HeroDevs: Transforming Open Source with Innovation and Funding

Hey everyone. Welcome back here to Techstrong tv. You know, I'm, I'm really happy to have this gentleman return.

He has some great news for you out there for the Open, legacy, open source industry, as well as for him and his company. Let me introduce you to Aaron Frost. Aaron is the CEO and co-founder of Hero Devs.

If you are really in the open source world, you've probably heard of them, but if not, we'll not to worry, we'll get you up to speed. Hey, Aaron, welcome back to Tech Drunk tv. It's great to have you back on, man.

Yeah, thanks for having me back, Ellen. It's good to be here. Cool.

Um, Aaron, let you know, it's probably been, I'm gonna guess nine months, maybe close to a year since you've been on here. Mm-hmm. Um, why don't, you know, I, I don't assume people are gonna remember, you know, from your last time, but give people a sense of how you came to co uh, co-found hero, Deb, the CEO here, kinda what your path has been like.

Yeah, so in 2018, I kinda did some work in my personal life and realized I should probably start my own thing. And we started as a consulting shop, but, uh, a really popular piece of open source hit an end of life that was brutal for my customers. So we, we created a fork and we started shipping updates to that fork to our customers who, who needed it.

And it, overnight it became obvious. This is a huge problem for a lot of people. And so through 20 21, 20 22, 20 23, we, we leaned into that.

We started shipping, um, to more customers. We started shipping more open source projects that are each end of life. We started finding more security problems in those projects and fixing that kind of validating the need for our existence, uh, with the customers.

And, um, the growth has been honestly, kind of fantastic, Alan, in, in 2024, we were nominated as the, the, the first, the fastest growing company in Utah at a 4200% in the previous three years. So, um, wow, That's crazy. Kind of extreme growth.

And then, you know, in, in 2025, we, we took a step back and said, Hey, this is something that needs to be here in another a hundred years. Like this is a business that has to survive. Um, let's bring on a partner that's gonna help, um, take this, uh, uh, to the next level with us.

And so we're, we're here today 'cause we're excited to talk about bringing a, a new partner. And we did, we did a, a big round of funding recently. It was a $125 million round Wow.

Invested into the business as a, as a strategic growth round. And we're excited about what it helps us do as a business. And so we're, we're excited to come tell the community, Hey, this is happening and, and this is what it means for him.

So who's the partner? So it's a, it's a growth equity firm at, based out of p uh, Boston called PSG. And, uh, it's led by a guy named Marco Ferrari and Paul Rus.

They're, they're, they're honestly pretty rad. Um, mm-hmm. And if, if you, if you check out PSG, you'll see they raised an $8 billion fund in February.

They announced it. And they're focused on like, tech enabled services and, and, and, and mostly on tech. And so it's exciting.

They're really, really cool. They, uh, they've been a huge support to the team already. And they're, they're continue to push us, um, to serve more of the community faster.

So it's a good partnership. First of all, man, Aaron, congratulations. Right?

I, I've, I've, I've done four or five startups, venture backed startups. I know what it's like to raise money, you know, a really smart man who, who's a mentor to me, and then, uh, mentor to a lot of people. This guy named, unfortunately, he's not with the same, his name's Len Fassler.

He used to tell, tell me, he, he used to tell it to everyone. He did about three or four rollups in his life, three or four different rollups, you know, and then IPO'ed and stuff. So he bought a lot of companies.

Um, every single one, he would sell the dev to the, uh, founders. He'd say, look, be really proud. 'cause anytime someone's willing to reach into their pocket and write a check or give you cash for what you've built from scratch, that's something to really, really be proud of.

That's kind of the ultimate, right? You can sell customers, you could get customers, you could build a business. But if you build a business that someone says, Hey, I wanna invest $125 million into that business, think about it.

Right? That's, that's the real mark of success, right? In a lot of ways.

So congratulations to you and the whole team there. That's, that's a fantastic thing. You know, Aaron, as we were talking off off camera, a lot of our audience can say 125 million in this market.

Wow, that's fantastic. What does it mean? What does it mean for me?

What does it mean for the market? What does it mean for the community? Yeah, let's talk about that.

It's a good question and it's an important question. And, uh, we're at the, the part, it, it enables a lot of growth. And let me talk about the one that I think I'm the most excited about.

In 2024, we, we donated back to the open source teams whose projects we've worked, we donated back to those teams over $2 million. We have a bit of a rabbit hood play as part of our business model, which is, um, that we work with the teams to coordinate security vulnerability disclosures and make sure that if we fix something, they have it fixed, fixed in the, in the, in the still supporter versions before we announce. That way, their community, the whole community's not not left exposed.

And another part of that is, um, we, we done it 10% of our proceeds back into those projects. And so in 2024, we got into over 2 million. And this round we were able to schedule, um, to set aside $20 million of wow Ted TEDx back into these projects.

And so we announced an open source sustainability fund, Alan, that we are, we're enabled as a CEO. It's nice to say, I am empowered to give this money out to the communities. And the, the, the idea here is we wanna improve the end of life ex uh, knowledge around each of these products.

'cause everyone announces their end of life differently. They have a different cadence. The way that they consider what they will and won't fix on end of life versions is different.

The length of their long-term support prior to end of life is different. And so we want people to be a lot more explicit in announcing, Hey, this is what your exposure looks like at the end. And projects who lean in on doing a better job at announcing end of lifes and protecting the community by just virtue of that knowledge being on their websites, they're now eligible for their share of this, you know, $20 million.

And there's a lot more information coming out about it very, very soon. Um, the press release around it officially launching, went out a few weeks ago and, and there's a lot more information coming soon, but open source authors can already today go and sign off to be a part of this program. You know, we have a couple teams, big open source projects like the Bootstrap team and, and the View project who we're, we're, we're certainly among their top donors based on this, uh, this, this, this relationship we have with them.

And we're excited to continue to expand that out into, um, additional projects in, in additional communities. The dinette community, maybe the Java community, um, database, community, open source, um, operating systems community. So yeah, it's, that's, that's the piece I'm the most excited about.

Beautiful. Yeah. Yeah.

I mean certainly we've seen a lot of shaken around in the Linux space, but Aaron, um, you know, to me that sounds almost like I, so I remember when the whole responsible disclosure thing sort of became real in security. 'cause he, when I first got into security, it was the wild west. Mm-hmm.

You know, researchers couldn't wait to, to to, to, uh, you know, announce that they found a a, a bug. They give you two days. Yeah.

I'm renouncing this Thursday. Today's Tuesday. Yes.

Yeah. And, and a lot of people push back around responsible disclosure and then, you know, but if you think about it, the responsible disclosure kind of protocols gave rise to bug bounties or maybe the bug bounties help solidify responsible disclosure. Mm-hmm.

Right. And, and this is a very, could be a very similar thing. We could, you know, this serves as the bug bounty, if you will, to having people do the right thing about how they end of life open source projects.

So it's a little more predictable, a little less uncertainty. Right. And, and there's a, there's a process that, that we all follow.

Aaron, how many different projects is hero dev kind of shepherding these days? Currently shipping out to our customers, I think we've got about 1,078 different open source projects that we forked. Wow.

And we're shipping continual updates down into our customers. A lot of these are based around the front end and Java technologies like Spring or Struts, Apache or Tom. So a lot of it's very focused.

And, um, this round also helps us do some growth as a business. Once we can do JavaScript or Java, it's very easy to go deep in those technologies and, and pile on a lot more products. Where we, where we struggle is to get breadth of new technologies, new ecosystems, like a database that's a wholly new, um, game for us.

And so this round helps us expand into additional and, and more complex, um, types of, of ecosystems in the open source community where we can now, once we have that muscle, now we can go deep on that muscle and we can continue to expand out. So, um, yeah, it's, it's quite a, it's quite a lot already. com, where every open source project that's used by enterprises and governments can have a commercial license on end of life versions.

That's our goal. Got it. Hey, let me get real geeky open source licensing on your for a second.

So when you guys are forking the end of life, open source is your fork open source, or that's now closed source? Yeah, so the, the fork continues under the same license as, as it existed before. Same license as the original.

That's beautiful. Yeah. And do you keep the same name or you gotta change the name of the fork?

Well, we, we add the word NES to the end of the name. Okay. So like, if I had a project called Alan, if I forked it, I would call it Alan NES.

So Alan never ending support version. And then that way everyone knows this is the opus, this is the community. Well, you know, that's, I'm thinking how do you know the difference then?

Yeah. But yeah, I mean, look, you know, I, again, I come from the security world, so I saw it over and over in security, but we're seeing it. Look, look what on went on with Hashi and open tofu and all these things.

Right? Um, really cool stuff. Aaron, I know we're kind of running on time, but it got more for you.

Ai, everybody's crazy with AI and, and what's happening. What effect is this happening on open source projects? I think, um, AI is on, on, in different ecosystems is having a lot more impact than others.

Like, if you look at the community like spring, there's a massive push to get the spring AI modules going so that it can be platformed, um, in a more uniform fashion so that not everyone has to reinvent the wheel to, to add AI into those projects. There's also a lot of inefficiencies that come with adding ai. If you don't know which of your systems calls out, if it calls out too much and you add AI to that, you're tokenizing, you know, a hundred times more often than you should.

And tokenizing sending tokens to AI is a very, very expensive part of your, um, API going forward. So there's it, it's forcing everyone to rethink about what we've built and to reconfigure it to make it be significantly more efficient as far as it accelerating programming. I mean, if you look at, you know, Satalia Naela or, um, any of the other, you know, serious execs talking about it, it's, it's shown a 20 to 30% in improvement in efficiency among development.

So it's, it's, it's, uh, incontrovertibly having a serious effect. If it, if you're leaning into, Hey, how's it affecting end of life supporter versions? It, it doesn't have too much of an effect on, um, people who need end of life code to continue to, to survive.

And so where we sit in the open source community, it's not wildly impacted, but generally it's impacting open source communities in a big way. Yeah. Overall, and I think we'll see it continue to expand that.

You know, one last thought, Aaron, you know, putting out security patches for these end of life open source tools, in so many ways, it's, it's about software supply chain security as well, right? Because in my mind, and I don't know your business, like, you know, your business obviously, right? But there's two sort of use cases here.

One is, hey, I already have an app out there, right? I, my app, my company relies on this app. Our customers rely on this app.

This app is, you know, like most apps today, kind of a Frankenstein made up of a lot of open source components with a little code stitching it together. And I gotta make sure that those components I'm using are secure. And look, if there's a vulnerability found in a, one of the components I used, I gotta up fix that.

And if one of the components I used end of life, it's, it's a bit of a pain in the butt to go find a replacement. I'd rather keep using it if I could make sure that the security and functionality's gonna be up kept to, to a minimum of what I need. So that's one use case, right?

Post-deployment. Then there's the other use case, redeployment, which is, you know, developers are very much creatures of habit. I need this functionality.

This is what I use when I wanna put this functionality into an app that I'm building. Struts is a great example, right? Uh, uh, uh, uh, J two four, whatever, uh, you know, we, we use the same things over and over again as we develop new apps.

And sometimes I think developers, they don't care if it was end the Life or not. It's still up in the repo. It's still, I can still pull it down from GitHub or or m VIN or wherever I'm pulling stuff from.

And there, I think it's even more important that DevOps engineers somewhat is saying, Hey, wait a second, wait a second. There's an old version known vulnerabilities, there's an updated fork that they're going to continue to, uh, support. Right?

That, that to me is, you know, let's make sure it gets into the SBO m all these things, right? That, that's a huge thing. Especially, you know, they say that with AI helping us with code, we're gonna develop x more applications and lines of code than we already have, right?

What we already have in the world is gonna be dwarfed by what's gonna be written, let's say in the next five years with AI and stuff, right? So that's a huge mar even bigger than the existing. Yeah.

So cra you know, when you think of that, it's a crazy time we live in. It's a crazy It is, It is. And whether you're in the first scenario where I have a massive app that that's responsible for most of my revenue as a business and I need to stay alive, or I'm in the second camp where my developers, they know how to use this, my whole system's configured to use this legacy thing, we don't want to reconfigure to launch new things with new stuff.

We're, we're, we're kind, we, regardless of which camp you're in, um, we're here to be a partner to make sure that it's safe. It's, it doesn't have security vulnerabilities as you do that. And, and, uh, when you're ready to upgrade, uh, obviously we'll coach you through that as well.

We'll help, you know, the fastest and best way to, to get your app on a modern platform. So, um, at the end of the day, we do think it is the best idea for everyone to upgrade. But if you can't upgrade, that's, that's, that's the reason why we're here to help and stay safe before you do that.

So, yeah. I love it. Aaron.

I gotta wrap it up, man. But hey, congratulations again. I'm really, really proud and happy to see you guys succeeding like this.

Keep doing what you're doing and don't wait nine months for a year to come back on here. Okay? Yeah, Bet.

Thank you. I appreciate you. Alrighty.

I appreciate you. Aaron Frost, CEO co-founder of Hero Devs here on Text Drunk tv. We'll take a break.

We'll be right back.