Inspired with Alexa von Tobel
00:06:21 · Dan Lorenc
[00:06:21] S0: Yeah. So we're building a safe source for open source software. Open source software is, like, 90 to 95% of the software used every day application from, you know, the software running inside of an ATM into the software inside of an airplane to, you know, the apps on your cell phone. And it's... The the term open source means it's free. You get the source code. It's written by basically strangers on the Internet, and it's just published for anyone to use and do anything they want with. And by the volume, like, that's crazy. 90 to 95% of the code is just free, and people aren't actually writing all of that. But it's amazing. It's why, the whole industry is able to move quickly because we can reuse these shared components at the bottom. But recent... In recent years, we've kind of learned the hard side of that, which is that when stuff is maintained by strangers on the Internet, not everyone on the Internet is nice. If you spent any time on any social media platform, you've probably noticed that. And, you know, you get no guarantees with this. You're not paying for it. There are issues. There are bugs. Some of those bugs lead to security incidents. And then we have nation states like, you know, North Korea, Iran, you know, putting bad stuff in there on purpose. So you've got this huge foundation that the whole software industry is built on, and it's under attack in a bunch of different ways. So we're building a safe way for enterprises to get that software that they they need without having to worry about the security issues.
00:07:40 · Alexa von Tobel, Dan Lorenc
[00:07:40] S1: Dan, say more, and we'll get into the business model and all of those things since... So open source code Yeah. That anybody can come use. Yeah. But Chainguard makes it such that you can trust the code you're getting. And in some ways, just to use a cooking analogy, it's like Chainguard lets you know that the ingredients that you're gonna go use in your food are healthy and organic and safe. That's effectively what Chainguard does. But just give us a sense of how do you create that safety? What does that look like practically? [00:08:15] S0: Yeah. So the trust is the keyword here. And, you know, there's really two problems when you boil it down. The ingredients one is great. Right? There's ingredients in the food. Things can get recalled, and, you know, you wanna make sure that you're up to date. And if, one of these ingredients was bad, then you have a way to fix it and get a fresh one. The other one is the tampering side of it. And so it's kind of like that, yeah, when you... The trusted ingredients and then a tamper proof seal on it to make sure, people haven't put anything bad in it on the way to you. And these supply chains are very long. The the term software supply chain is the same as a physical supply chain. It's just much bigger and much more complicated than software.
00:08:15 · Dan Lorenc, Alexa von Tobel
[00:08:15] S0: Yeah. So the trust is the keyword here. And, you know, there's really two problems when you boil it down. The ingredients one is great. Right? There's ingredients in the food. Things can get recalled, and, you know, you wanna make sure that you're up to date. And if, one of these ingredients was bad, then you have a way to fix it and get a fresh one. The other one is the tampering side of it. And so it's kind of like that, yeah, when you... The trusted ingredients and then a tamper proof seal on it to make sure, people haven't put anything bad in it on the way to you. And these supply chains are very long. The the term software supply chain is the same as a physical supply chain. It's just much bigger and much more complicated than software. [00:08:50] S1: Say more. What makes it more complicated, actually? And and I and I I do like the food analogy because it's like, because of Chainguard, I can trust that the open source code I'm using is safe, secure, tamper proof, and then you can just go and cook your own meal. So what makes what makes a software supply chain more complex than maybe a physical supply chain?
00:09:12 · Dan Lorenc
[00:09:12] S0: Yeah. And maybe more complex isn't quite... In a very different way. If there's anybody here that works in physical supply chains, I'm sorry. Don't wanna make that sound easy. But, you know, one analogy I've heard a couple times, like, the the bill of materials for, like, a Boeing airplane is massive. Right? Millions of parts in there from hundreds of thousands of different suppliers, that kind of thing. The software, like, the bill of materials for one app on your Android phone is larger than that. It's coming from more people. You don't even know who some of them are at the end of the day. It's just anonymous accounts on social media sites, basically, like GitHub. And so the volume is a lot higher even for small simple applications. And then there's a lot less trust involved. Like, you know, if you're building an airplane and you buy a Bolt, you know, you you wrote a check to someone and you know who show... Sold you that Bolt. Here, it's just like a picture of a cat and a bunch of random characters on GitHub. Right? You don't know who that person is. You can't go call them if anything goes wrong. So a much larger, much more fragmented supply chain without really that trust element at any of the links in here.
00:10:12 · Alexa von Tobel
[00:10:12] S1: Let's talk a little bit about Chainguard today. So you've been up and running for about five years. What you've accomplished in a short period of time is really remarkable, but your platform spans 2,000 open source projects. I'm sure that number's even out of date. 100,000 plus libraries and hundreds of thousands of container images, all continuously rebuilt and maintained. First of all, how'd you get that that big that quickly? Talk a little bit about literally the accumulation of code.
00:10:41 · Dan Lorenc
[00:10:41] S0: Yeah. It's one of these things where, you know, I I love the the sayings, the engineers' credo. We do these things not because they are easy, but because we thought they would be easy when we started. And, you know, we we didn't know how hard it was gonna be. We just started doing it. And, you know, the first 10 or 20 projects we did this for really kinda proved out the market demand. Everyone wanted these. They wanted more than we had, as fast as we could possibly add more, you know, software packages to this catalog that we sell. And, you know, we just sort of looked... Stepped back and looked at it. It's a lot of work to do this. It's a lot of work to maintain the software. But the business model itself is classic economies of scale. You know, everyone at the end of the day is using mostly the same open source. And the old way this worked was every company was doing this kind of same thing themselves for the portion of that open source that they needed. You know, in the beginning, our our gross margins were terrible. They were negative. We were losing money on every deal because we had to spend so much time to build and maintain all of this software. Yep. But it's just resale of that same software. And so you you kinda draw it out of, like, the more customers we get, the better our margins get. The cost doesn't go up as we add more and more customers to this. And we can afford to invest even more in automation. And so it sort of builds this flywheel where the business gets better the more we sell and the faster we sell, And then we can afford to invest even more to make the catalog grow faster and maintain it all for cheaper.