David DeSanto, GitLab | KubeCon + CloudNativeCon North America 2023

This is Textron tv. Hi everyone. Alan Shimmel back here at Chicago CubeCon, uh, north America 2023.

If you've watched our coverage of PE Cube Con or RSA or even sometimes on Textron tv, you know this fellow right here, he's my friend, David DeSanto. David is the, is it Chief Product Officer? Chief Product Officer, yep.

At GitLab. And, um, you know, GitLab always has something doing, especially if it's the 22nd of the month, right? Correct.

Um, how many consecutive 22nd of the month releases are we up to now? Do you know? Over 150.

I know That. Over 150. Yeah.

Um, but GitLab is also a, a big, uh, community member of CNCF, as well as a bunch of the other Linux Foundation. Absolutely, yeah. Foundations as well, But, and David's always a wealth of information.

So, David, I hope I didn't put too much pressure on you, but welcome. It's fine. Okay.

Thank you for having me. Always a pleasure. So let, let's first talk a little bit about the show.

Yeah, Absolutely. GitLab is here. What are you, what are you seeing, hearing?

What are you thinking about? Yeah, so I would say, uh, this probably is no surprise to everyone who's watching, but this year it's all about security and ai. Yeah.

And sure enough, at GitLab's Booth here, uh, or Booth M one, uh, it's also about Security and ai Security and AI and, uh, visibility. So, you know, we, um, we've been talking a little bit about security and AI too. Surprise.

Yeah. And one of the, we actually, just a quick plug. We actually have a great virtual event coming up in December on ai, and it's sort of where does AI meet rubber meet the road.

Right. And I, I want to turn that around to you, David. Look, AI has tremendous potential to help, I think with security.

It does. I don't know how much of it is real today. I think a lot of it will be real.

Certainly, but where, what's real today? Yeah. No, no.

Holds barred. Yeah. So What's your Take?

Yeah. So I'll be able, we'll start with the, uh, the AI part of that and then tie it into security. So, okay.

I, I always look at new technology through the lens of my parents. They're both much older than I am. Right.

And to them, when I showed them ai, it was magic because to them it really was, how is that happening? Right? Right.

But then I also had to help ground that in reality, for them to say, well, this is generative ai. It works by predicting the next word based officer In front of the other. Right.

And so it's not sentient When you, when you look at it, though, some people have thought it's sent to Yeah. But if you No, your parents, like my, I go by my wife's sister. Okay.

She's 74, and she Yeah. She thought there was a little person in there. Yeah.

Um, but yeah. Yeah. Not totally.

Just as a quick note, and your, the viewers will love this, but like, I introduced them to it at my sister's wedding earlier this year, Uhhuh, I needed to do a toast. So I had a bar, both the toast generate the, uh, toast for me. And they were like, how is this happening?

Right? They're beautiful. Yeah.

I I hear you. But to kind of ground in reality, and you realize how gene AI works, you have to then ask yourself, what are the best use cases to apply it to? It's not going to be able to tell you how many pages there are in a book, how many words are in a book.

Those aren't things that are questions it can build. Right. But it can help you with tasks that can sometimes be, uh, mundane.

It can help you with understanding something better. And that's how I kind of tie it back to ai. So when GitLab started applying AI to our platform, we started in 2021 with code review.

Mm-Hmm. Because that was a huge pain point helping customers get through code review. The next area we looked at was actually security.

Really. And the reason why we did that is that, you know, GitLab is, in essence was a developer platform when we started where an enterprise DevSecOps platform today. Right.

But it was about helping developers be more effective. And developers don't start their day off by saying, you know what? I wanna write a zero day vulnerability in the application today.

I wanna make it super vulnerable. Right. You know, they wanna write really good code.

And so we said, you know, we've helped shift security left. How do we help? Now those developers understand that secure, they're saying.

And so we launched at RSA this year, uh, explained this vulnerability where it actually explains vulnerability, natural language using AI gives them an example of how that vulnerability is exploitable. And it gives 'em an example of how to resolve it. And those code snippets it shows or, and the language that the developer's writing it.

And so, when I think about AI and security, I think about it being, making security truly approachable. And if you can do that, then everyone starts to Win. So I, I would give you guys the Oscar for best use of ai, right.

Because I think that's where it shines. I I had a very similar experience with me. Um, so I'm not a coder.

Yeah. I, and I, I claim to be one, but it's been a decade plus since I've run any code. But you know what, try putting a little code into your generative AI chat bot and say, explain this, or what does this mean?

Yeah. And it goes through line by line and tells you that's what this is for. This is what it's calling, this is what it's doing.

And if you could be a complete neophyte around let's say Python or, or name your language wherever you want to do it, it's, and it, it really teaches you how to code. It Does, it does Line by line where, you know, syntax by syntax. So to me, that's a great use of ai.

Right. That's what we should be using it for. It's not Google search.

Right. I, a lot of people I know they, they think it's Google. It's not Google search.

No. But those kind, it's good for writing toasts for a best man or whatever. Yeah.

But or an anniversary. Yeah. As someone in my office, I know used it.

Yeah. And his wife called him on it. But, um, anyway, it's, it's really great, great for learning tool.

Now, when we talk about AI and security, though, there's an evil dark side to it. There Is, which is how do you secure ai? Yeah.

And so, uh, I love that question. So, uh, the first time we spoke, which now is, uh, four or five years ago, uh, the question you asked me is like, GitLab and security explain that. And we talked about why we're taking that journey.

And today, GitLab is recognized as a security player in the space. Absolutely. And it's one of those things that we are very proud about, because we helped define what Shift left actually meant.

And so if you bring this back to ai, the one thing I always tell people is that, yeah, co-generation can be scary. You're not sure, is it writing good code? Is it writing functional code?

But if you're using GitLab, that code gets committed back into your CICD pipeline and the GitLab security scanners run. And now you know that vulnerability has been resolved and nothing new has been introduced. Right.

And so, if you pair AI with the right things around it, it can be truly powerful. But you're right. If you, if you're not doing that and you're thinking it is the person living inside the machine, uh, you, you give a little too much trust to it today.

Yeah. A a is not, AI's not a hundred percent there yet. Absolutely.

Well, so that's the next segue. Don't give up any secrets. Let's not get in trouble.

You're a public company now, but where do you see AI going with GitLab? Yeah. Specifically over the next, let's say between now and RSA and May or something like that.

Yeah, great question. So, uh, fortunately we're a very transparent company, so I can talk about roadmap and not get in trouble. Yep.

Uh, but thank you for making sure that I don't get myself in trouble with legal For Me. Yeah. Uh, but, uh, so where we see a AI going with GitLab is there's really two paths that, that we're exploring.

The first is, uh, GitLab du a chat. We released it back in June. They continues to mature.

We're seeing people gravitate towards wanting to talk to chat and not necessarily click a button in the UI or engage with AI that way. And it, it makes sense. If you think about it, we're humans.

Yeah. You and I are talking, we're having a conversation. That's what we'd wanna engage with it.

And that's why the chat bots are so popular. And so what we're looking to do is continue to take what we've released. We have 14 AI features today.

Really? Okay. Yeah.

Everything from GitLab is for the entire SDLC. So we have AI assistance in planning, coding, securing, deploying the whole way across. And so we're slowly moving those features into chat.

An example that explained this vulnerability is a great example. So that'll be available in chat here shortly. And the reason why we're doing that is the natural thing is, well, help me resolve it.

Here's my code. And so we want to help AI be not just a pair programmer for the developer, but be that trusted partner that can help write more secure codes. So I would say over the coming several months going into RSA, you'll see a lot of AI and security and our Duo Chat feature coming together.

I love it. The other area is our, wait, hold on On one second. I wanna make sure Duo Chat.

Yeah. Not everyone out here is gonna know Duo Chat. Yeah.

So, perfect. Yeah. So GitLab Duo is the name of our AI workflows within the GitLab platform.

Got it. The name is based off the fact that it's you as a user. Plus AI makes the AI dynamic duo a duo.

Okay. It also helps that I'm a huge Batman fan and dynamic. All right.

I love it. I love it. Uh, I didn't tell marketing that though.

No, no, no, No, no, No. Hopefully they don't watch this. They, they'll not know my secret.

But what does Marketing ever, I'm only kidding. I'm only kidding. I love my marketing people.

Uh, but, uh, so that's the name of the, the suite of those AI workflows. And so, uh, there are things like, explain this vulnerability. You're explaining of codes for, we actually haven't explained this code.

I love it. We'll explain the code. Uh, we have our code suggestions, which is gonna generate either code completion, your cursors in the file.

It's reading what's before and after the file's open and recommending code. I love that. Or code generation where you can actually do comment to code that's actually the most popular for our users.

Uh, as well as things in like helping you, uh, do your planning, summarizing conversations, helping CI configurations and beyond. So that's, that, that's what GitLab Duo is, and Duo Chat is part of that. And so, uh, that's the chat bot you can launch within GitLab's ui.

Now, is there a way to kind of implant this into your IDE or, And that's, and that's the last thing I was gonna mention that we're working on. Yeah. So the other thing You didn't pay me to say that I did not, okay.

I did Go ahead. Did. It's almost like you, uh, read our GitLab issues and read our Roadmap.

We may not coordinate our wardrobe. We didn't, But we, I do wish I would've worn the whole, the fall shirt today. Yeah.

Time. We will next time we'll do that, but, all right. Uh, but anyway, uh, we're gonna be bringing Duo Chat to the IDs.

So today we have it as an experimental feature, and we're trying at a GitLab today to make sure it works. But it'll be available in all the IDs that we support today, including the Jet Brain Suite Visual Studio vs. Code.

Really Neo Vim and the GitLab id. I love it. I love that.

Fantastic. Yeah. But by the way, that'll also then bring those same actions that are in the GitLab UI into chatting your id, so you can actually explain the vulnerability, explain the code, all those things directly where you're working.

You don't have to leave your ID to get that While we're on this subject. You know, a lot of people out here, look, there's so much, uh, there's so much controversy around ai Mm-Hmm. Is it going to kill off humanity?

Is it going to take everyone's jobs away? Is it going to, you know, and I, you know, my feeling is it's not, you know, will it do some jobs? Yeah.

But for the most part, it's gonna make a lot of people who do these jobs 10 x more effective. Yeah. How, how do we, you know, how do you view it and has GitLab view this right?

In a world where Chat and Duo Chat is built in and AI is built into the entire GitLab SDLC pipeline. Yeah. Does it really 10 x these people?

So that, that's our target. And to give a little context for everyone, uh, GitLab Ultimate, which is our top tier, includes every future GitLab has, including ai. Uh, when we did a survey of our customers, we had an independent company do that, they found that people using GitLab Ultimate get a seven X boost in efficiency for their organization.

So you're ha you're over halfway there. Yeah. And an ROI, uh, within six months of what they paid for it.

And so when we ask ourselves, how does AI help, we set ourselves a 10 x goal. So continue to accelerate that efficiency. And our customers using GitLab today, and GitLab Duo are talking about that.

They're talking about getting through code review faster. They're talking about resolving vulnerabilities faster. And to the first part of your, your comment, we don't, we don't see AI as a replacement for your team members.

We see it as helping them be more effective, removing some of the mundane tasks that can slow them down and unlocking their true potential. Imagine a world where your developers don't have to worry about doing things like creating the template for the code, and now they can just go in and write the actual strategic parts. Right.

And same thing across the entire software development lifecycle. I personally benefit from duo, uh, almost on a daily basis in that as the CPO of the company. I get pinged on our GitLab issues or GitLab epic or whatever, and someone will say, what are your thoughts on this?

And I'll look at it and I go, how long is this? And I'll go up and say like, PDF it, and it's like, it's a hundred pages, you know, the issue's been open eight months, Summarize, Customers are coming. Yeah.

So I say I do the same thing. Summarize the discussion, right. We're we're connected.

Yeah. I do the same thing. Yeah.

And so that's where I see it. Like, that made me more efficient. I now didn't spend two hours doing that.

Alright. I I'm doing the same exact ICEO, you know, a techron. Yeah.

'cause I'm inundated, inundated with content. You know, should we publish this? Is this the right tone?

Here's the abstracts. Just, you know, and a lot of times, and I don't mean to sound callous, but I just don't have the time To Go through it all, but a summary, man, just give me, give it to me in five bullets. Right.

And, and by the way, the other part of that that I, I use is that I also help generate descriptions and tasks. And so I will a lot, right? So I'll just say like, I read all that.

I have an action. Remind me to do this. Help me create the task for and so forth.

But you're, you're, you as the, you are the great example, right? Same thing with the developer, a security person. There are other things that your brain power should be used for and why spend the time doing those things that I I Agree.

Truly are Not moving tech strong forward or that kind. No, I, you know, we'll, we'll come up with a, you know, we have a theme for given event, a virtual or in person. We need the abstract.

I can have other people write the abstract, but it doesn't really capture my right vision for it. I find just putting that into a bot, into a chat. Yeah.

It nails it. But here's another thing that I think is, and again, for those of you out there who don't use generative AI yet, you should, don't be afraid to give it a nice long prompt or give it a lot of back. Yeah.

The more info you give it, the better it, it kicks back to you. It does. It actually, uh, goes off feedback and you can like something or thumbs it down.

Right? I, I, that was another kind of revelation. And I think, I think it probably work the same way with code.

It, it actually does. So, uh, the backend of GitLab Duo is monitoring for the amount of code you keep. So do you accept the recommendation?

Do you not? Yeah. It also, uh, measures retention.

So Yeah. Is that code still there after you move on? Um, and same thing with the chat.

So I've actually had to say to it, and there's a joke on the internet about you have to be polite back to the chat bot. Right. I actually just recommend it.

'cause I've seen the, that documentary Terminator with Skynet Uhhuh and you know, I'm just afraid one day they might come for you, You just want, you want to suck up to them now. So when they take over, They remember you. Well, don't remember it, but no, Uh, I'll actually say back like, that's interesting, but have you thought about this?

And here's why. And then I see that actually learns from it because we constantly fine tune models based off that feedback. Right.

I agree. So absolutely ple, please be kind to the chat box. Be Kind to your chat bott we'll Always chat to Everyone else.

Right. That's, you know, if it is, Especially in this day with everything in our world going On. Yeah.

If it's anything, you should be polite. Right. There you go.

If you can be anything, be polite. Yeah. non-AI stuff.

Yeah. What's your impressions of the show this year? Uh, I've enjoyed it so far.

Uh, RSA conference used to be my favorite conference Yes. To go to. I think Q Con is now tied for first and might sometimes edge it out.

And the main reason why is that here is one of the few times I feel like it reminds me of, uh, the Black Hat Conference back in the day, back In the day. You've got, uh, all the, it, it is not meant to sound negative, but like the doers here, right? Yeah.

You're having real conversations with developers are trying to understand operations, better security professionals who are here, trying to make sure they're supporting developers', operations. Same thing with operations. So you get this like, really good mix of people and it just reminds me of almost like a large startup, if that's a good way to look at It.

Yeah, no, there's, there's a, there's an energy Yeah. That you, that's palpable that I think works. But, But I do wanna just make sure RSAI still love you.

We'll be there. May 6th Oh, I'll be there as Well. Is our DevSecOps.

It's gonna be all about AI in the future of security, our event as well as, you know, the, the larger AI Yeah. Event all week. Oh, the larger RSA event or week.

What about Reinvent? You guys are gonna be at reinvent? We will be at re invent, uh, this month.

I'll personally not be there. No, no. I actually, I hit the point where this is my last full week of the year.

I've been gone three weeks a month for the, this entire year. I wanna stay married. I hear you.

I wanna spend some time with my dogs. And so I'm taking, uh, December and, uh, most of January off from travel. Good for you.

Yeah. I'm getting a new dog Friday. What kind of dog are you getting?

I guess I could share it. Yeah. Um, so we, we've had bulldogs for about almost 30 years.

Okay. Our last one passed away in May. She was 14 and a half.

You and I actually, I think you and I talked about that. Yeah. So it took a little while for us to Yeah.

You know, get back in the I need a dog, but I, I need a dog. So it's a new Bulldog puppy. Her name is Kaya.

Oh, wow. KAIA, which means C Okay. In Hawaiian.

Her father's name is Ocean. Oh, wow. And, uh, yeah, I'll post pictures.

Okay. Um, uh, so just do, like, I think I've showed this to you before, but we have two, uh, rescues, Uhhuh, uh, they're both Chihuahua mixes. Oh, yeah.

Yeah. Um, One's really dumb and the one's really smart, so, But it's good mix. Good.

Yeah. I will tell you, I I, when I get home, they're so excited to see me and they get really sad, happy. There's something like the love of a dog.

I completely agree. No doubt. But about the conference, yeah.

We, we went off there, but again, completely Derailed us. Yes. So, uh, GitLab a couple things.

So people are watching and they're here, they wanna see it. If not, check it out. After the conference on our website, uh, we, uh, brought our product analytics feature to market.

We already have some customers adopting it and we're demoing it. And I wanted to share it here because Q coupon's also about visibility. Yeah.

And you can't close the SDLC without user feedback. And so similar to how we have observability, there's about the application running in production, the value stream analytics and value stream management. This is now user feedback.

So as part of GitLab ci cd, we can embed telemetry into the application. Wow. So it's deployed and connect back to GitLab.

And so giving you data about your monthly active, daily active usage, uh, the return rate of those users, uh, Is available Now. Is available Now? Or you just demoing No, it's available.

It is available. What Do you call that? Uh, well, we love our boring names at GitLab and our values.

So it's just called GitLab Analytics. GitLab Analytics, yeah. GitLab Product Analytics to be specific.

All right. Uh, but yeah, we, we started using it earlier this year, uh, for our handbook and we're able to learn about how our users use the handbook, our employees and, uh, team members. And so I'm excited how make this available because, you know, other people want to understand that how their apps are being used long-term, we'll be able to pull in things like retention rate, uh, user adoption journey metrics.

But today it's just those raw metrics, like the active usage return rate, uh, the graphs of how the usage is going. But we're very excited to be demoing it here. It's, it's really cool.

Absolutely. Yeah. Very cool.

GitLab user analytics. Yep. David, it's always a pleasure, my friend.

Yep. Love our chats. You know what, we're gonna, I, I spoke to you.

We're gonna do another chat with David before you leave for two months. Yep. With the dogs.

Yeah. Um, I will be working for everyone. I'm not taking time, I'm just staying home.

I'll Be okay. You're just not on the road. Yeah, I'll be working from home that entire Time.

I was just say, that's a lot of, a lot of vacation time. No, no, no. I, I did have my first big vacations to the pandemic though.

Really? Yeah. We went to Bar Harbor for two weeks and hiked the Kaia National Park.

Oh, That's beautiful. Yeah. And when was this?

Uh, end of August. Last two weeks of August. Oh.

So it's still nice. It was very beautiful, but Not really peak color season there yet, but beautiful time. Summer.

But, but we'll definitely can that 'cause I'm working. I'm just not on the road. All right.

But we're gonna have you on tech drunk TV 'cause you guys have more news we do that we can't talk about yet. Yeah, That's a good teaser. Everyone tune in.

That was my, that's what we, we call it. That's what we call in the industry. My hook.

Going back to our marketing friends. That's the hook. Alright.

Hey, we, we better take a break here. We're getting a little loony. Um, we'll be back.

We're live in Chicago. We CubeCon with our friends at GitLab. We'll be right back.