Full transcript
0:00[Music]
0:13hey friends I'm Scott hansome and this
0:14is another episode of Hansel minutes
0:16today I'm chatting with Jacob De priest
0:18he's the deputy chief security officer
0:20at GitHub how are you sir I'm doing well
0:22thanks for having me today so uh you
0:24know I always look at people's LinkedIn
0:26which is the standard thing you do when
0:27you fill up 47 tabs with questions for
0:29an interiew you like this and not
0:31everyone when you scroll on their
0:33LinkedIn uh spent 15 years at the NSA of
0:36all the three-letter acronym agencies
0:39that is the one that I have the most
0:41mysterious and shrouded in mystery how
0:43was that experience it was great I did a
0:46bunch of different things there uh over
0:48the years from software defined radio to
0:51digging into open source and devx
0:53projects and even running some kind of
0:54large scale it and security projects I
0:57think the fun thing about my time there
0:59particularly at the end is I actually
1:01pivoted and was more open and was
1:03working on open source activities and
1:05partnering with other agencies and
1:07trying to figure out how to help
1:08developers get more active in the open
1:10source Community from contributions and
1:12releasing projects and so uh it gave me
1:14an opportunity to be a less mysterious
1:16face on behalf of the agency yeah you
1:19were the like the senior OSS evangelist
1:22and I'm trying to get my head around how
1:24you would even pull that off I mean I
1:25just assume if you worked for a
1:27three-letter acronym agency then you
1:29would just not even tell your neighbors
1:31right like we we see the TV shows what
1:33do you do I work for the government
1:34that's all I can tell you but you're
1:35like no I'm evangelizing open source for
1:38the NSA how did you connect the two yeah
1:42I mean I think it starts uh as many of
1:44our stories do of just following a
1:45passion following an interest we're
1:47working on a project and we thought it
1:49would be great to open source it because
1:51we wanted to partner with universities
1:53in the military and other places that
1:55didn't necessarily have access to the
1:56internal networks we were working on and
1:58uh that you know spun
2:0018mon effort to release a million lines
2:02of code and I learned a lot in that
2:04process and wanted to make it better for
2:07other developers and so really just kind
2:08of leaned into that and spent some time
2:10looking into it and talking to folks and
2:12figuring out how we do more of it you
2:13know so what's cool about that is that
2:15it fits nicely into why you would come
2:17to GitHub like you basically became so
2:19open and so into open source that that
2:21passion LED you into doing open source
2:23of GitHub yeah exactly I couldn't think
2:26of a better place to come after my time
2:28in the federal government and the fun
2:30thing is too and some of the other
2:32things that I was involved in at the
2:33agency I really got to understand and
2:35think about risk at very high levels uh
2:38as it may impact Nations or you know
2:41critical infrastructure and things like
2:42that and so combining the leadership
2:45training and the risk training I got at
2:47the feet of some very amazing leaders
2:49there with my open source passion uh
2:51working on security GitHub has been a
2:53really great and natural next step for
2:55me and I think actually we may not have
2:58met in person but we were both I think
2:59think at all things open in 2020 in
3:02North Carolina yeah and you were talking
3:04about devops so where is devops fit into
3:07your life like I know that the name
3:09devops is itself knew you know we used
3:11to call them build servers or sdlc but
3:14now it's like devops is baked into the
3:16Zeitgeist uh when did open source and
3:18devops kind of merge for you it was
3:20again one of those natural progressions
3:21where I was working on open source and
3:23the processes and legalities of how to
3:25do that better inside a federal agency
3:28and it became evident that that was only
3:30one piece of the puzzle and so without a
3:33consistent developer experience platform
3:35for the developers inside the agency the
3:37open source piece was more difficult to
3:39achieve and so a group of us actually
3:42two or three of us got together and
3:44essentially kind of did a a startup
3:46inside the government we put a pitch
3:47deck together we got funding we put all
3:51the the kind of like pros and cons
3:52together and we started a program called
3:54devx that uh ended up kind of being
3:57responsible for all the the devops
3:59pipeline developer security
4:01collaboration tools and kind of all the
4:03things that you would need to be
4:05successful for an agency of 40,000 plus
4:08folks is it fair to say that even in
4:102024 like there are companies that are
4:12just probably building on someone's
4:14laptop and then don't have any kind of
4:16mature devop build server even Dev SEC
4:19Ops kind of a practice within their
4:21organizations I think that's true I
4:23think we also see a lot of fragmented
4:26approaches where there's 10 or 20
4:29instances of get servers and things are
4:32under people's desks and codes spread
4:34around Enterprises and they're not
4:36getting the benefits of sort of the
4:39central collaboration tooling and
4:40security honestly that comes with some
4:43of the things that you can do when you
4:44pull those things together and take the
4:46burden off of individual developers yeah
4:48the the under someone's desk like
4:50totally resonates with me like there's
4:52so many times this a story that I tell a
4:55lot but like long story short my blog I
4:57thought was a virtual machine for many
4:59years
5:00and then when it finally died and I
5:01called support it turns out they had
5:03never moved it into a VM it had always
5:05been under someone's desk it was
5:06literally like a mini tower under
5:08someone's desk and they were like well
5:09you know we're getting around to it it
5:10was like a Hoster surface they never
5:13imaged it they never backed it up so I
5:15ftpd in did a frantic backup and you
5:18know the little spinning hard drive
5:20finally just pooped out at the end but I
5:23I can visualize it under someone's desk
5:25never been more true that the cloud is
5:27just someone else's computer then but is
5:29someone else's well-run computer right
5:31and that's the thing I think people
5:32don't like I joke about that too it is
5:34someone else's computer but it's a best
5:36practice it's like a we are figuring out
5:38those best practices as a community yeah
5:40absolutely absolutely uh you mentioned
5:43one of the things you when you were
5:44talking about like listing out the kind
5:45of the pipeline of all the things for
5:47regular Joe's and Janes like myself that
5:49have like maybe a small business like
5:51this podcast I've got the website I've
5:54got to build in GitHub actions you know
5:56I call it I keep calling it a build
5:57server my devops is effectively I check
5:59it into gith Hub and Magic pops out the
6:01other end that's kind of as
6:02sophisticated as it gets but you
6:04mentioned things like governance and
6:06security and like the supply chain
6:09should a regular developer like me a
6:11regular Joe or Jane be thinking about
6:13that level of complexity within their
6:15own devops pipelines I mean you're
6:17asking the security person this question
6:19so I'm probably gonna say yes to some
6:21degree I think the important part here
6:23is that it's it's just only after the
6:26core things are done so you know for the
6:29folks out there I've mentioned this
6:30before like don't don't ever Skip Leg
6:32Day like I think for me that kind of
6:34core thing in the security translation
6:36is things like TFA is making sure the
6:39account is secure making sure that
6:41things like we don't have storage
6:44accounts that are open to the internet
6:46and things like that I think once all
6:47those things are done for the average
6:49developer then like leaning into some of
6:51the capabilities that you know for
6:52instance on GitHub um a lot of our
6:54GitHub Advanced security capabilities
6:56like dependabot and code scanning and
6:58secret detection are all available for
7:00free for public repos and so I think
7:02those are things that folks should turn
7:03on but for us when we think about
7:05security kind of for the product and for
7:07the community we always start with a
7:09developer account and that's why over
7:11the last 18 months or so we've kind of
7:13worked through a campaign to turn on
7:16tofa for all the contributors on GitHub
7:19which was a huge effort to basically say
7:21like no this isn't optional anymore if
7:23you're contributing actively on GitHub
7:25you have to turn on tofa and that's
7:27that's why because we just see too many
7:29things start with password spraying or a
7:31breach or a credential leak yeah I 100%
7:34all in on tofa and you know I use things
7:36like aie but then I worry like it's
7:39becoming centralized like ay just for
7:41example is pulling their desktop app
7:43which makes sense I probably shouldn't
7:45be too aeing with the thing that I'm
7:47have in front of me I should have
7:48another Factor but I'm was like oh man
7:51like are they just going to stop caring
7:52about that this all these authenticator
7:55and then of course the sheet that we're
7:56supposed to print out that no one prints
7:58out of their backup tokens I'm sure that
8:00there's a lot of really freaked out
8:01people who will lose access to stuff at
8:03GitHub if they don't print out their
8:04backup keys yeah I think this is where
8:06I'm excited about pass keys and some of
8:09the innovations that are happening there
8:11where some of the ma major companies and
8:13and we were actually involved to a
8:14certain degree and in some of the Pas
8:16key establishment are getting together
8:18to pull the standardized way of doing
8:20this together and you could argue that
8:22there's maybe like more secure ways like
8:23UB keys and you know Biometrics and
8:25things like that but as a step forward
8:27from username passwords and
8:30when it can be stored in a centralized
8:32way that's secure I think I think it's a
8:34great progression uh that we're excited
8:36about at GitHub yeah you know you
8:38mention UB keys and I'm sitting here and
8:39I just picked my I'm holding up my
8:41GitHub UB key that was mailed to me that
8:44I never really used because it didn't
8:46fit into my lifestyle and I know that
8:48there are people who are so excited
8:49about that level that kind of security
8:51but it just never worked for me then
8:53there was usba and C one of them's a one
8:55of them C and I just got tired and now
8:57it sits here unused which means that I'm
8:59somehow a bad security person now oh
9:02definitely not I don't I think my UB key
9:04is sitting in my bag somewhere but
9:06because I've got all the pass keys
9:07turned on and pH and and you know Touch
9:10ID and so that's how I operate every day
9:13so same security just don't have to find
9:15my UB key and that's the thing right
9:17security has to fit into our lifestyles
9:19right if it is if it is inconvenient
9:21enough then we're just not going to use
9:23it at all yeah that's right we have to
9:24make it work for users and that's partly
9:26why even though we're requiring tofa for
9:28contributors on GitHub we're not
9:29requiring you know UB keys or pass keys
9:31or anything like that because the
9:33diversity of the population that uses
9:35GitHub for open source is huge and not
9:38everybody has access to a mobile phone
9:41or modern tech and can afford things
9:43like that and so we want to balance
9:44security here with the accessibility and
9:47and equitability for our user base yeah
9:50I appreciate that you called that out by
9:52the way like equitability like even the
9:54pricing is modest you know GitHub Pros
9:56like four bucks and you know for a time
9:58there when before private repositories
10:00uh were free it was like seven bucks I
10:02mean it's not big money to support your
10:05small projects yeah agreed and I think
10:07you know we're still one of the few
10:09larger SAS providers uh in this realm
10:13that offer free compute as well so free
10:14actions minutes and free code spaces
10:17minutes and things like that and
10:18particularly for universities they they
10:20get an even you know more attractive
10:22kind of onboarding package there which
10:24is intentional right we want to support
10:26the educational use cases but it it's
10:28great it's a great way to get started
10:29isn't that attractive to bad guys though
10:31like the second you say free compute
10:33then someone's going to go and start
10:34mining Bitcoin or doing something
10:35naughty and as an organization that is a
10:39giant CMS you're not only shipping
10:42binaries but you're potentially building
10:44binaries that could be evil and then
10:45helping distribute them are people
10:47abusing releases are people abusing raw.
10:50whatever GitHub CDN and and using it and
10:53are you constantly just slapping people
10:54down for doing those kind of things yeah
10:57it's actually a huge huge challenge for
10:59the platform with 100 million developers
11:02using the platform and a massive amount
11:04of compute there is a lot of folks who
11:07are trying to use this for nefarious
11:08purposes so we have uh in the security
11:11team actually uh inside GitHub we have a
11:13counter abuse team and they are building
11:15machine learning pipelines Auto
11:17detections they're working very closely
11:19with support and trust and safety to as
11:22much as possible automate remediate and
11:24kind of shut down both spam and abuse
11:28but also things like you know crypto
11:30Mining and also things like hosting
11:33binaries or content that don't meet our
11:35terms of service yeah it's definitely a
11:38challenging both engineering and scale
11:40problem across the board so GitHub
11:42Advanced security is a is a product or
11:45collection of products it's the name for
11:47looks like you've got a friend there in
11:48the background I can hear do sorry about
11:51that no it's fine that's the kind of
11:53security that we're looking for though
11:54at the company and then someone you'll I
11:56assume that there's a bark that you'll
11:58hear that is the I need to get up bark
12:00because there's a bad guy versus the I
12:02see a squirrel bark unfortunately
12:05they're exactly the same also friend
12:07bark is the exact same so they not not
12:09effective as a security tool you may uh
12:13we have my I don't have a dog but my my
12:15niece does absolutely useless as a
12:18security well she's like oh it'll warn
12:19me if no it won't no it won't it will
12:21let them in and introduce and like bring
12:23them over you know you see those Tik
12:26toks with like the giant German Shepherd
12:28and then like the delivery guy comes in
12:30like how you doing yeah indeed that is
12:33exactly my dog I was going to ask about
12:36GitHub Advanced security and understand
12:38like is it a product is it a collection
12:39of products so get up Advanced security
12:42is a couple things so one for kind of
12:44our Enterprise customers it's a product
12:47that can be purchased that includes code
12:50scanning which is our SAS capability
12:52based on code ql it includes kind of our
12:55supply chain capabilities which is
12:56largely kind of dependabot and
12:58dependency scanning and then secret
13:00scanning which includes push protection
13:02we just recently announced that this is
13:04all being augmented by AI as well so
13:06code scanning now comes with things like
13:09autofix so suggestions so instead of
13:11just like highlighting the potential
13:12vulnerability in the code and saying hey
13:14developer you should remediate this it's
13:16coming with an actual suggestion in the
13:18pull request to say like oh and here's
13:20how we think you should remediate this
13:21you can just click accept and move on
13:23from there and then in the secret
13:24scanning space we're using AI to not
13:27just detect high confidence patterns
13:29which is kind of where we've been to
13:31date you know things like Azure tokens
13:33or AWS tokens or things like that but
13:35also lower confidence patterns like
13:37username and passwords or SSH keys or
13:39RSA keys so um that's kind of the full
13:42kind of get up Advanced Security package
13:44most of that is also available for free
13:46on public repos on GitHub you know and I
13:49I have to admit I have abused all of
13:51those things like if there's a free
13:52thing on a public repo I turn it on and
13:54like dependabot I could just gush I
13:56could do a whole show on dependabot you
13:58know people don't realize how good it is
14:00because it's not on by default right you
14:03get the vulnerability dependencies is on
14:04by default but if you're an admin on a
14:06public repository you just go and you
14:08check and you turn it on and then you
14:10get dep pendot and it's like an employee
14:12that makes poll requests while you sleep
14:15and it's it's amazing I I I gush about
14:18how awesome dep pendot is yeah it's
14:20really fantastic and then we're seeing
14:22just a huge I mean secret scanning is a
14:24newer capability for us but that
14:26combined with push protection we're just
14:27seeing some incredible things happening
14:29I mean I'll just give you an example
14:30inside of GitHub we've really worked to
14:34you know reduce and eliminate secrets
14:35and code in our own codebase using get
14:38up Advanced security and being able to
14:40keep it eliminated with push protection
14:42so that nothing's getting in there after
14:44we've cleaned everything up is just an
14:45absolutely amazing capability but you
14:48know being able to offer that for public
14:49repos is critical because you know it's
14:52not a cheap thing for us to do from an
14:54infrastructure perspective but it's the
14:55right thing to do because we take that
14:57responsibility kind of at the center of
14:59a lot of the software development
15:00ecosystem very seriously yeah and this
15:02push protection we should explain that a
15:04little bit because like one of the
15:05number one questions on stack Overflow
15:08like the top questions is I've pushed a
15:11secret into GitHub I pushed a connection
15:13string how do I make it go away yeah I
15:16mean that's also one of the number one
15:18questions we talk to customers about a
15:20lot as well because it's once it's in
15:22it's in right it's super expensive to
15:24remediate it's super difficult to know
15:26it's good and from and if you talk to
15:28any security team they're going to say
15:29well like once it's there you got to you
15:31have to deactivate it you have to roll
15:32it you got to change the credential and
15:34so push protection basically sits in
15:36between the editor and the GitHub
15:39service itself and inspects you know
15:42it's secure it's encrypted but it
15:44inspects what's coming in looking for
15:46credential secrets in the code before it
15:49actually goes into the get system itself
15:51and if it finds anything it'll block it
15:53and then there's options depending on
15:55what you're doing you come back to the
15:56developer and say do you want to
15:57override this or you know Enterprises
16:00have the ability to adjust some of the
16:01responses there as well so it's a pretty
16:03powerful tool yeah and it it really this
16:05this idea of these these sass these
16:07shared access security tokens and their
16:10potential vulnerabilities it's just it's
16:12a magic number and if somebody gets it
16:15they own you and the amount of like
16:17responsibility that can be assigned to
16:19one of these tokens that is just easily
16:21copy pasted and given to someone is huge
16:23and I understand I saw some stuff cuz I
16:25work at Microsoft in my day job this is
16:27all public there was some nation state
16:29actor that got a hold of some tokens and
16:31was running around on some you know
16:33non-production build servers recently
16:35and it all starts with those freaking
16:37tokens that you could paste to someone
16:39in a slack so you're going to want to
16:41catch those so it makes me wonder though
16:43as devs how can we have them without
16:45ever seeing them like I don't want it in
16:48my clipboard because once it gets into
16:49my clipboard it could be given it could
16:50be moved away is there a way to have
16:52secrets that we simply can't see that
16:55wouldn't even show up in GitHub it's a
16:57great question you know and I think when
16:59I think about the proactive security
17:01space and kind of all the advances that
17:02are happening I think this is an area
17:04that a lot of Enterprises work towards
17:06through things like Enterprise vaults
17:09and kind of accessing these secrets on
17:10demand through apis which is probably
17:13that's one of the right ways to do it I
17:14won't say it's the only right way to do
17:16it but you know having that accessible
17:18to a normal Dev is more of a challenge I
17:20think because it's just it's so easy
17:22just to go grab that token and toss it
17:24in the repo and keep moving to deploy
17:27the blog or do whatever so I think this
17:29is where normalizing things like secret
17:31scanning and normalizing and making it
17:33clear where to put secrets in places
17:36like GitHub or you know Cloud compute
17:38like Azure is helping but we can still
17:42do more I think as a community here yeah
17:44I like the the call out of like
17:46normalizing it like right now when I
17:48start a new project it usually ends up
17:50in some Json file and that's just wrong
17:52that should be it's wrong by default and
17:55it should be right by default and I need
17:56to like get that into my head so that it
17:58is normal and of course GitHub will
18:00catch me 99.9% of the time or as you
18:03said it'll warn you and say are you sure
18:05you want to do this this this token's
18:07used for testing but even then I
18:09shouldn't push it through I should do it
18:11correctly from from the beginning yeah
18:13agreed and you know for like that normal
18:15Dev out there at a minimum storing it as
18:18part of the secret management capability
18:20inside GitHub is a good first step I
18:22think once you start to scale that
18:23though there's probably more
18:25sophisticated ways to share that across
18:26an Enterprise team so I want to also
18:28talk about the the Third Leg of that
18:30stool we talked about secret scanning
18:32independent bot but then code ql it's
18:34this code analysis tool and it'll
18:36analyze your code it'll give you quality
18:38uh but it's really becoming a security
18:40tool like it's spotting like bad
18:42practices but you have to do this across
18:44a plurality of languages right like
18:46there's all kinds of you you could be
18:47doing llang you could be doing rust you
18:49could be doing C code ql has to manage
18:51all of that it does it does indeed and
18:54we have we have an amazing team who is
18:56building essentially language models for
18:58each one one of the languages we support
19:00and continue to evolve them and it's not
19:01just a once andone build either because
19:04as you know these languages evolve all
19:06the time there's new releases there's
19:07new versions of python coming out you
19:09know constantly and so how do we keep up
19:11with that I think there's there's kind
19:12of two angles here one is how does the
19:15team continue to model and create what
19:17is considered a vulnerability we
19:19approach this a few different ways one
19:21is we actually have researchers inside
19:24of GitHub who are doing vulnerability
19:26research on open source projects and
19:28they are actively contributing what
19:30they're learning back into the cql base
19:32which then is then made available to all
19:34of our customers and open source users
19:36typical devs all the way to you know big
19:39Enterprises and then we have started to
19:42use AI to help automodel languages
19:44faster and open source projects that are
19:47widely used so that we can actually
19:49increase the rate that we are modeling
19:52and supporting new capabilities in that
19:54program now I was picking random
19:56languages but I do want to come and to
19:58give a brief brief correction I ran I
19:59called out rust and llang which are you
20:01know I thought about them a little bit
20:03more on the far side of the bell curve
20:04there but those are not supported you
20:06have cess plus C go cotlin is in beta
20:09you've got Swift in beta which is pretty
20:11cool python Ruby you know what I'm
20:13struck by with this list is you've got
20:15both compiled and interpreted languages
20:17which are two different universes that
20:19you're going to have to treat as if
20:20they're the same but they're very
20:22different they're really different in
20:23terms of how we approach it the team's
20:25making some incredible progress to be
20:28able to tackle even the compiled
20:30languages in uh faster and I'll just say
20:33like easier to set up ways because right
20:35now you often have to like integrated
20:37into the build uh as you're thinking
20:39about like a Java build the goal here is
20:41to really make this easy to turn on easy
20:43to use and and kind of easy to get to
20:45that first meaningful alert that moves
20:48the needle on the security here and
20:50they're making a ton of progress on that
20:52so I'm I'm excited to see where we're
20:53headed as a as a a program there the
20:56amount of like work happening to to just
20:59push a hello world like the back behind
21:01the scenes work must be insane you were
21:03talking about free compute like if I go
21:05and make hello.c and I check it in for
21:08me it happens instantly I see the file I
21:10can set up a GitHub actions I can make a
21:12release executable pops out and then I
21:15can start hitting raw. whatever whatever
21:16and I can start DR I can curl it
21:18immediately but behind the scenes you've
21:21run code ql you've scan for viruses like
21:23there's a whole bunch of compute that
21:25happen and you did that on a public
21:26repository is this going to be
21:28sustainable you just make it more
21:30efficient I don't understand how that's
21:31going to be something that'll be around
21:33in 10 years but it needs to be it's a
21:35good question I think some of it's about
21:37the efficiency and I think some of it is
21:38about the fact and and this is one of
21:40the things I love about GitHub is that
21:43you know the leadership and the company
21:45generally values this community and
21:48values the work we're doing here and is
21:50investing in that as well and so I think
21:52you know it's not necessarily a question
21:54of like can we make this cheaper to to
21:56run or not for public repos it's like
21:58how do we do it is is it scalable at all
22:01you know period for some of the
22:02capabilities and I think it gets a
22:03little harder when we talk about GPU
22:05bound AI features but generally you know
22:08it's an important part of what we're
22:09doing as a company and as a business to
22:12support the open source community and
22:13continue to lean into that
22:15responsibility so kind of over all of
22:18this like looming over all of this is
22:20GitHub co-pilot which is generating code
22:23there's a large language model at its
22:24base but large language models are tuned
22:27for different stuff some are good at
22:29generating Shakespeare and limeric and
22:30some are good at generating code but
22:32some are just confident bsers how do I
22:36know that co-pilot or some code language
22:38model is not going to go and generate
22:39insecure code and then run it down my
22:42pipeline my security pipeline sure so
22:45kind of starting at the the left side of
22:47this the models we're using are very
22:49much focused and tuned towards software
22:52development and the way we're
22:54incorporating those and so we're going
22:55to continue to work on what's the right
22:58model to use for the right situations
22:59here and that will evolve as the product
23:01evolves as well but then kind of if you
23:03move a little bit to the right then we
23:05are working with uh Microsoft and we've
23:09got our own filters in place as well
23:11that we've partnered with Microsoft on
23:12that do things like security filtering
23:14and toxicity filtering so they're
23:16looking for common MySQL injection
23:19vulnerabilities and are going to prevent
23:21those from even being suggested to
23:23developers before they even get there
23:25now this is early days and I think this
23:27is going to continue evolve and I'm
23:29really excited actually to see over time
23:31if we see fewer and fewer
23:33vulnerabilities introduced in the editor
23:35to begin with because actually think we
23:37are we're already seeing that now but
23:39you know I think getting these filters
23:40getting the tuning necessary after the
23:43suggestions to make sure it's relevant
23:45to the context of what the developer
23:47doing what they're trying to do what
23:48question they asked is something we're
23:50very focused on and then you know we
23:52always say even though these suggestions
23:54are good and we're seeing huge
23:56acceptance rates here it's it's a
23:57co-pilot so you should still run
23:59Advanced security you should still check
24:00the code you should still make sure your
24:02builds work and do all your normal tests
24:04as you would normally I appreciate the
24:07call out about the idea of context I use
24:09that in my talks about not just co-pilot
24:11but AI in general is that if you you
24:13know if you walk up to someone and you
24:15say that they're going to like I joke
24:16about this my wife and I we finish each
24:19other's sandwiches you know that's like
24:21maybe it's context that we have because
24:23we've been married for 25 years but when
24:25you say to GitHub co-pilot hey write me
24:27a for Loop how much context is
24:29appropriate does it need to know what I
24:31wrote last week does it need to know
24:33what I wrote earlier today or can it
24:35produce what I need it to produce now
24:38maybe it doesn't know that I'm in the
24:39middle of red teaming or maybe it
24:41doesn't know I'm in the middle of
24:42whatever context that get up co-pilot
24:44knows can get into an uncanny valley of
24:46creepiness where I might feel
24:48uncomfortable that the AI knows stuff
24:51but if it's permissive and it says
24:53follow-up questions like I don't know
24:56not like clippy but you know what I mean
24:57like looks like you're doing some
24:58naughty things with red teaming would
25:00you like help versus it looks like
25:02you're really focused on security and
25:03you want your code to be extra secure
25:05how much context should co-pilot have
25:08when it's trying to help me sure I think
25:10you know this is something we we talk to
25:12customers about and I know our product
25:13and Engineering teams are are really
25:15focused on as well and I think some of
25:17this is going to come down to where in
25:19the product and where in the workflow
25:20that the developers engaging AI as it is
25:23and so you know the context going into
25:26co-pilot GitHub co-pilot from Auto
25:28completion maybe open files in the
25:31editor that they're working on now but
25:33if they've got chat GitHub co-pilot chat
25:35up as well and they're asking questions
25:38then that can tune and help it
25:40understand a bit more and so as we kind
25:42of are building GitHub co-pilot into
25:44more and more of the GitHub platform in
25:46terms of enabling developer productivity
25:48and to end I think we're going to
25:50hopefully see that be more evident to
25:53developers where it's getting it and how
25:56it's helping them be more productive I
25:58like that the evident part like I don't
26:00want magic I want code ql or dependabot
26:04or any number of these tools in GitHub
26:06Advanced security and my pipeline to let
26:08me know hey I found a thing here's why I
26:11think it's a thing and here's what I
26:12think you should do about it like don't
26:14just say this is a problem tell me why
26:16you figured it out so then I can learn
26:18and be better myself sure yeah no I
26:21totally agree and I think you know when
26:23I will pull up co-pilot chat and start
26:25asking questions I that's one of my
26:27favorite Parts about it actually is it's
26:28explaining to me here's what we're
26:30suggesting here's why hey this is
26:32vulnerable hey if you want to read more
26:33about why it's vulnerable go click this
26:34link and it just honestly it's a much
26:37richer experience than going to a search
26:40engine and trying to find help for the
26:42thing I'm trying to do and it's also way
26:45way faster I was editing a jupyter
26:47notebook the other day to like analyze
26:49some data for the teams and I needed to
26:51make some changes to it and I wasn't
26:53super familiar with the language and I
26:54was like H this is going to take me
26:56hours I'm not even going to bother with
26:57this and and I was like oh wait actually
26:59let me fire up co-pilot and see what I
27:00can do I had it fixed in like five
27:02minutes it did exactly what I wanted it
27:04to do and I understand why it did it and
27:07that was just a a fun thing for me given
27:09that I don't really develop every day
27:10anymore in my day job you know it's it's
27:12interesting that you call that out
27:13though because you you know that idea
27:15that there are co-workers or relatives
27:16who are really good googlers you know
27:18I'll have like non-technical relative
27:20try to Google for something and they'll
27:21just keep banging their head against the
27:22wall and then I just I'll notice like
27:24you used Too Many Words use less and
27:27then I'll find it on the first try or
27:29there's a particular term hopefully
27:31co-pilot and AIS will equalize that more
27:34so that everyone will get the answer
27:35that they want because what happens now
27:37is my non-technical relative will be
27:38like oh you're just a really good
27:39googler it's like well no you know I
27:42want I want to teach you how to be able
27:43to do that but I noticed that their
27:45solution is to Simply restart and try
27:47again yeah like give up on the query and
27:50phrase it differently but with with with
27:52a with an AI or with a co-pilot I don't
27:55just give up and start a new
27:56conversation I try to refine it I think
27:59that's a skill we're going to have to
28:00teach our non-technical Brethren I agree
28:03I also think at least to me it feels
28:05more intuitive to do that with an AI
28:07co-pilot I mean just being able to have
28:09that context we were talking about a few
28:11minutes ago that it's already got it
28:12already sort of knows roughly what I'm
28:14trying to do or at least what I'm seeing
28:16on my screen to a certain degree and say
28:18like hey can you explain this file to me
28:20I don't have to tell it which file it is
28:22or can you help me rewrite this file
28:24from cobal to python there's things like
28:27that where if I went and Googled that it
28:29would take me hours and hours and hours
28:31to figure out roughly the same thing
28:33because I would have to keep doing that
28:34iterative thing and even though I'm not
28:36quite as good of a googler as my wife is
28:38I'm still fair at it very cool well I
28:41think that our in conclusion what I'm
28:43hearing is I need to make sure that I've
28:44got Advanced security turned on on all
28:47of my repositories which I can do if I'm
28:49an admin on a public repository I can
28:51turn these on and that'll give me
28:52dependabot which I already love a code
28:54ql which I can use and if I interact
28:56with it I will get nothing with good
28:58stuff and then secret scanning and push
29:00protection is going to be fantastic as
29:02well this is all combined within the
29:04context of GitHub advaned security this
29:06is pretty cool stuff Jacob thanks for
29:08hanging out with me today thanks so much
29:09for having me enjoy chatting we've been
29:12chatting with Jacob the priest he's a
29:13deputy chief security officer at GitHub
29:16this has been another episode of Hansel
29:17minutes and we'll see you again next
29:20[Music]
29:27week
29:32[Music]
29:39n