00:49:28 · John Coogan, Feross Aboukhadijeh
[00:49:28] S0: Right? Overnights success. I love it. Yes. What was the key unlock for the new round? Growth needed the capital for specific expansion, just the broad tailwinds of the industry, people looking forward to more demand? What's changed in the business? [00:49:47] S7: So the business is just inflecting. Every year I feel like, okay, this is great. Certainly, we're going get like a regression to the mean or something, but it just keeps accelerating. So over the last while, we've had 500% plus ARR growth over the last twelve month period. And it keeps going. I think we're seeing kind of three forces converging all at once here. We have this kind of like perfect storm between AI generating more code than ever before. You got developers and increasingly non developers too that are pulling in open source dependencies and third party code at unprecedented velocity, and you have more code being written than ever before, both by humans and AI agents. And the kind of maybe counterintuitive thing is it actually brings in a lot of third party code, and that code is is really vetted less than it's ever been before. [00:50:41] S0: Yep.
00:50:41 · John Coogan, Feross Aboukhadijeh
[00:50:41] S0: Yep. [00:50:42] S7: And and that's kind of like the first thing. The other thing is you got the the the frontier AI models like Mythos that are that are finding, you know, thousands of high severity vulnerabilities across, every major operating system and open source library. So the total volume of vulnerabilities in code is exploding right now and it's going to keep going as we start to throw these models against you know, this backlog of code that's been out there for a long time and has a lot of vulnerabilities. And then kind of the third the third piece is that the the attackers have really started kind of realizing that they can exploit the software supply chain to get into companies. So they're not really like coming in through, you know, finding vulnerabilities, but they're actually kind of realizing if we go into an open source component, that's actually an easy way to get into an organization and not just one, but usually thousands of organizations that all use that same component. So it's this like perfect storm of all these factors right now.
00:51:35 · John Coogan
[00:51:35] S0: So walk me through how your business model interacts with the open source community. Because when we see things like Mythos, finding a bunch of bugs in open source repos, you know, we we hope that everyone will just submit bug reports early for the good of the world. But I'm interested in like the economics of patching open source if there's a really important package out there that maybe doesn't have a Linux foundation behind it. Like how at some point, like, at the very least, there's inference costs. Who's paying to patch all of the open source software that so many different companies rely on? If you go to a big company, they pay you. They might patch like, their dependencies. But how does this all flow together into an actually safer Internet?
00:52:27 · Feross Aboukhadijeh
[00:52:27] S7: Yeah. Well, I've been in open source for, I think, over fifteen years now, and I maintain bunch of open source packages and, you know, have a a real soft spot for the open source community. And so let me tell you, they were suffering under an enormous burden even before the current, you know, AI Yeah. Trends have kind of made it even worse. You know, they don't get much support whether financial or just in terms of, you know, the number of people working on this really critical infrastructure is super low for for how critical it is. And so, you know, we started seeing a lot of AI tools being used to create these slop PRs Yep. SLOP issues, and that was already kind of causing a burden. And then now you have the various frontier labs that are finding with with their models are finding a lot of vulnerabilities that were there, were always there, but the community didn't know about. And I will say they're doing a good job of providing a patch along with bug that they've identified, so they're doing a lot of the work for the maintainer, but it still takes effort to review the PR, and the thing that people don't realize is when you accept a pull request as a maintainer, you're not just kind of it's not this one time cost. You're actually accepting the burden kind of indefinitely into the future to maintain that code and make sure that that code is is secure and, you know, is kept up to date with all the other changes. And so I think what we're going to see and we're already starting to see is despite the kind of best efforts of the Frontier Labs and they are making good effort, you know, maintainers are going to fail to actually accept these patches. And so we're going to see a lot of libraries that may have a vulnerability in them that literally have effectively code sitting on GitHub that anyone can look at and use to generate an exploit against that vulnerability, and that's there's not going be an easy path for companies and for developer teams go and actually patch their libraries because there's no version they can upgrade to. Because the maintainer is just sort of sitting there on that patch and hasn't hasn't accepted it. So it's just creating this real risk where, you know, like there's more homes than ever before and there's not really like easy paths. And so this is actually something we try to solve.
00:54:36 · Feross Aboukhadijeh, Jordi Hays, John Coogan
So we built a solution to this called certified patches. And what this is is basically kind of a deterministic way to, in kind of one click, make your vulnerabilities and your open source code go away. So we use we use a whole bunch of AI and kind of produce these patches that make the VULN go away without any work on the on the part of the developer. There's no kind of burden of of upgrading packages. You just sort of in a click the Vault is gone from your dependencies and you can kind of keep the rest of your code and your application the same. And so it's really kind of a quick fix to the problem that we hope is going to be part of the solution. And by the way, we're giving away all the critical patches to the community for free so we can try to disseminate this widely to as many people as possible. [00:55:21] S1: Are there are you able are you finding any companies that are completely asleep at the wheel or is everyone like giving this an [00:55:28] S0: Who should I hack today?
00:55:28 · John Coogan, Jordi Hays, Feross Aboukhadijeh
[00:55:28] S0: Who should I hack today? [00:55:30] S1: No. Just want like I imagine like part of why the business is growing so quickly is this is like a hair on fire Yeah. Problem, concern every single day. Right? You're seeing these like vulnerabilities or issues pop up. And so I would have to imagine that every every software company online where the technical leadership there uses the Internet, which I would imagine is all software companies are like pretty like leaning into this problem. But do you ever do you ever like I'm curious even from like an outbound sales marketing standpoint, are there people that are like, oh, this is just like not that important for us right now? Or or or would like a no be like, we we have a solution, it's with someone else? [00:56:13] S7: We we okay. So we've met one company that has literally no software. They produce toilet paper and they didn't [00:56:21] S0: have Christopher, no one of of business. No Yeah. Smart