00:48:05 · John Coogan, Dylan Field, Tae Kim, Jordi Hays, Feross Aboukhadijeh
[00:48:05] S0: Like Yeah. [00:48:06] S6: Both is the answer and so that's what we're really building for right now. [00:48:09] S0: Exciting. Well, thank you so much for taking the time to come on the show. Have a great rest of your week. Great to see you. [00:48:15] S6: Good to see you all. [00:48:15] S3: Thanks for talking to soon. [00:48:16] S0: Talk to [00:48:17] S1: See you. [00:48:18] S0: Up next, we have Farras from Socket back on the show to discuss and Series C by none other than Thrive Capital will bring in Farras from Socket from the waiting room to the TVP and Ultradome. [00:48:32] S1: Get that going ready. [00:48:33] S0: Welcome to the show. How are doing? What's up? Good to see you How's it [00:48:36] S7: going, guys? Thanks for having me back. [00:48:38] S0: I I think last time you were on, Jordan, I will see you soon and here you are. Give us the news first. What happened? [00:48:44] S7: Yeah. So Socket announced its $60,000,000 series c [00:48:47] S3: at a billion dollar valuation again and again. [00:48:51] S0: It led by Thrive Capital. Congrats. [00:48:54] S7: And it's a big day for us. [00:48:56] S0: Absolutely massive. [00:48:57] S1: Is what you do important right now?
00:48:57 · Jordi Hays, Feross Aboukhadijeh, John Coogan
[00:48:57] S1: Is what you do important right now? [00:49:02] S7: Yeah. You know, you couldn't have really asked for a better, you know, perfect storm. You know, you have just the confluence of, you know, AI, cybersecurity, and all the different attacks we've been seeing, and we kind of built the perfect product for this moment. And it's been something that we've been building towards for you know, it seems like it's okay, you know, we just we we had the right thing right now, but the reality is, you know, we've been building towards this for, you know, four years plus. Yeah. And so, you know, it's an overnight success success that took four years. [00:49:28] S0: Right? Overnights success. I love it. Yes. What was the key unlock for the new round? Growth needed the capital for specific expansion, just the broad tailwinds of the industry, people looking forward to more demand? What's changed in the business?
00:49:28 · John Coogan, Feross Aboukhadijeh
[00:49:28] S0: Right? Overnights success. I love it. Yes. What was the key unlock for the new round? Growth needed the capital for specific expansion, just the broad tailwinds of the industry, people looking forward to more demand? What's changed in the business? [00:49:47] S7: So the business is just inflecting. Every year I feel like, okay, this is great. Certainly, we're going get like a regression to the mean or something, but it just keeps accelerating. So over the last while, we've had 500% plus ARR growth over the last twelve month period. And it keeps going. I think we're seeing kind of three forces converging all at once here. We have this kind of like perfect storm between AI generating more code than ever before. You got developers and increasingly non developers too that are pulling in open source dependencies and third party code at unprecedented velocity, and you have more code being written than ever before, both by humans and AI agents. And the kind of maybe counterintuitive thing is it actually brings in a lot of third party code, and that code is is really vetted less than it's ever been before. [00:50:41] S0: Yep.
00:50:41 · John Coogan, Feross Aboukhadijeh
[00:50:41] S0: Yep. [00:50:42] S7: And and that's kind of like the first thing. The other thing is you got the the the frontier AI models like Mythos that are that are finding, you know, thousands of high severity vulnerabilities across, every major operating system and open source library. So the total volume of vulnerabilities in code is exploding right now and it's going to keep going as we start to throw these models against you know, this backlog of code that's been out there for a long time and has a lot of vulnerabilities. And then kind of the third the third piece is that the the attackers have really started kind of realizing that they can exploit the software supply chain to get into companies. So they're not really like coming in through, you know, finding vulnerabilities, but they're actually kind of realizing if we go into an open source component, that's actually an easy way to get into an organization and not just one, but usually thousands of organizations that all use that same component. So it's this like perfect storm of all these factors right now.
00:51:35 · John Coogan
[00:51:35] S0: So walk me through how your business model interacts with the open source community. Because when we see things like Mythos, finding a bunch of bugs in open source repos, you know, we we hope that everyone will just submit bug reports early for the good of the world. But I'm interested in like the economics of patching open source if there's a really important package out there that maybe doesn't have a Linux foundation behind it. Like how at some point, like, at the very least, there's inference costs. Who's paying to patch all of the open source software that so many different companies rely on? If you go to a big company, they pay you. They might patch like, their dependencies. But how does this all flow together into an actually safer Internet?
00:52:27 · Feross Aboukhadijeh
[00:52:27] S7: Yeah. Well, I've been in open source for, I think, over fifteen years now, and I maintain bunch of open source packages and, you know, have a a real soft spot for the open source community. And so let me tell you, they were suffering under an enormous burden even before the current, you know, AI Yeah. Trends have kind of made it even worse. You know, they don't get much support whether financial or just in terms of, you know, the number of people working on this really critical infrastructure is super low for for how critical it is. And so, you know, we started seeing a lot of AI tools being used to create these slop PRs Yep. SLOP issues, and that was already kind of causing a burden. And then now you have the various frontier labs that are finding with with their models are finding a lot of vulnerabilities that were there, were always there, but the community didn't know about. And I will say they're doing a good job of providing a patch along with bug that they've identified, so they're doing a lot of the work for the maintainer, but it still takes effort to review the PR, and the thing that people don't realize is when you accept a pull request as a maintainer, you're not just kind of it's not this one time cost. You're actually accepting the burden kind of indefinitely into the future to maintain that code and make sure that that code is is secure and, you know, is kept up to date with all the other changes. And so I think what we're going to see and we're already starting to see is despite the kind of best efforts of the Frontier Labs and they are making good effort, you know, maintainers are going to fail to actually accept these patches. And so we're going to see a lot of libraries that may have a vulnerability in them that literally have effectively code sitting on GitHub that anyone can look at and use to generate an exploit against that vulnerability, and that's there's not going be an easy path for companies and for developer teams go and actually patch their libraries because there's no version they can upgrade to. Because the maintainer is just sort of sitting there on that patch and hasn't hasn't accepted it. So it's just creating this real risk where, you know, like there's more homes than ever before and there's not really like easy paths. And so this is actually something we try to solve.