Transcript
A (0:00)
In this lessons episode, explore what drives secure and scalable open source businesses amid growing cyber risks. Discover why security depends more on culture and investment than open or closed models. Understand how customer led product development enables early enterprise adoption and uncover how impact, growth and community attract and retain top technical talent.
B (0:27)
The other thing that I think about when I think about open source is you've built this community of people that are always like pressure testing your software. Talk to me about security, talk to me about why open source. I've watched a couple other interviews you're in and just the security point I think is important, more important than ever before with the amount of people that do get compromised. So when you roll this out and when you build an open source project, is it more secure than a closed source?
C (0:54)
Yeah, that's a great question. I think, you know, it's many things. It's not just the open or closed model, right? It's the investment on security. It's, you know, your internal process. Security doesn't come down to, you know, one or two things. The way that, you know, think about, there's sort of three principles to think about in security. One is nothing is secure. There's always going to be vulnerabilities. All you can do is kind of move those around. So that's, that's one. And when you're open source software, you have a lot of visibility and your customers are very motivated to work with you on security. Everyone runs the secure customers. We're in public sector, we're in like US Air Force, right? There's like 20,000 US air crews that rely on mattermost in order to fly planes. And the security and the rigor that we go through is at that level. And then you'll find us in many communities that have very, very high security standards. So I think that community and that understanding that yeah, all software is vulnerable, we've got transparency and people can report to us and we have a system to address that. That's all super important. So I think that's one on security that is for the open source model I think the second is really about there's a second principle which is the effort that goes behind a breach, right? That goes behind an attack is proportional to the value of that breach. So what that means is, you know, if you can think of like, hey, I've got everything in this giant cloud system, like everyone in the world uses this cloud. Great, guess what? There's going to be like an infinite amount of like resources that will be dedicated to breaching that like mega fortress, right? And all they need is a crack in the armor and they're going to be going after it. What open source and self hosting lets you do, we can do either cloud or self hosting, but what it lets you do is go, is put that behind your own defenses, right? So one, your data is not mixed in with all these other, you know, honeypot targets you've got, you know, your stuff is off the side and it's behind all your other security. And the only people that are breaching it are the people that want to breach you, not breaching you by accident by hitting somebody else. So I think that's the second piece and then the third is really just about the dedication to security. So one thing that I'm actually personally proud of is our security team and how it works with, how it works with the community. We just brought on a wonderful person, Jerry Perello, who is the former CISO of the New York Stock Exchange, as an advisor. So, you know, that's just an example of how much we care about security. And he, you know, he doesn't hold back, you know, on his opinions and what we need to do. And it's super helpful. And what I'm really proud of is just a little while ago we discovered as we're. Because we vet all the software that kind of comes into mattermost and we vet it very carefully as we're vetting a certain library for SSO SAML authentication. We, we found a vulnerability in the Golang language itself in the XML parser and this. And we're like, wait, this can't be true. And we looked at it and we're like, oh crap, this is true. That never went into, we were never exposed to that vulnerability. Our customers are not exposed to that vulnerability. But there were a lot of other people that use Golang and use SAML SSO that had a vulnerability. It took us three months working with the Golang team and working with the downstream libraries to figure out how do we do a coordinated disclosure. So the coordinated disclosure is tell the like, we created the patch mattermost itself, not the Golang, you know, folks, but we created the patch itself. We created, you know, a reference for, for how to fix it. We went through a very time series. We told the downstream libraries, we got them to prepare patches. We told the people, private and public companies and government institutions that were exposed to this vulnerability that was there so that they can fix it quickly. And then we did a public disclosure. So we did it in a responsible way. We cascaded it, we gave people time, let people know, it was important and this was a big deal like it would, you know, one of the tech giants, you know, had to, had a delay, one of almost had to delay one of their launches because of, because of this issue. So, you know, that's what it means to be part of the security community and really participate in not only the safety of our products and our customers, but of the general software community itself. So I think when you think about, you know, what it means to be great at security, I think it's not one or the other, it's about, you know, how do you, what is the whole story about your investment security also the fact that keeps things safe.
