Anthropic IPO Stakes, Open Source Strain and GitHub Security

Happy Friday, everybody. Welcome to the Techstrong gang, and as usual, we have our, well, I guess I'm going to call it the regular Friday lineup, starting with John Schwartz. John, how you doing?

I'm good, Mike. You know what? Tonight's the World Series.

I know. Oh my gosh. It's exciting.

Yes. The Milwaukee- Two small market teams. What a nice change of pace.

Yeah. Unless you're a television executive, and now you're- Oh, it's going to be a disaster ratings-wise. It's going to be one of the worst-rated series ever.

Yeah. Oh well. Could be fun, but I'm hoping to catch some of it somewhere along the line.

Of course, Jack Palmer, who could care less about the World Series or any other major sports that doesn't occur at least as a headquarters in the US, right? Well, yeah, we believe in better living through internal combustion engines, and F1 is back in the continent now at Circuit of the Americas in Austin this weekend. Mm-hmm.

So that's going to be a fun one. And we get to watch it now because it's on our time zone instead of midnight our time because it's somewhere in Eastern Europe or Malaysia or wherever. At least two of my children will disappear watching F1, so that I know for sure.

All right. Tracy Reagan, haven't seen you in a little while. How you doing?

I'm happy to be back. Yeah, I took some time off. I am happy to be back, though.

All right. So, let me ask you, are you prepared to live in the great state of New America? How's that going to go?

Yeah, right. Yeah, right. Exactly.

What a joke. And by the way, Jack, Albuquerque still has a drag racing track that you can go to for free, and they bring in the funny cars, and it's a blast to be that close to something that uses jet fuel. I'm there.

" Absolutely. You literally could get right next to the funny cars. It feels like it's going to singe your eyebrows off.

Outstanding. All right. Nothing like old school, good times.

All right, now, Jeff Rich, always good to see you. It's Friday, and there's an image behind you. I believe that looks to me like, I don't know, a chocolate layer cake.

What is that? Well, it might be Boston cream pie, Mike. Ah.

In fact, there's two days you should be aware of. One is Boston Cream Pie Day. I know it's one of John's favorites.

Yes. It's also National TV Talk Show Host Day. So congratulations.

Yes, Mike, congratulations. It's your day. We should've had a picture of Mike behind you, Jeff.

Yeah. I guess I'm celebrating something today, but we'll see how that goes. I'm not quite sure where my other television hosts are.

I didn't get an invitation to the party, wherever it is, but we'll see how this goes. We normally, on Friday, the third segment of the show is something that's a little off-kilter and somewhat bizarre, but today we're going to lead off with that. It's the Anthropic IPO.

Everybody and his brother is talking about this thing, and John, you have a long history of covering these types of events. know. The thing that leapt out at me immediately was this company has lost north of $80 billion just so far in-- Did I read this correctly?

It's like so far this year? And so, in any other industry, the CEO would be shown the door for such a performance. But here we are, all on pins and needles wondering what the valuation is going to be like and how the market's going to react to this thing because it is going to be the bellwether IPO for everything that follows suit, apparently.

But what is your take on this, John? Is this sustainable? Yeah.

So when we talk about AI, we're just talking about big numbers and trying to reach big numbers. And the reason I keep saying that is because Anthropic, when they go public, and it could happen as early as the week of November 9th. If they do, they better have a huge valuation.

So according to this draft prospectus that the Wall Street Journal gleaned, their valuation would be $2 trillion, and that's going to be essential because they are spending money like water. They're going to have to raise this valuation to extraordinary heights because they have to sustain this heavy spending on specialized chips, data center footprint, top-tier technical talents. Like, for instance, the amount of spending they're doing on computer and infrastructure the first half of this year is roughly $9 billion.

Last year, it was $7 billion total. And according to this journal story or prospectus that they grabbed, Anthropic holds roughly 450 billion, with B, in non-cancellable cloud infrastructure commitments over the next seven to 10 years among Google Cloud, AWS, and Microsoft. Nice work.

So basically, they're securing seven to 10 years of compute before knowing exactly how their customers are going to use AI, according to one analyst at least. And that begs the question of how much flexibility Anthropic has to put that capacity to work as customer use evolves. So at the same time, I'm going to do a story later today that Mike passed on to me about OpenAI.

25 trillion valuation ahead of their IPO, presumably next year. Basically, what this shows is these companies have to raise money as fast as possible to fund their expansion. But that also brings the question, I'd love to hear what Jack has to say about this.

What about the revenue? How does it possibly match the spending? And I think that eventually will come back to bite these companies once they become public after a couple of quarters, and then the losses escalate.

Well, let's go to Jack because the issue is that people are starting to move more towards these open-weight models, and 80% of what we need to be done can be done using something else. And it would appear that Anthropic is going to have to, and so long with OpenAI for that matter, increase pricing at some point, although they're claiming their margins are somewhat healthy as it is. But clearly, the spend exceeds the margins.

So how does this all play out, Jack? Is this for real in your mind? Yes, but for a completely different reason.

First of all, they are claiming out, I think, John, in your article, it said an 85% gross margin, which is pretty good- That's pretty good. Yeah, that's not bad, John ... at this stage of the business.

Yeah. But we have a precedent here that points to IPOs like this where the finances are immaterial, and that's Google, which also went public on absolutely horrible financials statements. And what is happening here, and because Anthropic is going first, it puts them in a different place than any of the other AI vendors, particularly OpenAI.

People want a piece of Anthropic to have a piece of Anthropic, regardless of the financials. They want to own a share, just like everybody wanted to go out and own a share of Google when it first went public. And so what you're seeing here is true market forces of supply and demand about owning the stock that has an Anthropic ticker on it, not about what it represents, right?

999% of all other stock cases, the stock represents the value of the company, and the only value of the stock is the fact that it's backed by the financials of the company. " Right? "I want to buy it," and they're going to buy it, and whatever dollar value it has on day zero is going to go up for a little while.

Then people are going to actually start understanding the financials, and all bets are off at that point. Mm-hmm. One thing, too, that I should mention, too, in fairness to Anthropic, because they are reinvesting a ton of money, but they wouldn't be the first company to do this.

Remember Amazon as the classic example. Eventually, it did pay off magnificently. So I'm not discounting the fact they could possibly do it, but I just think it puts a tremendous amount of pressure.

And I also wonder, and I'm not predicting this, but companies tend, after they go public, they reach a certain threshold, they bring in a new CEO, or they transition to someone who is better at operating a major business. And at Google, they brought in Eric Schmidt, and I think in Anthropic maybe that could possibly happen, but that's far down the road. Tracy, you run your own tech company.

What's your read on all this? So I was just going to say, we, like a lot of companies, are experimenting with AI everywhere. Just a plug, our Ortelius open source project won a second place position at the All Day AI Hackathon yesterday.

Yay, Ortelius. Congratulations. So yes, we're all experimenting with AI and in many different ways, and I know that there's value coming out of it in some areas.

Marketing, I think, is a really amazing area. Medicine. There are some areas that AI is really creating measurable business value.

But I don't believe that AI right now is generating enough measurable business value to support these massive models and the way we're being asked to do. In your discussion, you just add it up, it's $4 trillion in two companies. And are companies really benefiting enough from AI, if you're playing the long game, to say that these companies are really worth that kind of money?

I don't think they are. I don't think that we're seeing enough measurable business value to say that AI has that much itself, a company like Anthropic has that much value. So to Jack's point, it's about owning Anthropic, right?

It's not about AI. To that- Because AI's not there yet. It's not.

Nobody's making that much money off of it. John, I live here in New York, and of course, everybody's always whispering about stocks in New York, but one of the things that they are whispering is that there's a rush to do this before the midterm elections and Congress- Yes ... change hands, because there's going to be a boatload of investigations around what happened.

Absolutely. And you know what? There's one thing that keeps resurfacing, and I don't know how accurate it is, but Kara Swisher, no matter what you think about her, she does have access to pretty good sources within the government now as well.

And one of the big rumors is that most of the investigations, not all of them, but a preponderance of them, are going to involve Elon Musk. Actually, they're going to go after him first. And it looks like, whether that happens or not is another topic, but I want to ask this of you, Mike.

This whole rogue AI agent stuff that's going on. There was a story in Axios yesterday about agents running amok within bank accounts at the same time that Barclays says they're going to lay off 5,000 and rely more on AI. I wonder if that narrative and the fear of AI rogue agents, among other things, AI running amok, whether that undercuts these IPOs, because I'm starting to see smaller IPOs being dropped or delayed that are beyond Anthropic and OpenAI.

I think it has an impact in the short term. I'm actually cautiously optimistic that we will have the capabilities to safely deploy AI agents and keep them within certain bounds and policies and rules and isolation. My problem, and maybe I'm being optimistic, is that it requires organizations to actually invest in the cybersecurity fundamentals that they have thus far not invested in all these years.

So let's bring in Jeff on this point, but am I overly optimistic here that maybe we can actually securely deploy these things with the tech we have, or are we just kind of screwed and kidding ourselves? Well, actually, I do think we have the capability, and I think you and I discussed last week, this is a question I've been answering for close to 50 years, whatever the new technology is. The big difference now, as we've often said, I repeated before, is speed and scale.

So from a technology perspective, that's all very doable. And to your point, it means business can't simply say, "Go get the sexy AI agents and we'll worry about what happens later," because whatever bad comes from it will happen faster. So let's figure out what we need to do and then go get the tools we need to do it, which will probably be AI.

" I don't know yet. There'll be a lot of fired CSOs before that decision's made, though, I believe. Mike, going back to the...

Sorry, Jeff. Mike, going back to the midterms, you're right. They're probably trying to rush this.

And I think OpenAI, it's too late for them, but I suspect, and I'm not a fan of this because it rarely leads to anything. We're going to have a series of hearings, perhaps, aimed at Altman, and maybe Olemde to a lesser extent, but just kind of public shaming of AI, which I don't think is going to lead to anything substantive once the Democrats take over the House. And we might see more consternation, but it's all public show.

Yeah. I'm not certain they're that concerned with it. If you take a look at the big Meta, Amazon, or AWS, they have all gone through that.

And Zuckerberg's a great example of that. Mm-hmm. He's probably not super happy, but he's not really suffering because of it.

No, no. He showed that he had the blueprint. He just said, "We'll get back to you.

We'll be working on that. " He used that pattern and it worked. But, I mean, also there was a bill, I guess, in Congress that's being introduced in terms of job displacement.

So, and there's a bipartisan movement to look at AI and its impact, but again, this polls well. This does well in terms of voter approval. So voter, not approval, but voter- Consternation.

One might say ... consternation, right? I mean, you just use AI as a stalking horse.

We're in the fear-mongering stage right now, and once the elections are over, they'll drop that and they'll go to the next shiny diamond. No, there's- I want to give Captain Cynic the last word here. Jack I don't know what the whisper number is, but in your opinion, does the value of the stock go up or down there the day after the IPO?

What do you say? Oh, I think it definitely goes up the day after the IPO. I think when we get our first, maybe not our first quarter, but our second quarterly results.

If those don't continue the trend, the actual numbers don't matter and aren't going to matter. Just like with Amazon and Google, the actual numbers aren't going to matter for a year or two. What's going to matter is the direction and the trend.

If they can continue to show gross margins and a path towards, whether it's a one-year or a 10-year path towards profitability, then the numbers are going to keep fairly solid. If they end up showing like, "Oh, because we're public now, and we now have to open the books," and everybody sees all of the... And what I'm concerned about is sort of the circular funding, right?

Is- Mm-hmm ... I got an investment from NVIDIA, and in return, NVIDIA gives me chips, right? So NVIDIA gives me $10 billion, I go buy $10 billion worth of NVIDIA chips.

So how much did NVIDIA really invest with me? Did they invest $10 million? Did they invest a billion dollars worth of chips, right?

And so that's- That- Right? So the money laundering, and I use that term loosely, I don't want to be in trouble here, but once those books get opened up and people see what's actually going on and how that turns into real dollars to stockholders in six months to a year, that's where it's going to get really interesting. You're right, exactly about that.

That's when the scrutiny really starts heightening and you're right, circular funding, that's going to get more and more attention. But, in the short term, Wall Street really is very quite forgiving towards these blue chips Particularly if you're one of the traders in the early traders, man, you get a piece of the pie regardless of the direction it goes. Well, I would say that for every one investor who's betting on Anthropic, there's another one that's probably shorting it, and we'll see what happens.

And it is gambling. That's all it is, pure and simple. So good luck to all the bettors out there.

All right. I'm going to shift the gear here to talk about open source and what's going on with that, because there's a report out from the Linux Foundation that's talking about how, well, in general, the state of open source seems reasonably solid, but there's a lot more code starting to go into these projects that is of uncertain provenance, and people don't have a lot of confidence in it. And there's another report that says that one of the things about these AI coding tools is we're using more open source software than ever because, well, that's where the AI coding tools find you most easily, because the proprietary stuff's probably behind some sort of firewall somewhere.

And that brings us back to this whole concern we have about, well, there's more vulnerabilities than ever showing up in open source software. So, Tracy, I know you're close to all this, but what's your read on what's all going on here? And are we winning or losing?

Well, we're definitely changing. AI has fundamentally changed how open source software communities work. I knew this was occurring.

Everybody could see it. We get PRs that we don't want to accept. But when DigitalOcean changed the way their Hacktoberfest worked by taking out the traditional PR counting to eliminate these low-effort spam PRs, I knew that there was something bigger happening.

DigitalOcean has been a huge favorite for hackers and people that want to do hackathons for years, and for it to change that drastically, it was a big statement. I speak often to Mark Waite, who's one of the Jenkins maintainers. Even though he's retired from CloudBees, he still does that work.

And they basically say if they do any kind of a hackathon, that they can't keep up with the PRs, that the amount of gen code coming into these open source projects is sort of ridiculous, to be honest. So I didn't need to have a survey to know that this was happening. But it is interesting that in their survey, they claim that 25% of the PRs are low quality, and that over 30% of us have no way of policies around their projects, which doesn't surprise me.

We wouldn't even know how to handle it. We're having to do it all manually, and it's taking a lot of time, and there's headache associated to it. There's no doubt.

So yeah, I think that the issue is AI is helping us produce software faster, but our existing development, security, and governance processes, we just can't keep up. And open source teams are constrained, so it puts a lot of pressure on us. And at the same time, we have the Cyber Resiliency Act, CRA, out of the European Union, telling open source teams that if their software is intended for commercial use, which most of it is, that they have to report an exploited vulnerability within, I think, 24 hours by the end of next year.

And we don't even have a good catalog for telling us what's exploited. So I think overall, the industry is struggling with trying to keep up with what has occurred because of AI. Before we started doing a lot of generated code, we already knew we had a problem with keeping up with vulnerabilities.

Literally pitching for DeployHub, I would tell people a vulnerability can be exploited in about 10 days. Well, now a vulnerability can be exploited in about a minute. When you have an AI agent that goes out, finds a zero-day vulnerability, and figures it out and exploits it all at the same time, we have a problem.

And we're already there. This is not something that's coming soon. No, we're there.

We're in the thick of it. Yeah. This week alone, and we're not talking about it specifically here, there's two big issues that should have everyone's attention.

One are the compromised TLS certificates, which that got lost in the shuffle because of the bigger issue with PHP, which affects millions of websites. All right? So think about this.

A TLS compromise isn't even a top security story for the week. What's wrong with this picture? It's because we're flying the plane really fast, and all of the gauges are going crazy, giving us different information, and we cannot correlate it.

So this is just the beginning. I think to, going to be the harbinger of doom here, but to Tracy's point, we are going to have more and more problems that are going to happen faster and faster, and sure, tell me about exploited. I don't even know.

No one's going to know. We're there. Jack, were you referring to this month already as Black October just because of all the patches?

What does November, December, and January bode for you as you think about all this stuff? More of the same, right? The ironic thing, something Tracy said sort of hit me, which is thinking about open source and resource constraints, right?

And for a very long time when, as I progressed in my career, starting in the late '80s, early '90s, open source, for a very long time, touted itself as being more secure than commercial software because you had access to the source, you could see it, you could compile it yourself, you could read it, figure out if something was bad or not. Now we're way past the point of anybody looking at open source. It's much more about it's available, but the open source companies are much more resource-constrained than the commercial software companies for a lot of the projects.

And a lot of the projects that we rely on aren't even run by... They're open source, but not by profit-making entities. A lot of the stuff we depend on is actually done by volunteer maintainers, and somebody had an idea and put it out there, and it became a project that people use.

And we have to rethink our concept of the difference between an open source and something that's made by for-profit versus a not-for-profit entity of one form or another, because the for-profit companies are now incentivized to build more secure code because reporting requirements or their customers are going to go away if they don't build secure stuff. And I just want to put a plug out there, though, to organizations like the Linux Foundation, because what they are doing is they're doing their best to help their open source projects follow more corporate kinds of standards. So, for example, the OpenSSF, their projects, they have money that they can put into those projects to help them shore up their Git repos.

They have audits that they can do on them. So this is the importance of foundations to manage and govern open source. We used to didn't have to have that, and there are plenty of companies who have open source projects that are not under a governance board of some sort, but those governance boards are what's going to keep open source safer.

So Apache Foundation, the Eclipse Foundation, Linux Foundation, and all their sub-foundations are doing the best they can to make sure that open source is safe. I just want to make sure that that's out there. So if you want to use open source, think about that.

Right. Please, and thank you, Tracy, because I didn't want to imply that by any stretch of the imagination that open source isn't safe. I think from a software development perspective, we always have to make the trade-off of how much time do we devote to various activities, being how much time do we devote to fixing our existing issues, particularly security issues, versus new feature functionality.

" And sometimes I think the open source people maybe need to take that attitude as well as we're getting flooded by PRs. Those PRs aren't new feature functionality, or a lot of them aren't. A lot of them are like, whether it's low quality or not, it's potentially an issue here.

Maybe what we need to say is let's do a dedicated sprint of a week, a month, a year, whatever it is, to say, let's go look at how do we go and fix those issues before we start looking at our feature backlogs. All right. So Tracy, why don't we do that?

Because we've seen it done elsewhere, and it may be at the point that that's where we are. I believe some open source projects are leaning more towards these sprints. No doubt.

I know that the Artillus project, we think about things in that way. And in terms of getting more people to contribute to these projects, I think that DigitalOcean's move to having more of a hackathon, their Hacktoberfest now is being managed in a different way, where open source projects can have their own hackathon. So for example, the one that Artillus did yesterday was around, we called it a CVE Reasoner, where it went through to figure out if a vulnerability should be fixed or not.

Is it reachable? Does it have lots of dependencies associated? Does it have breaking changes?

We had a very specific requirement for that, and I do believe that open source projects are starting to ask for smaller projects, and they want suggested PRs so that they could look at all of them and determine which one's the best to use. So we are changing the way we're managing our projects, there is no doubt, Jack. That is definitely the way more teams are starting to think about it.

Because we just can't just have random PRs coming through our supply chain and accept them because we're excited that somebody contributed to our code base, which is how it used to be, right? Yeah. And then I wonder, and I'll throw this to Jeff, but maybe we're going to be onto something that's a little more permanent here.

And historically, I think maybe developers might have spent, I don't know, I'll make up a number, three hours a month working on fixing vulnerabilities and because they were incentivized to build new features. Well, maybe it's time to look at the way we incentivize folks because right now we're so obsessed with creating new features and deploying them, 90% of which most people never wind up using anyway, and so do we have our proverbial heads up our a***s anyway? So I'm not going to comment on the last one.

But to cover the technical aspect of your question, it's time and we can do it. And I'm going to use an example. I worked for a company a number of years ago, and when I came in, I ended up taking over incident management and the help desk and some other things in addition to security.

And the pay structure was that if you were a developer or a maintainer, you got paid a bonus to come in and fix problems when they happened. And I think that's where we are right now. We are trying to catch up and fixing as they happen.

" It took six months to turn it around, but we need to have code that works, not simply code that's deployed, and then get paid more to fix it, because we're not getting paid more to fix it. m. because they weren't getting a bonus for it.

I think that principle can work here, and it's going to be community development. And to everything Tracy talked about, the community's going to drive this. And I also think this is tied back into the first segment we talked about, that where AI is just gathering everything in and making it work.

There does need to be more human-based intervention to say, "Are we doing the right things? " Right. Or, I don't know, you're describing a world where people get paid more to come in and fix their mistakes.

There's another way of thinking about that. There's you get paid less for making mistakes. You can say it.

I want to point out, though, that fixing a vulnerability in a package, there's more toil around that, to be honest, than fixing your own code. Mm-hmm. Because there's a lot of unknowns about it that you have to try to sort out.

So ironically, AI's gotten us into this problem, and as I've said before, AI's going to get us out of this problem because AI does have the ability to help us speed up the process- Mm ... of fixing those packages because it has intelligence that we wouldn't normally have, like trying to sort out a dependency graph. I don't want to look at a dependency graph.

I just want somebody to tell me what packages are going to be impacted if this one changes, right? So reporting, I think, on these vulnerabilities is good, but using AI to start helping us reduce the toil around fixing them is more important right now. Even if there's a human in the loop that accepts the change, is getting...

The CVE Reasoner, we have an 18-step MCP process to get it done, and that is basically the stuff that every person has to go through in order to get a critical package out the door, fixed and out the door. So it's harder to fix those than it is your own code. All right.

I'm going to leave this here, but I would recommend everybody to look up the definition of insanity, because that's where we are right now. All right. Shift in gear.

GitHub is finally doing some things to secure the software supply chain, and the question that I immediately have, though, is whether or not this will be filed under too little too late. But the two things they are doing that caught my eye is one is they've created a firewall for the hub that essentially will make it more challenging to download the wrong kinds of software, I guess is the way to look at that. And then they throw in a scanner that will review this code before you download it, hopefully.

But Jack, as you look at all of this, is this going to make a meaningful difference to securing our software supply chains? " I think it'll make a difference because of the types of issues we're seeing now. And the one that was highlighted in the articles that you shared with us was essentially similar in one aspect to PHP to Shell, which Jeff mentioned.

PHP to Shell was a vulnerability, or is a vulnerability, that doesn't require you to log in. If you have a system that is running PHP and it's got an open port and you hit that port with a well-crafted HTTP request, the PHP engine itself is what's reading that request and getting compromised, right? So it's not your code, it's the code you're dependent on that has the issue.

That's one way to think about it. The second thing is, one of the articles highlighted that the vulnerabilities that people were finding wasn't in the open source packages they were downloading. It was in the installers that installed those packages before you got to use them.

And so, we don't even think about that, that the act of installing this source code for us to build another program on, that source code has to be installed in that. Installing that is actually a program that you're running, and that's where the vulnerability was, and there were password stealers being installed and credential stealers being put in those install scripts. So both of those types of issues are things that people weren't necessarily looking for and are also really hard for humans to find because somebody who's basically building code that's going to be doing something in Java using some NPM script, some NPM thing, they may be an expert in what they're asking that code to do, that API call that they're trying to do.

They're not an expert in the installation of the tool itself, and that could be thousands or 50,000 lines of code that they'd have to wade through to figure out if that thing was trying to have a password stealer in there or not. So having tools that are going to look at your code as you look at the package that installs it is the same thing we do today on a Windows box, or when you install something in Windows, Microsoft Defender goes and looks at it and says, "Hey, was this downloaded from the internet? Does it have an ID?

Was it signed? If it's not signed, are you sure you trust it? " Right?

So we're already doing that to some extent on the applications we run on our desktops, but we don't think about that when we're a developer and we're just grabbing source code. It's an inanimate thing. It doesn't do anything.

It's just code. It can't run. But there's an installer there that we don't think about.

So I think this will be very good. And it's an incremental improvement. It's evolutionary, not revolutionary, but I still think it's very good.

Yeah. Tracy, what's your read here on how much responsibility does GitHub have in this whole software supply chain process? " And now here we have these tools.

So, are they changing the way they view themselves within that software supply chain? Is that a good thing? And, well, a lot of people point fingers at GitHub.

Is that justified? Okay. Well, I would answer this differently if I worked for Sonatype or JFrog.

Right? This is one of their core offerings. So, it makes sense.

Let's just put it this way, over the course of time, GitHub, GitHub Actions, and expanding what Git is able to do, is taking over more and more of what we used to see in traditional DevOps tools. We have firewalls already. We have package registries, and I think they're an important first line of defense, and that's something that is going to be done for you without thinking about it, and not using Sonatype or JFrog, that's great.

But it's not really a complete supply chain security strategy, which is what tools like JFrog and Sonatype are going to add to that. So it's a good first defense, but it doesn't complete the story. And then, in terms of the AI scanning, finding more vulnerabilities is not really better security.

Fewer unresolved vulnerabilities would be nice, and we're not seeing that. We're finding more and more every day. So I don't know if telling me I have more vulnerabilities does anything for me.

I hate to say it that way. Telling me I have an exploited vulnerability or I have a critical vulnerability may help me, but it's just gotten to be so much. To add some of these tools is just more noise, and it may deafen some of the developers who are the ones who need to be looking at them the most.

So while it's great, it's not a magic pill that's going to solve the problem. Jeff, to Tracy's point, more developers than I care to admit don't run scanners at all. " So what's to be done here?

So for every developer that's not going to run scanners, say they're too busy or that's ops problem, at some point you go back a few years, this is what DevOps and DevSecOps was supposed to solve, though clearly we're not there yet. I applaud that this is a good step, and to Tracy's point, knowing about more vulnerabilities doesn't make me more secure. But what we haven't talked about yet is how we're really prioritizing them, and the CVE score is not what we're looking for, because I'm not certain that's necessarily going to get us there either.

" And then there's other categories. Until we get something like that, the noise to the signal ratio gets out of proportion way too high, and you can't distinguish what you need to pay attention to. So this is a good necessary next step, I think.

" And whether it's with a third party like JFrog or someone else, we need to find a way to solve that problem so we know where we put our resources, not that we need to put every single resource we have into every single vulnerability that's documented. Our problem is the dependency graphs are so freaking huge. Mm-hmm.

And I keep talking about de-bloating. We really have to start de-bloating some of these packages. Python doesn't need to be as big as it is.

So I feel like I would love to see the Linux Foundation or the OpenSSF where some money go into helping these bigger open source projects that everybody depends upon, like Python, de-bloat. Let's start taking out these packages because if they're not reachable, if they're not used, we don't need to have them there. And this has been a problem for developers for such a long time.

We like to throw code into our builds just in case, because we're not sure. And it's a habit that we've gotten into. So now we're just scanning, it's being reported on.

We've got to start reducing the number of packages that are coming through the supply chain, not making sure they have no vulnerabilities. We just have to get rid of them if they're not needed. " It doesn't have as many vulnerabilities because it's not relying on these other packages.

So I feel like we're going down the road, and we're going down the wrong road. We're always talking about reporting the vulnerabilities, and that's the conversation. I really want to start talking about reachability and de-bloating more often, because that's really what's going to get us out of this, even if it's scary.

Yeah. Jeff, to Tracy's point, why don't the security people run a better scan and be more knowledgeable about what it is they're doing? Because every developer I talk to says the same thing, "I get these reports from the security people.

I go waste time chasing them down. " So if you listen to what Jeff said, and you listen to what Tracy said, I can take any commercial scanner, I can have AI write a scanner in an hour, and I can go scan the environment. In a typical IT environment, I'll find thousands of vulnerabilities running in an environment today.

If I point it at code, I'll go find tens, hundreds, thousands of vulnerabilities. The question always becomes prioritization, but who decides what's important? For different applications, for different users, for different environments, what you consider as priorities is more important than...

Your measures of priority differ. So Tracy brings in reachability. That's one measure that's important.

When we look at it and I think Tracy's thinking about source code, I'm just going to step back a little bit and think about it from an enterprise environment point of view. When we do an enterprise, we go scan an enterprise environment, we find thousands and thousands of different machines that have vulnerabilities in them. Reachability is one factor.

What type of data exists on the machine or what it's handling is another factor, right? When you think about that in terms of source code is what type of vulnerability is it? Is it that the program crashes, or is it that it exposes data, or it's a login vulnerability, or you will only hit it if you're 10,000 steps in and you're a super user, right?

And by that time, you've already got all the information you need. So it takes a lot more than just finding the vulnerability to get to enough information to prioritize it. And this is, I think, a question of product market fit of the people building the scanners trying to find these things, not necessarily or necessarily not providing or providing.

What's the information a software developer needs in order to decide what's the right priority for them to go fix these things? It shouldn't be on the vulnerability scanner's responsibility to do the prioritization. It should be the vulnerability scanner's responsibility to provide that information so that the appropriate people can prioritize it based on what they view are the critical factors or not critical factors for their particular use case.

Jeff, I want the last word here. I'm going to use an analogy on that. If you go to a doctor and you get blood work done, you're going to get a bunch of panels back with different information.

Of course, when you get to my age, there's a lot of different information than when you're younger. But there's going to be some things that your primary care is going to say, "You should go see a rheumatologist about this. But first, go see a cardiologist about this one.

This is a higher priority. " And that's, I think, Jack, I'm not trying to really oversimplify this. I think that's what you're talking about.

Absolutely. But again, Jeff, in your example, the same data that you get off a blood panel would be interpreted differently if you're a 25-year-old man versus if you're a 75-year-old man. Right.

Or if a rheumatologist is looking at it versus a cardiologist looking at it. Exactly. It's all context.

But that prioritization needs to happen. All right. I'm going to end this here, and I want to thank everybody for sharing their insights, as always.

I think it's apparent from all three segments that there is a chronic shortage of rational thought in the world, and here we are. Rational thought and AI, do those go in together? This is our fundamental issue.

Hopefully- Yeah, it's accidental AI, not artificial, right? Hopefully by Monday there'll be more rational thought in the world, but I wouldn't bet on it. But here we are.

Hey, I want to thank you all for watching the latest episode of the Techstrong gang. Please stay tuned for the rest of the rerun of the Techstrong TV lineup. And with that, here's a word from our favorite sponsor, us.