Trusted Open Source Catalogs for AI and Developers

Hi, everyone. " I don't get a chance to talk to my friends from ActiveState often enough. Spent some time with them at Black Hat, but I wanted to bring them back and then really dig into what they're doing.

And then, life has a funny way of working. Events in the last week or so really have brought into focus what ActiveState does, and I think we're going to have a good discussion. Let me introduce you to Leslie Pascual.

Leslie is the Field Engineering Manager for AI and Security Solutions at ActiveState. Leslie, it's good to see you. How are you?

I'm good, Alan. Thank you so much for having me. Oh, it's my pleasure.

So Leslie, that's a long title here, Field Engineering Manager for AI and Security Solutions. How did you wind up here? Yes, thanks for asking, Alan.

I've been in tech for over 20 years and have touched upon different areas of the career, everything from engineering, architecture, to leadership, and really landed in my passion, which turned out to be cybersecurity. Just went down the rabbit hole of being an architect who wanted to really secure enterprise level healthcare applications, and found that ActiveState did that full-time. So now I get to do what I enjoy full-time and be consultative with my customers about how they're integrating AI, how they're securing their AI, and that's why we're here today.

Well, you know what they say, if you do what you love, you never work a day in your life, right? So good for you. That's fantastic.

ActiveState is a company, well, we've been covering ActiveState for a couple of years, so a lot of people in our audience may have heard of them, but I always like to tell the story. I know a little bit of the ActiveState story myself, and what I love about it is this is not a Johnny-come-lately, right? This isn't one of these companies that emerged from stealth last year or something, right?

ActiveState, is it 20 or 25 years? It's been around a long time. Longer.

Yeah. We're nearing 30 years- Yeah ... at this point.

And yes, ActiveState has been around for that long. We started with providing secure Perl, Tcl, some of the older languages. And honestly, we still have a great customer base that hasn't been able to migrate away from those languages, so we're still maintaining those languages.

And also started putting on some of the more modern languages like Python, Java, JavaScript, things like that. So we've expanded into more of the modern languages, but really utilizing that learned practice of how organizations are securing what they bring into their pipelines and securing the bases for their software builds. Excellent.

And, there's a lot that goes on into that, obviously. Leslie, I wrote an article earlier this week about some friends of mine at a company called Minimus, and it was a cautionary tale, right? And what was interesting is the founding team there were very successful in past ventures, right?

They were the team behind Twistlock, one of the first container security companies. Look, through a couple of pivots and everything, they basically were offering secured container images. The best way, like from a repo that you could download.

And not that that's a bad business. There's a lot of companies doing that. You can get secured containers from your Unix or your Linux providers, a lot of different places.

Mm-hmm. And so they basically gave back what money they had left that they had raised because they weren't getting the traction, and they didn't want to waste other people's money, and I commend them for it. I think that's very admirable, and I wish more founders actually maybe took that to heart.

But that being said, in the article that I wrote about it, I said, I'm not here to throw mud at anyone or say anything's bad, but I wish they would've focused on something a little more downstream, which is how do we keep all of this bad code from seeping into our code, into our applications? How do we put policies and processes and procedures in place to make sure that whether it's an artifact or a code snippet or whatever you're getting from external sources, how do we secure that? How do we make sure the quality's there?

And this is something ActiveState works on a lot, yes? Yes. So we're trying to shift that security all the way left.

Right now, it's happening with scanners. A lot of developers are bringing in open source from the internet. AI agents are bringing open source from wherever they can find it, really.

They're identifying, "Okay, we need this package," and they just go and find it from whatever source it is. That can leave you open to lots of vulnerabilities and liability as well. And scanners will compare the packages and the CVEs based on metadata.

Nobody's really actually scanning. Well, maybe there is someone out there, but scanning the code itself, to see how it's behaving. Is it behaving as expected?

So we're trying to bring that shift completely left. Instead of doing it later down the pipeline in the SDLC, we're trying to do it at the very beginning. So let's start vetting packages before they even enter your environment.

How do we do that? Using a trusted source like ActiveState, we have catalogs that our customers can subscribe to, like our Python catalog, for example, or our Java catalog, for example. And you can subscribe to that and know that the components that you're getting have been fully vetted up front.

They've gone through that cool-down period. They're being built on secure infrastructure. They're being attested, signed, and provided with the strongest provenance possible to ensure that there's no malicious attacks or malicious malware getting in there at the moment of build.

So yeah, that's the problem- I love it ... we are tackling. Yep.

When you say shifting, it's funny, we're putting on this DevOps Experience Virtual Event next month. Well, two months. No, next month, September.

We're still in August when we recorded this. And someone just submitted a speaking thing yesterday about is AI shifting further left than developers? Right before the developer actually starts working on the code.

And that's kind of what we're talking about here, right? We're putting up that firewall, an approved catalog that allows the developer to know, "Hey, I'm going to use this Python script. I'll use this container image.

I'll use this artifact, whatever it is. " Right? And so that is one less thing to worry about.

But now, on the ActiveState side of the house, how often are you rechecking these sources? How do you make sure you've got the latest and greatest versions of them? Because we're finding new vulnerabilities, with this Mythos stuff every day.

Yeah. So we are constantly scanning our own catalogs. Part of what we do for our customers is not just build once.

We're continuously managing, continuously monitoring as well to ensure that we can provide that service as well. So continuously monitoring and bringing in any of the latest fixes, patch releases, things like that, building those for our customers proactively and providing them in the catalog. We also provide that intelligence to our customers so they can make those an informed decision about approving a package, the use of a package, or the upgrade of a package as well.

Excellent. For our audience, we mentioned Python script, right? What are some of the other kind of places where your catalog has deep resources?

Yeah. Our Java catalog is pretty extensive as well, and we are supporting some end of life for some major organizations who maybe have a pinned version, for example, that they can't move from quite yet, things like that. We also have a JavaScript catalog that we are working with as well to provide that to some enterprise-level customers, and we continue adding more languages.

We have an R catalog, in which I know that we're one of the few that does. And so we're expanding into languages every day. We have the top nine open source ecosystems ready to go today and expanding into the top 12 languages as we speak.

That's fantastic. That's extensive. Mm-hmm.

Just curiosity, maintaining those has to be a huge chore. How much is AI helping you there? Helping with just the- Keeping stuff up to date, scanning ...

scanning, just automation- Yeah ... things like that. It's still more on the automation side for us right now because we want to make sure that things are working.

We go through the same extensive security as we provide to our customers as well, if you can imagine. Well, drinking your own champagne or whatever you want. Yeah.

Some say you're eating your own dog food, right? Exactly. Yep.

So now, I want to look at it from a developer point of view, well, from an organization customer point of view. So we subscribe to ActiveState, and each of my developers gets a seed or whatever, however it's licensed. And then, if it's a human building it, the human knows, okay, this is my catalog where I could go get artifacts, snippets, code that I know is good.

But as you mentioned in the beginning, so much is being built by AI right now. Do we restrict our AI agents just to the ActiveState catalog, basically? Do you have your own agents that...

I mean, how does that work? Yeah, absolutely. So, we can integrate into Claude, Cursor, those.

We can use the ActiveState catalog to be the source of truth for those AI agents as well. And we also integrate, so we're trying to solve this problem at an organizational level- Yeah ... not just as to the individual developer.

So we also integrate with all of the existing distribution mechanisms, such as if a company's using JFrog, for example, to send all of their developers into a approved repository, or Sonatype, or even Cloudsmith environment, for example. So we are able to integrate to any of the distribution mechanisms. So you're integrating into things like Artifactory, Maven, like- Correct.

Yes ... the mainstream repos that- Mainstream ... that people use ...

distribution systems, yes, that people use, so that there's less developer friction, less developer need to change their behavior if an organization already has one of these distribution mechanisms. So yeah, that's what we're trying to be tool agnostic and still provide that source of truth. I get it.

Let me ask you, so let's say I'm using Artifactory. Mm-hmm. And now I'm using ActiveState.

What I actually get is ActiveState catalog of artifacts that are in Artifactory because I imagine the ActiveState catalog, which is secured, is a subset of a bigger Artifactory set that hasn't all been checked, and you don't know what you're getting. Mm-hmm. Yes, so we plug right into Artifactory.

So for example, you can have a remote repository mirrored into your Artifactory from ActiveState that provides those secure components, and developers are able to use that entire language that we provide through their Artifactory. Got it. It's great.

Let me ask one other. We're running low on time, but I just want to- Sure ... take this out a little bit.

Does ActiveState have anything that goes into the pipeline, right? Mm-hmm. Into that CI/CD pipeline that checks to make sure, kind of almost like shifting right almost, right?

So now they took it down, the developer did their thing, it's now moved along. They put it in Git, and it's moving along towards deployment. Does ActiveState continue to check in there, and does ActiveState help them with...

Because I would imagine you're in a great place for SBOM, right? Oh, yes. Absolutely.

Yes, and we are. We are providing SBOMs for the components that we provide right now. So you do have that attestation as well.

But I am going to leave a carrot dangling, so maybe we can talk about this next time as well. All right. The old dangling carrot.

Go ahead. We are working on an MCP server in order to be able to provide that right side of the service as well and be able to have customers integrate into their pipeline and then have that intelligent security as well. All right, so we got something to talk about next time.

Yes. Absolutely. All right.

Hey, Leslie, I want to thank you for coming on here on Techstrong TV with us. Keep up the great work. Say hello to my friends at ActiveState, and we'll be in touch with you soon.

Thank you so much, Alan. This was great. Thank you.

Leslie Pascual, a field engineering manager for AI and security solutions at ActiveState. You know, Leslie, we didn't mention the website. com?

Oh. com. You can find all of our solutions, products, get in touch with us, read our latest blogs.

We're trying to stay on top of the industry and, yeah, find us there. Thank you. com.

We're gonna take a break here on Techstrong TV. We'll be back with more in a little bit.