It's Monday morning. Oh, Monday morning. Big day, though. Big day for vaccines. Big day for counting electoral votes. Ooh, big day. And it's a big day also because Sophie Cock is here with us from the Star Advertiser. And she wrote a story. We want to talk to her about it here on Community Matters. Good morning, Sophie. Good morning, Jay. Nice to see you. So it's about beaches. It's all about beaches.  It's essential connection with the land. It's really connection with the beaches and the water. And people feel that. It's almost a religion with a lot of people. And so it's built into the DNA of the state, isn't it? Can you talk about the background of the connection between the people way back when and the beaches and the water? Well, I mean, I think you're right. I think that, you know, the beaches and the ocean have always been central to life in Hawaii. Obviously, it's a center for recreation. It's where people take their kids and, you know, their friends and families. It's where people have fished for generations. So I don't think you can underestimate the importance of the beaches to Hawaii. And obviously, they're a huge draw for our tourist economy as well. And so when, you know, as we're facing a future with far future, far fewer beaches, it's a real emotional thing for people to grapple with. Now, when you say that, you're talking about sea level rise. You're talking about the disappearance of beach sand, which we already see in so many places. You're talking, you know, and you're talking about really people who thought they really made a brilliant move by buying property on the water. The future may not hold all the same promise they were expecting. So you wrote an article about beaches, and I think it's really important that we discuss, you know, what that's about, because although you and I respect the whole notion of allowing access to beaches, not everybody does. Can you talk about that? Yeah, well, I mean, I think, first of all, just to put the series of stories that I've been working on into context, as you had mentioned, we've already lost a lot of our beaches. And scientists estimate that on Oahu, Maui and Kauai, about one quarter of the beaches have been lost. And that's largely due to shoreline armoring. Obviously, you know, over the past decades, we developed way too close to the coast.  And, you know, so that's, you know, in part why I felt like it was really important to do this series now is that we're just sort of at this crossroads right now, if we don't make dramatic changes in the way that we're managing our shorelines scientists predict the loss of our beaches is going to be really dramatic in the coming decades. To revisit the notion of seawalls for a moment, I know some property owners on the North Shore, we're talking decades ago, who saw this happening and who decided as a matter of faulty engineering that they should build seawalls to protect their own beaches, their own, their own sand behind their house.  And now it's disappearing. So your first reaction is, oh, I think I think about build a seawall and an engineer come around and stamp the plans and presto you have a seawall. And just as you said, the seawall does not help. It's reverse effect. All of a sudden you have no beach and the whole thing is inundated. Right. Well, it helps the private property owner, but it's obviously a huge loss to the public. I mean, we've seen it in Launaykai, Mughalaya, where rows of seawalls have gone up. It's like it's a domino effect. And it happens pretty quickly in terms of the erosion of the beaches. And it's tragic for the public, I think. What's quickly, Sophie? Well, scientists say you can't make a generalization about how it depends on the coastal area. So you can't over generalize about, well, if we put seawalls up on Sunset Beach, how quickly that beach is going to go. But I think what we've seen with Launaykai, that happened over 10, 20 years in terms of how quickly we lost that stretch of coastline. Half of that beach is gone now. Scientists are predicting that it'll continue to erode. So these decisions are, it's not something that's happening over 100 years. It's something that's happening 10, 20 years or losing them. Well, Chip Fletcher at SOEST, at the university, tells us what areas are likely to be inundated. And there's an awful lot of them. And he gives us maps. I'm sure you've seen the maps of the water creeping up into the community. But a lot of people, they don't take it seriously. They have these rationalizations. I don't shop there. I don't go there. I don't need to go there. I don't care. I don't care if we lose the beaches. In fact, those tourists, I don't care about them either. So what? What's your answer to that? Yeah, it's that's one of the things that was really interesting in reporting this last story and interviewing so many of the homeowners on the North Shore of Oahu. These are some of their most treasured beaches. And it was interesting talking to them because a lot of them were aware of the damages that seaballs cause. But they still wanted to put up a seawall on Sunset Beach, Pupukea, because their rationalization, what I kept hearing was like, well, yeah, we know that it's caused damage on other beaches. But we just don't think it's going to happen on the North Shore. We think it's fine if we put up seawalls. Or others are just really adamant about what they see as their right to protect their private property, even if it is at the expense of public trust lands, the beach. And of course, our laws and policies and Supreme Court rulings say the exact opposite. They say that it is government officials responsibility to preserve and protect natural coast lines. That area is a public trust and it belongs to the public. It doesn't belong to private property owners. But it's, you know, it's a thorny situation because when you have people living on the coast and they're, you know, on the brink of losing their home to the ocean, it's probably human nature to scramble and try to save it. And it's hard to tell someone that they're going to lose their home. And some of the property owners are really wealthy. They live in multi-million dollar homes, but we also have other areas around the islands where you have people who live there for generations and don't have a lot of money. And so it's a really difficult thing when you're faced with, you know, telling that property owner that their investment is now public land. Yeah. Well, you know, one question occurs to me. I do want to move on to the legal, but one question occurs to me is that if you build a seawall and then you recognize that that's not going to work, it dawns on you, that's not going to work. Or rather, put it this way, it dawns on the authorities, the governor for example. If people seriously take climate change as an emergency, which they should, and say, gee, we can't afford to have that, so we are going to, you know, take an aggressive step. And we're going to tell all these people they got to remove the seawalls or we'll do it for them. And so we're going to take them down one way or the other. Does that correct the problem or is it simply too late? Well, I think it depends on the coastline and what the projections are for sea level rise. I mean, as you had noted, so I said UH Manoa has really good maps right now that show the inundation with sea level rise. And so they don't see it, you know, when I talk to scientists, they don't see it as too late. But they do see it as, you know, we're at a point where we have, we can't keep bandating the situation. We have to take action now if we want to preserve beaches like the North Shore, which, you know, are so important to so many people. I mean, they're heavily used. And so, you know, I don't think we're going to save all the beaches that are left. And scientists don't say that, but, you know, we got to start prioritizing what we do want to save and then figuring out an exit strategy for all those private property owners. And it's not just homeowners. The state has done a terrible job in terms of relocating highways away from the coastline. And that's been one of the, you know, a really big culprit in terms of beach loss. So we're dealing with not just the loss of our beaches, but infrastructure and homes falling into the ocean if we, if we don't try to, you know, remedy the situation. And it's, and then we have all of these cesspools all along the coastline. And so scientists are, you know, growing increasingly alarmed about what impact that's going to have on the quality of near shore waters. If we have all of this wastewater flowing into the ocean, you know, it's being inundated. Yeah. And vice versa. It's the ocean flowing into the aquifers as well. Right. So you have an exchange of, I don't want to say, well, of contaminants as it were from one side to the other. Let me digress for a moment though, because what strikes me to hear you talk is that there's another issue too, and it's the North Shore as well. You know, we all came up at the time where every X yards, there was an access to the beach. And that you could, you could park on the road on Kamehameha Highway there, and you could take stuff out of your car to go to the beach, and you could walk down a little, a little access way, and it was usually fenced, because the property owners on either side didn't want you to get into their backyards, so they fenced it. And then all of a sudden property owners started to shut those down. And it was a, you know, a big rumble about that, maybe what, 10 years ago, maybe, where some of the local people said, wait a minute, wait a minute, wait a minute, you're shutting down what we thought was our right to access the beach. And oh, people were fighting about it as if that wasn't the law, but it was the law. Where does that fit in all of this, Sophie? Yeah, that's not, I haven't focused that much on, it's a huge issue, and I totally agree. I mean, the public absolutely has a right to access the shoreline, and there are stretches of coastline that have, that private property owners, hotels, condos have worked very hard to close off to the public. We just saw recently the whole skirmish with Koalina blocking off shoreline access to the public. There was no, I think the issue was with parking, and they've been suffocating that for years, trying little by little by little, to stifle any access. Yeah, and so Oahu's Surfrider Foundation did a really good job in, you know, trying to raise awareness about that issue and opening a parking along there, but it's a huge problem. I think through, not just Oahu, I know on Maui, it's something that they've been fighting on the west side, particularly, you know, with the hotels. The beach is not, it's not private part of, you know, hotels private property, or homeowners private property, it's it's a public beach, and so I think a lot of that comes down to the county in terms of enforcing shoreline access, you know, making sure that they stay open, and that there's enough of them, that they're, you know, interspersed. We have certain parts of the island where the access is really good, like Waimanalo Beach Slots, or that whole coastline, and then other, like, where it's terrible. Well, let's talk about, you know, the governmental, the governmental imprimatur here. So if I, I'm returning to the main theme, if you will. So if I build a seawall, or I do other engineering that is actually hurtful to the ecology, and enhances the sea change, sea change, sea level effect. So I need, I need permission to do these things, like seawalls, from DLNR. And that was an essential part of your story the other day. Can you talk about that? What, what, what kind of permits do I need to get? How hard or easy is it to get them? And what about this thing about renewing them indefinitely? Can you talk about that? Yeah, so, you know, there's the seawalls, which permanently fixes, which fixes the shoreline. And I think it's pretty hard to get a approval from DLNR for a new seawall, particularly if it's on a sandy beach. It's very hard, but we've seen property owners just go to the county sitting in County of Honolulu and get the approval. But in terms of the story that I was working on, on these emergency approvals, that's really a whole different thing. DLNR has for years, sort of viewed them as or soft erosion control. And they see it as, you know, when you have a, when the erosion is within 20 feet of a home or hotel, they've been allowing the property owners to essentially put up these sandbag revetments. And there's all sorts of iterations of it. I mean, we have just stacks of sandbags. We have these burritos that have been going up on the North Shore, where you have like a long tube, and then they put geotextile fabric over it. It's all different concoctions. But scientists say that shoreline hardening is shoreline hardening. And it doesn't matter if it's a sloping boulder revetment or a seawall or a sandbag revetment. If the shoreline is naturally eroding, it's going to have the same effect. It's going to pull sand off the beach. So they become increasingly alarmed by all of these emergency protections that are going up. The burritos on the North Shore, you know, there's 30 of them. And those are just the ones that are, you know, have been authorized, most of them after the, a lot of them after the fact. I've also heard that there's others that are up that are illegal that just aren't on DLNR's radar. And those approvals really, I think, have gone on below the radar. When I talk to lawmakers, they had no idea that, you know, that this was taking place. I had no idea until I started investigating the store, the series at the beginning of the year that that's how, I mean, we see these big sandbag revetments go up. But I had no idea what, you know, what the authority was that was authorizing them or how they came to be. And so what happens is that basically the head of DLNR, you know, if they see it as an emergency, they can sign off on it and allow them to install this structure. And it's supposed to be, per DLNR's own administrative roles, temporary. But what temporary means has been, I think, one we construed. And what I found in my investigation was that these sandbag revetments go on for years and years and years that DLNR continues to basically extend them. Usually they're given three years, you know, but they continually extend them. And I found, you know, sandbag revetments that have been up for more than two decades. And so those approvals completely bypass our whole approval process for new seawalls. If you want a new seawall from DLNR, you have to obtain a conservation district use permit. So you have to do this environmental assessment. It's a really rigorous process. You have to, it goes before the land board, you know, if it's in the conservation district and on public land, they then have to pay the state to lease the land, which can be incredibly expensive. But these emergency approvals bypass that entire process. So, but then, you know, on the other hand, it's a situation where I think DLNR feels like they're in this bind, you know, they're trying to protect public safety and not have all these homes fall onto the, you know, the beach. But at the same time, it's these, you know, seabag sandbag revetments are becoming long term fixtures on our shoreline. And we just haven't come up with any sort of exit strategy or anything. Well, soon enough, these homes will fall into the water. There's another element too, and I just recalled, is that if the ocean comes higher on you, if there's a rise and it takes the sand away and all that, the, I think it's the high water mark is the end of your property. And you may have bought, you may have thought you were buying, your property description may have indicated that you were buying more, but you wind up buying less as time goes on, because the high water mark is, is climbing to you. There's one reason why a homeowner would want to avoid this process, because he's losing land, his property's becoming less valuable and all that. Is this relevant to, is this becoming relevant to the choices made by the homeowners, by DLNR, you know, to get, to approve, to renew these emergency permits? I mean, if I come to, if I come to you and say, look Suzanne, Suzanne case, look Suzanne, I'm losing land. I got to preserve my land. It's not only that it's, my house is going to fall into water, but it's, I'm losing land. We can't have this. And I know of no other arrangement where I could protect what I bought. So how about it? Or perhaps more to the point, I go to a legislator or I go to the governor and I apply political pressure on the basis of my problem. Is this, is this playing into it? In terms of, yeah, I do think that the property owners have a lot of influence over lawmakers and to some degree, government officials. It's a little harder to get at that issue, but I think the real estate industry has had a lot of influence and developers, you know, at the level of the, you know, state legislature and city councils, county councils. But yeah, I mean, what we state, what we state publicly, you know, the state says publicly about owning a home along the coast is that it's a risky proposition, you know, it's a risky investment to buy a home along the shoreline. And our laws are very clear that if the shoreline migrates Malca, as you had mentioned, then that becomes public land. The boundary between public and private property is the high wash of the waves during the time of year that, you know, the ocean is furthest inland. And of course, our oceans are increasingly pushing inland with the level rise. So it's not a good place to be.  I think what I've found in terms of reviewing 20 years of approval is that the state and county level is that over and over again, government officials, when it comes down to it, they repeatedly favor the interests of private property owners and for the interests of the public. It really flips the priorities that are outlined in our laws and policies. So it's going to take some leadership to say, wait a minute, we have to look at the priorities here.  I really wonder, by the way, just a footnote wonderment if those properties are as valuable as they used to be. I mean, it's a headache. If I sell you a property that needs a seawall to preserve what I think is my high watermark, that's a built-in expense. I have to go file for a permit. I have to go lobby. I have to spend money to get protection on this. And so it's a built-in problem. It's like an EPA problem. And it's going to follow that property wherever that property goes. And therefore, I would reduce my offer for that property because I would build that cost into the value of the property. That must be happening with at least some of these properties on the North Shore and elsewhere. Well, yeah. I mean, what I found, which was particularly alarming is that a lot of these property owners, particularly on the North Shore, obtained these emergency protections from the state. And right after they get them and they have their, you know, a lot of them, it's like they put up a burrito illegally and got after the fact approval from the state. And they immediately flip the property or put it up for sale. And buyers, I talked to, some of them told me, I mean, this is their side, their version of the story, but they said they didn't even know that the emergency burritos were going to expire.  And it's amazing how much these properties are selling for. I mean, they are classified as eminently threatened. You have to, you know, just in order to get an emergency approval, it has to be classified as eminently threatened by the state. Yet they're able to sell it for millions of dollars. And it's just, it's a huge problem. And it raises a lot of ethical issues. And then, you know, one other issue just to touch on really quickly that you talked about is what I found is that there's really an equity issue involved in all of this. It's really only the wealthy property owners that can afford these protections. The emergency revetments often cost 30 property owners have told me $30,000 to $70,000. And these are supposed to be temporary, you know. And then sea walls can cost hundreds of thousands of dollars just to get through the regulatory approval process can be incredibly expensive. So this is something that's really only in the reaches of the wealthy. Yeah. Well, you know, I'm reminded of an architect, rather an engineer who died a few years ago by the name of Alfred Yee and his partner was Hans Crock. They were both, you know, structural engineers. And they designed this concrete anchor system for the Natatorium. And the idea is to put these special molded concrete forms in the water around the Natatorium and you change the way the water flows. And these guys knew how to do that stuff. The city was not interested and it got in the newspaper, but nothing ever happened with their solution or any solution. You know, government just had no will on this issue. It was not a priority finish. So I'm thinking maybe there's another kind of engineering solution. And it isn't just a sea wall or a burrito. It is another kind of engineering solution that people or the government can and should do to preserve the shoreline. Has there been any discussion of that or are we limited to, you know, sea walls and burritos? You know, I think that there is some discussion about that. When I've talked to coastal specialists, they say that there could be sort of a middle ground where, for instance, on the North shore, property owners are able to put up some sort of protection during the time of the year when their home is really being hammered by the ocean and then they take them out. And so they do see some sort of middle ground there, but I haven't seen anything manifesting in that regard. No, that's the problem. It's not a priority. And indeed, these days, we have so many other priorities and we're in a pickle with the budget. So where's the money going to come from? I mean, this is not going to get resolved by individuals. It's going to have to be state action. And it is critical to the state. And I'm thinking of when Bloomberg was the mayor of New York, they came to him, the engineers, the architects that came to him and they said, you got to do something because Sea Level Rise is going to ruin downtown. It's going to creep into all of Lower Manhattan. And he did take steps. I don't know what they were. They were engineering solutions to avoid inundation. And in a funny way, New York, which is very threatened by this, right on the Hudson River and the East River, actually did stuff. And here, we're surrounded by water. Those charts that they make at the university are very, very, very threatening. Not only the property owners, but the whole economy of the state. What do you do with Waikiki? The island of Waikiki is inundated. Oh boy, what are we going to do then? It's a terrible result. So the question is, if I gave you, Sophie, a check for anything you wanted in terms of American money, billions, what could we do? What's your mailing address? Never mind. What could we do? I mean, maybe those roads have to be built up. Maybe they have to be moved inland. Maybe the governments that come around and do condemnation and all those buildings that are losing value on the shoreline. We have to reorganize our entire community physically in order to deal with the climate chain, which is happening. And certainly nobody can say that it's slowing down. It's speeding up. There's no question whatsoever that this is going to happen at increasing, accelerating, and more threatening all the time. So, querie, what will ultimately have to be done if I gave you this billion, billion dollar check? Oh, jeez. I'm just a reporter. I agree with you. I think step one is getting the state and kind of start moving the roads back. I think that would help immensely. And it would show the state is showing us some leadership on zone infrastructure. I mean, the whole issue of, you know, are we going to condemn land and pay fair market value or just let nature take its course is so, so thorny because, you know, I've gotten a lot of emails actually from people in other states like California, North Carolina saying, you know, the state's policy has just been to let nature take its course if you lose your house by the ocean takes it, the ocean takes it, right? So when you get into this whole issue of condemning land or buyouts, it's tricky because critics are saying, you know, why should we, as a public, be bailing out private property owners for making a bad investment decision? And it becomes even more, you know, people get even more upset if it is hotels and, you know, really wealthy homeowners. Why are we having to spend all this money to bail them out so we can protect, you know, what is public land? And so it's just really, it's hard, you know. And then, of course, again, there's the equity issue. Can you even distinguish by, you know, wealth? Can you say, well, you know, this homeowner is low income and lived there for generations.  And I don't know that you can start doing some sort of a litmus test, you know, and, you know, if you're going to have an overall policy, I don't know if you can get into that litmus test about who you help out and who you don't. Maybe you can. It's a challenge. It's a challenge and it's not, it's not comforting in the sense that right now it's visible. You can see it right down the road what's going to happen. And you can see that it's a threat right now in certain ways, but it's going to become more of a threat in other ways. And after a while, it's going to become existential, you know, to the economy of the state. And our systems are, what do you want to call it? May I say democracy, our transparency, our whole system of dealing with existential problems is it really needs work.  It's just been a reactive type of, you know, and not proactive. And so those issues are just really coming to a head. And but yeah, it is, you know, just two, three months ago, government officials and scientists really thought we were going to see a whole, you know, bunch of homes on the North Shore just collapse. I mean, that's how serious the issue is. It's not really a question of if it's a question of when. And, you know, the burritos are upsetting a lot of people because they're worried that it's going to erode the beach on the North Shore. But, you know, whether there will, you know, ultimately be able to hold back the ocean, I think most people say, no, I don't think so. What are you going to do with that mess when, you know, it's dangerous?  It's really scary. Just the thought of it. Yeah. Think of the lawsuits. Yeah. You know, and the lawsuits will shoot in every direction, and including the state, including the neighbors, including the engineers, whoever. Well, thank you very much, Sophie. It's been a great discussion. And I feel that we are not yet done. I feel that you are not yet done. This is, this is going to be a subject you can plan to cover for many happy years to come or unhappy years as the case may be. You know, you're onto something here because this is going to be with us and be increasing the relevant, increasingly threatening as we go by. Well, thank you very much for coming around. I hope we can do it again. Yeah. Thanks for talking to me, Jay. Appreciate it. Aloha. Sophie Koch, Star Advertiser. Star Reporter on Star Advertiser.


Perfect. All right, thank you everyone for joining this morning. I have today with me, my dear friend and security leader, Nick from SNAP. He heads the detection engineering at SNAP. Nick, thank you so much for joining me this morning. Thanks for having me so much, Sandeep. It's such a pleasure. Absolutely.  We will not be talking specifically about any particular product or any particular feature. Rather, the goal of this, you know, session essentially is to talk to thought leaders like Nick, see how cutting edge security teams like the one in SNAP or the ones in Google or Amazon, essentially use open source software at scale to keep their security program, keep their security apparatus consistently cutting edge. So that would be the topic today. The way we're going to go about this, Nick, essentially is, of course, we have, I have a dozen, you know, almost a dozen questions for you starting, you know, talking about the evolution of cloud security, talking about how open source fits the bill. You know, what sort of any initiatives that you might have at SNAP that we could, you know, take as a use case and talk about it. And of course, a bunch of inputs along the way for vendors who have open source first, you know, good market strategy, as well as, you know, any other compliance with that, that would be the format. Well, we'll keep it part structured, part free flowing. So please feel free to ask any questions. Anytime you want to take the questions towards the end. And with that, I think we'll just go ahead and get started on this one. So by default, all the attendees are muted. This webinar, of course, is being recorded and you'll have the slides as well as, you know, the video shared with you as we go forward. Keep asking the questions anytime you want to, you know, ask those questions absolutely fine. I will try to keep looking at the, you know, the questions and, you know, if I find any question that is sort of super relevant. At that point in time, I'll bring it up right now. Otherwise, we'll take a couple of questions, you know, towards the end of the webinar. So with that, to introduce myself, of course, I'm Sandeep Kofan, I'm the receiver defense. I have Nick with me, security and utility leader at SNAP. Nick, once again, welcome to the session. Yeah, thank you so much Sandeep. And of course, Nick, you and me go back a long way, you know, start, you know, meeting first on the bylines of one of the conferences and we share this common passion for open source. But for the audience, you know, that has tuned in today, do you want to go ahead, you know, sort of talk about your journey. How you, you know, what is your primary role and responsibility at SNAP, what you've been doing prior to that. We would love to hear your story. Start with that, please. Yeah, absolutely Sandeep. Thank you again for having me. It's such a pleasure to be here and share some thoughts with the audience. I recognize some of my friends and future employees that actually joined this call. So we have an individual joining us soon at SNAP that's actually on this webinar to listen in, which is really, which is really great to see. Thank you for joining Karen. And also thank you for joining Jeff. Look, it's been a while journey. I'm an immigrant kid who came here at five years old with two bags and a dream my family landed in JFK some 20 years ago, more than that actually like 30 years ago. And we, we've just been trying to build our life here and I found security pretty young age and at about age 16 I started, I started hacking web proxies at school because I wanted to get access to the open internet to download music. I didn't want to do this. But at the time the internet was really slow at home we only had America online dial up we would get the CDs and because we were poor, we could only get like 30 hours a month from the CD and then we had to get to the next CD. But the school had proper internet it was T1 it was 1.54 and BPS, which is a lot faster. But there was a problem. I couldn't get past the web proxy to use Kazan Napster download music. I figured out like hey there's this little host file you can edit. And if you edit the host file it changes the route that that machine takes to bypass the web proxy and then I can get to the open internet. And I did, but that was my realization about age 16 I realized that this six the security industry is my calling and since then I've been at it for 20 years and in the best like five years or so something changed in my career I realized I've learned a lot and I've harvested a lot of knowledge. And now it's time to give back that knowledge. And part of giving back that knowledge is sharing some of the cool stuff I've learned along the way with others. And that inspired me to not only do more things that snap and be more influential but also have a more influential effect on the community to start paying it forward during COVID during lockdowns. We had more time on our hands I decided to create a class on cloud native cloud security technologies fully focused on open source. This class has now been consumed by over 2000 students 2000 people I've never met have taken a class that I created I hope I've created some value for them. Some of them have reached out to me and thank me. Many haven't but that's okay. You know as as I was writing this class I realized that there's not a lot of good books on cloud native open source security. So every book that was even like close to that topic I had a stack of seven or eight books, and they're real and that these books are really great and I could probably write a better book. So after the class shift in May of 21, myself and a couple of folks at snap we, we proposed a book proposal to a publisher we had a relationship with through Michael Zalewski who used to be our VP of security he's kind of an influential guy in the industry. We had some introductions and we got a book deal with no starch, which builds themselves as entertainment for the geeks. So, we're working on the book we're about halfway down it'll ship in September of this year. Hopefully maybe we could do a book signing with with defense maybe at one of the conferences this summer. But yeah that's a little bit of background and beyond that right now I look after corporate. I look after corporate security at snap. I have interest in a lot of other areas that I've talked about with your teaching and my personal research so yeah that's a little bit of background. Absolutely love, love that make and you know what love to host you at our book at RSA and maybe even a black hat, you know, the book comes out by the back by then. And you know what I think one of the common themes that both of us have sort of interacted on is, you know, security is a digital public good. Everybody has a big it's a basic right everybody needs it. It's like GPS it's like raw infrastructure and security is essentially that it's a public good. Everybody has to have an access and I think that's where you know be connected on the open source, essentially the passion for open source and you know, really giving it back to the community so thank you so much for that. Now let's just, you know, try and you know look at open source insecurity and how leaders such as yourself companies that have snapped essentially look at this from a standard point of view really right. Yeah. What level open source security solutions are considered by your teams be the detection engineering team be the the security engineering team or DevSecOps or you know you name it essentially. One of the options that comes to you know the team's mind or you essentially always start with open source solution is how do you really think about it. We almost always start with open source and the reason from there. Now there are some things they wouldn't build like they wouldn't build an anti virus team and that's really involved and other people have done it really well. We probably wouldn't build some other commodity tools but would we build the service around device trust to assure that every single corporate device on the network actually belongs to the company and when you authenticate to a company endpoint. We can add in a payload in the authentication header to assure that that endpoint is actually the company's endpoint it's not a real good point. That's something we build. We call it device trust. So it's foundational right we could have when bought something similar sure there's beyond corp style zero trust products in the industry but that's not how we approach it let me let me tell you a little bit more about why. Let me zoom back out to the kind of cloud cloud angle here to me it's really ironic that the cloud and the internet are built on open source technologies broadly. However most security tools are closed source commercial products.  I think it holds back security engineering as really being seen as a true engineering discipline and a lot of companies. At high technical bar companies this isn't the case but in in lower technical bar companies security is seen as a compliance function as the policy people people who say no. But what why is that the case at like at the foundation security is an engineering problem. Right. And so at you know at internet scale the way that we operate we we need to build to support the the ecosystem that part of if I can convince the engineering team that a security control needs to be implemented and built in a certain way and we can't have like low low observability of how we do that especially in the cloud context. We're not going to be able to get it across the line and close source commercial products.  Let me give you an example snap rounds of service measure over 1000 communities clusters. In order to add runtime monitoring like Falco we had to convince the mesh platform engineering team that's kind of the central team that builds the service mesh that we instantly understand the fault modes for Falco. And we have a way to kill the sidecar that Falco runs in. If something goes wrong. I remember this meeting vividly. It was a meeting with the engineering director for that she means like Nick where is the big red button. Like, oh, you mean like how do I kill it if it's if it's if it's doing something unexpected. Yeah, like Nick how do you kill it because honestly these folks don't really want this there this is like another variable for them to manage so we have to convince them that this is the right thing to do so how do we do it we throw it modeling and we sit down and say okay what are the fault modes that can happen. The cluster loses connectivity to the network and fully saturate the network adapter what do we do next Falco sidekick services down or inaccessible how do we kill it that we push a bad rule to Falco another rule up data is stuck in a loop. Right, what do we do next, or we have an unexpected CPU load on the kernel, and that that's maybe the fault of Falco how do we have observability so we spent like a year studying how to do this correctly. I'm not kidding like a year, and then implementing all these control mechanisms these big red buttons as I call them right to roll out of Falco that's just one like one major product yeah we chose open source Falco instead of cystic like enterprise Falco. Why because we felt we could do it ourselves and we wanted to take the time to really do it correctly and not put ourselves into a position where that when I get you know challenged by an engineering director. Whereas the big red button I know where the button is I know how it operates and I'm confident that we need to want me to press it we will press. If we need to. So, that's part of our ethos and I think when you build security services in house completely or open source you know exactly what's going on you can debug traces will have low level of their ability. You are empowered to scale the services to your company's needs. You're not locked into a vendor ecosystem and ultimately, this is a lot more fun like, I think I can hire better people who are more into building, and then keep them happy because they're building really cool stuff in the industry because it's a lot more reliable versus like taking boxes on the UI you don't really know what the box does you have to dig in through a vendor documentation. Now I do want to caveat this isn't for everybody a lot of companies may not want to treat their security engineering program this this way but where they have a heavy build or heavy open source culture. Some companies want to treat it more as like a dial or manager role this role decks of vendors run some tools you look at some logs have some alerts you do some follow up at the end of the day this is risk management is the risk that way we've chosen the risk we've chosen to manage the risk a very different way a very intentional way a very deep way a very methodical way and to do that we have to really understand what's going on. And to do that we need to have low level understanding of the code of the of the the Providence of it. If it comes from open source which of course we can always look because open source is open or build it in house. So that's a little bit of our ethos envy. Absolutely. In fact, as you were outlining that particular example. I totally concur that operationalizing security program at scale is an engineering problem. It is not a vendor problem. It's not any of those other things really, and especially at your scale or any you know internet scale companies it's it's the, the tool the product that you're using has to be out then the public you should be able to build faith around the, you know, the thesis the product has, you know, maybe even sort of evaluate it internally to see if it is, you know, it meets your, your own standards of quality really right. And the second one is the most of the float source product and I totally agree with them they probably wouldn't scale to where snap is at or where Google is at for sure really right so you can take the code for open source customize it you know operationalize it truly the way engineering happens and you know top tier tech companies really so it couldn't agree with you more really and you know I think the right way what it is is basically that operationalizing security is an engineering problem. Absolutely it's it is risk management again at the end of the day but to operationalize and scale it you need to create these happy paths for engineering teams right you can make it easy for them to do the right thing and hard for them to do the wrong thing. Yeah, in a way that's as frictionless and seamless as possible. Absolutely you couldn't agree more. And you know what what I love that the fact about open source I mean I mentioned that essentially is the quality of folks that you've been hired just to work on cool stuff which is out there and open and trust me since we went open source. I have made most of my key hires on GitHub. It changes the game you're not no longer right initial recruitment and hiring top talent for example ebpf you know we did the same thing. Most of my top ebpf hires are from GitHub project either they reach out or reach out and that's it. No recruiters nothing so open source essentially. Yeah. The quality the DNA essentially has to be needed in DNA to operationalize any kind of security at scale so yeah. Absolutely. Now, we spoke about we know I want to go deeper on one or two use cases, you know that you might be dealing with or the team might be dealing with that snap neck.  What is your mental model, you know, having been through the journey really it has evolved I'm sure really right based on starting at the 16 year old to where you are now. What is your definition, what is good and what is great. What did just compliance even purchase and what is security engineering driven security program essentially. Yeah, you know, having a chance to work with you on and doing some consulting work 2011 2013 timeframe, I open my eyes to what I call good to great security. I think the major difference between good to greater the engineering bar and the adoption of a either an in house built culture or an open source built culture. Like we really mentioned sick at its core security is an engineering problem. So let's talk about an example. Let's say you have 2500 engineers they need to correctly manage I am permissions for AWS. Right. And we need to do this consistently so how do you make this easier for 2500 engineers, you let them like pick whichever permission they want do you like have some set of permissions do you have some birthright access you have. Do you have like some kind of system you build. How do you do that like, how do you abstract away the complexity of 2500 engineers. Right, you need to build a happy path right and sure there's vendor solutions that do this but in this example snap has also chosen to build in house we built a tool and how to do this. And we've taken the like a leasing philosophy where you get access for an ephemeral period of time, and that that ephemeral period of time that expires and like our app where you send a snap. Once you've read it and replayed it once it's gone forever, ever ever right same thing the same thing that the access now. The balance here is how much overhead this is created for an engineer to come in request access lose access request access was access. We're not clobbering them like every couple hours you know it's every couple of days or maybe a little bit longer. But that's the kind of thing they need to do like we've solved for this at massive scale not even one cloud to clouds, and that internal system that we build it handles both of them and we could probably scale it to a third one if we needed to.  At one point you're going to be like, what am I even doing like I'm lost. And these tools that I have I don't know you know what they're for like a lot of tools are never even used. So there was like a study on the three something I read on the internet that I think like 40% of organizations have tools that they never even log into right like what's the point. So you got to be like a lot more intentional about this stuff right because if you're being intentional and building you know why you're building you know why you're there you know why the codes being written and you know my open source is being used consuming tools left and right. Unfortunately the industry wants us to do that I get solicited to probably 50 times a week. You know it's everything from like, you know Nick do you want a gift card do you already want to go drive Porsches with us so I get to know you a bit better like come on. Why do we have to be, you know, having to be transactional. Right. I can't accept any of these things it's against company policy please don't offer me. So, anyway, I think the time for open source really is now the security landscape is shifting to open source first. And these recessionary times and companies are being challenged and see if those are being more scrutinizing with those that role of decks of vendors that I talked about the time for open sources right now like the people doesn't care how much open source costs because it doesn't cost anything to get started and then when you graduate and what enterprise, it's probably going to be more affordable than a pure pure play commercial product what do you think Cindy. Absolutely, you know, absolutely especially in fact I had I had a couple of questions that came up, you know from from this discussion that we're having the first question Nick is to run second engineering security as an engineering function in a way really or or call it secret engineering which is basically operationalizing sacred apparatus of scale. Roughly, what sort of commitment companies like snap look at essentially are we looking at 10 security engineers for every 100. Yeah, that's a really good that's a really good question. Yeah that's that's right so we've historically taken a 10% of engineering kind of baseline proxy metric. So if engineering is 2500 or so about 10% of security across all different disciplines right. We have seven teams across those those those disciplines. But yeah that's the metric that's a big investment. A lot of companies cannot make that kind of investment and if you're a smaller company, you're lifting this like man this guy's crazy like how can you have that many people. Well because we're intentional we care a lot and we build. If you're smaller you can scale that down to the smaller size that you are right. Maybe it's not 10% free maybe it's 5% right but it needs to be a kind of like engineering minded metric otherwise it's unclear what the purpose of this role is. And that is so true for so many products it's unclear why they were purchased, why one of the, you know what the matrix, what are the key goals and objectives you had they never get deployed forget getting deployed at scale they just never even get deployed really find solutions really and you know I completely agree with you that you know open source gets you know forget the vendor side of it purely from customers point of view from a user's point of view.  Then of course oftentimes you see that there are companies there are startups who are essentially often support or some additional features on top of that that you can always reach out to, you know, you know, work with them as part of your, you know, your extension as, you know, as part of your team essentially, and go from there to you right so do you do that as well Nick or it's primarily, you know, we collaborate like I'll give an example but we need to build arm 64 support for for Falco. What did we do we went on the Falco Slack forums and start talking to other people who are BPF developers we're not BPF developers. The person who worked on this and part of our sister team like he never even looked at that before but we know again we have a higher technical bar. We give people space and it took some time but he figured it out. And now we have arm 64 support. What would we have done if it was a vendor. All right. Hello, Mr. Account Manager. Hi, I'm Nick. I have a problem. This thing doesn't have arm 64 support. Can you get it into the roadmap. Okay, Nick. Let me go talk to the product manager. Okay, okay. Sometimes passes, they come back. Oh, let me talk to the product managers manager. You know, Nick we talked to the head of product that we can build this for you it's going to be six quarters. That like, that's the reality that we deal with like that that's that that really is the reality I'm not dramatic so. And I think it also depends on how enterprise grade that that particular open source product is I mean is it just a command line tool that you're bringing in and the building. That's that's that's exactly that's exactly right like like like defense and tackle these are enterprise grade security tools, much like what has she core brought to the market when they built vaults. Some 10 years ago right like it's enterprise great it's high quality for the enterprise and happens to be open source this is like the best of the world right like why are more people doing this I don't get I don't get it so. I think everybody is going to do it soon enough absolutely agree with you. So, you know, moving on, I'm already getting a couple of questions more than a couple of questions from audience. The last point was super important for them and I took you see we know how and why essentially. Hey, do I have to put in 10% of my engineering strength to operationalize this particular tool now or will 2% or will 1% or hey you know what I'm an up and coming SMB. I hired our first security higher than that's my whole team, what do I do with open social area I'm sure these are all, you know, valid questions and I would have to dig deeper into all of these so but moving on, you know, for now. Tell us what are some of the challenges organizations may face when trying to adopt OSS for security. And what I mean by this is, is there. For example, you in your case really do you have a checklist that hey this project has to be Apache V2. Hey this has to be part of CNCF or open SS or you know what the dentist report has to be out there and get to otherwise I'm not going to touch it you know, is there a model is there a checklist you know that you or the team had essentially why evaluating such projects for your intelligence. Yeah, that's a really good question. Well, I look I think just to get started like the technical bar is definitely a bit higher and you need to hire people who are technically capable hands on engineers, not all security engineers can code for open source I think you people who can code. Or it could be DevOps engineers or other engineers but they need to be engineers like they need engineering to be somewhere close to the title. So you need to have that type of talent. Now I think secondly is is you need to ensure the project you're you're considering is legitimate and it's serious. And you should also consider supply chain tampering like maybe projects coming out of certain parts of the world. Maybe they have, maybe they have backdoors maybe they have some some nefarious things going on maybe they're sort of, you know, Trojan horse kind of projects to get into your environment and then absorb your environment so you got to be cautious open source as well so the way we look at is like is it legitimate how much adoption has it had in the industry are people in our like tighter circles of security engineers talking about it. How many stars does it have on GitHub how many times has a ripple been forked right like how, how, how, how good of quality is the code like we can obviously audit the code because open source, right. And then how much more do we need to do to make it operationalized at our company, because that that's the part that takes the time right like you can always drop it in and get immediate results it depends on your requirements like if our requirements are very sophisticated if it's a smaller company that may not be as sophisticated so pentest reports also matter but I think reputation matters more and like like really like shaking it down and like getting a couple people to look at it closely that that can probably give you enough, enough comfort, and then the rest is is is implementation and opera operationalization. Yeah, no totally agree and in fact you know the bit that you said about. Are there any back doors, is there anything potentially nefarious with this, I think open source sort of you know gives you puts it out there in open really for so many eyeballs you know like you essentially so many people are looking at at and you know if you look at if you look at the stories every quarter, somebody's firewall gets hacked. But you know the Genesis of Secretary industry was around hacking close source products really right so open source in a way I think I'm fresh with of air because you know it's out there to see you can have your engineers you know look at it pentested you know find the kids treat this as an engineering problem just like you would do for your services you know your critical. You know, I can think of many vendors security incidents that we responded to as a result of poor security practices. Totally yeah totally see that yeah. In fact you know what I wanted to keep this question for the end Nick but I think it's so relevant to this particular point I must bring it up now. This is a question from such it such it is the question for you Nick he's basically asking. I can't do 10% of security engineering from get go for open source, if new adopters are scaling and always his program. What are core competencies needed in security, essentially what such is asking me. Hey I have X people engineering team and I have some security folks. What do I look for in these security engineers to be you know calling them essentially security engineers for this new program really right. So that you can resume that is the question that you know the essence of your question, Nick over to you. Yeah, that makes sense, such a thanks for joining such as a friend of mine for many years actually so great question. Look, you don't need 10% to get started 10% is where you where you may end up over time. I think you need a couple of good people who have done similar work in in and around open source projects either developers of them contributors to them or other companies that have similar cultures, like take any tier one tier two tech company. Most of those companies have done open source projects in this kind of way.  And what are some okay ours for that focus. Right now for us it was for the faculty story it was getting run time observability over our over Kubernetes fleet. That was a big big big project where I took it took a while to do that that that was our challenge but our fleet is like very large and complex. And so take like one or two areas where you feel like there's good partners on the market like a defense for example that built legitimately high quality enterprise grade products. Find one or two people, probably at like a l 405 level, which is like senior senior or staff, and, and put their focus on this and if they're good and the product that you're using is good. I think you're going to see incredible results you'll be surprised by how much, how much of value you're getting and how much money you're saving with open source. Absolutely. Absolutely.  You know, is there a company behind is there is there, you know, essentially someone who's sort of willing to work as an extension of your team, even if you don't have a team, for example, you're just building. Is there a community like if it's two guys in a van kind of open source project like yeah maybe it's kind of risky to put your your big bet behind that. But if it's a legitimate company that has large adoption like the examples that we've talked about, they have a product community they have good quality documentation like that's okay like you could start there and then, and then iterate and see and see how your adoption goes. Absolutely. In fact, you know what there is one more question coming from Christian Becker, what Christian is essentially asking is, what about Oasis license management, thinking about copy left and copyright licenses here in commercial. Yeah, that's, that's a great question Christian so yes you need a way to to observe this there are mechanisms and tools that can can ensure you're within license license compliance. So maybe there's tools that scan repos to look for whether the license allows commercial usage or for commercial usage rather. This is another angle of it yes the you do need to manage this it's not something you can exclude, but you can also very clearly when you go to the project like you can see what the license is and before you adopt it because okay can I use this license is this this license allow this kind of use case open source cannot be the wild wild west you can't be like okay team open source slam my hand on the table scatter no you like anything in life you need to have a strategy to be intentional. And so when you pick like one or two or you know or five of these, you can vet them obviously and you should have them before you use them, and then I think you'll have much much better understanding of what you're doing and these types of risks are are really really mitigated. Absolutely. Yeah absolutely Christian I hope that answers your question. Thanks Nick and moving on to now to you know essentially a more specific use case for you right. I want to ensure Nick that you know we're giving our listeners right now something super concrete that they can relate to for example you know hey I'm just building up my security program and I've been told by my CISO, or it's a board level you know sort of you know, a director which has come in, which says hey you have to be at least 50% compliant as per MITRE attack and that means doing one two three and four right that could be basically one of the management that has to be you know cloud specific attack vectors you know as per cloud MITRE attack framework really right. MITRE attack of course is you know it has so many favors now for cloud, Kubernetes and so much more. How would you go about it essentially and it's a very sort of a high level question essentially we can just pick up one single modality saying that hey look, we are working on AWS forget Kubernetes for a moment really just think of it as a cloud environment, and I am supposed to be meeting at least 50% of the MITRE guidelines.  And you know, essentially, can we map some of the open source tools that we have that that you might have seen to one of the existing one of the ongoing or one of the evolving programs within SNAP saying that hey, look, we would be supposed to be doing this let's say MITRE attack we were supposed to have 50% coverage for MITRE. And as part of that effort, this is what we did, and this is how we went about it. Yeah, do you have any such case to do that you think we can share. No, that's a really, that's a really good question. The way the way I would think about this as follows MITRE is now pivoted and provided very actionable very measurable from initial infection to pivot to lateral movement coverage with their ATT and CK framework right. So you sit down and map this what this means to your DNR program for example and say okay, how do we get signal coverage for 50% of the MITRE ATT and and CK framework. Well, what are they. Let's look at them in detail. Now we say okay how do we get a signal for that. We need some kind of attack vector from an from the AWS infrastructure well we need some kind of product to do that. Right, we need some kind of observability product to do that. It turns out that deep fence offers MITRE mappings out of the box. So if you turn on deep fence for that cloud infrastructure to start observing it you'll quickly see which one which signals you're generating for the for the cloud infrastructure and those AWS it could be at a DM level it could be at a Kubernetes EKS level, regardless right, you'll get that like out of the box immediately and then that saves you a lot of time like this was hard like sitting down like parsing spreadsheets to figure like well I have this thing here it maps MITRE here. This is really labor intensive enough fun. But if you have this mapping in a product like it'll quickly show you like here's the coverage here here's the gaps here, and then you can start to operationalize those to your detection and response team to act on it to triage it right to enhance the alert. And then we get into playbooks and response and containment kind of exercises that you know as per classic detection response goes. And this is this is pre deployment, as well as post deployment, some of these controls, some of the checks and balances some of these tools that need to operationalize to let's say meet 50% of MITRE coverage really. They have to be deployed throughout your CSID pipeline right there, they're not necessarily only as part of CSID in the sense of you know pre deployment or not necessarily only at some time right they have to be scattered throughout. The first you will have to probably figure out all the integration points where you really need to do what, map it back to potential vendors or open source projects and essentially go from there really right to get you that brother coverage.  If the coverage comes with the product out of the box which it does with defense like that's so powerful that this this could take many, many, many days and weeks to to parse through. And I think that's to in a sense it's like a quick start guide already. So, yeah, absolutely. Moving on, I'm getting a couple more questions but I think we can save those for later they're not about the point that we were discussing so let's move on. And, you know, talk about this particular question that that is in front of us essentially is so when you think about building secure cloud native services and be getting more specific about cloud native now. Are there any fundamental controls or partner technologies that are table stakes for organization to consider essentially what are the lowest common denominator to make when it comes to building a cloud data security program is what the question is. That's a really good question. The way the way we think about it is this like the foundations that we need to build to be secure, whether it's in a corp context in a cloud context and other context. Those foundations really haven't changed in the last 20 years the technologies and the how has changed, but the foundations really haven't changed so what I the way I think about this is. Okay. You start with a security strategy for those foundational controls that you need to have in your environment and they could be things like, do you have observability on any piece of infrastructure that is being provisioned to your to a public internet presence. Do you have observability on hardening scanning pre deployment, do you have runtime observability in context, are you collecting logs, are you sending them to a system or a human who can act on them. Do you have audit mechanisms to look for changes that infrastructure that are unexpected. If a pod is immutable, which it is in the clock in the cloud communities context. It changes on a pod like what's going on like why somebody shelling into a pod that that's probably a bad actor behavior now. Continuing my my discussion here. Now you take that signal and you send it to to an individual and then individual X on it, or a system X on it will store type frameworks we can have systems acting on signals now. So what I just what I just described like that, it really hasn't changed in the last 20 years. When we had bare metal VMs and data centers when I got started with this industry was basically the same. It's become more sophisticated the skill has become larger and the unit deployment has become smaller now it's the pod before it used to be the physical server, but the elements of this are basically the same. Yeah, you know I told you again in fact you know what one of the one of the things that I used to want to make. And I'm sure you thought about this too is given the fact that observability basically means being able to infer internal state of any system by looking at the outputting signals, right, which is why you have any LT in you know, observability metrics events, errors logs and traces essentially really in in cyber in security we have the mitre attack and defend we have really granular flavors of mitre for various modalities but there isn't anything like any LT, which basically tells me hey if you just this for you taken care essentially, but what I what I what I learned from what you're saying which I think it sort of you know resonance very well with me is look at four pillars here too. The first pillar essentially is measure your attack surface, you know that is your pre deployment checks post deployment checks scanning CSPM, what have you essentially what could go wrong pillar number one and this is commodity everybody needs it. The modality change, it was VMs earlier now it's communities on top of VMs probably tomorrow something else but essentially the core principles remain saying the modality might change so measure what could go wrong the move on. And then deploy or develop a way essentially to measure what comes in what goes out and what changes is basically what it is really figure out your attack surface and see how the runtime signals are interacting with your attack surface, and that is pretty much essentially the way to. What do you agree. Yeah, I know I completely agree and so we could talk more specifically about this we have some some questions up and it's sort of in the back, maybe we could skip to question nine I can talk more about this. Sounds good. Okay. Now this is this is purely this question comes purely from a start point of view, maybe right like I'm a startup let's say we're running a startup which is you know having this open source project seeing great traction. And we want to know how a top tech, you know, Dr engineering team would evaluate such a such a project really right. Yeah, that's part of whose reputation and even the fitment and you know all of that. Sure. But is there anything more there. Absolutely so first of all, first of all the first question is what what problem are we looking to solve internally. Yeah, and sometimes we do a build versus buy bake off if there's a compelling product in the industry that we're we can get behind. Sometimes we don't sometimes we we we skip immediately to open source or build. We don't have the same modality, because the open source almost always involves like some some building to operationalize into your environment so. And then we ask ourselves like hey what is like the ideal state and this is where like my product management had turns out a little bit. There's this idea of like working backwards or okay now that the thing has been completed and launch and has this capability. You, you will have like an announcement of that capability I'll give an example now we can observe all runtime. How do we work backwards from that and state to actually establish that and then how do we evaluate the potential partners with how close they will get us to the what and why that we're looking to accomplish with objective criteria like how would you know the end of market. How much existing adoption. Do they have how, how many feature requests or pull requests are being submitted into their open source project. How engaging is there, is there support community like we don't want to be on an island ultimately if we have to support something will will be will usually figure it out. But those are the kind of questions that we asked. Right. Now, be beyond beyond that. We also ask ourselves, how, how long will this probably exist and like what's the next iteration of it, and with open source next iteration can be our own iteration, we can fork the project and make it to whatever we want, versus with close source partner technologies, they're completely commercialized, we're at the mercy of the product team back to my, you know, begging and pleading to the product management team to build features. Absolutely. And I think, after that, of course, the open source product, or the project that you're choosing has to be at least as good as the close source options that might be there on the table essentially or at least has to be open enough, so that you can customize it really right and that's when the quality differences will probably start coming in. Hey, what is the quality of alerts, how many integrations it has and stuff like that to you right so. Right. Absolutely. Yeah. Okay, moving on to the next question. And I told you already we have at least a dozen questions for you and I see more and more questions coming in from folks as well so I hope you have time. We'll move on. Of course. Of course. Absolutely. So the question is, you work with household internet scale companies and it snap isn't household name. And that, of course makes you a desirable target for right after three right. And is there a or use case or example of how you're always a strategy helps your company manage cloud media security at internet scale essentially. So I think this is probably the same use case that we're speaking about of your observability but but over to you, if there is anything more that comes. Yeah. Yeah, well, at internet scale as we discussed there often are not alternatives that are palatable that are not open source of built in house. Now to make this to make the answer here like we're useful to a broader audience they're not always internet scale companies. Let's talk a little bit about like the tenants of why open source is useful. So I lead my teams to have extreme ownership and focus on craftsmanship. Right. You, you, you, you eat your own food so to speak meaning the code that you build it should be of high quality we should have unit test we should have coverage. It should be understood by others. It should not be a black box we should avoid single points of failure. Right, which means a single, a single engineer on a team should should not be the only person who understands it multiple engineers on a team need to understand that with open source this is very achievable, because everybody can see what's happening they can look at the repo, we can collaborate on on feature requests and PR is we can do code reviews together. Right. And we know like we know what's happening and that that helps us really for that helps us inform our strategy just like iterate and like build feature a build feature be and so forth. In other sense, I think open source helps us with hiring like I already talked about some of this but like the best people in the industry that we hire they want to build the cool stuff like they want to do stuff that's like really notable. We've open sourced some projects that snap has built like back to the community right. And we won't and we'll do more white white like why not it's we built it we built it for the world will build will will allow allow the world to use it. I think also having an open source heavy culture. It allows you to hire software engineers into security engineer roles. Because at the core like what what is a security engineer security engineer somebody who has context and knowledge of threat modeling and attack surface and risk play kind of risk based mentality but they're also somebody who can code and he was an engineer at the core. So in some cases we've taken software engineers by title and really by background. And we've hired them into teams that build build services or build on top of open source services and we've taught the threat modeling the kind of attacker based mentalities and so forth. Now we open up our talent pool like dramatically if we can hire let's say back in software engineers versus security engineers which are a lot harder to find and they typically come with a premium. So we completely get moving on to the next question. And this is a little bit about, you know, the description that you will need to have essentially is anything about defense or a project like defense essentially threat map about open source, you know, CNAP essentially which helps you scan. As part of CICD at runtime across all the cloud modalities essentially to and ensures that all the all the days you know essential features like vulnerability management, you know CSPM malware scanning security scanning is essentially out there for everyone to use, but also comes with matters included right like you have integrations you can you know integrate this tool in your ops to lane file a georatica in all of that stuff really. So, and this probably goes back to one of the earlier questions essentially is when you're taking something like this, like you know defense we have had a different journey they did not start as an open source company. We were closed source first day earlier right when we started but then we went open source. So the platform that we open source essentially was already being used by enterprises for for you know close to a year. So what would be your input to to start that so vendors like defense essentially that hey it's it's essential to have those enterprise features baked in as part of the platform that you're putting out so that anybody could just download and start using it you know without any customization without putting any additional it's sort of on it. How would you look at it essentially and what would be your advice to you know the listeners. If you're a builder, like like yourself send deep and you would like to take a product to market. And your commercial only you're going to be met with a lot of resistance from people like me. I get peppered for requests to look at stuff all the time. And a lot of it I'd never even look at because it to me, what's more novel is what what you're doing. What's more novel is taking open source approach so in the competitive landscape that that exists in this industry with with just and so many options so much optionality there are very few high quality open source products. And those stand out to me the ones that do stand out to me. And this this is why I'm an advocate for this the space. So my advice would be like hey build this in to your product or like maybe have like some part of the product open source people can start maybe there's like a freemium kind of layer of. Hey you start here and then you grab and when you graduate we're here we're here with you we're not going to leave you leave you hanging right and so like in that sense you you can get the best of both worlds and you get your product to to market for people like myself who are skeptical of closed source, and then you have a kind of like a revenue pipeline to enhance and build the enterprise version into that customer install over time. Absolutely and you know overall it raises the bar for everyone right by permanently shifting these you know demand and supply curve in our case and in cloud security essentially everything that you need on what whether you're building out a security program or whether you have already matured program or you're willing to you know are looking at replacing a bunch of float source vendors with open source becomes a standard essentially right in terms of usage adoption and you know that way you're you know slowly but steadily changing the demand and supply curves of cloud security couldn't agree more. Moving on. So, we spoke about observability we spoke about Falco Falco's use case we spoke about the four pillars that need to be defined, which is basically what comes in what goes out for changes and how all of this interacts with your existing attack surface.  I think one of the largest communities deployments I've heard of, honestly you know I didn't you know we've been speaking to so many large companies but your scale is very, very different, especially in terms of communities really. So tell me more about this post deployment. How important is runtime security to observability, you know and we're talking about the molecules we're talking about part level process level context. Yeah. None of that. Yeah.   Okay. How do you observe for bad in this running state and in a immutable service context where a change should never actually happen to a pod because it's meant to not be changed. So you need to observe you need an observability layer like falco or like defense that can basically run a kernel level BPF probe to look for look for assist calls to the kernel introspect them and tell you, Hey, is this normal or is this not normal and if it's not normal fire from alert. Here's some like really good examples. A lot of communities clusters are targeted for crypto mining takeovers this happened to Tesla I've talked about in the class that I built with capacity. That's one of the three studies that we go deep on. They had their API server layer exposed that actor took over there. What are what are many of their Kubernetes clusters and started spinning up Monero crypto mining pods to do crypto mining why it's free compute awesome right. What the lot with a lot of infrastructure going on. I, unless you have logs that specifically look for like callbacks to their C2 control, or other, other log level observability on like the network layer let's say you won't cash it at the pod level unless you have a low level observability with something like defense or Falco you just want there's no I don't think there's a way you can technically do it. So, to me, this is definitely more advanced but to me if you if you care about runtime and you actually care what's happening. While the infrastructure is running before it gets you know killed destroyed and reintroduced because in this context we mostly treat this infrastructure like like cattle right versus like pets. Just like in the corp context if we have a laptop on the network. I need an observability in the laptop because without observability I can't react to a malware download on a laptop on on on the corporate network just the same way I can't respond to an event on a pod in the cloud context unless I have that low level observability. Absolutely. Yeah, absolutely. So while it is essential to do scan as part of the deployment, of course, can you tell infrastructure, you know, using agent base region to solution to cover the basics essentially CSP and moldability management all of that it is equally important to have runtime essentially which which use EVP or for one of you know something similar essentially to get you this low level telemetry and really build detection on top of that right that's that's a high order bit I'm taking a review of me. You need both standing comes first short. It's it's it's a busy don't need but once you have that you need something something which goes deeper right and you know sort of you know is looking at all of these all of these runtime signals to say whether you're under attack or not. That spot on like this is not a a start with this kind of thing this is a graduate from pre deployment to post appointment observability but once you've graduated this is an extent. Perfect. Moving on Nick, and I have at least four more questions I'm not sure whether we have time to take all of those but at least with two of those questions will take. And this is probably the last question from my side.  What would be one piece of advice you would want to sort of leave our audience with essentially before we you know pause the session and then sort of open it for a question. Yeah. I think what's made the difference and deep as this philosophy of being a lifelong student. Being intellectually curious and really never stop learning so if you stop learning you'll probably stop earning and or you may stop earning as much. Right. This industry is extremely dynamic and fast paced and you should never you should never stop learning so for me the day I stop learning is probably the day they like slowly retire and like just rest somewhere. Not focusing on this industry as much until then I will always continue learning. But learning is not enough to me to me, you need to teach other ones you've gotten to a certain place in life to help evangelize and build the next generation. Right. The people we're hiring now are going to be me and some in some in some time frame right. Right. There's also this philosophy that I take of always be firing yourself, like not actually firing myself but removing yourself from the critical path to love people who you've hired to become better than you. Right. Absolutely. And to me that to me this is this is this is the style of servant leadership that I that I like to practice and really support my team with some. And solve for the boring things first the things that we talked about the the hardening the observability the monitoring their learning those are kind of boring this isn't the ml this ai that right then the stuff the vendors want to sell you like the boring stuff matters a lot. Right. If you solve for the boring stuff then you then you'll be in a really really good place right a lot of people don't solve for the boring stuff that they jump into the sexy shiny object stuff. And they actually missed the point of absurd of how to approach this in a strategic way in terms of security program leadership so. I think the other thing is like have advocacy have people that are supporters of your view and have people that you support in the industry like this kind of relationship I think has really helped me like have a broader perspective and how the industry operates.   Absolutely make love that paid forward. Absolutely. Exactly what we believe at the fence. I think with that you know what we'll do is we'll just open up for some more questions.  Given the time limit so let me go ahead. This is a question for you Nick from Dave. The question is, when do you decide to pick up open source point solutions for a specific use case versus go with a broader platform, which is also open source. So what is the thought process taking up a single tool to solve a single matter problem versus going broader. Yeah, that's a great question Dave, thank you for asking it. I think you just start with your strategy so we're a doc based culture we write down okay problem statements who bar to bar at plus and right we write it down. We ask ourselves okay what are we trying to solve for specifically like very specifically, not high level specifically. And then we say okay how can we accomplish this okay are we looking to scan images but we can do that with gripe. Okay, are we looking to look at a bill of materials, there's products for that open source products free. Come take it, or are we looking for a solution that wraps them together like like defense does again open source, or maybe we're looking for commercial offering because we really want that we really think like this is the one. There are those as well that we've purchased like there are this is the one kind of commercial solutions that are fully closed source that we've also bought. You got to start with the strategy you got to ask yourself like, what are you solving for what are the requirements and how do and how will you get there. Absolutely. In fact that was my next question that was in front of me that is, what are the set of criteria that you look for when you want to upgrade from open source to enterprise version of the product. But maybe that could be the sort of you're concluding your mark on that helps the founders like me and companies who are you know trying to monetize open source. Right. I know that's a really good question. You have to figure out what the market's going to pay for it and what is, what is desirable enough for a person like me or another security leader to pay for the enterprise what does the enterprise need well the enterprise needs, usually like lower level authorization management because I have a lot of users using the system, we probably need additional logs we may need support because we get stuck and we may not have, you know all the resources to go iterate and expand our wheels trying to figure it out through the forums. We may need more advanced features you have to figure out what that is, depending on whatever product area and like in this product area. You know threat mapper gives you observability from mapper gives you context from mapper can have have you harden and ensure what you're deploying into production is safe. Now threat striker, which is the enterprise product version here in this context, it will give you a threat graph it'll allow you to seal off and stop attacks at runtime by basically killing the network connection. Okay, if you've studied this and you decided okay, this is the thing people are going to pay for this is the thing that we're going to basically allow for free. You got to do that for every product that's built. Yeah, absolutely. Yeah. What is day zero use cases, one of the day one use cases where is your IP as a company, you know which what is what is something that you can you know give away build a community around the stuff like that I think these decisions have to be made by, you know, on case by the companies that are trying to monetize, whether you want to go open code, you want to remain completely open source or you want to, you know, have a convention they are totally unique. This was awesome. Nick, thank you so much for your time.