STEPHANIE WONG: Hey, everyone.
This is Stephanie Wong, Cloud Developer Advocate.
We are back with our own Google fellow Eric Brewer.
Last time, we talked about his last 10 years
of building infrastructure at Google and Kubernetes'
influence in the space.
He mentioned how he is now focusing
on creating processes for more secure software supply chains.
So Eric, how are you doing today?
ERIC BREWER: Fantastic.
It's good to see you again.
STEPHANIE WONG: Good to see you, too.
All right, so let's dive right into it.
Last time, we were talking about supply chains for software.
Now, you were talking a little bit about the risk space
and companies tied to it.
So how is the supply chain risk assessment happening today?
Why is the risk so large?
ERIC BREWER: Well, I think there's
a lot we need to do here as an industry,
and it's beyond the power of just Google.
In fact, it's really quite a challenge for the whole planet.
But I would say the first thing we need to decide is which
projects we want to actually bet on, because in some sense,
any project you're betting on for security,
you'd like to make sure that there are people that care
about that project and are paying attention to it and will
fix security vulnerabilities as they arise,
because in practice, 99% of our vulnerabilities--
literally 99%--
are not in the code that you write for your application.
They're in this very deep tree of dependencies, some of which
you may know about, some which you may not know about.
And so the first thing is what are those dependencies, which
ones are well-maintained, which ones are not.
We're starting to present that kind of information.
But to take it up a level, it's actually
going to be important for all industries
to try to understand what pieces of software
do we want to bet on and why.
And what do we do about the ones that are not quite up to par
yet?
STEPHANIE WONG: Yeah.
And whether some companies know it
or whether they have come to an acceptance of it,
Kubernetes has become the de facto way to build and deploy
many, many applications today.
Or at least that's the North Star for many organizations.
And now it has several hundred software library dependencies,
right?
So what are we at Google Cloud doing to help
reduce those vulnerabilities?
ERIC BREWER: Well, there's tons.
There's of course, CNCF, we started as a home
for Kubernetes.
And it's part of the Linux Foundation, which we also are
big fans of and funders of.
I personally helped create Open SSF, Open Source Security
Foundation.
That, in my mind, started in 2019,
although I think it actually launched in early 2020.
But that foundation is, in fact, explicitly targeted
at open source security and the supply chain.
It was created for that purpose.
And fortunately, it was created before this stuff really
became so visibly bad.
But I could see it coming, and that's
why we needed to kind of start early.
The other thing I would say is that Google has a long history
of committing to open source.
And in our recent response to the White House,
we committed another $100 million to open source
in the coming years.
And it's important to set that precedent because the repairs
we need-- there's a lot of mundane work
to do to make open source as secure as we need it to be.
And it's not fair to say oh, volunteers and others, please
work harder.
That's not going to be the sustainable path.
And in fact, I'm arguing for federal funding
as well for open source security.
I kind of feel like we need to get to a sustainable model
where the ongoing work of security, which is not
easy stuff, is actually financially supported,
not just for this year when it's a crisis, but for the future.
By the way, I think of it the same way
as you think about other public infrastructure.
We passed a trillion dollars to spend on roads and other things
in the US.
Open source is a public infrastructure also.
And like all public infrastructures,
it needs maintenance and support.
And so we have to figure out how that's going to work.
It's not at all an easy thing.
But I do think that is part of the path of the future.
STEPHANIE WONG: Yep, and it's really hard to predict that.
And so I think having the secure processes in place from
build to deploy is really key, especially
as we've seen the detrimental work of adversaries
coming to light.
Now, can you talk a little bit about our contributions
and the work that we've done in the open source space?
What are some of the organizations and the projects
that we've worked on?
ERIC BREWER: I'm a big fan, as you know,
of kind of raising the level of attraction over time.
And that gives developers more leverage.
It allows us to do more automatically
on both the security side and the management side.
And Autopilot is a great example of that.
It's really-- we will manage the nodes for you and your cluster,
and you don't have to.
And that is a security improvement,
but it's also, frankly, just a toil improvement.
Why do the toil of managing those nodes
if you don't need to?
That's probably not what you're doing your Kubernetes job.
You probably have something you'd
like to do, like a business app or website or a data analysis.
Focus on those things, and we can manage the nodes.
And that general direction is the way it's going to go.
We can manage more things over time,
but they'll be the things that you
don't want to manage yourself because it's a hassle.
STEPHANIE WONG: Exactly.
And I do want to dive a little bit more
into Google Kubernetes Engine and what
we've been doing over the last couple of years.
I know that we just had GKE's sixth birthday, actually.
So why don't we go ahead and save that for the next episode?
Thank you so much, once again, Eric.
And to everyone else watching, stick around
because we are going to have more soon.
[MUSIC PLAYING]