ActiveState’s Stephen Baker on Securing Open Source

This is Textron tv. Hi everyone. Welcome back here to techron tv.

Um, really happy to have joining me today, Stephen Baker. Steven is kind of the newly minted CEO and President at Active State, a company we've been covering for, for a while now. Here.

Um, it's okay if you don't not familiar with Active State. Hopefully after today you will be as well as Steven. Steven, welcome to Tech Drunk tv.

It's great to have you on here. Thank you, Alan. Thanks for having me.

Great to be here. Pleasure. It's pleasure's ours.

So, Steven, before we jump into Active State, let's talk a little about you, if you don't mind, and we don't embarrass you. Uh, why don't you share kind of your journey with our audience a little bit to, you know, up to becoming here, CEO and President? Yeah, For sure.

Thank you for that. Um, well, I've been in technology for about 26 years now. Uh, most recently I spent the last three years at Amazon, uh, primarily in AWS, uh, where I led worldwide go to market for, uh, artificial intelligence and machine learning.

Uh, obviously super hot space, especially with all the, uh, uh, the innovation and interest in generative AI over the last year. So, uh, that was a, uh, a great, uh, a great three-year run at Amazon. Had a lot of fun, uh, helping build and develop that business and, and sort of positioning the, uh, the AI products and services for, for growth and adoption amongst our customers.

Um, believe it or not, Amazon was sort of like my first real big company that I worked at. Prior to that. I've been involved, uh, with, uh, five, uh, early stage or startup technology companies.

Uh, going kind of way back to starting my career in the, the web search space. Uh, then moving into, uh, enterprise search, uh, and then getting involved in companies that were doing more around, um, speech recognition. Uh, again, leveraging a lot of, uh, AI and machine learning capabilities.

Um, and then lastly, sort of in the, uh, the cognitive search and the, uh, the ai, uh, kinda operations space. Um, functionally I started in product managements, uh, then ultimately moved into sales, became, you know, chief revenue officer, then COO roles, and then ultimately, you know, CEO roles. Um, so, you know, really think of it as, um, you know, five, uh, five, uh, uh, technology startups or early stage companies working to establish product market fit, grow them to critical mass, uh, have exited, uh, all those companies.

Uh, and then had my three year stint at Amazon. And, and now I'm, uh, really excited to get back into, uh, earlier stage, you know, companies that are in a really exciting space. So, uh, hence why I'm at Active State.

I love it. I love it. You know, I, I'll look it up afterwards, but we're doing this, uh, DevSecOps event at RSA, again, this year, active State was there last year as an exhibitor, as a sponsor of it.

And this year, of course, like everything else in the world, it's, it's DevSecOps in ai and we actually have someone pretty high up the chain at AWS in their AI team as one of the key speakers. We have some folks from OpenAI and anthropics and Google, but we have AWS too af after we're done, I'll give you the name maybe you ran into them at, at during your time there, but it, it's quite a journey. And, and you know, you're right, it's a pretty hot topic and, and it, and I, but here's my a my question to you is what do you take from that into active state, right?

And I guess before we answer that, we should first lay a little bit of a foundation here. 'cause there, as I said, there are people out in the audience who don't know active state. So why don't we, we start there and then talk about kind of taking what you learned, what you were working on, maybe at AWS and applying it here and, and what does the future for active state look like?

Yeah, that's great. Great question. Um, so, you know, active state, you know, kind of our, our, we, we provide a, a platform and a set of services that help any customer or any company, um, that is using open source programming languages, Pearl, Python, Java, et cetera.

Um, in their software development, we help them integrate those languages into their software supply chain in a secure manner. Um, and you know, what that means is like, you know, kind of historically kinda the legacy of the business has been, you're looking at like Pearl or Python distributions, for example. Uh, providing, you know, managed distributions to customers that are free, uh, or I should say comply with, uh, a a customer specific security policies, making sure the packages are void of any vulnerabilities, uh, making sure we understand exactly like the lineage of where the open source, you know, package came from, and that we have done, you know, everything we can to remediate any vulnerabilities that might be in that.

And, and that helps our customers, you know, do a couple of things. One, um, it allows 'em to sort of like upgrade to new versions of languages on their own timeline. Uh, 'cause we're gonna always provide, you know, support for the, the legacy, even the, the, the, the out of date languages that they're currently using.

But secondly, because we actually understand exactly what our customers, you know, require from a security posture standpoint, when they choose to upgrade from like Python two to Python three, for example, we can update them very seamlessly. Uh, for context, you know, most customers tell us, you know, to update from Python two to Python three is, is a few months and a few developers to do it, whereas we can do it in a, in a, in a matter of, of, of, of days. Um, so really, you know, kind of focusing on helping developers do what they do best, which is develop at scale and innovate and do less of sort of the, that low level, you know, kind of maintenance and, and, and, uh, retrofitting of, of languages.

So that's kinda like the legacy of the business. Where we're going and where we really see the opportunity is, is providing an end-to-end platform specifically for integrating open source languages into software supply chains that not only ha ha handles the package management, but also provides consistency across development teams, across, uh, platforms and operating systems so that, uh, build environments are, are, are, are spun up, uh, with consistency. So again, just, you know, helping developers focus more on developing and less on sort of like the administrative tasks, other jobs, and then also providing complete observability into the software that's being developed.

Where's the open source, uh, in a, uh, in an end, uh, in a end product or in an application? Uh, what is the, you know, the bill of ma materials impact, uh, of the, the, uh, the open source languages? What are the attestations or the, you know, kind of the lineage of those languages, what remediation took place, et cetera.

So we're trying to evolve the company from this, this legacy focus on, on providing packages and maintaining packages to providing much more of an end-to-end platform that seamlessly integrates into the complete software development, uh, supply chain and handle security observability, uh, end to end, uh, for that. Um, to answer the other part of your question, you know, why, you know, kind of looking at some of the things I focused on in the past and sort of where we're going now. Well, one is in general, you know, as I look at, you know, companies that I'd like to work with, I'm, I'm less focused on kind of where I've been historically, and I'm more focused on, hey, where's the, where's the puck going, so to speak in the technology industry.

And active state is certainly a company that has a very relevant, uh, position when it comes to managing security postures around open source languages. But with all of the interest in, uh, preventing and eliminating, uh, or at least protecting yourself against supply chain, uh, vulnerabilities and hacks, um, and you look at sort of the, the, the, you know, the breadth of capability that we bring to the table, I think there's an incredibly exciting opportunity for us to sort of, you know, become even more useful, more relevant to the developers that we work with. And I think part of that journey is going to involve significant events, investments in AI and machine learning.

I, I give you a very simple example. Uh, one of the more exciting and sort of, uh, you know, well adopted areas of generative AI is code generation. So you can imagine, you know, we, we will, we'll, we'll, we're looking at using code generation to do automated, uh, you know, automatic, uh, uh, or automated rather code translation from Python two to Python three in a manner that is consistent with what our customers are looking for, and in a manner that, you know, prevents sort of like the manual heavy lift that's kind of required there.

So that's just an example of some of the things that we're, we're gonna be focused on going forward. I love it. You know, I'm just sitting here thinking though, and this look, doing this kind of thing, using a, some sort of chat bot it AI capability in there, it's gonna be can't, can't hurt, right?

It, it's make, make things even even faster for that. Steven, what I always, one of the things I found interesting about the active state is this ain't your usual startup. Do you know what I mean?

It's been around now, what is it, 15, 20 years? Um, so, you know, has a long legacy of, of working in open source and with developers and, you know, making their lives better in using open source, uh, languages and, and tool sets. Now we are, you know, the, the, the, like a Cambrian explosion of all of of languages.

And you know, it used to be as used to, there was Pearl in PHP, now Python's pretty pretty dominant right now, but there's rust and there's Golan and there's, you know, everybody and their mother has their own language today. How do, how do you stay on top of all that? Yeah, no, you're right.

Um, again, great, uh, great question. I think there's, there's a few ways to answer that. And, uh, just to, uh, back to your, your, your previous point.

Yeah, the company's been around about 20 years. We actually count, uh, 97% of the Fortune 1000 are using, uh, active state, uh, services. Um, and again, a lot of that is that sort of that legacy service essentially, you know, dis distribution, you know, management of, uh, of Pearl Python, tickle, things like that.

Um, and you're spot on. You know, what we wanna do, part of our, part of our mission here is to continue to add support for additional open source languages. Um, I think, you know, the key stat that gets me pretty excited about the market opportunity here is that somewhere between 85 and 90% of all organizations globally are using open source in some area of their application development or software development.

So obviously, no, I think it's like 98% is the last numbers I've seen. It's a big number. Yeah, exactly.

And I, I don't have the exact breakdown of the most popular languages, but of course, you know, Java is sort of at the top of the pile there. So one of the things I'm really excited about is we're, uh, we're announcing, uh, early preview support for Java, uh, which is gonna, you know, again, make us more relevant to the broader, you know, spectrum of open source languages that are currently in use. And then, yeah, we're always gonna be looking at, you know, the, the, the additional languages we could be covering, such as Go and the other ones that you referenced.

Um, you know, in, in general. And, and, and, you know, I think this is, you know, sort of a best practice that's not unique to active state. We're gonna work backwards from what our customers are telling us.

Um, you know, a lot of our legacy is in Pearl and Python, and there are strong interest in having us stay, you know, very connected with those communities, uh, helping customers support, uh, deprecated end of life languages, helping them stay current on those, helping them upgrade, helping them refactor. Um, there's obviously, you know, some customers have been using the same version of Pearl or, uh, yeah, same version of Pearl for like 20 years. And so now if they're looking to, you know, potentially upgrade to a, a newer version of Pearl or, or migrate to Python, you know, they're gonna be looking to companies like Active State to handle, you know, what are the dependencies there, what are the security risks and vulnerabilities that need to be addressed?

What are the policies of the companies, et cetera. So, you know, having a company like Active State step in and handle those upgrades, you know, help our customers get current and stay current as sort of like an anchor tenant of what we do. And obviously that just provides a lot of, of, uh, of, um, productivity gains, you know, for our customers.

Uh, you know, put differently, you know, what you would typically pay for an annual subscription to our service is gonna be way less than the developer investment you need to put into maintaining open source languages, upgrading them, uh, retrofitting them, kind of, so on and so forth. Um, so again, that sort of aligns with, you know, help developers do what they do best, which is innovate and do less of what is is less interesting, you know, the maintenance of those languages. Uh, but in general, we'll work backwards from the customers where they're asking us to, um, you know, add additional language support or deep, deeper support for languages.

And like I said, we're really excited about the early preview for the Java support that's coming up. What, uh, is that early preview available now, or it's just something you're announcing now will be available soon? It is, it's available now.

Yeah. So we can work with customers, uh, on, uh, on Java distributions right now. Um, we're, we're, we're doing, so when we say early preview, sort of getting engaged with our customers to understand exactly the pain points that they, uh, they're looking to help us, uh, you know, manage for them.

Um, and then we will, uh, you know, you know, apply our platform to, uh, to whatever that customer need is. And, you know, through that process of just learning more about our customer requirements, we'll continue to build more feature sets around that. But we're, we're open for business for Java right now, and we're looking forward to engaging with our customers on that.

Very cool. Steven, um, you know what we didn't mention, people wanna get more information about Active State. What's the website?

com. Uh, it's, uh, we just launched a, uh, a, uh, a refreshed version of the website. Lots of great information there, especially on the, on the, uh, on the, uh, you know, the blog side of the website.

Lots of, uh, information on, you know, kind of the state of, um, uh, secure supply chain, uh, for software development, uh, kind of what we think are best practices there, where we see the industry growing. We sort of translate a little bit of the, the NIST and some of the other requirements and frameworks that have been laid out there in terms of how Active state can help customers get, you know, compliant with that as quickly as possible. Lot, lot going on there.

I, I think, uh, the Csar and some of the other government stuff, the government agencies, entities just came out with a new thing about software supply chain security agents last couple days. And of course, that's a really, really hot topic around, around the, the, the space here. Um, Steven, first of all, congratulations and best of luck on, on the, your CEO position with active state, you know, to the whole company.

We, we, uh, we'll be following it and it'll be interesting to see how, you know, this next chapter of active State's history, you know, moves forward. Um, you're in the, you know, it's a hot spot, so, you know, make it happen. Thank you for coming up on Text Drunk TV today.

Absolutely. Thank you for having me. Appreciate it.

All right. Stephen Baker, CEO, president of Active State here on Text Drunk tv. We're gonna take a break and we'll be right back.