Jeff Borek, IBM | Open Source Summit NA 2022

This is Textron TV. Hey everyone back here in Austin at open. Source, Summit Linux Foundation Austin.

We have had an amazing day. We've got a lot of time talking about security though and open source supply chain security. We're going to talk a little bit more about Open Source.

It is the open source Summit. I want to introduce you to Mr. Jeff borek.

Jeff has been well, I don't want to say how long you've been with IBM but just been with IBM a long time and the last 10 years or so really focused in on IBM and open source software specifically and you know, Jeff will tell you this, but I don't want to embarrass him. Historically IBM has been one of the biggest supporters of Open Source software in the world right going back to the early days of Linux. To many many other open source the eclipse Foundation.

Yeah great example. Yeah. No, thanks.

I when I talk about it. I like to say I stand on the shoulders of giants right because back when you know open source was a new thing the senior leadership team looked into it in great clarity and did some very Savvy things and you know, the Triple Crown I like to kind of refer to is, you know, you mentioned Linux you mentioned Clips but IBM was also fundamental in helping to establish the Apache Foundation. Yes wrote some of the bylaws absolutely and so back then IBM also had a clear understanding that you know, this was something that IBM needed to be thoughtful about not just walk in and say hey we're from IBM and you know, I'm here to help.

Yeah, we know what's what right do it our way, you know, we tried to go in thoughtfully both look to how to contribute and establish this new echo system as well as To consume from it in a thoughtful way. Yep, and I'm glad you said it that way because it's a two-way street and that people don't understand that I think today more people understand it. But back in the day people didn't understand the two-way street of Open Source software end of community.

Right, right. For too many people was like it has to be a win-lose situation what's in it for me? Right but there's almost a little bit of pay it forward and when it comes to open source and Community, well you do right you kind of does right by you and it is that two way street.

Well, it's one of the ways that open sources survived as long as it's had right because right the other thing that I think is interesting is that it all started out with individuals, you know, IBM wasn't there at the very beginning but you had a variety of people that were passionate about it for, you know, either possibly political reason or possibly just Independence reason or some it's almost like for some of it's almost like a quasi, you know, religious. Yeah. It was I was there for those days you're right, but then you know, the second wave was when traditional it vendors and it wasn't just IBM there were others that got involved early on and started to experiment and see what this could you know deliver and the Third Way started about, you know, a little over a decade ago now, but it was you know it To what I call the the wave of the hyperscalers, right?

Some people like to say Fang but you know the Facebook Apple Amazon all of the players that build you Jeff. I this how I explain it and you make agree to disagree in my mind that first phase you spoke about I call the cathedral in bizarre phase if you remember the book, right absolutely great very much, you know freezing Freedom. There was some folks who are into open source because it was free is in Freedom.

There are other folks here because it was freeze and beer right and with That you know, Dr. Richard stallman and that whole thing. The next phase that you described is when commercial software got into it.

I call that the Big Brother face. We're all of a sudden these these, you know commercial technology software companies said wait a second. This is great.

We can get other people to contribute to the software. We use that we control that we ultimately own but we're gonna call it open source. I know we're gonna do some good in the community, but at the end of the day, we're gonna steer this thing for our own benefit and If it helps other people great, but really we're going to help ourselves.

Yeah, I think it'd be I think I'm not a big brother. Well, I wouldn't argue with that other than to say that different players at scale came at it from different ways and some were more focused on what was in it for them. Yeah.

That's what I'm trying somewhere a little bit more selfish at the end of the day companies are kind of like people and everyone I like to say act in their own self interests at Subway and some people are very altruistic because that's in their own self interest. But some people also realize that sometimes doing the right thing come the wheel of karma pays you back in Spanish. Absolutely and I'd like to think that Foundation face though.

Right? Right. Well and the foundation phase was always kind of as big companies got involved the foundations acted as a counterbalance to maintain a Level Playing Field, right?

Well, I was in Isaac as a more fan. So I like Each face but yeah it what it did it developed this concept that's co-opetition right where if we all play together nicely. We will that Rising tide lifts all boats.

We started a really good level and then what you do with it at IBM versus HP is up to you guys. Well another great example of that and this Level Playing Field concept is the whole kubernetes. Yeah people, you know, I'm sure kubernetes came from a lot of origin stories.

Right? But one of the ones that I think resonates is the fact that Back when in 2014 I was at a conference like this and all the buzz was about Docker and containers and in Austin I was too and and Docker to their credit they did a pivot they were working on creating a pass and they were starting to flame out money-wise and they looked at well, we've got a pivot. What can we do?

Well, we created this Innovation around using containers and we're gonna contribute that out and then we're gonna Rebrand ourselves as Doc and they became the darling of the industry for a period of time and I was the second chair of the docker governance and why he's really cool trying to help them do the right thing, but they made a I guess the calculated step that had pluses and minuses you have the open source project and then you have the company that's looking to create products and they conflated that by branding their project doctor and their company doctor and that was One of a number of things that created there was that yes. I mean, there's probably a Harvard Business School review and where docker you know went off but to bring it back to kubernetes in a that Level Playing Field concept, so The industry was looking for okay, you know, that's great Docker this is innovative and it shows a lot of problems. That's great.

But the the bigger problem is how do you do orchestration at scale but they try to orchestrate and I'm telling you something if you or I were in Vegas sitting at the sports book and you said okay, here are all of the container orchestration. Formats, you know at five to two is Docker because they had their own orchestration. I forget swarm swarm five to two.

A a Rancher Labs had one they were doing I was a long shot noises. Mesos. D2 IQ or whatever the heck it was.

I mean there was all there was a whole bunch of yeah, kubernetes was not the favorite. No, it's hard as hell. Yes so hard.

Yes, so but yeah, but but the part of the way I explain it's original story is that It's 2015 now and you're a CIO and I'm here to you know from IBM and I'm saying hey, you know, you know IBM you love us and you know, we have a concept of cloud back in that time. That was largely focused on private Cloud. Yep, and on the other side of the spectrum there was AWS starting to emerge and they were all about public and they wouldn't even they threw shade on anything.

That wasn't them as oh, that's just the traditional vendor Cloud wash. but Google would go into that same environment and say hey we have GPC. We think it's a better mousetrap, you know at Google our propellers spin faster than anybody else's and we based our container orchestration on the board.

That's what they referred to internal right? So We we saw you're using AWS. Would you like to try GPC and the answer back was well, you know, the IBM guy was in there just recently and I told him I'd never use AWS because it's this murky highly, you know, not quite sure but it came through the side door.

And now I'm using it and now I have concerns about it because it's like I got my applications in and I don't know how I'm gonna get them out. Yep. So unlocked even though you know your GPC story sounds interesting and I sure your smart guys.

I'll take a pass for now. And they heard that time and again. And he started to realize gosh.

We need a more open Friendly on ramp to our board technology. Hey, you hands handful of smart googlers come up with Enterprise version of this highly complex infrastructure that we can put out there and open source. And they did and they came back a year later to that same CIO and said hey, you know we heard what you said.

Look we've got this new open source project on AWS and you know, so, you know, so let's talk turkey and this they got some takers but the smart CIO looked him in the eye and said, you know, you're right. It looks interesting looks you know decent quality, maybe a little complex and it is open source. But I'll pass why.

It's a community of one. And what is that? What do you mean if I do the dance with you and something doesn't go right?

You're the only people that really understand and there is basically a soul Source type of thing. They heard that enough. And at that same time some smart folks from IBM and some others from Red Hat started knocking on Google store and saying hey we see you put this out there.

We'd like to contribute and collaborate but we're not for doing it until it becomes under the control of a independent foundation so that it's a Level Playing Field and a rising tide can lift all boats. There you heard it the history of kubernetes, right and now Linux Foundation came. I'm sure there are other versions.

I don't know. I I'll tell you the truth. I've interviewed Tim Hawkins from Google.

I don't know if you know Tim he was on the original Google team Coop team and Similar similar kind of stuff but really that is why the foundational model for open source, I think had seen us. Open source rules right there plenty people today gave us this 90% of all software has open source in it today, right? Wouldn't be if not, but for a foundations.

Let's talk a little bit about though you're here. Impressions, you know, we were lucky enough to speak with Jamie essay. He was also from IBM and she is the chair of ossf.

the kind of a And I don't mean to embarrass you again. I'm sorry if we're going at it. No, but you had a pivotal rolling in IBM's participation in this.

Well the yeah basically being responsible for IBM's open source clearance process. I started losing sleep four or five years ago because I saw this, you know exponential growth in open source. And again we touched on it open source isn't inherently more or less secure but because of the sheer volume it created a large attack surface and I felt that it was time that we really needed to start like addressing this and as we mentioned it's it's a problem that is you know, pretty intimidating frankly because it's it's didn't happen overnight and it's a huge systemic challenge now in the industry and so you come to conferences like this.

0 because it was right as the pandemic was hitting and so hey great idea and there's clearly a need but do it remote. Yeah, and and no one has a checkbook that they're willing to open at that time. We don't know what's gonna have because we don't know what's gonna happen.

Yeah, I remember so there's been about 18 plus months of you know, good intent and that what I sometimes called the good college try. Yeah, but it was clear that the problem wasn't going away. Well, I think the full time frame was coming around again.

It was time to basically step up and try and do this, right? So the business unit that I currently look working committed the funds IBM's joined as a Top member. Up number of big players have joined and it's going to be a million dollars worth of big players who jump?

Yep, and certainly didn't it didn't hurt that the White House issue that snow that didn't hurt either the cybersecurity executive order that went out a little over a year ago now kind of rung the bell with respect to esperms and this software supply chain strategy. You know, I've been in security about 25 years. One of the lessons I learned really early on was nothing gets religion to your customers like a good old-fashioned security breach right incident, right and look and I'm not blaming anyone but the solar winds thing certainly and and then some of the subsequent ones leading all the way up here to log4j.

Right? Well you it was not that long ago, but I guess it was long ago 2014 teens and Trinity and the tech cycle, right? And that was when heartbeat hit.

Yes right boy the industry Dodge to Bullet because a white hat found it and they quietly got a study guide their hands, right and they came up with a patch. They got it out there and you know, thank goodness the industry largely dodged a bullet and Linux did not get the black eye. It could have absolutely Go forward three years and it was 2017 and the Apache Community had their own had their own scare with respect to Apache struts.

Yeah, but to their credit they found their problem. They got the patches not everyone put it out there. So they well they put it out.

I'm not everyone applied it so quick exactly and unfortunately sucks. Nine months or nine months after the Patch was available. I'll go one better six months after Equifax.

People are still downloading the old version. Yeah. Look, I mean in security a long time.

Here's what I I we're running out of time. But here's what let me end it on a good note. I think today we are better positioned better situated better Finance better organized.

Yes to deal with this issue. Then we ever have been. In the past by by a factor of 10 or 100 or more, right?

Yeah. We I think we're on to something and I think this model Right. So today it's software supply chain security two years now.

It might be another thing we're looking at but this model Works. Yep, right because the the security problems we need to tackle are too big for any company whether it's IBM or Google or Microsoft or any of them we need this. Consortiums type of yeah, it's definitely fixing this software security.

Supply chain is going to be a team sport. Yeah, and there's one last thought I'd like to leave your viewers with is that that you know, we touched on it briefly but asbaum software bill of materials. They're on the way they're gonna be coming acquire a requirement.

But a lot of what customers are hearing is that they need to publish one but long before they need to put one out. What you really need to do is start learning get your hands dirty and then use that learning to address those issues you need to remediately before you start, you know, handing them around like trading cards. I agree with you 100% We got to pull the plug on this one.

We got people waiting. But thank you so much man. I appreciate it great conversation.

Hey and many thanks for IBM in all you guys are doing with this. We're gonna take a quick break. We've got our friends from Jay frog next stay tuned.