Updating Open Source Software – William Morgan, Buoyant

This is texturing TV. Hey guys. Thanks for the throw.

We're here with William Morgan is the CEO for buoyant and we're talking about the rate at which open source software is updated which turns out to be not regularly enough William. Welcome the show. Thanks Mike.

It's great to be here. Why don't we update our software more regularly and should people be perhaps more outraged about the fact that this doesn't hurt as quickly as it should. Well, I you know, I'm not sure outrageous though is the right term.

I'm not sure I would add any more outrage to this world right now, but it may be concerned. Yeah, so, you know, we we looked in our little bubble. We looked purely at you know, kind of the cloud native space and at the linkerty project.

Alright, my dog is barking in the background, you know, which is one particular type of software, right? So we're not looking at like iPhone software. We're not looking at you know software on your cars or anything.

We're just looking at, you know, open source software that you're running on your kubernetes clusters and what we found was pretty surprising at least for the linkerty project, which is most people are not upgrading their their software. In fact, I think we we found you know, 50% of linkerdy clusters that were running out the release six months at a date and 20% were a year out of date and that was pretty I think the surprising to us in part because Linkerty is a security component. Right?

So if you're not updating this thing, if you're not keeping this up to date then you know, what's the rest of your stack look like? And this is true of other things we have seen people are running versions of kubernetes that go back. I don't know seven or eight releases and they probably have multiple clusters with different versions running on them.

It seems like even in the cloud native here where theoretically we're using devops workflows and things like that. We just don't seem to be able to get around to that. Is it because it's too hard or is it because our processes are too complex?

So what's what's that the root cause of all this? Yeah, I think it's you know that if you if you read through the SRE kind of book that Google wrote at some point in this cult kind of the whole ethos around SRE, you know, there's a type of work. That's called toil, you know, which is like stuff you have to do but it's not fun.

It's not gratifying it. Sometimes it's like scary to do scary and annoying and I think upgrading software usually falls into that category. Right?

It's not it's not building cool automation stuff, you know make it easy here for whatever to happen. It's like that's this task I have to do and it's annoying and you know in the case of something. like linkerdy which you know as a service mesh is sitting in this very critical part of your Application, you know, it's it's like it's it's right.

It's like a pacemaker in your heart, you know, it's scary to upgrade it, you know as safe as we make it as you know as much as we make it zero downtime and all that stuff. It's still like something that emotionally it's scary to do because you're like if I'm making mistake or something that's wrong then like I'm in for a world of pain. So I think that's why people don't do it, even though they know they should I think if you asked any SRE or DeVos person or kubernetes platform owner, you know, should you keep everything up to date first I say, yes.

Do you think some of this is just a legacy mindset because there was a time when you would upgrade open source things and by golly a lot of things would break and suddenly you'd be you know, a perfectly good application is no longer working and then you're trying to roll that back. And so and we conditioned ourselves to kind of fear the upgrade and or is the upgrade process smoother these days do you think Yeah, well, you know, that's a great question and you know, like the point in comparison for me. It's always like oh my iPhone, you know, I upgrade this apps all the time and I've never really worried about them breaking whenever I'm worried about them having like annoying new features that I didn't want.

I'm not worried about, you know, accidentally breaking my system by doing that and you know, so that's kind of the you know, I think that's an example of like, yes, it is possible. It's possible to get here are we there in the world of open Sports Club Cloud native, you know service messages and kubernetes like no, no, not really. But I think it's you know having that kind of North Star can be useful because it means we can you know, we can we can we can strive to make this.

A little better, you know one thing that we've been doing on the on the buoyant side. You know, so we buoyant, you know are the maintainer the creators and maintainers of linkerty linkerdy obviously is open source, and you know, you can take it and download it and do whatever you want with it. And you know, that's kind of the the contract with open source, but we actually provide a service called Point Cloud that we'll do automated upgrades for you.

Right? So we're trying to be we're trying to at least provide those mechanisms, you know for you to make this easy because it's also it's also in our interest to make sure that when you're running link or D, you're running on a modern version right and running one where we've patched all the security vulnerabilities that have been identified and the underlying libraries or whatever it is. So we want you to be running a modernity almost as much as you yourself want to be running a modern winter day.

Is a lot more discussion these days on securing software Supply chains and you look at the recent National cybersecurity strategy. There seems to be a lot more talk about liability for running software. So do you think that all these upgrade issues are going to get for soon and we're gonna have to address this one way or another.

Yeah, I think I think they will you know, and certainly the world has gotten a lot better. At tracking it's not perfect by any means. It's gotten a lot better about tracking dependencies and vulnerabilities and dependencies.

You know the other example to look at maybe is dependabot and GitHub. So if you have a project on GitHub, you know you GitHub knows what dependencies it has a software project. It knows what dependencies it hasn't and can not only tell you.

Hey, you need to upgrade this thing because there was like this, you know alert as security vulnerability detected that's in a lot of cases. I can actually make up a pull request for you that does the upgrade automatically so that was a huge Innovation, you know in my mind and I think that's an example the kind of thing where yeah, people are a lot more aware of the fact that every piece of software has this complex tree of dependency your graph maybe of dependencies underneath it and certainly when we've you know released, I'm kind of secured the Patches in linkerty, they've been largely because some underlying library or some dependency had a vulnerability discovered. you know and sometimes that has an impact on linkerty most of the time it doesn't actually because you know, we're not using it in a way that actually make it vulnerable but we release a new version anyways, because we're trying to keep everything up to date and and you know and healthy and not trigger anyone's security scanner or anything like that.

So how much of this is a technical problem versus a cultural problem? I mean, do we need someone the equivalent of Franklin Delano Roosevelt to stand up and say we have nothing to fear but fear itself or is there some technological advances that we need to make as well? Yeah, I think it's a it's one of like many areas of security.

It's it's an area where these two things are are kind of tightly. intertwined You know passwords are like a good example, right? Why don't people change or should people change your password.

Does that actually you know important? Well, I don't know. Is it good to use a password manager?

Well, yeah, probably, you know, should we auto-generate all of our passwords and like yes, we should then, you know, if you put a barrier if you make it a burden for people then I think you can have an inspiring speech and maybe that'll change behavior for the short term. But the long term you have to remove the barriers. If you really want people to have the behavior you want to have right like friction is always going to be the thing in the long run that prevents people from doing you know, what you what you want them to do.

So I don't think Eleanor Roosevelt are Franklin Roosevelt or anyone could give us speech that would really change things in the long run. I think we have to make it easier. I think we have to make it.

So that upgrades are the the default, you know, the default activity is or the default state of things. Is that your upgraded and that's a lot of what you know, like I said, that's kind of what we've been focused on in buoyant cloud is how do we automate that upgrade for you? So then it's so trivial that you know, all you're doing is changing, you know, a 12 to a 13 or whatever and point Cloud can do the rest for your likerty, you know environment right if we can make it that trivial right and service measures are I think maybe a little harder than most because you've got both the control plane and the data playing component.

Once you've upgraded the controlling you then have to upgrade the data plane. Which is like another bit of toil so, you know the fact that we can automate both and then we can make it, you know as simple as changing or two to a three or 12 to 13, I think goes a long way towards. Solving the core of the issue which is like it can't feel like a burden to use a user.

So what is your current assessment in the state of application security? Are we making progress or things getting better and always felt to me at least that the developers thought the security team is doing something about this and the security team that the developers were handling in and nobody actually did anything. So are we getting smarter?

I think we are as an industry, you know, and I don't really want to put myself forward as a as a security expert, you know, I'm an observer from the outside right like, you know, I'm in a lot of what people use Link or D. For is you know is is for security or for compliance because we're adding Mutual TLS or you know authorization policy or if you're doing zero trust stuff and kubernetes like, you know linkardy can do enforcement at the Pod level and he's workload identity and you know instead of IP addresses which has all these advantages so I kind of like absorb some of this from watching what people are doing with linkerty, but my sense is from from kind of the Observer perspective that yeah, the industry is a whole is getting a lot better about this certainly getting a lot more condiments of the fact that hey, you know, there are vulnerabilities. There's always going to be issues and software we can make choices that improve those things some of those choices like you like you mentioned our cultural, you know, there's the idea of Shifting left, you know shift security left, right?

It's not the security teams problem Securities. Everyone's problem, right same thing for reliability, you know, we saw this so it's kind of like, you know Echoes of the the devops movement, which was hey running this thing is everyone's problem. You don't get to just write this and throw it over the wall.

And then the Ops team has to deal with it, right you have to shift all those responsibilities left. So there's like the cultural aspect of that and then there's also you know, I think there's the the technical aspect and and certainly are our mission with linkerdy is we want to make the The default, you know for running applications and kubernetes, especially but kind of in the cloud more generally. Well that default to be secure right and and I think philosophically kind of our approaches well, You know, it's easy.

It's easy for the apples and the Googles and the you know, maybe even the twitters of the world to hire these incredibly smart people and get you know, and and have these Amazing Security, you know kind of policies and boundaries and whatever but you know the vast majority of software that you and I use every day. It's not Built by those companies it's built by all the other companies. And so how do we you know, how do we make it to the default kind of posture is one of security and of reliability and that's kind of like part of the philosophy.

Why? Behind why linkerdy's open source, right? It's like we want this.

We don't want there to be a barrier. Right and it comes back to friction and barriers, right? The lower friction.

It is the more people are going to do it. There seems to be a lot of effort to educate open source maintainers about security issues. We're seeing the open ssf work on that stuff is your sense that people are going to respond to that because part of the conversation is always been from those guys.

Look I built this thing on the weekend. It's a hobby and you know, if you're gonna use it, you know, it's a gift for me to you, but don't call me on looking for support on Sunday night at three o'clock in the morning. yeah, I mean I I think I think there's some validity.

I think there's some real validity to that which is you know, hey, it is open source. So, you know you are getting this thing. But like you can't expect me to maintainer to do, you know a bunch of work to support your specific use case and you know, that's part of it.

I think there's also the flip side which is you know, I don't think you can you know, just release a nuclear weapon and be like, okay, you know do whatever you do with it and like I have no responsibility, you know, right so I kind of see both sides to that, you know, I obviously linkardy is an open source project. We have commercial component and you know I ultimately have a responsibility to make sure the two things kind of our aligned but also have a responsibility to make sure that link 30 is use in a way that actually does improve the security and reliability. Of yeah, you know the people who are using it whether or not they are engaged in a you know, economic relationship with buoyant and part of the issue would open sources to make sure that the project isn't going concern and not just somebody's hobby that you're now building your entire strategy, right?

Yeah. Yeah, that's right. That's right.

And you know for us, you know, that's part of the reason why we wanted to have a company behind liquor ideas as well because it's very easy to be enthusiastic in the beginning and nights and weekends and school open Sports project and then you know your day your day job gets in the way and like we know what we've all seen what happens open source projects when the maintainer has like other responsibilities, you know, and and in order my belief is for a modern open source project that really to be successful vast majority of the time you need some kind of economic engine behind that to continue to invest in the project. If you don't have that then you're reliant on volunteer hours. You're reliant on nights and weekends you're reliant on you know, heroics and you know for some for some projects, that's okay and that kind of works, you know and certainly in the early days I was That was a kind of the dominant model for for open source, right?

That's how Linux worked right it was nights and weekends, you know, but I think that's increasingly less realistic in the modern world. So yeah having a company behind it. Made a lot of sense certainly for us.

And you know continues to pay the Lincoln maintainers bills. Course the project continues exist, right? Of course, you cannot walk down the street these days without somebody leaping out to tell you about their great new AI thing do you think AI was from ourselves and when it comes to open source updates Oh boy, you know I don't I don't think that.

Oh what that's a great question is AI gonna solve this for us? I'm not sure that it's really the most direct. Way to address a problem of software updates because it's not you know, at least if we're talking about GPT for or whatever chat GP here, whatever it's not really like, oh, we need a generative model to tell us that we need to do this upgrade.

Like we need to do the upgrade, you know, even if it was generating the commands. All those commands are already in the linkerty docs. Like that's not the hurdle right hurdle is like you actually have to go do this.

So I will I will go on record with the very profound and shocking statement that no, I don't think AI will solve the problem of software updates and community. All right, folks. Well, you heard it here projects in our garage that we started and probably lost sight of and we're just saying that that's not the way to run your software.

So you need to be mindful and pay constant attention because that what you think is secure today will be not so secure tomorrow. We guarantee William. Thanks being on the show.

Absolutely. Thanks for having me Mike. All right, and back to you guys in the studio.