Scaling Non-Functional Requirements with WebAssembly – Liam Randall, Cosmonic

This is texturong TV. Hey guys. Thanks for the throw.

We're here with Liam Randall is the CEO for cosmonic and we're talking about non-functional requirements what's going on with s-bombs and maybe there's just a better way to think about this whole thing and and Liam welcome to show Mike. Thank you so much for having me on. We of course are now all obsessed with sophomore Supply chains and S bombs and everything that needs to go into a application.

And the question I have for you is, you know, does this kind of beg your moment where we need to rethink how we build the applications in the first place? Because if we're gonna document them this degree, maybe we need to reduce the number of moving Parts as it were absolutely Mike. The number one rule in security is if you can reduce your attack surface, you've already gotten far ahead of the game because when you're handling less code you clearly have less maintenance to deal with and if we take a step back and think about the last 20 years, we've had these epics of tech where we have continued to pull complexity out of developers lives.

Let's maybe run through the last five or six of them here. We think about going starting in the 90s. We started with virtualization to pull to decouple applications and their stacks of dependent software out of an Digital PC from there.

We went to the virtual data center with public Cloud then the virtual operating system with containers each time reducing the amount of coupling between a specific application and it's underlying components as we've gotten into containers one ugly problem has continued to rear its head and that's that the applications we put inside of containers are created and include 95 a percent or more open source code a recent study from Deloitte actually observe that developers are spending as much as 80% of their time on operations and maintenance and when we think about what those tasks entail it's becoming boilerplate Farmers. It's all of these dependencies that that we are necessary to make our applications work web servers tracing monitoring logging and when there are vulnerabilities in these common libraries that are embedded throughout the thousands of patients that make up a major Enterprise or organization. I'm all work stops around the org until those vulnerabilities can be patched.

I would look at bashbug log4j these things tend to rear their head at least once a year on a systematic basis. So you guys are at the Forefront of the ship to webassembly. So how does that change the game here in terms of reducing those components?

That's absolutely right, you know webassembly is an open W3 standard. So it's on the same level of standardization as HTML CSS and JavaScript. It's only the fourth language for the web and it can be best thought of as a really tiny virtual machine and what's powerful about this virtual machine is that it gives us a gradual decoupling between applications that are running in in this little webassembly virtual machine and then underlying Linux distribution.

Let's compare it to containers. I'm in a container. We have a very tight coupling between Linux and the application.

So there's lots of sort of Legacy reasons that Linux works the way it does. For example, your terminal is 80 characters wide because Punch Cards were 80 characters long. I mean when we think about supporting all of those dependencies that come with containers, there are some drawbacks and webassembly is the first step in giving us an execution plane that lets us simply contain an application in and above itself.

But there's one more important feature of web assembly that's even more powerful and that's called the component model and the webassembly component model is simply the idea that you can use building blocks to satisfy common dependencies and applications. So think of when your web browser might ask you and say can this application use your camera or your microphone those capabilities have been Old in a way so that they're pluggable to the specific camera that you have underneath it. And in the same way we can model common browser capabilities.

We can also model the big building blocks that make up software. So if we think about the small piece of code, we might use to compute say an interest rate or to log a user in the non-functional code. That might come with that would be a web server, maybe a blob store, you know saving files to S3 logging tracing when we model these as a components.

We've now created another layer of decoupling just as containers decoupled us from specific installs of operating systems and virtual machines decapolis clouds webassembly now gives us the ability through the component model to decouple applications from their libraries. The result is developers, right significantly less code for application which means developers maintain significantly less code. application We hear from some developers that they're a little I don't know if the word intimidated is correct as much as they're just find it a little challenging their wrap their minds around Wasim.

So what are you hearing from? Folks? What do we need to do to kind of make this more accessible?

Yeah. I think the world has been inspired by some of these Mega apps that I've been built on top of webassembly and if we take a step back, the standard is is relatively new in the internet terms, which is very fast moving and it was only really unveiled a few years ago. Now a number of high-tech very motivated companies.

They'll bespoke applications to take full advantage of this power. I would look at figma recently acquired by or in the process of being acquired by Adobe for over 20 billion dollars. I would look at Amazon Prime the movie service that is adored by I don't know maybe a billion users on the planet.

It supports 8,000 unique devices. Both of those stories actually come down to webassembly and this phenomenal plug ability and portability that you get through this virtual CPU. So I think what we've seen in the times it's webassembly has lost launched is an incredible effort around creating better developer experiences when I was still at Capital On we actually open source to project that is now known as wasm Cloud.

It's in the cncf and it's a developer framework who's intention is to give developers an easy way to pick up and adopt a web assembly as a way to build applications that run on any clutter Edge including their own. Is one way to think about this that wasm just like JavaScript is jumping from the client side to the server side, and we just need to put together some sort of framework that provides the abstraction that makes that accessible is that that's yeah Mike that's a wonderful It's a Wonderful analogy and I would actually even take that analogy a little bit further if you were to start today and you wanted to build a new website and you went to design your front end. You would very light unlikely start with an empty notepad or vs code window and start writing raw HTML, you'd very likely pick up a framework a framework like maybe react that gives you a jumping off point because it comes with so many of the common components that you would likely use in a website.

It's gonna come with landing pages and drop downs and have you know Wizards and plugins and forms for users to fill out in the same way that you start with a domain specific template a domain of building a website to help you out. There are Frameworks that help you to adopt. Assembly such as Watson cloud and it's very fast moving space.

There are a number of emerging Frameworks cosmonic is the lead company that has spun out around Wasim Cloud. There's another wonderful one from a country called fermion. They have one that's called spin.

I'm an independing on what type of application you're trying to do. If you're trying to do an application, that's more of a plugin. There's a domain specific template from a company called suborbital that's called e2e.

I think it's so depending on what type of application you want. There are lots of emerging Frameworks that help you to adopt webassembly quickly and be I get a functional app creative fast in the same way that there are lots of unique Frameworks for building websites such as react, you know for Enterprise websites things like Hugo for, you know, quick static websites or view or something along those lines. Each of these Frameworks comes with a certain number of opinions and are sort of optimized for different use cases.

Our case on webassembly in Watson Cloud. We're trying to build a framework. That is the best way to make performant distributed applications that run everywhere and some orbitals case.

They're trying to make a framework. That is the best way to make plug in plugins for applications. So where you take webassembly and actually embed it into your application to extend the functionality.

Typically, it's a developer who decides what Frameworks and artifacts to use but do you think security people or maybe even senior level ctOS and cios are going to come around and say to folks. Hey, we're moving to awesome because in security issues are killing us and we just can't afford to do this the way we did. Yeah.

I I think it very intentionally one of the wonderful things about webassembly regardless of which framework you're using. Compatible with today's technology that you're using today. And I mean that you know kubernetes and containers Cosmic recently partnered with Adobe to release a case study in the cncf the first case studies ever done about webassembly and kubernetes together and why that's so powerful.

Mic is is that organizations have spent the last five or more years building all of their security controls into complex ci/cd pipelines. And what's great is we can take get most of the advantages of webassembly by simply using webassembly with our existing Technologies now webassembly is compatible with but it's also not dependent upon so if in the future you decide to run webassembly on openstack or on how she know mad or on Windows a computers or Max or on Android devices, you're still free to bring that same code there, but the big advantage that can help. To accelerate this journey is is that Security Professionals and ctOS can introduce this technology as an option for their developers and know that they can still ride on all of the Investments.

They've made in their operational control security controls monitoring all the complex regulatory contractual and best practices that they've already embedded into their pipelines today. Do you think Watson will be used for new classes of applications and we'll continue to use the stuff. We already have for existing applications or will Blossom eventually replace everything.

What's your sense of? What's the trajectory of awesome? That's a really great question Mike and I think that if we look at how Technologies emerged it's simply another tool in the toolbox.

And when I say that let's think about containers for example, you know containers have become a very popular way to deploy software but there are still some reasons when you choose to use Virtual machines and virtual machines are still very popular, but they're still some reasons that you choose to use physical machines in here in your workloads or in your your building out Edge Hardware or solutions that are portable. So I think in that same way webassembly has its own specific set of use cases where it really is the best choice and container still have use case where they're the best choice. Let me propose if you guidelines one of the areas where we see the Better Together story really working.

Well is when you want to use existing software that's already tightly coupled to Linux. Let's think about something like postgres or applications that you've been developing for years that already run on Linux and are tightly coupled with the underlying operating system. Those are very natural choices to keep in containers.

However, the properties of webassembly may make it may make sense for you to take some of that functionality or new functionality and to implement it and webassembly webassembly solves a couple of really hard problems that container suffer from one of the most important is is the startup time the cold start time that containers have even highly optimized containers that you would run in AWS Lambda which Essentially containers under the hood for right now and firecracker still take a half a second or longer to start up which means that you can't do it interactively. So you have to sort of have this lower bound problem that if you're running on containers, you have to have your caches your applications pre-warmed to a certain level webassembly has some phenomenal properties because we've pulled out many of these non-function requirements we have assembly is typically it can be as much as a hundred or 200 times smaller than applications in the Adobe case study. The application was 280 times smaller.

It was previously a Java container, you know with a full jvm. And after it was ported to Ross and on Blossom Cloud, it was only 210 kilobytes. I'm so it's 280 times smaller.

Now it was so small that the cold start time is measured in microseconds and what that means is that you could scale them faster you could start. Them already pretty warmed and you're able to in some cases even push them out to the customer's own Edge devices. Hmm.

So as you think all this through for a minute Do you think that it environments are going to get simpler? I mean, we promised everybody that it would get easier and we'd have flying cars and it doesn't seem like we're getting either ways right now. So, how am I going to manage?

I mean, what sounds like yet another abstraction layer that's added to the overall environment. Yeah, I I think what we've been very intentional in a learning about the things that we did really well with containers and kubernetes and the things where we needed massive improvements and I think many of our experiences such as my own have been shaped by taking large Enterprises and helping to migrate them in the cloud. You know, what I was at Capital One own Innovation and I was an incredible place to be incredible time from 2016 until just the year before last, you know, we moved hundreds actually thousands of applications into the cloud and it was only through that process and then living with the application lifecycle that we really got to see firsthand some of the downside in our abstractions.

Now the great news is is that we're always able to analyze what we've been doing and to think about how can we do things better? And For me personally when I realized how much time we were investing in up and operations and maintenance, you know, 80% of our developer time. We've talked to similar organizations at cosmonic and other major Banks and software companies report similar numbers some say they feel that they're developers are creating new new features only 25% of the time and the other 75% is spent on this operation and maintenance budget, but that really is one of the largest opportunities when I say opportunities, I mean problems with the way that we build manage and operate software over long periods of time.

So the move towards the abstraction is to make building applications significantly less complicated when we think about pulling, you know hundreds of dependencies out of each application. What it means is that instead of today's world where we have to maintain the same dependencies across thousands of unique applications we can Tame those dependencies in one place and really just scope applications to their unique business logic and then maintain the central components and the common components. Centrally.

I think this was a huge oversight but it's also a huge opportunity and those organizations that have started to embrace software Frameworks, like Blossom cloud or partner with companies such as cosmonic, which it aims to be the best way to run those platforms are already starting to tell stories about their operation savings about their management savings and about how as an organization. They're able to deliver features faster. All right, folks, you're hurting here.

There's a new tool in the kit it helps you build applications that are faster and also more secure. So I think maybe we just can't afford to not start playing with this stuff because the pressure is building. Hey Liam, thanks for being on the show.

Thanks, Mike. Have a wonderful day. All right back to you guys in the studio.