Inspired with Alexa von Tobel
00:03:37 · Dan Lorenc, Alexa von Tobel
[00:03:37] S0: Yeah. I think it's just being willing to try something you haven't done before, and that, you know, got to do a lot of that in college. I switched switched careers too. Right? My background was actually mechanical engineering at MIT. Half halfway through that, I took my first programming class, and we had to learn MATLAB, to do simulations and that kind of thing. And I thought I hated programming before this, but I'd never really done it. And I realized it was actually not as bad as I thought it was gonna be, and it was a lot faster. You could, you know, create things on your laptop in a dorm room instead of having to get time in the machine shop and order parts and wait for those to show up and screw up and then have to reorder more parts. You know, it kinda condenses that cycle of weeks and weeks to actually get something built to hours, and there's kinda no limit there. [00:04:17] S1: That's awesome. So you you enjoyed the speed. Yeah. Well, so let's go back to 2021 when you started Chainguard. What was the moment? Obviously, as I said, you'd spent almost a decade at Google. You had really been deep in open source. Where did the idea come from?
00:04:35 · Dan Lorenc
[00:04:35] S0: Yeah. It's a it's a funny story. There was no real idea or plan. You know, I was at Google for a long time. I was doing this open source security stuff for a while. No one really cared about it until the attack on SolarWinds happened. And then all of a sudden, everyone was like, oh, wow. We have to secure our build systems and our dependencies and all of that too. And so the space started blowing up, my cofounder Matt, who's our CTO, he left and took a bunch of time off during the pandemic. So I'd worked with him forever at Google, and he just took a break. And I kept trying to get him to come back to work because the whole space was heating up, and my team was hiring. I hugged him every day for six months. I was texting him, come back. Come back. And one day, he finally said he was ready to work again, but how about I quit and restart a company instead of him coming back? And, you know, I thought about it for a couple days, put a notice the following Monday, and I, you I knew, yeah, I knew if I thought about it too much, I'd talk myself out of it. But it seemed like a good idea that we... And, you know, we didn't really know what we were gonna do when we started. So, you know, we got the company started and spent a lot a long time figuring it out. But this space made sense. We tried things in a lot of different spaces. And I think it's sort of a strength. And I talked to a lot of early stage founders. I'm sure you do too. But if you go in with one idea and you have so much conviction in it, that's great because that can give you the confidence to go get started. But you can't also be wedded and tied to that first idea. The chances of that first idea actually being the right one, pretty low. But being willing to try a couple different things, experiment, and then really double down and invest when you're sure that you that you have the right one, I think it's better in some ways. You know, it's a slower start, but when we had that conviction, we were really ready to go.
00:06:03 · Alexa von Tobel
[00:06:03] S1: Absolutely. I mean, I think being adaptable is, like, the the vital trait of founders where you can follow your nose to where things are working and and where value could be created. For everybody out there listening, what is Chainguard in plain English? And and and maybe for people who are less familiar with it, give us give us a a decent full overview.
00:06:21 · Dan Lorenc
[00:06:21] S0: Yeah. So we're building a safe source for open source software. Open source software is, like, 90 to 95% of the software used every day application from, you know, the software running inside of an ATM into the software inside of an airplane to, you know, the apps on your cell phone. And it's... The the term open source means it's free. You get the source code. It's written by basically strangers on the Internet, and it's just published for anyone to use and do anything they want with. And by the volume, like, that's crazy. 90 to 95% of the code is just free, and people aren't actually writing all of that. But it's amazing. It's why, the whole industry is able to move quickly because we can reuse these shared components at the bottom. But recent... In recent years, we've kind of learned the hard side of that, which is that when stuff is maintained by strangers on the Internet, not everyone on the Internet is nice. If you spent any time on any social media platform, you've probably noticed that. And, you know, you get no guarantees with this. You're not paying for it. There are issues. There are bugs. Some of those bugs lead to security incidents. And then we have nation states like, you know, North Korea, Iran, you know, putting bad stuff in there on purpose. So you've got this huge foundation that the whole software industry is built on, and it's under attack in a bunch of different ways. So we're building a safe way for enterprises to get that software that they they need without having to worry about the security issues.
00:07:40 · Alexa von Tobel, Dan Lorenc
[00:07:40] S1: Dan, say more, and we'll get into the business model and all of those things since... So open source code Yeah. That anybody can come use. Yeah. But Chainguard makes it such that you can trust the code you're getting. And in some ways, just to use a cooking analogy, it's like Chainguard lets you know that the ingredients that you're gonna go use in your food are healthy and organic and safe. That's effectively what Chainguard does. But just give us a sense of how do you create that safety? What does that look like practically? [00:08:15] S0: Yeah. So the trust is the keyword here. And, you know, there's really two problems when you boil it down. The ingredients one is great. Right? There's ingredients in the food. Things can get recalled, and, you know, you wanna make sure that you're up to date. And if, one of these ingredients was bad, then you have a way to fix it and get a fresh one. The other one is the tampering side of it. And so it's kind of like that, yeah, when you... The trusted ingredients and then a tamper proof seal on it to make sure, people haven't put anything bad in it on the way to you. And these supply chains are very long. The the term software supply chain is the same as a physical supply chain. It's just much bigger and much more complicated than software.
00:08:15 · Dan Lorenc, Alexa von Tobel
[00:08:15] S0: Yeah. So the trust is the keyword here. And, you know, there's really two problems when you boil it down. The ingredients one is great. Right? There's ingredients in the food. Things can get recalled, and, you know, you wanna make sure that you're up to date. And if, one of these ingredients was bad, then you have a way to fix it and get a fresh one. The other one is the tampering side of it. And so it's kind of like that, yeah, when you... The trusted ingredients and then a tamper proof seal on it to make sure, people haven't put anything bad in it on the way to you. And these supply chains are very long. The the term software supply chain is the same as a physical supply chain. It's just much bigger and much more complicated than software. [00:08:50] S1: Say more. What makes it more complicated, actually? And and I and I I do like the food analogy because it's like, because of Chainguard, I can trust that the open source code I'm using is safe, secure, tamper proof, and then you can just go and cook your own meal. So what makes what makes a software supply chain more complex than maybe a physical supply chain?