,620 --> 00:12:20,480
doing every scanning,

569
00:12:20,600 --> 00:12:21,460
any permutation

570
00:12:21,460 --> 00:12:22,960
that might potentially exist,

571
00:12:23,020 --> 00:12:24,240
it's just too much

572
00:12:24,240 --> 00:12:24,800
to do.

573
00:12:24,940 --> 00:12:25,480
That's where the problem

574
00:12:25,480 --> 00:12:25,800
comes in.

575
00:12:25,860 --> 00:12:26,980
So at some level

576
00:12:26,980 --> 00:12:27,780
where I come back

577
00:12:27,780 --> 00:12:28,420
to the supply chain,

578
00:12:28,480 --> 00:12:29,400
you have to instill

579
00:12:29,400 --> 00:12:30,280
trust in it.

580
00:12:30,420 --> 00:12:31,540
You trust certain vendors,

581
00:12:31,660 --> 00:12:33,000
you trust certain things

582
00:12:33,000 --> 00:12:34,760
based on some risk scoring,

583
00:12:35,020 --> 00:12:35,920
relative risk scoring.

584
00:12:36,000 --> 00:12:36,240
And there's some

585
00:12:36,240 --> 00:12:36,860
interesting research

586
00:12:36,860 --> 00:12:37,460
being going on

587
00:12:37,460 --> 00:12:37,940
in this area,

588
00:12:38,040 --> 00:12:38,740
but can I create

589
00:12:38,740 --> 00:12:40,040
some relative risk scoring

590
00:12:40,040 --> 00:12:41,000
of what I get

591
00:12:41,000 --> 00:12:41,520
into the door

592
00:12:41,520 --> 00:12:42,600
and make my decisions

593
00:12:42,600 --> 00:12:43,980
based on that number?

594
00:12:44,220 --> 00:12:45,040
And that it's a factor

595
00:12:45,040 --> 00:12:46,260
of what is the impact

596
00:12:46,260 --> 00:12:46,820
potentially,

597
00:12:47,000 --> 00:12:48,260
the number of CVEs

598
00:12:48,260 --> 00:12:49,260
and whatnot versus

599
00:12:49,260 --> 00:12:50,280
in trying to scan

600
00:12:50,280 --> 00:12:50,900
the whole thing,

601
00:12:50,960 --> 00:12:51,760
you can really take

602
00:12:51,760 --> 00:12:52,740
what the vendor has said

603
00:12:52,740 --> 00:12:53,500
and there's some level

604
00:12:53,500 --> 00:12:54,120
of attestation

605
00:12:54,120 --> 00:12:55,120
and accreditation

606
00:12:55,120 --> 00:12:56,240
that might happen.

607
00:12:56,440 --> 00:12:56,740
Does that make sense?

608
00:12:56,740 --> 00:12:57,680
So then hopefully

609
00:12:57,680 --> 00:12:58,740
this won't be too much

610
00:12:58,740 --> 00:13:00,300
of an abstract rabbit hole

611
00:13:00,300 --> 00:13:01,280
to dump on the table

612
00:13:01,280 --> 00:13:01,980
right here.

613
00:13:02,120 --> 00:13:03,560
But anytime people come up

614
00:13:03,560 --> 00:13:05,240
with things like attestation,

615
00:13:05,620 --> 00:13:07,080
that's a funny way to say it,

616
00:13:07,140 --> 00:13:08,220
or trusting the bill

617
00:13:08,220 --> 00:13:08,780
of materials

618
00:13:08,780 --> 00:13:10,160
and then that immediately,

619
00:13:10,400 --> 00:13:11,700
like in the modern way

620
00:13:11,700 --> 00:13:12,600
of thinking about security,

621
00:13:12,600 --> 00:13:13,200
it's all about

622
00:13:13,200 --> 00:13:14,280
like risk management

623
00:13:14,280 --> 00:13:15,820
and expressing the risk

624
00:13:15,820 --> 00:13:16,880
to a decision maker

625
00:13:16,880 --> 00:13:17,820
who then makes

626
00:13:17,820 --> 00:13:18,420
a decision,

627
00:13:18,540 --> 00:13:18,960
lesser no.

628
00:13:18,960 --> 00:13:19,600
And especially

629
00:13:19,600 --> 00:13:20,920
since you have experience

630
00:13:20,920 --> 00:13:22,140
on the actual,

631
00:13:22,540 --> 00:13:23,420
whatever you would call them,

632
00:13:23,500 --> 00:13:24,180
customer side,

633
00:13:24,300 --> 00:13:25,460
on the side of companies

634
00:13:25,460 --> 00:13:26,720
who go through this,

635
00:13:26,920 --> 00:13:28,400
like that always seems nice

636
00:13:28,400 --> 00:13:29,740
until like you're on

637
00:13:29,740 --> 00:13:30,440
the wrong side

638
00:13:30,440 --> 00:13:31,260
of the risk assessment

639
00:13:31,260 --> 00:13:32,560
and then people get fired.

640
00:13:32,700 --> 00:13:33,540
And I don't mean that

641
00:13:33,540 --> 00:13:35,080
in a flippant way,

642
00:13:35,380 --> 00:13:36,020
but there's something

643
00:13:36,020 --> 00:13:36,920
about understanding

644
00:13:36,920 --> 00:13:38,160
like a risk assessment

645
00:13:38,160 --> 00:13:39,620
that I don't quite,

646
00:13:39,720 --> 00:13:40,640
that I don't quite

647
00:13:40,640 --> 00:13:41,520
appreciate yet

648
00:13:41,520 --> 00:13:42,680
because it's almost like

649
00:13:42,680 --> 00:13:44,080
when if I say

650
00:13:44,080 --> 00:13:45,480
I'm 95% sure

651
00:13:45,480 --> 00:13:46,460
everything's cool

652
00:13:46,460 --> 00:13:47,740
with this security thing

653
00:13:47,740 --> 00:13:48,680
and then it's just

654
00:13:48,680 --> 00:13:49,860
the way statistics

655
00:13:49,860 --> 00:13:51,100
and percentages work,

656
00:13:51,220 --> 00:13:51,860
that means there's

657
00:13:51,860 --> 00:13:52,820
a 5% chance

658
00:13:52,820 --> 00:13:53,720
that it's not cool.

659
00:13:53,960 --> 00:13:55,280
90% confidence interval.

660
00:13:55,420 --> 00:13:55,880
That's where you're

661
00:13:55,880 --> 00:13:56,220
trying to go.

662
00:13:56,260 --> 00:13:57,420
And then so for example,

663
00:13:57,540 --> 00:13:58,420
let me try to ground it

664
00:13:58,420 --> 00:13:59,000
some, it's like

665
00:13:59,000 --> 00:14:00,760
for every big

666
00:14:00,760 --> 00:14:02,440
solar winds blow up,

667
00:14:02,440 --> 00:14:04,540
there are 90,

668
00:14:05,000 --> 00:14:05,940
there's I guess

669
00:14:05,940 --> 00:14:07,580
90 more didn't blow up

670
00:14:07,580 --> 00:14:08,640
and those were cool.

671
00:14:08,860 --> 00:14:09,860
But it's, I just,

672
00:14:09,960 --> 00:14:10,600
it's always like

673
00:14:10,600 --> 00:14:11,780
how do you deal

674
00:14:11,780 --> 00:14:13,220
with that 10%?

675
00:14:13,480 --> 00:14:14,300
Because it seems like

676
00:14:14,300 --> 00:14:14,980
if you're in that

677
00:14:14,980 --> 00:14:16,020
10% of failure,

678
00:14:16,300 --> 00:14:17,800
no one cares, right?

679
00:14:17,820 --> 00:14:18,520
No one's like,

680
00:14:18,640 --> 00:14:19,920
we gave you the risk assessment,

681
00:14:20,080 --> 00:14:20,960
these were the numbers,

682
00:14:21,080 --> 00:14:21,820
but we were just

683
00:14:21,820 --> 00:14:22,740
on the wrong side of it.

684
00:14:22,760 --> 00:14:23,260
Or am I thinking

685
00:14:23,260 --> 00:14:24,200
about it completely wrong

686
00:14:24,200 --> 00:14:24,680
and it's not that

687
00:14:24,680 --> 00:14:25,540
you want 90%,

688
00:14:25,540 --> 00:14:28,720
you want 99.999%, right?

689
00:14:28,920 --> 00:14:29,820
Yeah, it's interesting though.

690
00:14:29,880 --> 00:14:30,760
If you think about

691
00:14:30,760 --> 00:14:32,180
what risk assessments

692
00:14:32,180 --> 00:14:33,680
really are trying to do

693
00:14:33,680 --> 00:14:35,080
is you're trying to quantify,

694
00:14:35,400 --> 00:14:36,220
for those that do it well,

695
00:14:36,460 --> 00:14:37,440
that you're trying to quantify

696
00:14:37,440 --> 00:14:38,440
what's the impact.

697
00:14:38,560 --> 00:14:39,500
Like if there's no impact,

698
00:14:39,660 --> 00:14:40,260
then there's no,

699
00:14:40,480 --> 00:14:41,620
you don't care too much about it.

700
00:14:41,740 --> 00:14:41,940
Yeah.

701
00:14:42,600 --> 00:14:43,260
But what's happened,

702
00:14:43,300 --> 00:14:43,980
what's happened is

703
00:14:43,980 --> 00:14:45,680
the way things in the industry

704
00:14:45,680 --> 00:14:46,960
has prevailed

705
00:14:46,960 --> 00:14:48,600
with these risk assessments.

706
00:14:48,600 --> 00:14:49,560
Like this is like

707
00:14:49,560 --> 00:14:50,380
the compliance department

708
00:14:50,380 --> 00:14:50,880
coming down

709
00:14:50,880 --> 00:14:51,460
or the security of it.

710
00:14:51,500 --> 00:14:51,720
Hey,

711
00:14:51,860 --> 00:14:52,820
they shall have so much

712
00:14:52,820 --> 00:14:53,720
or less risk.

713
00:14:53,900 --> 00:14:54,820
But there's no context

714
00:14:54,820 --> 00:14:55,360
with these things

715
00:14:55,360 --> 00:14:56,300
and we're trying to do this

716
00:14:56,300 --> 00:14:57,140
through process

717
00:14:57,140 --> 00:14:58,140
like Serb and Oxley

718
00:14:58,140 --> 00:14:59,500
or any of the other ones

719
00:14:59,500 --> 00:15:00,180
that are out there.

720
00:15:00,340 --> 00:15:01,080
Somebody comes out there

721
00:15:01,080 --> 00:15:02,000
with this large spreadsheet

722
00:15:02,000 --> 00:15:03,540
of 500 controls

723
00:15:03,540 --> 00:15:04,660
that they shall meet

724
00:15:04,660 --> 00:15:06,060
and if they shall not meet it,

725
00:15:06,140 --> 00:15:07,800
then your risk is high.

726
00:15:08,020 --> 00:15:08,880
But it doesn't have

727
00:15:08,880 --> 00:15:09,580
any rationale

728
00:15:09,580 --> 00:15:10,480
in the sense of

729
00:15:10,480 --> 00:15:11,500
if I put this

730
00:15:11,500 --> 00:15:13,660
in my little cup over here

731
00:15:13,660 --> 00:15:15,020
and it's not doing anything

732
00:15:15,020 --> 00:15:16,200
with customer data,

733
00:15:16,500 --> 00:15:16,840
so what?

734
00:15:17,000 --> 00:15:17,500
But the problem is

735
00:15:17,500 --> 00:15:18,600
that we're using spreadsheets

736
00:15:18,600 --> 00:15:19,340
and processes

737
00:15:19,340 --> 00:15:21,320
to rationalize over this

738
00:15:21,320 --> 00:15:22,360
versus the circle back

739
00:15:22,360 --> 00:15:23,000
to DevSecOps

740
00:15:23,000 --> 00:15:25,220
is codifying ways

741
00:15:25,220 --> 00:15:26,640
to instill this

742
00:15:26,640 --> 00:15:27,800
in part of your flow

743
00:15:27,800 --> 00:15:29,100
of what you're trying to do

744
00:15:29,100 --> 00:15:30,100
and then have a better

745
00:15:30,100 --> 00:15:31,240
risk determination

746
00:15:31,240 --> 00:15:32,000
based on actually

747
00:15:32,000 --> 00:15:32,860
what's something

748
00:15:32,860 --> 00:15:33,780
that tests to

749
00:15:33,780 --> 00:15:35,340
or that you can verify.

750
00:15:35,680 --> 00:15:36,780
Yeah, no, I like that.

751
00:15:36,900 --> 00:15:37,820
I'll have to think about that

752
00:15:37,820 --> 00:15:38,140
for a while

753
00:15:38,140 --> 00:15:39,040
because I think

754
00:15:39,040 --> 00:15:39,980
what you pointed out

755
00:15:39,980 --> 00:15:41,260
is a lot of the

756
00:15:41,260 --> 00:15:42,480
risk management conversation

757
00:15:42,480 --> 00:15:43,780
I have encountered

758
00:15:43,780 --> 00:15:44,480
over the years

759
00:15:44,480 --> 00:15:45,360
as you're joking

760
00:15:45,360 --> 00:15:47,260
is about a number

761
00:15:47,260 --> 00:15:48,600
or like a percentage.

762
00:15:49,080 --> 00:15:49,760
And I'm sure

763
00:15:49,760 --> 00:15:51,780
as with all process like this,

764
00:15:51,840 --> 00:15:52,900
the intention is never

765
00:15:52,900 --> 00:15:54,260
for the following state.

766
00:15:54,560 --> 00:15:55,400
It just ends up

767
00:15:55,400 --> 00:15:56,040
being that way.

768
00:15:56,120 --> 00:15:56,820
Whereas what that

769
00:15:56,820 --> 00:15:58,440
one number lacks

770
00:15:58,440 --> 00:15:59,860
is context

771
00:15:59,860 --> 00:16:00,760
and that context

772
00:16:00,760 --> 00:16:02,440
being at least two things.

773
00:16:02,560 --> 00:16:03,340
One is,

774
00:16:03,460 --> 00:16:04,400
to put it in another

775
00:16:04,400 --> 00:16:04,860
flippant way,

776
00:16:04,940 --> 00:16:05,460
what's the worst

777
00:16:05,460 --> 00:16:06,140
that could happen?

778
00:16:06,460 --> 00:16:06,540
Right?

779
00:16:06,680 --> 00:16:07,300
Like, what are we

780
00:16:07,300 --> 00:16:08,060
talking about?

781
00:16:08,200 --> 00:16:09,340
Never mind that it's

782
00:16:09,340 --> 00:16:11,060
99.99%.

783
00:16:11,060 --> 00:16:13,000
What does that lead to?

784
00:16:13,120 --> 00:16:14,080
And then the other

785
00:16:14,080 --> 00:16:14,840
part of context

786
00:16:14,840 --> 00:16:15,940
is not only

787
00:16:15,940 --> 00:16:16,540
what's the worst

788
00:16:16,540 --> 00:16:17,080
that could happen

789
00:16:17,080 --> 00:16:18,680
but what am I giving up?

790
00:16:19,000 --> 00:16:20,020
The going through

791
00:16:20,020 --> 00:16:20,620
the analysis

792
00:16:20,620 --> 00:16:21,360
of getting

793
00:16:21,360 --> 00:16:22,540
of that risk assessment

794
00:16:22,540 --> 00:16:23,800
should include

795
00:16:23,800 --> 00:16:25,160
what that context is

796
00:16:25,160 --> 00:16:26,020
so that you can really

797
00:16:26,020 --> 00:16:27,200
make that kind of assumption

798
00:16:27,200 --> 00:16:28,020
or not assumption,

799
00:16:28,120 --> 00:16:28,580
you can make that

800
00:16:28,580 --> 00:16:29,080
kind of thinking.

801
00:16:29,220 --> 00:16:30,580
and so you can figure out

802
00:16:30,580 --> 00:16:30,940
like,

803
00:16:31,140 --> 00:16:31,760
we are willing

804
00:16:31,760 --> 00:16:33,420
to take on this risk

805
00:16:33,420 --> 00:16:34,600
because we want

806
00:16:34,600 --> 00:16:35,280
this outcome

807
00:16:35,280 --> 00:16:36,560
as a common day thing

808
00:16:36,560 --> 00:16:38,320
and then we understand

809
00:16:38,320 --> 00:16:39,520
the risks that we're taking.

810
00:16:39,620 --> 00:16:40,000
I don't know

811
00:16:40,000 --> 00:16:40,860
if this is actually true

812
00:16:40,860 --> 00:16:42,020
but it would be fun

813
00:16:42,020 --> 00:16:42,660
to think like,

814
00:16:42,780 --> 00:16:43,760
if we take on this risk,

815
00:16:43,820 --> 00:16:44,380
we can hedge

816
00:16:44,380 --> 00:16:45,420
by getting some insurance

817
00:16:45,420 --> 00:16:45,900
over here

818
00:16:45,900 --> 00:16:47,100
that if something bad happens

819
00:16:47,100 --> 00:16:48,180
and we all agree that.

820
00:16:48,180 --> 00:16:48,900
I like that analogy

821
00:16:48,900 --> 00:16:49,800
because you could

822
00:16:49,800 --> 00:16:50,640
to a certain extent

823
00:16:50,640 --> 00:16:51,140
associate,

824
00:16:51,500 --> 00:16:52,300
like insurance companies

825
00:16:52,300 --> 00:16:52,760
are actually good

826
00:16:52,760 --> 00:16:53,020
at this,

827
00:16:53,080 --> 00:16:53,700
assessing risk.

828
00:16:53,740 --> 00:16:54,280
That's basically

829
00:16:54,280 --> 00:16:54,780
what they do

830
00:16:54,780 --> 00:16:55,600
is risk assessment.

831
00:16:55,820 --> 00:16:56,920
You see a rover behind me

832
00:16:56,920 --> 00:16:57,760
but I worked at NASA

833
00:16:57,760 --> 00:16:58,120
for a while

834
00:16:58,120 --> 00:16:58,640
and one of the things

835
00:16:58,640 --> 00:16:59,260
that they've done

836
00:16:59,260 --> 00:16:59,900
very well

837
00:16:59,900 --> 00:17:00,960
is risk assessment

838
00:17:00,960 --> 00:17:02,240
and there's this notion

839
00:17:02,240 --> 00:17:03,460
of a two-by-two matrix.

840
00:17:03,820 --> 00:17:04,520
So the context

841
00:17:04,520 --> 00:17:05,500
is really also,

842
00:17:05,880 --> 00:17:06,680
you look at what

843
00:17:06,680 --> 00:17:07,600
the impact is

844
00:17:07,600 --> 00:17:08,720
but the other dimension

845
00:17:08,720 --> 00:17:09,620
is the likelihood

846
00:17:09,620 --> 00:17:10,960
for it to occur.

847
00:17:11,240 --> 00:17:11,760
So that's a part

848
00:17:11,760 --> 00:17:12,400
of the context.

849
00:17:12,720 --> 00:17:13,720
So you can then map out

850
00:17:13,720 --> 00:17:14,740
if you get a CVE

851
00:17:14,740 --> 00:17:15,960
and what's the likelihood

852
00:17:15,960 --> 00:17:17,600
of sets being exposed?

853
00:17:17,720 --> 00:17:19,320
It might be in a container

854
00:17:19,320 --> 00:17:20,760
and nothing happens.

855
00:17:20,920 --> 00:17:21,700
So that part is

856
00:17:21,700 --> 00:17:22,620
you need to get

857
00:17:22,620 --> 00:17:23,320
to that motion

858
00:17:23,320 --> 00:17:24,100
where everything

859
00:17:24,100 --> 00:17:24,820
in your risk,

860
00:17:24,920 --> 00:17:25,500
you assess it

861
00:17:25,500 --> 00:17:26,680
based on those two dimensions

862
00:17:26,680 --> 00:17:27,680
but you need to have

863
00:17:27,680 --> 00:17:28,740
a way of codifying

864
00:17:28,740 --> 00:17:29,560
those capabilities

865
00:17:29,560 --> 00:17:30,700
when things come

866
00:17:30,700 --> 00:17:31,640
into your inventory

867
00:17:31,640 --> 00:17:32,440
in the company

868
00:17:32,440 --> 00:17:33,400
from your supply chain.

869
00:17:33,540 --> 00:17:33,800
Say, oh,

870
00:17:33,820 --> 00:17:34,920
I can now rationalize

871
00:17:34,920 --> 00:17:35,300
over this.

872
00:17:35,540 --> 00:17:36,160
What's the likelihood

873
00:17:36,160 --> 00:17:36,980
of this happening?

874
00:17:37,240 --> 00:17:37,940
And it takes a little

875
00:17:37,940 --> 00:17:38,920
human intervention

876
00:17:38,920 --> 00:17:39,820
to a certain extent

877
00:17:39,820 --> 00:17:41,060
knowing the context

878
00:17:41,060 --> 00:17:41,960
of an application.

879
00:17:42,260 --> 00:17:42,740
So getting back

880
00:17:42,740 --> 00:17:44,400
to the trusted supply chain

881
00:17:44,400 --> 00:17:44,960
sort of thing,

882
00:17:45,020 --> 00:17:46,240
I think that's an interesting

883
00:17:46,240 --> 00:17:47,080
not consequence

884
00:17:47,080 --> 00:17:48,080
but not feature

885
00:17:48,080 --> 00:17:49,060
but capability

886
00:17:49,060 --> 00:17:50,240
you would want to have

887
00:17:50,240 --> 00:17:51,520
out of a trusted supply chain

888
00:17:51,520 --> 00:17:52,740
as you were teaching me there

889
00:17:52,740 --> 00:17:54,080
is I would like

890
00:17:54,080 --> 00:17:54,860
to be able

891
00:17:54,860 --> 00:17:56,540
to assess

892
00:17:56,540 --> 00:17:57,720
the trade-offs

893
00:17:57,720 --> 00:17:58,380
that I'm doing

894
00:17:58,380 --> 00:18:00,040
and using classic

895
00:18:00,040 --> 00:18:00,860
productivity thing.

896
00:18:00,960 --> 00:18:01,560
It's not only

897
00:18:01,560 --> 00:18:02,660
that I want to assess

898
00:18:02,660 --> 00:18:03,300
the trade-offs

899
00:18:03,300 --> 00:18:04,420
by like you giving me

900
00:18:04,420 --> 00:18:05,420
maximal information.

901
00:18:05,880 --> 00:18:06,640
I want you to like

902
00:18:06,640 --> 00:18:07,800
minimize the amount

903
00:18:07,800 --> 00:18:08,940
of noise.

904
00:18:09,340 --> 00:18:10,560
It may be positive noise

905
00:18:10,560 --> 00:18:11,480
but I don't want to know

906
00:18:11,480 --> 00:18:13,080
about every single thing

907
00:18:13,080 --> 00:18:14,140
or like spend time

908
00:18:14,140 --> 00:18:15,380
scanning every single thing.

909
00:18:15,480 --> 00:18:16,580
Figure out the optimal

910
00:18:16,580 --> 00:18:17,420
set of information

911
00:18:17,420 --> 00:18:18,220
that you can put

912
00:18:18,220 --> 00:18:19,180
in front of some people

913
00:18:19,180 --> 00:18:20,160
so that they can

914
00:18:20,160 --> 00:18:21,660
decide on the trade-offs

915
00:18:21,660 --> 00:18:22,580
and the trade-offs

916
00:18:22,580 --> 00:18:23,260
might be like,

917
00:18:23,540 --> 00:18:23,760
no,

918
00:18:23,940 --> 00:18:24,860
I don't trust it.

919
00:18:25,060 --> 00:18:25,540
Go back.

920
00:18:25,540 --> 00:18:25,980
Yeah,

921
00:18:26,040 --> 00:18:27,040
I guess that's what happens

922
00:18:27,040 --> 00:18:27,840
with scanners

923
00:18:27,840 --> 00:18:28,780
to a certain extent

924
00:18:28,780 --> 00:18:29,500
to talk back.

925
00:18:29,740 --> 00:18:30,640
It's the same as

926
00:18:30,640 --> 00:18:32,420
if you get so much information

927
00:18:32,420 --> 00:18:33,580
you get so much noise

928
00:18:33,580 --> 00:18:34,480
but you really want to get

929
00:18:34,480 --> 00:18:35,020
and try to find

930
00:18:35,020 --> 00:18:35,820
the signal to noise

931
00:18:35,820 --> 00:18:36,820
or reduce the signal

932
00:18:36,820 --> 00:18:37,260
to ratio

933
00:18:37,260 --> 00:18:38,980
and there's some

934
00:18:38,980 --> 00:18:40,000
interesting software already

935
00:18:40,000 --> 00:18:40,860
that people are starting

936
00:18:40,860 --> 00:18:41,440
to come up with

937
00:18:41,440 --> 00:18:42,080
to rationalize

938
00:18:42,080 --> 00:18:42,840
over the supply chain

939
00:18:42,840 --> 00:18:43,920
like dependency tracker

940
00:18:43,920 --> 00:18:44,620
is an example

941
00:18:44,620 --> 00:18:45,820
of an open source project

942
00:18:45,820 --> 00:18:47,180
where you can bring it in

943
00:18:47,180 --> 00:18:47,820
and you can actually

944
00:18:47,820 --> 00:18:49,120
see the CVEs

945
00:18:49,120 --> 00:18:50,540
and then have a way

946
00:18:50,540 --> 00:18:51,920
of in context

947
00:18:51,920 --> 00:18:53,720
associate some risk scoring

948
00:18:53,720 --> 00:18:54,300
with that

949
00:18:54,300 --> 00:18:55,900
and so instead of looking at

950
00:18:55,900 --> 00:18:57,140
oh CVEs are high

951
00:18:57,140 --> 00:18:57,800
medium or low

952
00:18:57,800 --> 00:18:58,400
and based on that

953
00:18:58,400 --> 00:18:59,140
making determination

954
00:18:59,140 --> 00:19:00,180
that's kind of noise

955
00:19:00,180 --> 00:19:01,440
in the overall perspective

956
00:19:01,440 --> 00:19:02,360
but getting it down

957
00:19:02,360 --> 00:19:03,220
to this notion of

958
00:19:03,220 --> 00:19:04,020
okay what is a relative

959
00:19:04,020 --> 00:19:04,940
risk score

960
00:19:04,940 --> 00:19:05,980
that I can do

961
00:19:05,980 --> 00:19:07,060
and then systematically

962
00:19:07,060 --> 00:19:07,840
like what flows

963
00:19:07,840 --> 00:19:08,560
into production

964
00:19:08,560 --> 00:19:10,140
to base it on a risk score

965
00:19:10,140 --> 00:19:11,340
versus on high

966
00:19:11,340 --> 00:19:12,720
medium or low CVEs

967
00:19:12,720 --> 00:19:13,060
right

968
00:19:13,060 --> 00:19:14,200
because the volatility

969
00:19:14,200 --> 00:19:15,020
and the velocity

970
00:19:15,020 --> 00:19:15,980
on the CVEs

971
00:19:15,980 --> 00:19:17,100
is just going to increase

972
00:19:17,100 --> 00:19:17,700
more and more

973
00:19:17,700 --> 00:19:18,900
as we move into

974
00:19:18,900 --> 00:19:20,020
the software industry

975
00:19:20,020 --> 00:19:20,980
you just want to be able

976
00:19:20,980 --> 00:19:21,720
to rationalize more

977
00:19:21,720 --> 00:19:22,800
on a risk basis.

978
00:19:23,020 --> 00:19:24,100
All right so let's see

979
00:19:24,100 --> 00:19:24,600
if we get back

980
00:19:24,600 --> 00:19:25,000
to the main

981
00:19:25,000 --> 00:19:25,880
so I cut you off

982
00:19:25,880 --> 00:19:27,280
at Bill of Material

983
00:19:27,280 --> 00:19:27,980
generation.

984
00:19:28,180 --> 00:19:29,580
Yeah so Bill of Material

985
00:19:29,580 --> 00:19:30,000
is kind of like

986
00:19:30,000 --> 00:19:30,640
one of those first

987
00:19:30,640 --> 00:19:32,280
like what are the ingredients

988
00:19:32,280 --> 00:19:33,060
but the other thing

989
00:19:33,060 --> 00:19:33,560
that the industry

990
00:19:33,560 --> 00:19:34,580
needs with this

991
00:19:34,580 --> 00:19:35,880
is a way of

992
00:19:35,880 --> 00:19:37,380
attesting to this as well

993
00:19:37,380 --> 00:19:38,080
to give an example

994
00:19:38,080 --> 00:19:39,120
like you can slap a label

995
00:19:39,120 --> 00:19:40,480
on the product

996
00:19:40,480 --> 00:19:41,160
and do you just

997
00:19:41,160 --> 00:19:42,100
the guy that made this

998
00:19:42,100 --> 00:19:43,120
or is there a way

999
00:19:43,120 --> 00:19:43,860
of attesting to it

1000
00:19:43,860 --> 00:19:45,000
so create some credibility

1001
00:19:45,000 --> 00:19:46,720
is important to establish trust

1002
00:19:46,720 --> 00:19:47,460
so for example

1003
00:19:47,460 --> 00:19:48,640
is that the FDA

1004
00:19:48,640 --> 00:19:49,520
in the United States

1005
00:19:49,520 --> 00:19:51,280
or is it some institution

1006
00:19:51,280 --> 00:19:52,160
that can attest

1007
00:19:52,160 --> 00:19:52,620
that yes

1008
00:19:52,620 --> 00:19:53,420
that vendor

1009
00:19:53,420 --> 00:19:54,320
has provided

1010
00:19:54,320 --> 00:19:55,220
the right material

1011
00:19:55,220 --> 00:19:55,880
or whatnot

1012
00:19:55,880 --> 00:19:56,640
so like an example

1013
00:19:56,640 --> 00:19:57,460
that we're starting

1014
00:19:57,460 --> 00:19:57,940
to do like

1015
00:19:57,940 --> 00:19:58,900
in Vietnam

1016
00:19:58,900 --> 00:20:00,540
our application catalog

1017
00:20:00,540 --> 00:20:01,180
in Tanzu

1018
00:20:01,180 --> 00:20:02,520
what I'm really excited

1019
00:20:02,520 --> 00:20:03,260
about is that

1020
00:20:03,260 --> 00:20:04,560
we are actually doing

1021
00:20:04,560 --> 00:20:05,640
a lot of the tests

1022
00:20:05,640 --> 00:20:06,700
we're creating a bill

1023
00:20:06,700 --> 00:20:07,380
of material

1024
00:20:07,380 --> 00:20:08,480
the CVEs

1025
00:20:08,480 --> 00:20:09,120
and we're doing it

1026
00:20:09,120 --> 00:20:10,220
as part of a process

1027
00:20:10,220 --> 00:20:11,680
and then the next thing

1028
00:20:11,680 --> 00:20:12,640
is to attest

1029
00:20:12,640 --> 00:20:13,100
to that as well

1030
00:20:13,100 --> 00:20:14,120
so cryptographically

1031
00:20:14,120 --> 00:20:14,880
signing that

1032
00:20:14,880 --> 00:20:15,980
or a third party

1033
00:20:15,980 --> 00:20:17,180
through an audit mechanism

1034
00:20:17,180 --> 00:20:18,240
verifying that

1035
00:20:18,240 --> 00:20:19,020
what we've done

1036
00:20:19,020 --> 00:20:19,880
is actually true

1037
00:20:19,880 --> 00:20:20,920
so that creates excitement

1038
00:20:20,920 --> 00:20:22,000
because now a customer

1039
00:20:22,000 --> 00:20:22,740
can then take a look

1040
00:20:22,740 --> 00:20:23,320
at that and say

1041
00:20:23,320 --> 00:20:24,680
ah you've done the things

1042
00:20:24,680 --> 00:20:26,120
and I've got attestation

1043
00:20:26,120 --> 00:20:26,980
in place as well

1044
00:20:26,980 --> 00:20:27,720
but the interesting thing

1045
00:20:27,720 --> 00:20:28,520
with attestation

1046
00:20:28,520 --> 00:20:29,720
is not just saying

1047
00:20:29,720 --> 00:20:30,340
that the stuff

1048
00:20:30,340 --> 00:20:30,940
that's in there

1049
00:20:30,940 --> 00:20:31,420
it's also

1050
00:20:31,420 --> 00:20:32,200
what are the processes

1051
00:20:32,200 --> 00:20:33,180
that you've used

1052
00:20:33,180 --> 00:20:33,720
so for example

1053
00:20:33,720 --> 00:20:34,820
in the development space

1054
00:20:34,820 --> 00:20:35,700
has a developer

1055
00:20:35,700 --> 00:20:37,200
created tests

1056
00:20:37,200 --> 00:20:38,040
unit tests

1057
00:20:38,040 --> 00:20:38,660
for example

1058
00:20:38,660 --> 00:20:39,240
great

1059
00:20:39,240 --> 00:20:40,500
have they checked in

1060
00:20:40,500 --> 00:20:41,560
what was the PR

1061
00:20:41,560 --> 00:20:42,260
that they did

1062
00:20:42,260 --> 00:20:42,780
QA

1063
00:20:42,780 --> 00:20:43,360
have they done

1064
00:20:43,360 --> 00:20:44,080
their job

1065
00:20:44,080 --> 00:20:44,400
right

1066
00:20:44,400 --> 00:20:45,100
or there's some

1067
00:20:45,100 --> 00:20:45,620
other scanning

1068
00:20:45,620 --> 00:20:46,600
those steps

1069
00:20:46,600 --> 00:20:48,080
along that flow

1070
00:20:48,080 --> 00:20:48,920
need to be attested

1071
00:20:48,920 --> 00:20:49,520
to as well

1072
00:20:49,520 --> 00:20:50,260
and there's interesting

1073
00:20:50,260 --> 00:20:50,880
things in the industry

1074
00:20:50,880 --> 00:20:51,560
happening with this

1075
00:20:51,560 --> 00:20:52,180
it's like there's

1076
00:20:52,180 --> 00:20:53,300
frameworks like in Toto

1077
00:20:53,300 --> 00:20:54,120
that's starting to

1078
00:20:54,120 --> 00:20:55,020
you can certify

1079
00:20:55,020 --> 00:20:55,580
every step

1080
00:20:55,580 --> 00:20:56,240
that you've taken

1081
00:20:56,240 --> 00:20:57,180
so like in the factory

1082
00:20:57,180 --> 00:20:57,760
when you're making

1083
00:20:57,760 --> 00:20:58,240
the product

1084
00:20:58,240 --> 00:20:59,020
as it moves

1085
00:20:59,020 --> 00:20:59,860
inside of the factory

1086
00:20:59,860 --> 00:21:00,620
every step

1087
00:21:00,620 --> 00:21:01,340
that has happened

1088
00:21:01,340 --> 00:21:02,240
in the factory

1089
00:21:02,240 --> 00:21:02,880
can you attest

1090
00:21:02,880 --> 00:21:03,320
that it actually

1091
00:21:03,320 --> 00:21:04,080
has happened

1092
00:21:04,080 --> 00:21:05,200
like using SolarWind

1093
00:21:05,200 --> 00:21:05,760
as an example

1094
00:21:05,760 --> 00:21:06,980
this wouldn't have solved

1095
00:21:06,980 --> 00:21:07,900
the SolarWind problem

1096
00:21:07,900 --> 00:21:09,060
just don't get me wrong

1097
00:21:09,060 --> 00:21:09,960
but the steps

1098
00:21:09,960 --> 00:21:10,440
that we're taking

1099
00:21:10,440 --> 00:21:11,180
to build a piece

1100
00:21:11,180 --> 00:21:11,740
of software

1101
00:21:11,740 --> 00:21:12,880
could you inspect

1102
00:21:12,880 --> 00:21:13,640
it to say

1103
00:21:13,640 --> 00:21:14,500
yes testing

1104
00:21:14,500 --> 00:21:15,100
has occurred

1105
00:21:15,100 --> 00:21:16,080
yes it was built

1106
00:21:16,080 --> 00:21:16,980
by this person

1107
00:21:16,980 --> 00:21:17,820
or it was built

1108
00:21:17,820 --> 00:21:19,040
by this machine

1109
00:21:19,040 --> 00:21:19,740
over here

1110
00:21:19,740 --> 00:21:20,480
what does that look like

1111
00:21:20,480 --> 00:21:21,840
is that a manual process

1112
00:21:21,840 --> 00:21:23,740
or like cyborg process

1113
00:21:23,740 --> 00:21:24,860
manual and automated

1114
00:21:24,860 --> 00:21:25,600
or like just

1115
00:21:25,600 --> 00:21:26,560
just to let me make

1116
00:21:26,560 --> 00:21:27,460
a really simple example

1117
00:21:27,460 --> 00:21:28,180
we have someone

1118
00:21:28,180 --> 00:21:29,360
specify a feature

1119
00:21:29,360 --> 00:21:30,160
in our pagination

1120
00:21:30,160 --> 00:21:30,580
framework

1121
00:21:30,580 --> 00:21:31,520
so that's one step

1122
00:21:31,520 --> 00:21:32,380
then we have

1123
00:21:32,380 --> 00:21:33,000
a developer

1124
00:21:33,000 --> 00:21:34,600
write the feature

1125
00:21:34,600 --> 00:21:35,700
in the pagination thing

1126
00:21:35,700 --> 00:21:36,240
I don't know

1127
00:21:36,240 --> 00:21:37,060
they want to use

1128
00:21:37,060 --> 00:21:38,040
two dots in the middle

1129
00:21:38,040 --> 00:21:38,860
instead of listing

1130
00:21:38,860 --> 00:21:39,900
500 pages

1131
00:21:39,900 --> 00:21:40,320
whatever

1132
00:21:40,320 --> 00:21:40,960
and then

1133
00:21:40,960 --> 00:21:41,620
so then

1134
00:21:41,620 --> 00:21:43,080
someone has to test that

1135
00:21:43,080 --> 00:21:44,020
and then you bundle

1136
00:21:44,020 --> 00:21:45,680
that into a build

1137
00:21:45,680 --> 00:21:46,260
whatever

1138
00:21:46,260 --> 00:21:47,500
and then you upload

1139
00:21:47,500 --> 00:21:48,480
that to a website

1140
00:21:48,480 --> 00:21:49,460
and I only mention that

1141
00:21:49,460 --> 00:21:50,360
because there's a step

1142
00:21:50,360 --> 00:21:51,160
I don't know what you call this

1143
00:21:51,160 --> 00:21:51,820
but there's a step

1144
00:21:51,820 --> 00:21:52,740
of making sure

1145
00:21:52,740 --> 00:21:54,220
I got the actual build

1146
00:21:54,220 --> 00:21:55,020
like verifying

1147
00:21:55,020 --> 00:21:55,800
so like with the

1148
00:21:55,800 --> 00:21:56,300
in toto

1149
00:21:56,300 --> 00:21:57,700
what does it do

1150
00:21:57,700 --> 00:21:59,140
in each of those steps

1151
00:21:59,140 --> 00:22:00,260
so first you define

1152
00:22:00,260 --> 00:22:01,440
what the steps are

1153
00:22:01,440 --> 00:22:01,820
right

1154
00:22:01,820 --> 00:22:02,120
yeah

1155
00:22:02,120 --> 00:22:03,740
and any transition

1156
00:22:03,740 --> 00:22:04,420
from one step

1157
00:22:04,420 --> 00:22:05,080
to another step

1158
00:22:05,080 --> 00:22:06,120
gets certified

1159
00:22:06,120 --> 00:22:06,920
like signed

1160
00:22:06,920 --> 00:22:07,520
essentially

1161
00:22:07,520 --> 00:22:08,300
and so

1162
00:22:08,300 --> 00:22:09,400
an easy analogy

1163
00:22:09,400 --> 00:22:10,260
we're already familiar

1164
00:22:10,260 --> 00:22:11,240
with using git

1165
00:22:11,240 --> 00:22:11,900
for the most part

1166
00:22:11,900 --> 00:22:12,100
right

1167
00:22:12,100 --> 00:22:12,460
so

1168
00:22:12,460 --> 00:22:13,000
you're already

1169
00:22:13,000 --> 00:22:14,280
implicitly doing this

1170
00:22:14,280 --> 00:22:14,740
by saying

1171
00:22:14,740 --> 00:22:15,940
hey I do a pull request

1172
00:22:15,940 --> 00:22:16,180
right

1173
00:22:16,180 --> 00:22:16,800
you've signed

1174
00:22:16,800 --> 00:22:17,660
you get a signature

1175
00:22:17,660 --> 00:22:19,060
but it's not cryptographically

1176
00:22:19,060 --> 00:22:19,640
signed

1177
00:22:19,640 --> 00:22:21,080
for any means

1178
00:22:21,080 --> 00:22:22,120
it's more of like a hash

1179
00:22:22,120 --> 00:22:22,800
that happens

1180
00:22:22,800 --> 00:22:23,340
so in total

1181
00:22:23,340 --> 00:22:24,740
what that allows you to do

1182
00:22:24,740 --> 00:22:26,460
is more in general terms

1183
00:22:26,460 --> 00:22:27,560
say what are the steps

1184
00:22:27,560 --> 00:22:28,680
and along the way

1185
00:22:28,680 --> 00:22:30,100
you can sign the fact

1186
00:22:30,100 --> 00:22:31,000
that you have performed

1187
00:22:31,000 --> 00:22:31,520
that step

1188
00:22:31,520 --> 00:22:32,180
so now you can

1189
00:22:32,180 --> 00:22:33,080
rationalize

1190
00:22:33,080 --> 00:22:33,720
more over

1191
00:22:33,720 --> 00:22:34,260
have you done

1192
00:22:34,260 --> 00:22:34,900
all those steps

1193
00:22:34,900 --> 00:22:36,140
that you've said

1194
00:22:36,140 --> 00:22:36,500
you would do

1195
00:22:36,500 --> 00:22:37,120
like testing

1196
00:22:37,120 --> 00:22:38,080
okay so what you're doing

1197
00:22:38,080 --> 00:22:39,180
basically is

1198
00:22:39,180 --> 00:22:40,500
you're verifying

1199
00:22:40,500 --> 00:22:41,420
that someone

1200
00:22:41,420 --> 00:22:42,660
did something

1201
00:22:42,660 --> 00:22:43,280
and so

1202
00:22:43,280 --> 00:22:44,280
part of what you're trusting

1203
00:22:44,280 --> 00:22:45,600
is the meatware

1204
00:22:45,600 --> 00:22:46,700
sort of pipeline there

1205
00:22:46,700 --> 00:22:47,400
like the people

1206
00:22:47,400 --> 00:22:48,340
but you basically

1207
00:22:48,340 --> 00:22:48,740
want to know

1208
00:22:48,740 --> 00:22:49,380
this person

1209
00:22:49,380 --> 00:22:50,720
said they did this thing

1210
00:22:50,720 --> 00:22:51,020
right

1211
00:22:51,020 --> 00:22:52,000
this product manager

1212
00:22:52,000 --> 00:22:53,180
signed off on the feature

1213
00:22:53,180 --> 00:22:54,160
this developer

1214
00:22:54,160 --> 00:22:54,980
signed off

1215
00:22:54,980 --> 00:22:56,460
on checking it in

1216
00:22:56,460 --> 00:22:57,200
and we can also

1217
00:22:57,200 --> 00:22:58,060
verify that

1218
00:22:58,060 --> 00:22:58,800
what we have

1219
00:22:58,800 --> 00:23:00,120
is actually what they did

1220
00:23:00,120 --> 00:23:01,300
instead of another thing

1221
00:23:01,300 --> 00:23:01,760
and then

1222
00:23:01,760 --> 00:23:02,860
this QA person

1223
00:23:02,860 --> 00:23:03,940
we can verify

1224
00:23:03,940 --> 00:23:05,560
that this exact QA person

1225
00:23:05,560 --> 00:23:06,120
or entity

1226
00:23:06,120 --> 00:23:06,720
said they did

1227
00:23:06,720 --> 00:23:07,480
on and on

1228
00:23:07,480 --> 00:23:07,920
and so

1229
00:23:07,920 --> 00:23:08,540
there's nothing

1230
00:23:08,540 --> 00:23:09,200
like magic

1231
00:23:09,200 --> 00:23:09,820
about like

1232
00:23:09,820 --> 00:23:10,360
and then also

1233
00:23:10,360 --> 00:23:11,440
some AI came in

1234
00:23:11,440 --> 00:23:12,040
and looked at it

1235
00:23:12,040 --> 00:23:12,480
and made sure

1236
00:23:12,480 --> 00:23:12,980
that they were

1237
00:23:12,980 --> 00:23:13,800
actually doing

1238
00:23:13,800 --> 00:23:14,300
what they said

1239
00:23:14,300 --> 00:23:14,880
they were doing

1240
00:23:14,880 --> 00:23:15,740
it just lets you

1241
00:23:15,740 --> 00:23:16,540
track like

1242
00:23:16,540 --> 00:23:17,700
an individual's

1243
00:23:17,700 --> 00:23:18,460
saying yes

1244
00:23:18,460 --> 00:23:19,580
I did this thing

1245
00:23:19,580 --> 00:23:20,080
if you think about

1246
00:23:20,080 --> 00:23:21,180
a lot of compliance

1247
00:23:21,180 --> 00:23:21,760
right

1248
00:23:21,760 --> 00:23:22,200
if you actually

1249
00:23:22,200 --> 00:23:22,640
go through that

1250
00:23:22,640 --> 00:23:23,840
500 step

1251
00:23:23,840 --> 00:23:24,740
compliance checklist

1252
00:23:24,740 --> 00:23:25,300
most of them

1253
00:23:25,300 --> 00:23:26,040
actually have these

1254
00:23:26,040 --> 00:23:26,380
things like

1255
00:23:26,380 --> 00:23:27,420
oh what is your flow

1256
00:23:27,420 --> 00:23:28,340
have you accomplished

1257
00:23:28,340 --> 00:23:29,060
QA

1258
00:23:29,060 --> 00:23:29,900
and currently

1259
00:23:29,900 --> 00:23:30,380
yeah sure

1260
00:23:30,380 --> 00:23:31,360
just check the box

1261
00:23:31,360 --> 00:23:32,140
and move on

1262
00:23:32,140 --> 00:23:32,800
but this gives you

1263
00:23:32,800 --> 00:23:33,400
more of a

1264
00:23:33,400 --> 00:23:34,320
automated way

1265
00:23:34,320 --> 00:23:35,720
to attest

1266
00:23:35,720 --> 00:23:36,380
to these things

1267
00:23:36,380 --> 00:23:37,100
and like

1268
00:23:37,100 --> 00:23:37,920
if you start thinking

1269
00:23:37,920 --> 00:23:38,240
like our

1270
00:23:38,240 --> 00:23:39,300
build service

1271
00:23:39,300 --> 00:23:39,640
right

1272
00:23:39,640 --> 00:23:40,400
as it builds

1273
00:23:40,400 --> 00:23:41,340
the different pieces

1274
00:23:41,340 --> 00:23:42,180
you're going to test

1275
00:23:42,180 --> 00:23:42,740
that it has done

1276
00:23:42,740 --> 00:23:43,240
these things

1277
00:23:43,240 --> 00:23:44,040
you've done the

1278
00:23:44,040 --> 00:23:45,320
testing capabilities

1279
00:23:45,320 --> 00:23:45,760
I'm not saying

1280
00:23:45,760 --> 00:23:46,500
that every piece

1281
00:23:46,500 --> 00:23:46,920
of software

1282
00:23:46,920 --> 00:23:47,660
will do this

1283
00:23:47,660 --> 00:23:48,320
because ideally

1284
00:23:48,320 --> 00:23:48,700
you want to

1285
00:23:48,700 --> 00:23:49,420
establish trust

1286
00:23:49,420 --> 00:23:50,060
at a higher level

1287
00:23:50,060 --> 00:23:50,580
first

1288
00:23:50,580 --> 00:23:51,080
right

1289
00:23:51,080 --> 00:23:51,640
have you ever

1290
00:23:51,640 --> 00:23:52,200
built material

1291
00:23:52,200 --> 00:23:52,540
great

1292
00:23:52,540 --> 00:23:53,240
then the next level

1293
00:23:53,240 --> 00:23:53,940
is are you doing

1294
00:23:53,940 --> 00:23:54,300
the things

1295
00:23:54,300 --> 00:23:54,740
that you said

1296
00:23:54,740 --> 00:23:55,340
you would do

1297
00:23:55,340 --> 00:23:56,280
for your software

1298
00:23:56,280 --> 00:23:57,100
like testing

1299
00:23:57,100 --> 00:23:57,540
and all that

1300
00:23:57,540 --> 00:23:58,060
that's kind of

1301
00:23:58,060 --> 00:23:58,660
the next level

1302
00:23:58,660 --> 00:23:59,160
of trust

1303
00:23:59,160 --> 00:23:59,680
that's going to

1304
00:23:59,680 --> 00:24:00,420
happen in the industry

1305
00:24:00,420 --> 00:24:01,400
so what's interesting

1306
00:24:01,400 --> 00:24:01,960
is that obviously

1307
00:24:01,960 --> 00:24:02,680
the customers

1308
00:24:02,680 --> 00:24:03,500
are wanting to

1309
00:24:03,500 --> 00:24:04,140
to do this

1310
00:24:04,140 --> 00:24:04,860
on software

1311
00:24:04,860 --> 00:24:05,340
that they get

1312
00:24:05,340 --> 00:24:06,420
from their vendors

1313
00:24:06,420 --> 00:24:07,160
open source

1314
00:24:07,160 --> 00:24:08,040
community is starting

1315
00:24:08,040 --> 00:24:09,000
to make a lot

1316
00:24:09,000 --> 00:24:09,420
of headway

1317
00:24:09,420 --> 00:24:09,940
in this space

1318
00:24:09,940 --> 00:24:10,180
as well

1319
00:24:10,180 --> 00:24:10,940
like Debian

1320
00:24:10,940 --> 00:24:11,700
and some other

1321
00:24:11,700 --> 00:24:12,620
open source product

1322
00:24:12,620 --> 00:24:13,340
they're starting

1323
00:24:13,340 --> 00:24:13,760
to embed

1324
00:24:13,760 --> 00:24:14,160
some of these

1325
00:24:14,160 --> 00:24:14,720
capabilities

1326
00:24:14,720 --> 00:24:15,500
but then

1327
00:24:15,500 --> 00:24:15,920
the interesting

1328
00:24:15,920 --> 00:24:16,580
becomes now

1329
00:24:16,580 --> 00:24:17,020
is that

1330
00:24:17,020 --> 00:24:17,660
inside of

1331
00:24:17,660 --> 00:24:18,200
organizations

1332
00:24:18,200 --> 00:24:18,840
that build

1333
00:24:18,840 --> 00:24:19,260
software

1334
00:24:19,260 --> 00:24:19,960
if they want

1335
00:24:19,960 --> 00:24:20,580
to be more

1336
00:24:20,580 --> 00:24:21,600
of a leader

1337
00:24:21,600 --> 00:24:22,000
in a lead

1338
00:24:22,000 --> 00:24:22,960
software company

1339
00:24:22,960 --> 00:24:23,500
they're getting

1340
00:24:23,500 --> 00:24:24,240
currently bogged

1341
00:24:24,240 --> 00:24:24,880
down by a lot

1342
00:24:24,880 --> 00:24:25,460
of compliance

1343
00:24:25,460 --> 00:24:26,160
and security

1344
00:24:26,160 --> 00:24:26,620
things

1345
00:24:26,620 --> 00:24:27,380
and so

1346
00:24:27,380 --> 00:24:28,320
using those

1347
00:24:28,320 --> 00:24:29,120
same principles

1348
00:24:29,120 --> 00:24:29,920
and capabilities

1349
00:24:29,920 --> 00:24:30,980
codifying that

1350
00:24:30,980 --> 00:24:31,660
in their own

1351
00:24:31,660 --> 00:24:33,200
internal flow

1352
00:24:33,200 --> 00:24:34,060
of the supply

1353
00:24:34,060 --> 00:24:34,540
chain

1354
00:24:34,540 --> 00:24:34,920
like the

1355
00:24:34,920 --> 00:24:35,320
building

1356
00:24:35,320 --> 00:24:35,880
processes

1357
00:24:35,880 --> 00:24:36,800
it starts

1358
00:24:36,800 --> 00:24:37,720
you start

1359
00:24:37,720 --> 00:24:38,280
getting higher

1360
00:24:38,280 --> 00:24:39,020
velocity now

1361
00:24:39,020 --> 00:24:39,460
because you're

1362
00:24:39,460 --> 00:24:39,920
not like

1363
00:24:39,920 --> 00:24:40,400
oh wait

1364
00:24:40,400 --> 00:24:40,760
I need to

1365
00:24:40,760 --> 00:24:41,120
schedule

1366
00:24:41,120 --> 00:24:41,920
a compliance

1367
00:24:41,920 --> 00:24:42,400
check

1368
00:24:42,400 --> 00:24:43,120
with

1369
00:24:43,120 --> 00:24:43,700
x y

1370
00:24:43,700 --> 00:24:44,000
and z

1371
00:24:44,000 --> 00:24:44,220
in the

1372
00:24:44,220 --> 00:24:44,640
organization

1373
00:24:44,640 --> 00:24:45,060
and now

1374
00:24:45,060 --> 00:24:45,220
we're

1375
00:24:45,220 --> 00:24:45,600
a couple

1376
00:24:45,600 --> 00:24:45,880
of weeks

1377
00:24:45,880 --> 00:24:46,160
away

1378
00:24:46,160 --> 00:24:46,580
from actually

1379
00:24:46,580 --> 00:24:46,960
deploying

1380
00:24:46,960 --> 00:24:47,720
to production

1381
00:24:47,720 --> 00:24:48,140
or like

1382
00:24:48,140 --> 00:24:48,560
what you said

1383
00:24:48,560 --> 00:24:48,940
like certain

1384
00:24:48,940 --> 00:24:49,200
cases

1385
00:24:49,200 --> 00:24:50,140
they're preventing

1386
00:24:50,140 --> 00:24:50,580
us from going

1387
00:24:50,580 --> 00:24:51,020
to production

1388
00:24:51,020 --> 00:24:51,820
because they say

1389
00:24:51,820 --> 00:24:52,580
the relative

1390
00:24:52,580 --> 00:24:53,140
risk score

1391
00:24:53,140 --> 00:24:53,700
is high

1392
00:24:53,700 --> 00:24:54,080
and then

1393
00:24:54,080 --> 00:24:54,360
everybody

1394
00:24:54,360 --> 00:24:54,600
starts

1395
00:24:54,600 --> 00:24:55,300
unpacking

1396
00:24:55,300 --> 00:24:55,460
this

1397
00:24:55,460 --> 00:24:55,600
like

1398
00:24:55,600 --> 00:24:55,820
why

1399
00:24:55,820 --> 00:24:56,100
is it

1400
00:24:56,100 --> 00:24:56,360
high

1401
00:24:56,360 --> 00:24:56,540
what

1402
00:24:56,540 --> 00:24:56,760
is it

1403
00:24:56,760 --> 00:24:57,080
causing

1404
00:24:57,080 --> 00:24:57,840
and emails

1405
00:24:57,840 --> 00:24:58,580
back and forth

1406
00:24:58,580 --> 00:24:59,240
that start

1407
00:24:59,240 --> 00:24:59,600
happening

1408
00:24:59,600 --> 00:25:00,200
you want to

1409
00:25:00,200 --> 00:25:00,780
codify those

1410
00:25:00,780 --> 00:25:01,200
mechanisms

1411
00:25:01,200 --> 00:25:01,780
and so

1412
00:25:01,780 --> 00:25:02,260
what would you

1413
00:25:02,260 --> 00:25:02,840
say is like

1414
00:25:02,840 --> 00:25:03,460
the current

1415
00:25:03,460 --> 00:25:04,420
like status

1416
00:25:04,420 --> 00:25:04,820
quo

1417
00:25:04,820 --> 00:25:05,520
broadly

1418
00:25:05,520 --> 00:25:06,620
of like

1419
00:25:06,620 --> 00:25:07,240
large

1420
00:25:07,240 --> 00:25:07,960
organizations

1421
00:25:07,960 --> 00:25:08,780
managing

1422
00:25:08,780 --> 00:25:09,320
their supply

1423
00:25:09,320 --> 00:25:09,700
chain

1424
00:25:09,700 --> 00:25:10,360
yeah I think

1425
00:25:10,360 --> 00:25:10,720
they haven't

1426
00:25:10,720 --> 00:25:11,220
gotten to the

1427
00:25:11,220 --> 00:25:11,660
codification

1428
00:25:11,660 --> 00:25:12,320
piece

1429
00:25:12,320 --> 00:25:13,320
beyond like

1430
00:25:13,320 --> 00:25:13,720
doing the

1431
00:25:13,720 --> 00:25:14,020
scanning

1432
00:25:14,020 --> 00:25:14,340
that's

1433
00:25:14,340 --> 00:25:14,520
kind of

1434
00:25:14,520 --> 00:25:15,180
the first

1435
00:25:15,180 --> 00:25:15,440
basic

1436
00:25:15,440 --> 00:25:15,780
step

1437
00:25:15,780 --> 00:25:16,520
that the

1438
00:25:16,520 --> 00:25:17,020
compliance

1439
00:25:17,020 --> 00:25:17,300
department

1440
00:25:17,300 --> 00:25:17,700
say hey

1441
00:25:17,700 --> 00:25:18,060
Dysol

1442
00:25:18,060 --> 00:25:18,740
scan everything

1443
00:25:18,740 --> 00:25:19,240
into

1444
00:25:19,240 --> 00:25:19,580
harbor

1445
00:25:19,580 --> 00:25:20,100
registry

1446
00:25:20,100 --> 00:25:20,940
or sonotype

1447
00:25:20,940 --> 00:25:21,480
or fill

1448
00:25:21,480 --> 00:25:21,740
the banks

1449
00:25:21,740 --> 00:25:22,420
and then they

1450
00:25:22,420 --> 00:25:23,100
assign a lot

1451
00:25:23,100 --> 00:25:23,440
that has a

1452
00:25:23,440 --> 00:25:23,840
high level

1453
00:25:23,840 --> 00:25:24,620
of CVEs

1454
00:25:24,620 --> 00:25:24,880
and then

1455
00:25:24,880 --> 00:25:25,120
they have

1456
00:25:25,120 --> 00:25:25,460
exception

1457
00:25:25,460 --> 00:25:26,020
processes

1458
00:25:26,020 --> 00:25:26,880
in place

1459
00:25:26,880 --> 00:25:27,280
so the

1460
00:25:27,280 --> 00:25:27,520
maturity

1461
00:25:27,520 --> 00:25:27,980
level is

1462
00:25:27,980 --> 00:25:28,380
still like

1463
00:25:28,380 --> 00:25:28,920
a one

1464
00:25:28,920 --> 00:25:29,320
I would

1465
00:25:29,320 --> 00:25:29,560
say

1466
00:25:29,560 --> 00:25:29,960
we're still

1467
00:25:29,960 --> 00:25:30,140
in that

1468
00:25:30,140 --> 00:25:30,420
scanning

1469
00:25:30,420 --> 00:25:30,760
phase

1470
00:25:30,760 --> 00:25:31,240
we're not

1471
00:25:31,240 --> 00:25:31,920
nearly

1472
00:25:31,920 --> 00:25:32,580
what I

1473
00:25:32,580 --> 00:25:33,080
would call

1474
00:25:33,080 --> 00:25:33,880
making

1475
00:25:33,880 --> 00:25:34,620
rational

1476
00:25:34,620 --> 00:25:35,260
decisions

1477
00:25:35,260 --> 00:25:35,920
what goes

1478
00:25:35,920 --> 00:25:36,120
into

1479
00:25:36,120 --> 00:25:36,520
production

1480
00:25:36,520 --> 00:25:37,260
based on

1481
00:25:37,260 --> 00:25:37,660
some set

1482
00:25:37,660 --> 00:25:38,380
of attributes

1483
00:25:38,380 --> 00:25:38,960
that the

1484
00:25:38,960 --> 00:25:39,360
software

1485
00:25:39,360 --> 00:25:39,680
has

1486
00:25:39,680 --> 00:25:40,160
that just

1487
00:25:40,160 --> 00:25:40,520
apply to

1488
00:25:40,520 --> 00:25:40,660
the

1489
00:25:40,660 --> 00:25:41,180
attestation

1490
00:25:41,180 --> 00:25:41,800
yeah my

1491
00:25:41,800 --> 00:25:42,180
impression

1492
00:25:42,180 --> 00:25:42,780
from talking

1493
00:25:42,780 --> 00:25:43,260
with people

1494
00:25:43,260 --> 00:25:44,240
when they

1495
00:25:44,240 --> 00:25:44,700
ask about

1496
00:25:44,700 --> 00:25:45,000
this

1497
00:25:45,000 --> 00:25:45,860
is that

1498
00:25:45,860 --> 00:25:46,460
it's a lot

1499
00:25:46,460 --> 00:25:46,920
of what

1500
00:25:46,920 --> 00:25:47,440
you're alluding

1501
00:25:47,440 --> 00:25:47,700
to

1502
00:25:47,700 --> 00:25:48,460
there's emails

1503
00:25:48,460 --> 00:25:49,120
going back

1504
00:25:49,120 --> 00:25:49,420
and forth

1505
00:25:49,420 --> 00:25:49,680
right

1506
00:25:49,680 --> 00:25:50,720
just simply

1507
00:25:50,720 --> 00:25:51,580
extracting

1508
00:25:51,580 --> 00:25:52,700
the information

1509
00:25:52,700 --> 00:25:53,100
you would

1510
00:25:53,100 --> 00:25:53,560
need to

1511
00:25:53,560 --> 00:25:54,280
like do

1512
00:25:54,280 --> 00:25:54,960
a security

1513
00:25:54,960 --> 00:25:55,500
assessment

1514
00:25:55,500 --> 00:25:57,000
is not

1515
00:25:57,000 --> 00:25:57,560
automated

1516
00:25:57,560 --> 00:25:58,160
at all

1517
00:25:58,160 --> 00:25:58,680
like it's

1518
00:25:58,680 --> 00:25:59,400
really time

1519
00:25:59,400 --> 00:25:59,820
consuming

1520
00:25:59,820 --> 00:26:00,800
and maybe

1521
00:26:00,800 --> 00:26:01,280
even if

1522
00:26:01,280 --> 00:26:01,680
it is

1523
00:26:01,680 --> 00:26:02,180
automated

1524
00:26:02,180 --> 00:26:03,200
each team

1525
00:26:03,200 --> 00:26:03,980
of developers

1526
00:26:03,980 --> 00:26:04,580
automates

1527
00:26:04,580 --> 00:26:05,100
it a different

1528
00:26:05,100 --> 00:26:05,400
way

1529
00:26:05,400 --> 00:26:05,940
or that there's

1530
00:26:05,940 --> 00:26:06,640
multiple ways

1531
00:26:06,640 --> 00:26:07,260
of automating

1532
00:26:07,260 --> 00:26:07,700
it which just

1533
00:26:07,700 --> 00:26:08,320
adds more

1534
00:26:08,320 --> 00:26:09,280
cognitive friction

1535
00:26:09,280 --> 00:26:09,860
to doing

1536
00:26:09,860 --> 00:26:10,360
these things

1537
00:26:10,360 --> 00:26:11,360
so that

1538
00:26:11,360 --> 00:26:11,880
almost feels

1539
00:26:11,880 --> 00:26:12,260
like one

1540
00:26:12,260 --> 00:26:12,500
of the

1541
00:26:12,500 --> 00:26:13,420
first steps

1542
00:26:13,420 --> 00:26:14,100
to like

1543
00:26:14,100 --> 00:26:15,020
just doing

1544
00:26:15,020 --> 00:26:15,780
software better

1545
00:26:15,780 --> 00:26:16,560
is like

1546
00:26:16,560 --> 00:26:17,260
you got to

1547
00:26:17,260 --> 00:26:17,860
automate this

1548
00:26:17,860 --> 00:26:18,200
stuff

1549
00:26:18,200 --> 00:26:18,560
right

1550
00:26:18,560 --> 00:26:18,960
there needs

1551
00:26:18,960 --> 00:26:19,340
to be a

1552
00:26:19,340 --> 00:26:19,960
way of

1553
00:26:19,960 --> 00:26:20,580
essentially

1554
00:26:20,580 --> 00:26:21,520
you're doing

1555
00:26:21,520 --> 00:26:22,060
the same

1556
00:26:22,060 --> 00:26:22,580
security

1557
00:26:22,580 --> 00:26:23,060
and audit

1558
00:26:23,060 --> 00:26:23,480
checks

1559
00:26:23,480 --> 00:26:24,080
you just

1560
00:26:24,080 --> 00:26:24,660
don't have

1561
00:26:24,660 --> 00:26:25,040
to do

1562
00:26:25,040 --> 00:26:25,700
so much

1563
00:26:25,700 --> 00:26:25,920
of it

1564
00:26:25,920 --> 00:26:26,420
in email

1565
00:26:26,420 --> 00:26:27,000
you can

1566
00:26:27,000 --> 00:26:27,780
just get

1567
00:26:27,780 --> 00:26:28,060
that

1568
00:26:28,060 --> 00:26:28,820
not even

1569
00:26:28,820 --> 00:26:29,160
bill of

1570
00:26:29,160 --> 00:26:29,480
materials

1571
00:26:29,480 --> 00:26:29,720
I don't

1572
00:26:29,720 --> 00:26:29,880
even know

1573
00:26:29,880 --> 00:26:30,160
what you

1574
00:26:30,160 --> 00:26:30,520
would call

1575
00:26:30,520 --> 00:26:30,700
that

1576
00:26:30,700 --> 00:26:30,880
what

1577
00:26:30,880 --> 00:26:31,340
like the

1578
00:26:31,340 --> 00:26:31,720
raw

1579
00:26:31,720 --> 00:26:32,500
ingredients

1580
00:26:32,500 --> 00:26:33,340
of doing

1581
00:26:33,340 --> 00:26:33,960
a security

1582
00:26:33,960 --> 00:26:34,380
audit

1583
00:26:34,380 --> 00:26:34,940
like all

1584
00:26:34,940 --> 00:26:35,080
that

1585
00:26:35,080 --> 00:26:35,400
yeah

1586
00:26:35,400 --> 00:26:35,760
it's

1587
00:26:35,760 --> 00:26:36,020
I think

1588
00:26:36,020 --> 00:26:36,280
the level

1589
00:26:36,280 --> 00:26:36,820
of automation

1590
00:26:36,820 --> 00:26:37,300
right now

1591
00:26:37,300 --> 00:26:37,720
is that

1592
00:26:37,720 --> 00:26:38,360
Sonatype

1593
00:26:38,360 --> 00:26:38,640
or any

1594
00:26:40,360 --> 00:26:40,520
ability

1595
00:26:40,520 --> 00:26:40,860
and

1596
00:26:40,860 --> 00:26:41,400
automatically

1597
00:26:41,400 --> 00:26:41,760
a ticket

1598
00:26:41,760 --> 00:26:42,400
gets created

1599
00:26:42,400 --> 00:26:42,920
into

1600
00:26:42,920 --> 00:26:43,340
and put

1601
00:26:43,340 --> 00:26:43,580
in your

1602
00:26:43,580 --> 00:26:43,920
backlog

1603
00:26:43,920 --> 00:26:44,820
for remediation

1604
00:26:44,820 --> 00:26:45,460
that's about

1605
00:26:45,460 --> 00:26:45,820
the level

1606
00:26:45,820 --> 00:26:46,840
of automation

1607
00:26:46,840 --> 00:26:47,340
right

1608
00:26:47,340 --> 00:26:48,120
nothing that

1609
00:26:48,120 --> 00:26:48,640
moves it

1610
00:26:48,640 --> 00:26:49,020
up to the

1611
00:26:49,020 --> 00:26:49,980
supply chain

1612
00:26:49,980 --> 00:26:50,300
like the

1613
00:26:50,300 --> 00:26:50,580
shifting

1614
00:26:50,580 --> 00:26:51,280
left piece

1615
00:26:51,280 --> 00:26:51,880
that it's

1616
00:26:51,880 --> 00:26:52,540
data developers

1617
00:26:52,540 --> 00:26:53,000
automatically

1618
00:26:53,000 --> 00:26:53,640
have this

1619
00:26:53,640 --> 00:26:54,360
way of

1620
00:26:54,360 --> 00:26:55,180
rationalizing

1621
00:26:55,180 --> 00:26:55,660
other things

1622
00:26:55,660 --> 00:26:56,380
to take

1623
00:26:56,380 --> 00:26:56,680
or not

1624
00:26:56,680 --> 00:26:56,960
take

1625
00:26:56,960 --> 00:26:57,600
software

1626
00:26:57,600 --> 00:26:58,200
or

1627
00:26:58,200 --> 00:26:58,800
attesting

1628
00:26:58,800 --> 00:26:59,120
to the

1629
00:26:59,120 --> 00:26:59,400
steps

1630
00:26:59,400 --> 00:26:59,760
that they

1631
00:26:59,760 --> 00:26:59,980
do

1632
00:26:59,980 --> 00:27:00,440
I think

1633
00:27:00,440 --> 00:27:00,700
we're

1634
00:27:00,700 --> 00:27:01,060
getting

1635
00:27:01,060 --> 00:27:01,380
closer

1636
00:27:01,380 --> 00:27:01,620
there's

1637
00:27:01,620 --> 00:27:01,780
some

1638
00:27:01,780 --> 00:27:01,920
of the

1639
00:27:01,920 --> 00:27:02,340
capabilities

1640
00:27:02,340 --> 00:27:02,640
but

1641
00:27:02,640 --> 00:27:03,220
people

1642
00:27:03,220 --> 00:27:03,540
think

1643
00:27:03,540 --> 00:27:03,780
of it

1644
00:27:03,780 --> 00:27:04,260
as a

1645
00:27:04,260 --> 00:27:04,900
complex

1646
00:27:04,900 --> 00:27:05,420
problem

1647
00:27:05,420 --> 00:27:06,020
to solve

1648
00:27:06,020 --> 00:27:06,460
and

1649
00:27:06,460 --> 00:27:06,920
as you

1650
00:27:06,920 --> 00:27:07,140
put

1651
00:27:07,140 --> 00:27:07,880
security

1652
00:27:07,880 --> 00:27:08,200
in the

1653
00:27:08,200 --> 00:27:08,840
DevSecOps

1654
00:27:10,360 --> 00:27:11,340
you have

1655
00:27:11,340 --> 00:27:12,060
to have

1656
00:27:12,060 --> 00:27:12,960
codification

1657
00:27:12,960 --> 00:27:13,560
and automation

1658
00:27:13,560 --> 00:27:14,180
capabilities

1659
00:27:14,180 --> 00:27:14,900
to really

1660
00:27:14,900 --> 00:27:15,640
rationalize

1661
00:27:15,640 --> 00:27:16,040
other things

1662
00:27:16,040 --> 00:27:16,680
okay so

1663
00:27:16,680 --> 00:27:17,420
far have

1664
00:27:17,420 --> 00:27:18,000
we reached

1665
00:27:18,000 --> 00:27:18,680
I interrupt

1666
00:27:18,680 --> 00:27:18,960
and ask

1667
00:27:18,960 --> 00:27:19,520
questions so

1668
00:27:19,520 --> 00:27:20,280
much I lose

1669
00:27:20,280 --> 00:27:20,820
track of the

1670
00:27:20,820 --> 00:27:21,420
narrative thing

1671
00:27:21,420 --> 00:27:22,040
but have

1672
00:27:22,040 --> 00:27:22,480
we reached

1673
00:27:22,480 --> 00:27:23,020
the end

1674
00:27:23,020 --> 00:27:23,560
of the

1675
00:27:23,560 --> 00:27:24,120
trusted

1676
00:27:24,120 --> 00:27:24,940
supply chain

1677
00:27:24,940 --> 00:27:25,420
where are

1678
00:27:25,420 --> 00:27:25,880
we positioned

1679
00:27:25,880 --> 00:27:26,320
now

1680
00:27:26,320 --> 00:27:26,880
yeah I think

1681
00:27:26,880 --> 00:27:27,420
we're getting

1682
00:27:27,420 --> 00:27:27,840
to the point

1683
00:27:27,840 --> 00:27:28,340
of inventory

1684
00:27:28,340 --> 00:27:29,140
and build

1685
00:27:29,140 --> 00:27:29,680
building

1686
00:27:29,680 --> 00:27:30,080
but the

1687
00:27:30,080 --> 00:27:30,380
other heart

1688
00:27:30,380 --> 00:27:30,760
is that

1689
00:27:30,760 --> 00:27:31,400
even customers

1690
00:27:31,400 --> 00:27:31,840
that ship

1691
00:27:31,840 --> 00:27:32,260
software

1692
00:27:32,260 --> 00:27:32,800
now you have

1693
00:27:32,800 --> 00:27:33,040
to start

1694
00:27:33,040 --> 00:27:33,500
thinking about

1695
00:27:33,500 --> 00:27:33,780
how do

1696
00:27:33,780 --> 00:27:34,380
you distribute

1697
00:27:34,380 --> 00:27:35,280
this as

1698
00:27:35,280 --> 00:27:35,820
well so how

1699
00:27:35,820 --> 00:27:36,140
do you make

1700
00:27:36,140 --> 00:27:36,540
the build

1701
00:27:36,540 --> 00:27:37,100
materials

1702
00:27:37,100 --> 00:27:37,580
how do you

1703
00:27:37,580 --> 00:27:37,860
make it

1704
00:27:37,860 --> 00:27:38,500
at a station

1705
00:27:38,500 --> 00:27:39,440
because even

1706
00:27:39,440 --> 00:27:39,900
us as a

1707
00:27:39,900 --> 00:27:40,380
software

1708
00:27:40,380 --> 00:27:41,100
there's 50

1709
00:27:41,100 --> 00:27:41,560
million different

1710
00:27:41,560 --> 00:27:42,080
ways of

1711
00:27:42,080 --> 00:27:43,260
supplying this

1712
00:27:43,260 --> 00:27:44,020
build material

1713
00:27:44,020 --> 00:27:44,520
so there's

1714
00:27:44,520 --> 00:27:44,860
some interesting

1715
00:27:44,860 --> 00:27:45,260
notion here

1716
00:27:45,260 --> 00:27:45,720
there's some

1717
00:27:45,720 --> 00:27:46,280
proof of

1718
00:27:46,280 --> 00:27:46,940
concepts happening

1719
00:27:46,940 --> 00:27:48,240
in for some

1720
00:27:48,240 --> 00:27:48,620
of the energy

1721
00:27:48,620 --> 00:27:49,440
space in the

1722
00:27:49,440 --> 00:27:50,320
US do you do

1723
00:27:50,320 --> 00:27:51,580
centralizing all

1724
00:27:51,580 --> 00:27:51,920
these build

1725
00:27:51,920 --> 00:27:52,800
materials right

1726
00:27:52,800 --> 00:27:53,300
Google is

1727
00:27:53,300 --> 00:27:53,700
working on a

1728
00:27:53,700 --> 00:27:54,220
project and

1729
00:27:54,220 --> 00:27:54,480
some other

1730
00:27:54,480 --> 00:27:54,940
ones like do

1731
00:27:54,940 --> 00:27:55,460
you put it

1732
00:27:55,460 --> 00:27:55,860
all in one

1733
00:27:55,860 --> 00:27:56,420
place and

1734
00:27:56,420 --> 00:27:56,800
people can

1735
00:27:56,800 --> 00:27:57,400
download it

1736
00:27:57,400 --> 00:27:57,960
well what

1737
00:27:57,960 --> 00:27:58,300
happens if

1738
00:27:58,300 --> 00:27:58,640
that gets

1739
00:27:58,640 --> 00:27:59,080
compromised

1740
00:27:59,080 --> 00:27:59,840
right or

1741
00:27:59,840 --> 00:28:00,300
do you use

1742
00:28:00,300 --> 00:28:01,300
a distributed

1743
00:28:01,300 --> 00:28:01,980
way there's

1744
00:28:01,980 --> 00:28:02,400
distributed

1745
00:28:02,400 --> 00:28:02,860
ledger

1746
00:28:02,860 --> 00:28:03,460
mechanisms

1747
00:28:03,460 --> 00:28:03,940
to make

1748
00:28:03,940 --> 00:28:04,400
this available

1749
00:28:04,400 --> 00:28:05,080
so I think

1750
00:28:05,080 --> 00:28:05,640
there's work

1751
00:28:05,640 --> 00:28:06,020
that's being

1752
00:28:06,020 --> 00:28:06,520
done in that

1753
00:28:06,520 --> 00:28:06,980
space it

1754
00:28:06,980 --> 00:28:07,840
hasn't settled

1755
00:28:07,840 --> 00:28:08,220
what's an

1756
00:28:08,220 --> 00:28:09,000
ideal way of

1757
00:28:09,000 --> 00:28:09,440
distributing

1758
00:28:09,440 --> 00:28:09,900
your build

1759
00:28:09,900 --> 00:28:10,340
materials

1760
00:28:10,340 --> 00:28:10,820
like even

1761
00:28:10,820 --> 00:28:11,380
the with

1762
00:28:11,380 --> 00:28:11,860
docker and

1763
00:28:11,860 --> 00:28:12,820
oci could

1764
00:28:12,820 --> 00:28:13,320
you make

1765
00:28:13,320 --> 00:28:13,740
it be just

1766
00:28:13,740 --> 00:28:14,320
be part of

1767
00:28:14,320 --> 00:28:14,940
your image

1768
00:28:14,940 --> 00:28:15,260
that you

1769
00:28:15,260 --> 00:28:15,820
get just

1770
00:28:15,820 --> 00:28:16,140
like in

1771
00:28:16,140 --> 00:28:16,500
the food

1772
00:28:16,500 --> 00:28:17,000
store that

1773
00:28:17,000 --> 00:28:17,760
the product

1774
00:28:17,760 --> 00:28:18,240
hasn't

1775
00:28:18,240 --> 00:28:19,100
labeled stuck

1776
00:28:19,100 --> 00:28:19,440
on a thing

1777
00:28:19,440 --> 00:28:19,660
you can

1778
00:28:19,660 --> 00:28:20,360
actually see

1779
00:28:20,360 --> 00:28:20,860
it so the

1780
00:28:20,860 --> 00:28:21,180
industry is

1781
00:28:21,180 --> 00:28:21,560
working on

1782
00:28:21,560 --> 00:28:22,000
that aspect

1783
00:28:22,000 --> 00:28:22,440
of it as

1784
00:28:22,440 --> 00:28:22,600
well

1785
00:28:22,600 --> 00:28:23,220
that's interesting

1786
00:28:23,220 --> 00:28:23,900
you mentioned

1787
00:28:23,900 --> 00:28:24,200
it there

1788
00:28:24,200 --> 00:28:24,860
without saying

1789
00:28:24,860 --> 00:28:25,740
the blockchain

1790
00:28:25,740 --> 00:28:26,520
word but

1791
00:28:26,520 --> 00:28:26,780
that would

1792
00:28:26,780 --> 00:28:27,260
be that's

1793
00:28:27,260 --> 00:28:27,760
a perfect

1794
00:28:27,760 --> 00:28:28,760
non-monetary

1795
00:28:28,760 --> 00:28:29,500
application of

1796
00:28:29,500 --> 00:28:30,300
blockchain stuff

1797
00:28:30,300 --> 00:28:30,740
we have

1798
00:28:30,740 --> 00:28:31,780
these multiple

1799
00:28:31,780 --> 00:28:32,600
parties that

1800
00:28:32,600 --> 00:28:33,500
all that

1801
00:28:33,500 --> 00:28:34,660
attest to a

1802
00:28:34,660 --> 00:28:35,340
fact happening

1803
00:28:35,340 --> 00:28:36,160
so they could

1804
00:28:36,160 --> 00:28:36,820
attest to the

1805
00:28:36,820 --> 00:28:37,600
attestation

1806
00:28:37,600 --> 00:28:38,600
essentially and

1807
00:28:38,600 --> 00:28:39,260
then distribute

1808
00:28:39,260 --> 00:28:39,960
it all out

1809
00:28:39,960 --> 00:28:40,580
and which is

1810
00:28:40,580 --> 00:28:41,140
still like you

1811
00:28:41,140 --> 00:28:41,700
get if you

1812
00:28:41,700 --> 00:28:42,460
get a trusted

1813
00:28:42,460 --> 00:28:43,160
bad actor

1814
00:28:43,160 --> 00:28:44,180
then that's

1815
00:28:44,180 --> 00:28:44,800
no good but

1816
00:28:44,800 --> 00:28:45,620
whatever that's

1817
00:28:45,620 --> 00:28:45,920
the way it

1818
00:28:45,920 --> 00:28:46,200
goes

1819
00:28:46,200 --> 00:28:47,180
yeah there's

1820
00:28:47,180 --> 00:28:48,200
no 100%

1821
00:28:48,200 --> 00:28:48,720
guarantee with

1822
00:28:48,720 --> 00:28:48,960
anything

1823
00:28:48,960 --> 00:28:49,360
anything

1824
00:28:49,360 --> 00:28:50,120
but it

1825
00:28:50,120 --> 00:28:50,580
distribute

1826
00:28:50,580 --> 00:28:51,200
ledger has

1827
00:28:51,200 --> 00:28:51,920
some promises

1828
00:28:51,920 --> 00:28:52,520
there in the

1829
00:28:52,520 --> 00:28:52,840
sense of

1830
00:28:52,840 --> 00:28:53,720
some consensus

1831
00:28:53,720 --> 00:28:54,220
mechanism

1832
00:28:54,220 --> 00:28:54,840
it's a

1833
00:28:54,840 --> 00:28:55,340
multi-party

1834
00:28:55,340 --> 00:28:55,940
system

1835
00:28:55,940 --> 00:28:56,580
right if

1836
00:28:56,580 --> 00:28:57,100
you take a

1837
00:28:57,100 --> 00:28:57,340
look at

1838
00:28:57,340 --> 00:28:58,120
those properties

1839
00:28:58,120 --> 00:28:58,900
and capabilities

1840
00:28:58,900 --> 00:29:00,140
it could have

1841
00:29:00,140 --> 00:29:00,600
some benefit

1842
00:29:00,600 --> 00:29:01,600
in doing this

1843
00:29:01,600 --> 00:29:02,100
and you can

1844
00:29:02,100 --> 00:29:02,600
have third

1845
00:29:02,600 --> 00:29:02,920
party

1846
00:29:02,920 --> 00:29:03,780
certification

1847
00:29:03,780 --> 00:29:04,240
as part

1848
00:29:04,240 --> 00:29:04,740
for example

1849
00:29:04,740 --> 00:29:05,160
you might

1850
00:29:05,160 --> 00:29:05,580
ship your

1851
00:29:05,580 --> 00:29:05,960
software to

1852
00:29:05,960 --> 00:29:06,500
somebody else

1853
00:29:06,500 --> 00:29:07,060
they verify

1854
00:29:07,060 --> 00:29:07,780
these things

1855
00:29:07,780 --> 00:29:08,360
as well

1856
00:29:08,360 --> 00:29:09,060
attest to it

1857
00:29:09,060 --> 00:29:09,460
and now it

1858
00:29:09,460 --> 00:29:10,220
goes back to

1859
00:29:10,220 --> 00:29:10,900
the chain

1860
00:29:10,900 --> 00:29:11,380
of trust

1861
00:29:11,380 --> 00:29:11,820
for all

1862
00:29:11,820 --> 00:29:12,080
intents and

1863
00:29:12,080 --> 00:29:12,300
purposes

1864
00:29:12,300 --> 00:29:13,020
and then like

1865
00:29:13,020 --> 00:29:13,320
you're saying

1866
00:29:13,320 --> 00:29:13,680
the second

1867
00:29:13,680 --> 00:29:14,640
part is for

1868
00:29:14,640 --> 00:29:16,160
software that

1869
00:29:16,160 --> 00:29:16,560
you're making

1870
00:29:16,560 --> 00:29:16,880
your own

1871
00:29:16,880 --> 00:29:17,120
you don't

1872
00:29:17,120 --> 00:29:17,540
necessarily

1873
00:29:17,540 --> 00:29:17,940
want to

1874
00:29:17,940 --> 00:29:18,500
publish all

1875
00:29:18,500 --> 00:29:18,880
the stuff

1876
00:29:18,880 --> 00:29:19,340
you have

1877
00:29:19,340 --> 00:29:19,920
right like

1878
00:29:19,920 --> 00:29:20,500
I'm sure

1879
00:29:20,500 --> 00:29:21,100
all the way

1880
00:29:21,100 --> 00:29:22,000
from retail

1881
00:29:22,000 --> 00:29:22,520
to banking

1882
00:29:22,520 --> 00:29:23,120
to missiles

1883
00:29:23,120 --> 00:29:23,720
like you

1884
00:29:23,720 --> 00:29:24,260
don't necessarily

1885
00:29:24,260 --> 00:29:24,820
want to have

1886
00:29:24,820 --> 00:29:25,300
a bill of

1887
00:29:25,300 --> 00:29:26,080
materials out

1888
00:29:26,080 --> 00:29:26,400
there for

1889
00:29:26,400 --> 00:29:26,880
anyone to

1890
00:29:26,880 --> 00:29:27,280
consume

1891
00:29:27,280 --> 00:29:27,920
to figure

1892
00:29:27,920 --> 00:29:28,400
out like

1893
00:29:28,400 --> 00:29:28,860
all the

1894
00:29:28,860 --> 00:29:29,300
components

1895
00:29:29,300 --> 00:29:29,700
you have

1896
00:29:29,700 --> 00:29:29,980
in those

1897
00:29:29,980 --> 00:29:30,240
things

1898
00:29:30,240 --> 00:29:30,720
which means

1899
00:29:30,720 --> 00:29:30,960
you need

1900
00:29:30,960 --> 00:29:31,240
to have

1901
00:29:31,240 --> 00:29:31,640
more of

1902
00:29:31,640 --> 00:29:32,340
a private

1903
00:29:32,340 --> 00:29:33,260
way of

1904
00:29:33,260 --> 00:29:33,960
doing all

1905
00:29:33,960 --> 00:29:34,340
of that

1906
00:29:34,340 --> 00:29:35,240
and hosting

1907
00:29:35,240 --> 00:29:35,880
it internally

1908
00:29:35,880 --> 00:29:36,400
which is

1909
00:29:36,400 --> 00:29:36,640
another

1910
00:29:36,640 --> 00:29:37,160
yeah that's

1911
00:29:37,160 --> 00:29:37,420
really good

1912
00:29:37,420 --> 00:29:37,700
point to

1913
00:29:37,700 --> 00:29:38,120
make right there

1914
00:29:38,120 --> 00:29:38,400
because

1915
00:29:38,400 --> 00:29:38,900
I haven't

1916
00:29:38,900 --> 00:29:39,160
actually

1917
00:29:39,160 --> 00:29:39,620
thought about

1918
00:29:39,620 --> 00:29:39,820
it in

1919
00:29:39,820 --> 00:29:40,460
those terms

1920
00:29:40,460 --> 00:29:40,860
but there

1921
00:29:40,860 --> 00:29:41,460
is like

1922
00:29:41,460 --> 00:29:41,780
the double

1923
00:29:41,780 --> 00:29:42,280
blinders

1924
00:29:42,280 --> 00:29:42,600
type of

1925
00:29:42,600 --> 00:29:42,920
approach

1926
00:29:42,920 --> 00:29:43,640
where certain

1927
00:29:43,640 --> 00:29:44,360
people can

1928
00:29:44,360 --> 00:29:45,200
look at

1929
00:29:45,200 --> 00:29:45,760
the ingredients

1930
00:29:45,760 --> 00:29:46,140
per se

1931
00:29:46,140 --> 00:29:46,480
but other

1932
00:29:46,480 --> 00:29:47,140
people cannot

1933
00:29:47,140 --> 00:29:47,640
so yeah

1934
00:29:47,640 --> 00:29:48,200
so that part

1935
00:29:48,200 --> 00:29:48,680
hasn't quite

1936
00:29:48,680 --> 00:29:49,360
been figured

1937
00:29:49,360 --> 00:29:49,680
out yet

1938
00:29:49,680 --> 00:29:50,000
I think

1939
00:29:50,000 --> 00:29:50,460
there's some

1940
00:29:50,460 --> 00:29:50,800
promising

1941
00:29:50,800 --> 00:29:51,600
technology

1942
00:29:51,600 --> 00:29:52,280
capabilities

1943
00:29:52,280 --> 00:29:52,640
in that

1944
00:29:52,640 --> 00:29:52,880
area

1945
00:29:52,880 --> 00:29:53,360
but we

1946
00:29:53,360 --> 00:29:53,640
do need

1947
00:29:53,640 --> 00:29:53,820
to get

1948
00:29:53,820 --> 00:29:54,320
to some

1949
00:29:54,320 --> 00:29:54,660
level

1950
00:29:54,660 --> 00:29:55,100
that says

1951
00:29:55,100 --> 00:29:55,480
okay how

1952
00:29:55,480 --> 00:29:55,700
do you

1953
00:29:55,700 --> 00:29:56,340
concerns

1954
00:29:56,340 --> 00:29:56,720
because

1955
00:29:56,720 --> 00:29:57,140
without it

1956
00:29:57,140 --> 00:29:57,620
it's just

1957
00:29:57,620 --> 00:29:58,000
implicit

1958
00:29:58,000 --> 00:29:58,400
trust

1959
00:29:58,400 --> 00:29:59,180
and we

1960
00:29:59,180 --> 00:29:59,340
see

1961
00:29:59,340 --> 00:29:59,840
sometimes

1962
00:29:59,840 --> 00:30:00,240
how that

1963
00:30:00,240 --> 00:30:00,720
turns out

1964
00:30:00,720 --> 00:30:01,000
this is

1965
00:30:01,000 --> 00:30:01,180
good

1966
00:30:01,180 --> 00:30:01,540
because I

1967
00:30:01,540 --> 00:30:01,820
think what

1968
00:30:01,820 --> 00:30:02,240
we've laid

1969
00:30:02,240 --> 00:30:02,560
out

1970
00:30:02,560 --> 00:30:03,160
let's just

1971
00:30:03,160 --> 00:30:03,660
call them

1972
00:30:03,660 --> 00:30:04,140
we've laid

1973
00:30:04,140 --> 00:30:04,860
out the

1974
00:30:04,860 --> 00:30:05,360
problem

1975
00:30:05,360 --> 00:30:05,680
or the

1976
00:30:05,680 --> 00:30:06,320
requirements

1977
00:30:06,320 --> 00:30:06,700
or the

1978
00:30:06,700 --> 00:30:07,260
things that

1979
00:30:07,260 --> 00:30:07,560
we would

1980
00:30:07,560 --> 00:30:07,840
like

1981
00:30:07,840 --> 00:30:08,480
and I

1982
00:30:08,480 --> 00:30:08,680
think we

1983
00:30:08,680 --> 00:30:08,880
had a

1984
00:30:08,880 --> 00:30:09,140
little bit

1985
00:30:09,140 --> 00:30:09,260
of

1986
00:30:09,260 --> 00:30:09,640
discussion

1987
00:30:09,640 --> 00:30:10,820
of why

1988
00:30:10,820 --> 00:30:11,760
this is

1989
00:30:11,760 --> 00:30:12,400
an issue

1990
00:30:12,400 --> 00:30:13,080
nowadays

1991
00:30:13,080 --> 00:30:13,880
and that

1992
00:30:13,880 --> 00:30:14,540
being that

1993
00:30:14,540 --> 00:30:14,960
to use

1994
00:30:14,960 --> 00:30:15,380
the old

1995
00:30:15,380 --> 00:30:16,300
phraseology

1996
00:30:16,300 --> 00:30:16,820
except

1997
00:30:16,820 --> 00:30:17,300
genuinely

1998
00:30:17,300 --> 00:30:17,720
here

1999
00:30:17,720 --> 00:30:18,540
things change

2000
00:30:18,540 --> 00:30:19,020
so quickly

2001
00:30:19,020 --> 00:30:19,500
nowadays

2002
00:30:19,500 --> 00:30:20,060
you generally

2003
00:30:20,060 --> 00:30:20,460
are doing

2004
00:30:20,460 --> 00:30:21,020
faster and

2005
00:30:21,020 --> 00:30:21,680
faster releases

2006
00:30:21,680 --> 00:30:22,100
so you have

2007
00:30:22,100 --> 00:30:22,580
to do more

2008
00:30:22,580 --> 00:30:22,880
and more

2009
00:30:22,880 --> 00:30:23,140
of these

2010
00:30:23,140 --> 00:30:23,420
checks

2011
00:30:23,420 --> 00:30:23,700
which

2012
00:30:23,700 --> 00:30:24,100
back

2013
00:30:24,100 --> 00:30:24,460
to our

2014
00:30:24,460 --> 00:30:24,700
hundred

2015
00:30:24,700 --> 00:30:25,120
Nutella

2016
00:30:25,120 --> 00:30:25,580
sandwiches

2017
00:30:25,580 --> 00:30:26,160
becomes a

2018
00:30:26,160 --> 00:30:26,480
problem

2019
00:30:26,480 --> 00:30:26,980
it's just

2020
00:30:26,980 --> 00:30:27,560
no matter

2021
00:30:27,560 --> 00:30:28,100
how quick

2022
00:30:28,100 --> 00:30:28,340
you can

2023
00:30:28,340 --> 00:30:28,620
do a

2024
00:30:28,620 --> 00:30:29,000
scan

2025
00:30:29,000 --> 00:30:29,420
if you're

2026
00:30:29,420 --> 00:30:29,800
doing it

2027
00:30:29,800 --> 00:30:30,100
thousands

2028
00:30:30,100 --> 00:30:30,700
of times

2029
00:30:30,700 --> 00:30:31,060
it's going

2030
00:30:31,060 --> 00:30:31,360
to add

2031
00:30:31,360 --> 00:30:31,640
up

2032
00:30:31,640 --> 00:30:32,100
eventually

2033
00:30:32,100 --> 00:30:33,160
so that

2034
00:30:33,160 --> 00:30:33,760
that brings

2035
00:30:33,760 --> 00:30:34,160
in the

2036
00:30:34,160 --> 00:30:34,740
need for

2037
00:30:34,740 --> 00:30:35,120
this stuff

2038
00:30:35,120 --> 00:30:35,380
yeah

2039
00:30:35,380 --> 00:30:35,740
no that's

2040
00:30:35,740 --> 00:30:36,020
good

2041
00:30:36,020 --> 00:30:36,420
that's

2042
00:30:36,420 --> 00:30:36,640
good

2043
00:30:36,640 --> 00:30:36,840
do you

2044
00:30:36,840 --> 00:30:36,940
have

2045
00:30:36,940 --> 00:30:37,120
anything

2046
00:30:37,120 --> 00:30:37,380
else

2047
00:30:37,380 --> 00:30:37,640
we should

2048
00:30:37,640 --> 00:30:38,020
go over

2049
00:30:38,020 --> 00:30:38,440
before we

2050
00:30:38,440 --> 00:30:38,940
wrap up

2051
00:30:38,940 --> 00:30:39,260
no I

2052
00:30:39,260 --> 00:30:39,480
think

2053
00:30:39,480 --> 00:30:39,980
he thinks

2054
00:30:39,980 --> 00:30:40,520
I really

2055
00:30:40,520 --> 00:30:40,760
enjoyed

2056
00:30:40,760 --> 00:30:40,880
the

2057
00:30:40,880 --> 00:30:41,440
conversation

2058
00:30:41,440 --> 00:30:42,680
I love

2059
00:30:42,680 --> 00:30:42,960
talking

2060
00:30:42,960 --> 00:30:43,120
about

2061
00:30:43,120 --> 00:30:43,280
this

2062
00:30:43,280 --> 00:30:43,600
topic

2063
00:30:43,600 --> 00:30:43,800
I

2064
00:30:43,800 --> 00:30:43,940
think

2065
00:30:43,940 --> 00:30:44,140
there's

2066
00:30:44,140 --> 00:30:44,320
a lot

2067
00:30:44,320 --> 00:30:44,400
of

2068
00:30:44,400 --> 00:30:44,600
work

2069
00:30:44,600 --> 00:30:44,900
still

2070
00:30:44,900 --> 00:30:45,240
ahead

2071
00:30:45,240 --> 00:30:45,340
of

2072
00:30:45,340 --> 00:30:45,840
but I'm

2073
00:30:45,840 --> 00:30:46,120
encouraged

2074
00:30:46,120 --> 00:30:46,320
about

2075
00:30:46,320 --> 00:30:46,580
what's

2076
00:30:46,580 --> 00:30:46,940
happening

2077
00:30:46,940 --> 00:30:47,820
from a

2078
00:30:47,820 --> 00:30:48,360
regulatory

2079
00:30:48,360 --> 00:30:48,940
perspective

2080
00:30:48,940 --> 00:30:49,320
that they're

2081
00:30:49,320 --> 00:30:49,800
starting to be

2082
00:30:49,800 --> 00:30:50,400
concerned about

2083
00:30:50,400 --> 00:30:50,940
these things

2084
00:30:50,940 --> 00:30:51,400
obviously

2085
00:30:51,400 --> 00:30:52,480
and simplifying

2086
00:30:52,480 --> 00:30:52,760
but the

2087
00:30:52,760 --> 00:30:53,100
industry

2088
00:30:53,100 --> 00:30:53,340
also

2089
00:30:53,340 --> 00:30:53,740
corralling

2090
00:30:53,740 --> 00:30:53,960
around

2091
00:30:53,960 --> 00:30:54,160
this

2092
00:30:54,160 --> 00:30:54,440
notion

2093
00:30:54,440 --> 00:30:54,720
of

2094
00:30:54,720 --> 00:30:55,040
how do

2095
00:30:55,040 --> 00:30:55,140
I

2096
00:30:55,140 --> 00:30:55,400
create

2097
00:30:55,400 --> 00:30:55,600
more

2098
00:30:55,600 --> 00:30:56,060
trust

2099
00:30:56,060 --> 00:30:56,680
as well

2100
00:30:56,680 --> 00:30:57,020
and I

2101
00:30:57,020 --> 00:30:57,120
think

2102
00:30:57,120 --> 00:30:57,280
at the

2103
00:30:57,280 --> 00:30:57,400
end

2104
00:30:57,400 --> 00:30:57,600
it's

2105
00:30:57,600 --> 00:30:58,260
like a

2106
00:30:58,260 --> 00:30:58,540
playbook

2107
00:30:58,540 --> 00:30:58,700
from

2108
00:30:58,700 --> 00:30:59,000
Apple

2109
00:30:59,000 --> 00:30:59,240
right

2110
00:30:59,240 --> 00:30:59,400
is

2111
00:30:59,400 --> 00:30:59,700
that

2112
00:30:59,700 --> 00:30:59,900
it

2113
00:30:59,900 --> 00:31:00,320
sells

2114
00:31:00,320 --> 00:31:00,780
trust

2115
00:31:00,780 --> 00:31:01,140
sells

2116
00:31:01,140 --> 00:31:01,600
so if

2117
00:31:01,600 --> 00:31:01,860
you're

2118
00:31:01,860 --> 00:31:02,200
like

2119
00:31:02,200 --> 00:31:02,340
the

2120
00:31:02,340 --> 00:31:02,660
vendor

2121
00:31:02,660 --> 00:31:02,960
in

2122
00:31:02,960 --> 00:31:03,100
this

2123
00:31:03,100 --> 00:31:03,280
vendor

2124
00:31:03,280 --> 00:31:03,560
space

2125
00:31:03,560 --> 00:31:03,760
that

2126
00:31:03,760 --> 00:31:04,000
is

2127
00:31:04,000 --> 00:31:04,160
able

2128
00:31:04,160 --> 00:31:04,360
to

2129
00:31:04,360 --> 00:31:04,580
do

2130
00:31:04,580 --> 00:31:04,780
this

2131
00:31:04,780 --> 00:31:05,220
I

2132
00:31:05,220 --> 00:31:05,680
think

2133
00:31:05,680 --> 00:31:05,860
there's

2134
00:31:05,860 --> 00:31:06,160
a

2135
00:31:06,160 --> 00:31:06,340
good

2136
00:31:06,340 --> 00:31:06,760
financial

2137
00:31:06,760 --> 00:31:07,400
incentive

2138
00:31:07,400 --> 00:31:07,680
to

2139
00:31:07,680 --> 00:31:08,020
do

2140
00:31:08,020 --> 00:31:08,220
this

2141
00:31:08,220 --> 00:31:08,540
the

2142
00:31:08,540 --> 00:31:09,100
piece

2143
00:31:09,100 --> 00:31:09,380
around

2144
00:31:09,380 --> 00:31:09,620
this

2145
00:31:09,620 --> 00:31:10,100
I

2146
00:31:10,100 --> 00:31:10,240
don't

2147
00:31:10,240 --> 00:31:10,380
think

2148
00:31:10,380 --> 00:31:10,600
people

2149
00:31:10,600 --> 00:31:10,740
are

2150
00:31:10,740 --> 00:31:10,840
going

2151
00:31:10,840 --> 00:31:10,880
to

2152
00:31:10,880 --> 00:31:11,120
be

2153
00:31:11,120 --> 00:31:11,440
spreading

2154
00:31:11,440 --> 00:31:11,680
around

2155
00:31:11,680 --> 00:31:11,960
from a

2156
00:31:11,960 --> 00:31:12,240
marketing

2157
00:31:12,240 --> 00:31:12,620
perspective

2158
00:31:12,620 --> 00:31:12,820
hey

2159
00:31:12,820 --> 00:31:12,960
we're

2160
00:31:12,960 --> 00:31:13,080
the

2161
00:31:13,080 --> 00:31:13,340
most

2162
00:31:13,340 --> 00:31:13,860
trusted

2163
00:31:13,860 --> 00:31:14,260
piece

2164
00:31:14,260 --> 00:31:14,580
I

2165
00:31:14,580 --> 00:31:14,700
think

2166
00:31:14,700 --> 00:31:14,800
it

2167
00:31:14,800 --> 00:31:14,880
will

2168
00:31:14,880 --> 00:31:15,160
become

2169
00:31:15,160 --> 00:31:15,580
self

2170
00:31:15,580 --> 00:31:16,060
evident

2171
00:31:16,060 --> 00:31:16,620
right

2172
00:31:16,620 --> 00:31:16,820
are

2173
00:31:16,820 --> 00:31:16,900
you

2174
00:31:16,900 --> 00:31:17,020
going

2175
00:31:17,020 --> 00:31:17,080
to

2176
00:31:17,080 --> 00:31:17,160
go

2177
00:31:17,160 --> 00:31:17,260
to

2178
00:31:17,260 --> 00:31:17,360
the

2179
00:31:17,360 --> 00:31:17,620
grocery

2180
00:31:17,620 --> 00:31:17,960
store

2181
00:31:17,960 --> 00:31:18,160
that

2182
00:31:18,160 --> 00:31:18,420
it's

2183
00:31:18,420 --> 00:31:18,680
easy

2184
00:31:18,680 --> 00:31:18,820
and

2185
00:31:18,820 --> 00:31:19,100
convenient

2186
00:31:19,100 --> 00:31:19,420
for you

2187
00:31:19,420 --> 00:31:19,640
to

2188
00:31:19,640 --> 00:31:19,860
see

2189
00:31:19,860 --> 00:31:20,060
these

2190
00:31:20,060 --> 00:31:20,380
things

2191
00:31:20,380 --> 00:31:20,720
or

2192
00:31:20,720 --> 00:31:20,800
do

2193
00:31:20,800 --> 00:31:20,840
you

2194
00:31:20,840 --> 00:31:20,960
go

2195
00:31:20,960 --> 00:31:21,080
to

2196
00:31:21,080 --> 00:31:21,180
the

2197
00:31:21,180 --> 00:31:21,320
one

2198
00:31:21,320 --> 00:31:21,480
that

2199
00:31:21,480 --> 00:31:22,460
you

2200
00:31:22,460 --> 00:31:22,940
have

2201
00:31:22,940 --> 00:31:23,560
incidents

2202
00:31:23,560 --> 00:31:24,220
what

2203
00:31:24,220 --> 00:31:24,340
not

2204
00:31:24,340 --> 00:31:24,560
so

2205
00:31:24,560 --> 00:31:25,020
that's

2206
00:31:25,020 --> 00:31:25,060
the

2207
00:31:25,060 --> 00:31:25,200
thing

2208
00:31:25,200 --> 00:31:25,400
with

2209
00:31:25,400 --> 00:31:25,940
trust

2210
00:31:25,940 --> 00:31:26,500
is

2211
00:31:26,500 --> 00:31:26,660
like

2212
00:31:26,660 --> 00:31:26,760
what

2213
00:31:26,760 --> 00:31:26,820
I

2214
00:31:26,820 --> 00:31:27,000
mentioned

2215
00:31:27,000 --> 00:31:27,220
earlier

2216
00:31:27,220 --> 00:31:27,460
it

2217
00:31:27,460 --> 00:31:28,180
takes

2218
00:31:28,180 --> 00:31:28,340
a

2219
00:31:28,340 --> 00:31:28,540
long

2220
00:31:28,540 --> 00:31:28,720
time

2221
00:31:28,720 --> 00:31:28,880
to

2222
00:31:28,880 --> 00:31:29,080
gain

2223
00:31:29,080 --> 00:31:29,440
easy

2224
00:31:29,440 --> 00:31:29,640
to

2225
00:31:29,640 --> 00:31:29,940
lose

2226
00:31:29,940 --> 00:31:30,360
but

2227
00:31:30,360 --> 00:31:30,540
that

2228
00:31:30,540 --> 00:31:30,940
first

2229
00:31:30,940 --> 00:31:31,320
part

2230
00:31:31,320 --> 00:31:31,500
of

2231
00:31:31,500 --> 00:31:31,840
gaining

2232
00:31:31,840 --> 00:31:32,120
that

2233
00:31:32,120 --> 00:31:32,560
you'll

2234
00:31:32,560 --> 00:31:32,900
maintain

2235
00:31:32,900 --> 00:31:33,100
it

2236
00:31:33,100 --> 00:31:33,360
for a

2237
00:31:33,360 --> 00:31:33,520
long

2238
00:31:33,520 --> 00:31:33,740
time

2239
00:31:33,740 --> 00:31:34,160
for sure

2240
00:31:34,160 --> 00:31:34,760
the value

2241
00:31:34,760 --> 00:31:35,260
we provide

2242
00:31:35,260 --> 00:31:35,580
all right

2243
00:31:35,580 --> 00:31:35,980
if people

2244
00:31:35,980 --> 00:31:36,560
wanted to

2245
00:31:36,560 --> 00:31:36,880
poke

2246
00:31:36,880 --> 00:31:37,180
around

2247
00:31:37,180 --> 00:31:37,380
at

2248
00:31:37,380 --> 00:31:37,640
things

2249
00:31:37,640 --> 00:31:37,780
that

2250
00:31:37,780 --> 00:31:38,020
you're

2251
00:31:38,020 --> 00:31:38,200
up

2252
00:31:38,200 --> 00:31:38,420
to

2253
00:31:38,420 --> 00:31:38,700
you

2254
00:31:38,700 --> 00:31:38,880
have

2255
00:31:38,880 --> 00:31:39,140
a

2256
00:31:39,140 --> 00:31:39,800
weblog

2257
00:31:39,800 --> 00:31:40,180
a

2258
00:31:40,180 --> 00:31:40,400
Twitter

2259
00:31:40,400 --> 00:31:40,840
account

2260
00:31:40,840 --> 00:31:41,080
you

2261
00:31:41,080 --> 00:31:41,200
would

2262
00:31:41,200 --> 00:31:41,400
send

2263
00:31:41,400 --> 00:31:41,540
them

2264
00:31:41,540 --> 00:31:41,740
to

2265
00:31:41,740 --> 00:31:42,020
what

2266
00:31:42,020 --> 00:31:42,360
what's

2267
00:31:42,360 --> 00:31:42,460
something

2268
00:31:42,460 --> 00:31:42,660
you

2269
00:31:42,660 --> 00:31:42,780
want

2270
00:31:42,780 --> 00:31:42,860
to

2271
00:31:42,860 --> 00:31:43,160
promote

2272
00:31:43,160 --> 00:31:43,360
for

2273
00:31:43,360 --> 00:31:43,800
yourself

2274
00:31:43,800 --> 00:31:44,160
check

2275
00:31:44,160 --> 00:31:44,240
out

2276
00:31:44,240 --> 00:31:44,340
my

2277
00:31:44,340 --> 00:31:44,500
Twitter

2278
00:31:44,500 --> 00:31:44,720
or

2279
00:31:44,720 --> 00:31:44,960
just

2280
00:31:44,960 --> 00:31:45,520
LinkedIn

2281
00:31:45,520 --> 00:31:45,860
I

2282
00:31:45,860 --> 00:31:46,060
post

2283
00:31:46,060 --> 00:31:46,180
and

2284
00:31:46,180 --> 00:31:46,300
share

2285
00:31:46,300 --> 00:31:46,480
some

2286
00:31:46,480 --> 00:31:46,840
things

2287
00:31:46,840 --> 00:31:47,220
once

2288
00:31:47,220 --> 00:31:47,320
in

2289
00:31:47,320 --> 00:31:47,360
a

2290
00:31:47,360 --> 00:31:47,440
while

2291
00:31:47,440 --> 00:31:47,560
out

2292
00:31:47,560 --> 00:31:47,680
there

2293
00:31:47,680 --> 00:31:48,100
we have

2294
00:31:48,100 --> 00:31:48,260
a

2295
00:31:48,260 --> 00:31:48,800
VMworld

2296
00:31:48,800 --> 00:31:49,420
session

2297
00:31:49,420 --> 00:31:49,600
that

2298
00:31:49,600 --> 00:31:49,680
we

2299
00:31:49,680 --> 00:31:49,800
did

2300
00:31:49,800 --> 00:31:50,040
last

2301
00:31:50,040 --> 00:31:50,320
year

2302
00:31:50,320 --> 00:31:50,560
about

2303
00:31:50,560 --> 00:31:50,800
this

2304
00:31:50,800 --> 00:31:51,320
topic

2305
00:31:51,320 --> 00:31:51,500
as

2306
00:31:51,500 --> 00:31:51,640
well

2307
00:31:51,640 --> 00:31:52,020
be glad

2308
00:31:52,020 --> 00:31:52,200
to

2309
00:31:52,200 --> 00:31:52,660
share

2310
00:31:52,660 --> 00:31:52,860
that

2311
00:31:52,860 --> 00:31:53,240
all right

2312
00:31:53,240 --> 00:31:53,620
I'll put

2313
00:31:53,620 --> 00:31:53,940
some links

2314
00:31:53,940 --> 00:31:54,260
to that

2315
00:31:54,260 --> 00:31:54,600
wherever

2316
00:31:54,600 --> 00:31:55,480
I post

2317
00:31:55,480 --> 00:31:55,720
this

2318
00:31:55,720 --> 00:31:55,960
whether

2319
00:31:55,960 --> 00:31:56,700
you

2320
00:31:56,700 --> 00:31:56,980
find

2321
00:31:56,980 --> 00:31:57,140
this

2322
00:31:57,140 --> 00:31:57,260
in

2323
00:31:57,260 --> 00:31:57,500
YouTube

2324
00:31:57,500 --> 00:31:57,980
or

2325
00:31:57,980 --> 00:31:58,180
in

2326
00:31:58,180 --> 00:31:58,300
the

2327
00:31:58,300 --> 00:31:58,660
podcast

2328
00:31:58,660 --> 00:31:58,980
or

2329
00:31:58,980 --> 00:31:59,280
whatever

2330
00:31:59,280 --> 00:31:59,780
I'll

2331
00:31:59,780 --> 00:32:00,180
link

2332
00:32:00,180 --> 00:32:00,300
to

2333
00:32:00,300 --> 00:32:00,440
those

2334
00:32:00,440 --> 00:32:00,580
things

2335
00:32:00,580 --> 00:32:00,800
great

2336
00:32:00,800 --> 00:32:00,920
well

2337
00:32:00,920 --> 00:32:01,120
thanks

2338
00:32:01,120 --> 00:32:01,360
for

2339
00:32:01,360 --> 00:32:01,680
going

2340
00:32:01,680 --> 00:32:01,900
over

2341
00:32:12,860 --> 00:32:14,920
you