Securing OSS Vulnerabilities with HeroDevs’ Aaron Frost

This is Textron tv. Hi everyone, it's Alan Show here at, uh, Techron tv. I'm back with another guest.

I got a new company to tell you about. It's first time this this guy's been on our show. I'm happy to introduce you to him.

His name is Aaron Frost. Aaron is the founder and CEO of a company called Hero Devs. That's H-E-R-O-D-E-V-S.

Hey, a Aaron. How are you man? Nice to meet you.

I'm good, man. Just, uh, excited for another week. Nice to meet you too, by the way.

Really? Yeah, another week. I'm sorry.

Think another week, what? Just another long week before the holiday. Yeah, well, you and me both.

It's, I got this feel. We're recording this on a Monday and it's already been a long week. It seems like I've been, I've been doing stuff since at eight o'clock this morning on phones and videos, and it's only noon, so, man, crazy day.

But Aaron, before we jump into hero devs and all of that good stuff, let's hear a little bit about you. Yeah, so I'm a, I'm a former engineer, uh, spent most of my career as a, you're Never a former engineer, Aaron that're true. You're always an engineer.

That's true. But go ahead. So I started actually as a software tester, which meant, um, I never trusted engineers as a tester and then as an engineer, I also never really trusted engineers.

Um, and, um, so eventually grew growing up and starting a, a business that keeps software secure, uh, seemed like a good play and it seems to fit with my past. But yeah, I, I, I focused my career mostly on, um, frontend and backend web technology. And, um, through my career, I, I owned a couple of the biggest podcasts on frontend technology.

I owned one of the biggest, uh, tech conferences on front end. And, um, in 2000, uh, 21, we started selling a product here at Dev. Started selling a product that we thought people might like a little bit, but it turned out they liked it a lot.

And, um, we as a company grew in six months, the second half of 2021. We grew more than most startups will grow in their first eight or nine years. And so, um, just kind of on a rocket ship right now, trying to keep up with the enterprise demand on, on what we do.

So yeah, that's, uh, I'm also, I'm an identical twin, so there's two of me running around out there creating havoc for the world. And then I've got a, I've got a family with five kids, and so, um, they're my five best friends. God bless you, man.

That's great. Yeah. Thanks.

Yeah, I, I only got two and they're in of an age now where they left the house, and it's just me and my wife if we haven't killed each other yet, which is a good thing. Uh, yeah, but I miss my, my boys are coming home for the holidays, so I'm excited. That's true.

Is your identical twin party hero devs too? Or he does his own thing looking like you is enough not working with Yeah. Poor guy.

Looks like me. No, we don't work together, but we do actually co-share an office space, so we work out of the same spot, which is nice. That's cool, man.

You get to stay together, that's a good thing. Yeah. Um, so you mentioned you started hero devs like back in 2021, is that fair?

Well, we started, we started in 20, we started in 2018 as like a professional services business like Dev for hire. And in 2020 we've thought of, we had like a baby in our brains about what a product might look like, and a, a major piece of open source died and we thought, well, we have a lot of customers that need that to continue to be secured. What, What was that piece?

So it's called Angular js, and it was a big front end framework created by Google. And, um, we had a big, we had a big Angular podcast. We ran the biggest angular conference in the world.

And so, and we also were kind of fancying ourself as like the premier angular consulting team in the world too. So like we, we were poised to tell the world, Hey, when this dies, we will we'll ship a fork of it that continues to be secure for companies who need a longer runway. And that was the start of it.

And by the time we got, not, not a month or two into it, uh, the customers were like demanding, uh, that we ship this as spouse as possible, and that demand is what caught us off guard. And that's the demand that I kind of wanted to share with y'all today. Very cool.

So did, so you forked Angular? Yeah, so we forked Angular Jazz back then, and, uh, we hired one of the core contributors to Angular Jazz, and we said, Hey, you're one of us, now you're hero. And, um, we keep this product secure currently for about 700 of the biggest enterprises and governments in the world right now.

And, um, it's, it's, it's a product that despite Angulars end of life, uh, ULAR Jeff's end of life three years ago, we continue to amass more customers every single year. So it's a very successful product, that first product we launched. So, so I know a little bit about Open Source more than a little bit.

I've been involved with Open source really almost as long as I've been involved in security. So when you say you forked it, you're continuing to develop it or you just maintaining off like the last release? Last release.

So we just maintain out the last release. A real simple way to think of our product is before the product goes end of life, it goes into long-term support mode, and that's kind of like a hospice mode for Opus Source and, um, okay. So we keep, we keep that long-term support going for forever, and we've coined it never ending support.

So we sell never ending supported versions of your favorite open source packages that have reached an end of life. Love it. I love it.

Yeah. Have you ever given any thought, though, to continuing to develop the product like a true fork? So we've thought about it, but it's interesting.

Most of our customers, big, big enterprises in governments, they are very nervous that we might add something to the platform besides simply security updates. And so we're contractually bound to only provide the minimal amount of updates possible to keep it secure. And so our customers very much do not want, um, us to continue developing it.

They just want what they have to stay secure. That's, that's typically the person coming to what they're looking for. Now, of course, Matri pos a vacuum, right?

Yeah. What's taken Angulars place out there? Um, well, angular JS was replaced by several frameworks, um, one that sounds almost identical called Angular.

Um, but They're, and that's the one I'm familiar with. I apologize. Yeah, angular J and Angular, they're about as similar as dogs and hot dogs.

Uh, they sound pretty similar, but it's a totally different product. Um, and then there's things like React and View and, um, selt, and there's quite a few other front end frameworks. View was our second product that we ever launched, and it had an end of life for one of its older versions.

And, um, so that was the second product we launched. Um, and Alan, lemme just describe how the integration works. We essentially Sure.

If you could, if you can imagine the Raiders of the Lost Star, that first, um, that first Indiana Jones movie where he drops with rolling ball drops the sandbag, yeah. Where he drops the sandbag and takes the gold statue. I know, just what you talking about, That is our version of open source.

We just want you to replace the open source version with ours. Um, and unlike Indiana Jones, everything just keeps working and, um, and everything stays fine. So takes about five minutes to replace the public version with our private enterprise version.

So, um, Yeah, That's, that's, it's as simple as That. Is your private enterprise version also open source, though, or like under a li open source license or No, It's under, yeah, we, it, it's, it's, it's under an open source license, but you can't access, you do need to purchase support from the company. So Yeah, gain access just to the, to the, to the source code or to the app itself.

You gain access to the distribution to where you could download it To that digital. Okay. Yeah.

Yeah. You, you got it. You purchase support, you purchase a token, and then you, you've got free access to all of our software.

I got it. So fair, fair to say, hero Deb's business is basically extending the life of open source projects, libraries that, you know, the original, uh, maintainers have, have pulled the plug on or are pulling the plug on. Yeah, that's exactly it.

And it plays, it plays a really important role for our customers. Um, many of our customers, they were, they were aware of the end of life that was coming up, and they just needed a longer runway before they migrated away from these old technologies. But a lot of our customers, the majority, they weren't paying attention and they got caught unawares, and the regulator or an auditor came through and said, Hey, um, you're using Unsupported software, you have a regulation, or you have an SLA with your own customers, some sort of legal requirement that they're in violation of, they need to have support for these old versions.

And, and when that happens, you've got two options, thanks to Hero devs. You've either got, um, a massive migration, which is typically somewhere between six to $15 per line of code. So for a half a million lines of code, you can imagine the price there or hero devs usually comes in somewhere between 20 and $40,000 a year, um, to allow you to continue using the version, the software you already use, but to get a secure version of it.

That way you're, you're passing your compliance audits, whether it's hipaa, FedRAMP, PCI or your own SLA to your own customers, you're back in compliance with those, with those regulations. And so that is the, that is the value proposition, a multimillion dollar migration or a a 20 to $40,000, um, software subscription to allow you to keep using and, uh, keep the current app running in place. So Aaron, how many open source library slash projects are you guys supporting at this point?

That's a good question. So, prior to 2024, we'd only ever released three distinct products, but in 2024, we've really exploded and invested in a lot of new product creation teams, teams to both, um, be able to maintain the software, which is the hard part, and as well as, uh, marketing and sales. And so at this point, we have over 200 libraries and frameworks that we're supporting for the public.

And 2025 is another year of explosion where we should, again, five or six x the number of products that we're, um, supporting. Currently, we're mostly in front end and backend in 2020, uh, five, we'll be venturing into other, um, industries like databases, IOT, um, data flows, and, um, and then continue to harden our, our product catalog of other open sources that exist usually in the front end and the backend spaces. Sure.

Very cool. What a great, what a great, uh, service, first of all, right? Because look, I think we've, well, I don't know how, however you want out here, but I think many of us have all been in businesses where, you know that that's always one of the fears with open source, right?

That somehow the rug's gonna get pulled out from under Europe, right? Like, so I'm, I'm, as I told you, I'm in the security space and I, I told you we had a, uh, back in 2003, we had a vulnerability. This is when people didn't scan pre-deployment.

You only scanned what was in production, right? In production, yeah. And, uh, if you're lucky, once a year.

But anyway, you know, back then almost everything under the covers was Nessus, Nessus was open source back then. 7. And, uh, all of a sudden Ron Goler and the folks at Tenable to say, Hey, we're tired of everyone kind of making a product around our open source scanner that we maintain.

And they took ES out of open source. It was still free, but it wasn't open source and we couldn't use it in in van. And, you know, there was a fork on, I forgot that, I forgot what the name of the fork was right this minute, but in any event, um, or you could just maintain the last version of Nessus, which was a pretty decent scanner because that was just the scanner.

You just needed the Nale scripts, which you could write, right? And the scan for the latest vulnerabilities. So it was, you know, a similar kind of thing.

And, and so there was a whole bunch of folks who were, you know, doing that, that was just for one product, of course. Right. Um, but I think we've all had that happen.

It, it's, you know, it, it upsets the apple cart and there's long term and short term solutions. Yeah. Aaron, before we go further, hero devs website, what's the website name?

com. Um, it's, yeah, just like it sounds. com.

Com. H-G-R-O-D-E-V-S. Right.

Now, you guys recently announced in a relationship with the good folks over at Mend Men io. Yeah, we did. Where Yeah.

Men's, the scanner. But if they find, I guess like a, an out of date or, or extinct or end of life library slash open source project is basically a pretty nice integration with you guys where that you, you can, you know, click through to get it, uh, to remediate, updated, and move it over. Yeah, Yeah.

Our partnership. Tell us about that a bit. Yeah.

The partnership with Men is really interesting because it creates, for the first time an opportunity for enterprises to both scan and find the vulnerabilities or the exposure to end of life libraries, but also get the remediation straight in line with the same exact product. And that currently doesn't exist. You, you'll use some SOM, uh, software composition and analysis tool and it'll spit out, Hey, you know, Alan, you're using Library A that has five security problems.

And then it doesn't help you much more beyond the letting you know you're in trouble. And now with the hero devs and the Men Partnership men can do, the first part is say, Hey, you've got a library a with security problems one, two, and three, you can click to purchase this solution that has all those security options, um, security vulnerabilities addressed inside of it. So it's the first time ever that you can remediate that straight in line in an, in an SCA tool like men.

Very cool. Um, and congratulations to men for, you know, seeing this and making this relationship with you guys. This has been out, I think Aaron, you mentioned since around in October Yeah.

Announced partnership October. How has been received? Yep.

How's it been received in the Margate? The men community is really excited about it and, um, there's been a lot of traction and a lot of, um, people becoming aware that our product exists now. So it's been very beneficial for MEND to have new products to sell, but it's been very beneficial for Hero devs to, um, continue to raise our brand awareness among commercial and enterprise companies.

So it's been, it's been a great partnership for both and we're continuing to, um, further and further integrate our product into the MEND platform every, every day. Mend has some really, really popular open source platforms that are, that have freewares as well. And Hero Dev Solutions will continue to be exposed even out into those free versions in, in 2025.

So a lot of really cool product development between the two teams coming out. I love it. Aaron, we probably ran over, I apologize, but this is like something I have personal interest in, so I like to talk about it.

Uh, uh, hey man, I wanna wish you the best of luck at Hero devs. This is, this is a great, great story. Something that's obviously needed in market.

Um, come back and keep us posted as you got more news. Okay, man. Yeah, I appreciate you chatting with me today, man.

It's the pre, it's my, my pleasure. com. Doing keeping ad, you know, extinct or going extinct, open source tools and libraries viable for your enterprise.

We're gonna take a break. We'll be back here on text Drunk on Text, drunk tv. Excuse me, not text drunk, Hank.