Github Advanced Security with Jacob DePriest

[Music] [Music] hey friends I'm Scott hansome and this hey friends I'm Scott hansome and this hey friends I'm Scott hansome and this is another episode of Hansel minutes is another episode of Hansel minutes is another episode of Hansel minutes today I'm chatting with Jacob De priest today I'm chatting with Jacob De priest today I'm chatting with Jacob De priest he's the deputy chief security officer he's the deputy chief security officer he's the deputy chief security officer at GitHub how are you sir I'm doing well at GitHub how are you sir I'm doing well at GitHub how are you sir I'm doing well thanks for having me today so uh you thanks for having me today so uh you thanks for having me today so uh you know I always look at people's LinkedIn know I always look at people's LinkedIn know I always look at people's LinkedIn which is the standard thing you do when which is the standard thing you do when which is the standard thing you do when you fill up 47 tabs with questions for you fill up 47 tabs with questions for you fill up 47 tabs with questions for an interiew you like this and not an interiew you like this and not an interiew you like this and not everyone when you scroll on their everyone when you scroll on their everyone when you scroll on their LinkedIn uh spent 15 years at the NSA of LinkedIn uh spent 15 years at the NSA of LinkedIn uh spent 15 years at the NSA of all the three-letter acronym agencies all the three-letter acronym agencies all the three-letter acronym agencies that is the one that I have the most that is the one that I have the most that is the one that I have the most mysterious and shrouded in mystery how mysterious and shrouded in mystery how mysterious and shrouded in mystery how was that experience it was great I did a was that experience it was great I did a was that experience it was great I did a bunch of different things there uh over bunch of different things there uh over bunch of different things there uh over the years from software defined radio to the years from software defined radio to the years from software defined radio to digging into open source and devx digging into open source and devx digging into open source and devx projects and even running some kind of projects and even running some kind of projects and even running some kind of large scale it and security projects I large scale it and security projects I large scale it and security projects I think the fun thing about my time there think the fun thing about my time there think the fun thing about my time there particularly at the end is I actually particularly at the end is I actually particularly at the end is I actually pivoted and was more open and was pivoted and was more open and was pivoted and was more open and was working on open source activities and working on open source activities and working on open source activities and partnering with other agencies and partnering with other agencies and partnering with other agencies and trying to figure out how to help trying to figure out how to help trying to figure out how to help developers get more active in the open developers get more active in the open developers get more active in the open source Community from contributions and source Community from contributions and source Community from contributions and releasing projects and so uh it gave me releasing projects and so uh it gave me releasing projects and so uh it gave me an opportunity to be a less mysterious an opportunity to be a less mysterious an opportunity to be a less mysterious face on behalf of the agency yeah you face on behalf of the agency yeah you face on behalf of the agency yeah you were the like the senior OSS evangelist were the like the senior OSS evangelist were the like the senior OSS evangelist and I'm trying to get my head around how and I'm trying to get my head around how and I'm trying to get my head around how you would even pull that off I mean I you would even pull that off I mean I you would even pull that off I mean I just assume if you worked for a just assume if you worked for a just assume if you worked for a three-letter acronym agency then you three-letter acronym agency then you three-letter acronym agency then you would just not even tell your neighbors would just not even tell your neighbors would just not even tell your neighbors right like we we see the TV shows what right like we we see the TV shows what right like we we see the TV shows what do you do I work for the government do you do I work for the government do you do I work for the government that's all I can tell you but you're that's all I can tell you but you're that's all I can tell you but you're like no I'm evangelizing open source for like no I'm evangelizing open source for like no I'm evangelizing open source for the NSA how did you connect the two yeah the NSA how did you connect the two yeah the NSA how did you connect the two yeah I mean I think it starts uh as many of

I mean I think it starts uh as many of I mean I think it starts uh as many of our stories do of just following a our stories do of just following a our stories do of just following a passion following an interest we're passion following an interest we're passion following an interest we're working on a project and we thought it working on a project and we thought it working on a project and we thought it would be great to open source it because would be great to open source it because would be great to open source it because we wanted to partner with universities we wanted to partner with universities we wanted to partner with universities in the military and other places that in the military and other places that in the military and other places that didn't necessarily have access to the didn't necessarily have access to the didn't necessarily have access to the internal networks we were working on and internal networks we were working on and internal networks we were working on and uh that you know spun uh that you know spun uh that you know spun 18mon effort to release a million lines 18mon effort to release a million lines 18mon effort to release a million lines of code and I learned a lot in that of code and I learned a lot in that of code and I learned a lot in that process and wanted to make it better for process and wanted to make it better for process and wanted to make it better for other developers and so really just kind other developers and so really just kind other developers and so really just kind of leaned into that and spent some time of leaned into that and spent some time of leaned into that and spent some time looking into it and talking to folks and looking into it and talking to folks and looking into it and talking to folks and figuring out how we do more of it you figuring out how we do more of it you figuring out how we do more of it you know so what's cool about that is that know so what's cool about that is that know so what's cool about that is that it fits nicely into why you would come it fits nicely into why you would come it fits nicely into why you would come to GitHub like you basically became so to GitHub like you basically became so to GitHub like you basically became so open and so into open source that that open and so into open source that that open and so into open source that that passion LED you into doing open source passion LED you into doing open source passion LED you into doing open source of GitHub yeah exactly I couldn't think of GitHub yeah exactly I couldn't think of GitHub yeah exactly I couldn't think of a better place to come after my time of a better place to come after my time of a better place to come after my time in the federal government and the fun in the federal government and the fun in the federal government and the fun thing is too and some of the other thing is too and some of the other thing is too and some of the other things that I was involved in at the things that I was involved in at the things that I was involved in at the agency I really got to understand and agency I really got to understand and agency I really got to understand and think about risk at very high levels uh think about risk at very high levels uh think about risk at very high levels uh as it may impact Nations or you know as it may impact Nations or you know as it may impact Nations or you know critical infrastructure and things like critical infrastructure and things like critical infrastructure and things like that and so combining the leadership that and so combining the leadership that and so combining the leadership training and the risk training I got at training and the risk training I got at training and the risk training I got at the feet of some very amazing leaders the feet of some very amazing leaders the feet of some very amazing leaders there with my open source passion uh there with my open source passion uh there with my open source passion uh working on security GitHub has been a working on security GitHub has been a working on security GitHub has been a really great and natural next step for really great and natural next step for really great and natural next step for me and I think actually we may not have me and I think actually we may not have me and I think actually we may not have met in person but we were both I think met in person but we were both I think met in person but we were both I think think at all things open in 2020 in think at all things open in 2020 in think at all things open in 2020 in North Carolina yeah and you were talking North Carolina yeah and you were talking North Carolina yeah and you were talking about devops so where is devops fit into about devops so where is devops fit into about devops so where is devops fit into your life like I know that the name your life like I know that the name your life like I know that the name devops is itself knew you know we used devops is itself knew you know we used devops is itself knew you know we used to call them build servers or sdlc but to call them build servers or sdlc but to call them build servers or sdlc but now it's like devops is baked into the

now it's like devops is baked into the now it's like devops is baked into the Zeitgeist uh when did open source and Zeitgeist uh when did open source and Zeitgeist uh when did open source and devops kind of merge for you it was devops kind of merge for you it was devops kind of merge for you it was again one of those natural progressions again one of those natural progressions again one of those natural progressions where I was working on open source and where I was working on open source and where I was working on open source and the processes and legalities of how to the processes and legalities of how to the processes and legalities of how to do that better inside a federal agency do that better inside a federal agency do that better inside a federal agency and it became evident that that was only and it became evident that that was only and it became evident that that was only one piece of the puzzle and so without a one piece of the puzzle and so without a one piece of the puzzle and so without a consistent developer experience platform consistent developer experience platform consistent developer experience platform for the developers inside the agency the for the developers inside the agency the for the developers inside the agency the open source piece was more difficult to open source piece was more difficult to open source piece was more difficult to achieve and so a group of us actually achieve and so a group of us actually achieve and so a group of us actually two or three of us got together and two or three of us got together and two or three of us got together and essentially kind of did a a startup essentially kind of did a a startup essentially kind of did a a startup inside the government we put a pitch inside the government we put a pitch inside the government we put a pitch deck together we got funding we put all deck together we got funding we put all deck together we got funding we put all the the kind of like pros and cons the the kind of like pros and cons the the kind of like pros and cons together and we started a program called together and we started a program called together and we started a program called devx that uh ended up kind of being devx that uh ended up kind of being devx that uh ended up kind of being responsible for all the the devops responsible for all the the devops responsible for all the the devops pipeline developer security pipeline developer security pipeline developer security collaboration tools and kind of all the collaboration tools and kind of all the collaboration tools and kind of all the things that you would need to be things that you would need to be things that you would need to be successful for an agency of 40,000 plus successful for an agency of 40,000 plus successful for an agency of 40,000 plus folks is it fair to say that even in folks is it fair to say that even in folks is it fair to say that even in 2024 like there are companies that are 2024 like there are companies that are 2024 like there are companies that are just probably building on someone's just probably building on someone's just probably building on someone's laptop and then don't have any kind of laptop and then don't have any kind of laptop and then don't have any kind of mature devop build server even Dev SEC mature devop build server even Dev SEC mature devop build server even Dev SEC Ops kind of a practice within their Ops kind of a practice within their Ops kind of a practice within their organizations I think that's true I organizations I think that's true I organizations I think that's true I think we also see a lot of fragmented think we also see a lot of fragmented think we also see a lot of fragmented approaches where there's 10 or 20 approaches where there's 10 or 20 approaches where there's 10 or 20 instances of get servers and things are instances of get servers and things are instances of get servers and things are under people's desks and codes spread under people's desks and codes spread under people's desks and codes spread around Enterprises and they're not around Enterprises and they're not around Enterprises and they're not getting the benefits of sort of the getting the benefits of sort of the getting the benefits of sort of the central collaboration tooling and central collaboration tooling and central collaboration tooling and security honestly that comes with some security honestly that comes with some security honestly that comes with some of the things that you can do when you of the things that you can do when you of the things that you can do when you pull those things together and take the pull those things together and take the pull those things together and take the burden off of individual developers yeah

burden off of individual developers yeah burden off of individual developers yeah the the under someone's desk like the the under someone's desk like the the under someone's desk like totally resonates with me like there's totally resonates with me like there's totally resonates with me like there's so many times this a story that I tell a so many times this a story that I tell a so many times this a story that I tell a lot but like long story short my blog I lot but like long story short my blog I lot but like long story short my blog I thought was a virtual machine for many thought was a virtual machine for many thought was a virtual machine for many years years years and then when it finally died and I and then when it finally died and I and then when it finally died and I called support it turns out they had called support it turns out they had called support it turns out they had never moved it into a VM it had always never moved it into a VM it had always never moved it into a VM it had always been under someone's desk it was been under someone's desk it was been under someone's desk it was literally like a mini tower under literally like a mini tower under literally like a mini tower under someone's desk and they were like well someone's desk and they were like well someone's desk and they were like well you know we're getting around to it it you know we're getting around to it it you know we're getting around to it it was like a Hoster surface they never was like a Hoster surface they never was like a Hoster surface they never imaged it they never backed it up so I imaged it they never backed it up so I imaged it they never backed it up so I ftpd in did a frantic backup and you ftpd in did a frantic backup and you ftpd in did a frantic backup and you know the little spinning hard drive know the little spinning hard drive know the little spinning hard drive finally just pooped out at the end but I finally just pooped out at the end but I finally just pooped out at the end but I I can visualize it under someone's desk I can visualize it under someone's desk I can visualize it under someone's desk never been more true that the cloud is never been more true that the cloud is never been more true that the cloud is just someone else's computer then but is just someone else's computer then but is just someone else's computer then but is someone else's well-run computer right someone else's well-run computer right someone else's well-run computer right and that's the thing I think people and that's the thing I think people and that's the thing I think people don't like I joke about that too it is don't like I joke about that too it is don't like I joke about that too it is someone else's computer but it's a best someone else's computer but it's a best someone else's computer but it's a best practice it's like a we are figuring out practice it's like a we are figuring out practice it's like a we are figuring out those best practices as a community yeah those best practices as a community yeah those best practices as a community yeah absolutely absolutely uh you mentioned absolutely absolutely uh you mentioned absolutely absolutely uh you mentioned one of the things you when you were one of the things you when you were one of the things you when you were talking about like listing out the kind talking about like listing out the kind talking about like listing out the kind of the pipeline of all the things for of the pipeline of all the things for of the pipeline of all the things for regular Joe's and Janes like myself that regular Joe's and Janes like myself that regular Joe's and Janes like myself that have like maybe a small business like have like maybe a small business like have like maybe a small business like this podcast I've got the website I've this podcast I've got the website I've this podcast I've got the website I've got to build in GitHub actions you know got to build in GitHub actions you know got to build in GitHub actions you know I call it I keep calling it a build I call it I keep calling it a build I call it I keep calling it a build server my devops is effectively I check server my devops is effectively I check server my devops is effectively I check it into gith Hub and Magic pops out the it into gith Hub and Magic pops out the it into gith Hub and Magic pops out the other end that's kind of as other end that's kind of as other end that's kind of as sophisticated as it gets but you sophisticated as it gets but you sophisticated as it gets but you mentioned things like governance and mentioned things like governance and mentioned things like governance and security and like the supply chain security and like the supply chain security and like the supply chain should a regular developer like me a should a regular developer like me a should a regular developer like me a regular Joe or Jane be thinking about regular Joe or Jane be thinking about regular Joe or Jane be thinking about that level of complexity within their that level of complexity within their that level of complexity within their own devops pipelines I mean you're own devops pipelines I mean you're own devops pipelines I mean you're asking the security person this question

asking the security person this question asking the security person this question so I'm probably gonna say yes to some so I'm probably gonna say yes to some so I'm probably gonna say yes to some degree I think the important part here degree I think the important part here degree I think the important part here is that it's it's just only after the is that it's it's just only after the is that it's it's just only after the core things are done so you know for the core things are done so you know for the core things are done so you know for the folks out there I've mentioned this folks out there I've mentioned this folks out there I've mentioned this before like don't don't ever Skip Leg before like don't don't ever Skip Leg before like don't don't ever Skip Leg Day like I think for me that kind of Day like I think for me that kind of Day like I think for me that kind of core thing in the security translation core thing in the security translation core thing in the security translation is things like TFA is making sure the is things like TFA is making sure the is things like TFA is making sure the account is secure making sure that account is secure making sure that account is secure making sure that things like we don't have storage things like we don't have storage things like we don't have storage accounts that are open to the internet accounts that are open to the internet accounts that are open to the internet and things like that I think once all and things like that I think once all and things like that I think once all those things are done for the average those things are done for the average those things are done for the average developer then like leaning into some of developer then like leaning into some of developer then like leaning into some of the capabilities that you know for the capabilities that you know for the capabilities that you know for instance on GitHub um a lot of our instance on GitHub um a lot of our instance on GitHub um a lot of our GitHub Advanced security capabilities GitHub Advanced security capabilities GitHub Advanced security capabilities like dependabot and code scanning and like dependabot and code scanning and like dependabot and code scanning and secret detection are all available for secret detection are all available for secret detection are all available for free for public repos and so I think free for public repos and so I think free for public repos and so I think those are things that folks should turn those are things that folks should turn those are things that folks should turn on but for us when we think about on but for us when we think about on but for us when we think about security kind of for the product and for security kind of for the product and for security kind of for the product and for the community we always start with a the community we always start with a the community we always start with a developer account and that's why over developer account and that's why over developer account and that's why over the last 18 months or so we've kind of the last 18 months or so we've kind of the last 18 months or so we've kind of worked through a campaign to turn on worked through a campaign to turn on worked through a campaign to turn on tofa for all the contributors on GitHub tofa for all the contributors on GitHub tofa for all the contributors on GitHub which was a huge effort to basically say which was a huge effort to basically say which was a huge effort to basically say like no this isn't optional anymore if like no this isn't optional anymore if like no this isn't optional anymore if you're contributing actively on GitHub you're contributing actively on GitHub you're contributing actively on GitHub you have to turn on tofa and that's you have to turn on tofa and that's you have to turn on tofa and that's that's why because we just see too many that's why because we just see too many that's why because we just see too many things start with password spraying or a things start with password spraying or a things start with password spraying or a breach or a credential leak yeah I 100% breach or a credential leak yeah I 100% breach or a credential leak yeah I 100% all in on tofa and you know I use things all in on tofa and you know I use things all in on tofa and you know I use things like aie but then I worry like it's like aie but then I worry like it's like aie but then I worry like it's becoming centralized like ay just for becoming centralized like ay just for becoming centralized like ay just for example is pulling their desktop app example is pulling their desktop app example is pulling their desktop app which makes sense I probably shouldn't which makes sense I probably shouldn't which makes sense I probably shouldn't be too aeing with the thing that I'm be too aeing with the thing that I'm be too aeing with the thing that I'm have in front of me I should have have in front of me I should have have in front of me I should have another Factor but I'm was like oh man

another Factor but I'm was like oh man another Factor but I'm was like oh man like are they just going to stop caring like are they just going to stop caring like are they just going to stop caring about that this all these authenticator about that this all these authenticator about that this all these authenticator and then of course the sheet that we're and then of course the sheet that we're and then of course the sheet that we're supposed to print out that no one prints supposed to print out that no one prints supposed to print out that no one prints out of their backup tokens I'm sure that out of their backup tokens I'm sure that out of their backup tokens I'm sure that there's a lot of really freaked out there's a lot of really freaked out there's a lot of really freaked out people who will lose access to stuff at people who will lose access to stuff at people who will lose access to stuff at GitHub if they don't print out their GitHub if they don't print out their GitHub if they don't print out their backup keys yeah I think this is where backup keys yeah I think this is where backup keys yeah I think this is where I'm excited about pass keys and some of I'm excited about pass keys and some of I'm excited about pass keys and some of the innovations that are happening there the innovations that are happening there the innovations that are happening there where some of the ma major companies and where some of the ma major companies and where some of the ma major companies and and we were actually involved to a and we were actually involved to a and we were actually involved to a certain degree and in some of the Pas certain degree and in some of the Pas certain degree and in some of the Pas key establishment are getting together key establishment are getting together key establishment are getting together to pull the standardized way of doing to pull the standardized way of doing to pull the standardized way of doing this together and you could argue that this together and you could argue that this together and you could argue that there's maybe like more secure ways like there's maybe like more secure ways like there's maybe like more secure ways like UB keys and you know Biometrics and UB keys and you know Biometrics and UB keys and you know Biometrics and things like that but as a step forward things like that but as a step forward things like that but as a step forward from username passwords and from username passwords and from username passwords and when it can be stored in a centralized when it can be stored in a centralized when it can be stored in a centralized way that's secure I think I think it's a way that's secure I think I think it's a way that's secure I think I think it's a great progression uh that we're excited great progression uh that we're excited great progression uh that we're excited about at GitHub yeah you know you about at GitHub yeah you know you about at GitHub yeah you know you mention UB keys and I'm sitting here and mention UB keys and I'm sitting here and mention UB keys and I'm sitting here and I just picked my I'm holding up my I just picked my I'm holding up my I just picked my I'm holding up my GitHub UB key that was mailed to me that GitHub UB key that was mailed to me that GitHub UB key that was mailed to me that I never really used because it didn't I never really used because it didn't I never really used because it didn't fit into my lifestyle and I know that fit into my lifestyle and I know that fit into my lifestyle and I know that there are people who are so excited there are people who are so excited there are people who are so excited about that level that kind of security about that level that kind of security about that level that kind of security but it just never worked for me then but it just never worked for me then but it just never worked for me then there was usba and C one of them's a one there was usba and C one of them's a one there was usba and C one of them's a one of them C and I just got tired and now of them C and I just got tired and now of them C and I just got tired and now it sits here unused which means that I'm it sits here unused which means that I'm it sits here unused which means that I'm somehow a bad security person now oh somehow a bad security person now oh somehow a bad security person now oh definitely not I don't I think my UB key definitely not I don't I think my UB key definitely not I don't I think my UB key is sitting in my bag somewhere but is sitting in my bag somewhere but is sitting in my bag somewhere but because I've got all the pass keys because I've got all the pass keys because I've got all the pass keys turned on and pH and and you know Touch turned on and pH and and you know Touch turned on and pH and and you know Touch ID and so that's how I operate every day ID and so that's how I operate every day ID and so that's how I operate every day so same security just don't have to find so same security just don't have to find so same security just don't have to find my UB key and that's the thing right my UB key and that's the thing right my UB key and that's the thing right security has to fit into our lifestyles security has to fit into our lifestyles security has to fit into our lifestyles right if it is if it is inconvenient

right if it is if it is inconvenient right if it is if it is inconvenient enough then we're just not going to use enough then we're just not going to use enough then we're just not going to use it at all yeah that's right we have to it at all yeah that's right we have to it at all yeah that's right we have to make it work for users and that's partly make it work for users and that's partly make it work for users and that's partly why even though we're requiring tofa for why even though we're requiring tofa for why even though we're requiring tofa for contributors on GitHub we're not contributors on GitHub we're not contributors on GitHub we're not requiring you know UB keys or pass keys requiring you know UB keys or pass keys requiring you know UB keys or pass keys or anything like that because the or anything like that because the or anything like that because the diversity of the population that uses diversity of the population that uses diversity of the population that uses GitHub for open source is huge and not GitHub for open source is huge and not GitHub for open source is huge and not everybody has access to a mobile phone everybody has access to a mobile phone everybody has access to a mobile phone or modern tech and can afford things or modern tech and can afford things or modern tech and can afford things like that and so we want to balance like that and so we want to balance like that and so we want to balance security here with the accessibility and security here with the accessibility and security here with the accessibility and and equitability for our user base yeah and equitability for our user base yeah and equitability for our user base yeah I appreciate that you called that out by I appreciate that you called that out by I appreciate that you called that out by the way like equitability like even the the way like equitability like even the the way like equitability like even the pricing is modest you know GitHub Pros pricing is modest you know GitHub Pros pricing is modest you know GitHub Pros like four bucks and you know for a time like four bucks and you know for a time like four bucks and you know for a time there when before private repositories there when before private repositories there when before private repositories uh were free it was like seven bucks I uh were free it was like seven bucks I uh were free it was like seven bucks I mean it's not big money to support your mean it's not big money to support your mean it's not big money to support your small projects yeah agreed and I think small projects yeah agreed and I think small projects yeah agreed and I think you know we're still one of the few you know we're still one of the few you know we're still one of the few larger SAS providers uh in this realm larger SAS providers uh in this realm larger SAS providers uh in this realm that offer free compute as well so free that offer free compute as well so free that offer free compute as well so free actions minutes and free code spaces actions minutes and free code spaces actions minutes and free code spaces minutes and things like that and minutes and things like that and minutes and things like that and particularly for universities they they particularly for universities they they particularly for universities they they get an even you know more attractive get an even you know more attractive get an even you know more attractive kind of onboarding package there which kind of onboarding package there which kind of onboarding package there which is intentional right we want to support is intentional right we want to support is intentional right we want to support the educational use cases but it it's the educational use cases but it it's the educational use cases but it it's great it's a great way to get started great it's a great way to get started great it's a great way to get started isn't that attractive to bad guys though isn't that attractive to bad guys though isn't that attractive to bad guys though like the second you say free compute like the second you say free compute like the second you say free compute then someone's going to go and start then someone's going to go and start then someone's going to go and start mining Bitcoin or doing something mining Bitcoin or doing something mining Bitcoin or doing something naughty and as an organization that is a naughty and as an organization that is a naughty and as an organization that is a giant CMS you're not only shipping giant CMS you're not only shipping giant CMS you're not only shipping binaries but you're potentially building binaries but you're potentially building binaries but you're potentially building binaries that could be evil and then binaries that could be evil and then binaries that could be evil and then helping distribute them are people helping distribute them are people helping distribute them are people abusing releases are people abusing raw.

abusing releases are people abusing raw. abusing releases are people abusing raw. whatever GitHub CDN and and using it and whatever GitHub CDN and and using it and whatever GitHub CDN and and using it and are you constantly just slapping people are you constantly just slapping people are you constantly just slapping people down for doing those kind of things yeah down for doing those kind of things yeah down for doing those kind of things yeah it's actually a huge huge challenge for it's actually a huge huge challenge for it's actually a huge huge challenge for the platform with 100 million developers the platform with 100 million developers the platform with 100 million developers using the platform and a massive amount using the platform and a massive amount using the platform and a massive amount of compute there is a lot of folks who of compute there is a lot of folks who of compute there is a lot of folks who are trying to use this for nefarious are trying to use this for nefarious are trying to use this for nefarious purposes so we have uh in the security purposes so we have uh in the security purposes so we have uh in the security team actually uh inside GitHub we have a team actually uh inside GitHub we have a team actually uh inside GitHub we have a counter abuse team and they are building counter abuse team and they are building counter abuse team and they are building machine learning pipelines Auto machine learning pipelines Auto machine learning pipelines Auto detections they're working very closely detections they're working very closely detections they're working very closely with support and trust and safety to as with support and trust and safety to as with support and trust and safety to as much as possible automate remediate and much as possible automate remediate and much as possible automate remediate and kind of shut down both spam and abuse kind of shut down both spam and abuse kind of shut down both spam and abuse but also things like you know crypto but also things like you know crypto but also things like you know crypto Mining and also things like hosting Mining and also things like hosting Mining and also things like hosting binaries or content that don't meet our binaries or content that don't meet our binaries or content that don't meet our terms of service yeah it's definitely a terms of service yeah it's definitely a terms of service yeah it's definitely a challenging both engineering and scale challenging both engineering and scale challenging both engineering and scale problem across the board so GitHub problem across the board so GitHub problem across the board so GitHub Advanced security is a is a product or Advanced security is a is a product or Advanced security is a is a product or collection of products it's the name for collection of products it's the name for collection of products it's the name for looks like you've got a friend there in looks like you've got a friend there in looks like you've got a friend there in the background I can hear do sorry about the background I can hear do sorry about the background I can hear do sorry about that no it's fine that's the kind of that no it's fine that's the kind of that no it's fine that's the kind of security that we're looking for though security that we're looking for though security that we're looking for though at the company and then someone you'll I at the company and then someone you'll I at the company and then someone you'll I assume that there's a bark that you'll assume that there's a bark that you'll assume that there's a bark that you'll hear that is the I need to get up bark hear that is the I need to get up bark hear that is the I need to get up bark because there's a bad guy versus the I because there's a bad guy versus the I because there's a bad guy versus the I see a squirrel bark unfortunately see a squirrel bark unfortunately see a squirrel bark unfortunately they're exactly the same also friend they're exactly the same also friend they're exactly the same also friend bark is the exact same so they not not bark is the exact same so they not not bark is the exact same so they not not effective as a security tool you may uh effective as a security tool you may uh effective as a security tool you may uh we have my I don't have a dog but my my we have my I don't have a dog but my my we have my I don't have a dog but my my niece does absolutely useless as a niece does absolutely useless as a niece does absolutely useless as a security well she's like oh it'll warn security well she's like oh it'll warn security well she's like oh it'll warn me if no it won't no it won't it will

me if no it won't no it won't it will me if no it won't no it won't it will let them in and introduce and like bring let them in and introduce and like bring let them in and introduce and like bring them over you know you see those Tik them over you know you see those Tik them over you know you see those Tik toks with like the giant German Shepherd toks with like the giant German Shepherd toks with like the giant German Shepherd and then like the delivery guy comes in and then like the delivery guy comes in and then like the delivery guy comes in like how you doing yeah indeed that is like how you doing yeah indeed that is like how you doing yeah indeed that is exactly my dog I was going to ask about exactly my dog I was going to ask about exactly my dog I was going to ask about GitHub Advanced security and understand GitHub Advanced security and understand GitHub Advanced security and understand like is it a product is it a collection like is it a product is it a collection like is it a product is it a collection of products so get up Advanced security of products so get up Advanced security of products so get up Advanced security is a couple things so one for kind of is a couple things so one for kind of is a couple things so one for kind of our Enterprise customers it's a product our Enterprise customers it's a product our Enterprise customers it's a product that can be purchased that includes code that can be purchased that includes code that can be purchased that includes code scanning which is our SAS capability scanning which is our SAS capability scanning which is our SAS capability based on code ql it includes kind of our based on code ql it includes kind of our based on code ql it includes kind of our supply chain capabilities which is supply chain capabilities which is supply chain capabilities which is largely kind of dependabot and largely kind of dependabot and largely kind of dependabot and dependency scanning and then secret dependency scanning and then secret dependency scanning and then secret scanning which includes push protection scanning which includes push protection scanning which includes push protection we just recently announced that this is we just recently announced that this is we just recently announced that this is all being augmented by AI as well so all being augmented by AI as well so all being augmented by AI as well so code scanning now comes with things like code scanning now comes with things like code scanning now comes with things like autofix so suggestions so instead of autofix so suggestions so instead of autofix so suggestions so instead of just like highlighting the potential just like highlighting the potential just like highlighting the potential vulnerability in the code and saying hey vulnerability in the code and saying hey vulnerability in the code and saying hey developer you should remediate this it's developer you should remediate this it's developer you should remediate this it's coming with an actual suggestion in the coming with an actual suggestion in the coming with an actual suggestion in the pull request to say like oh and here's pull request to say like oh and here's pull request to say like oh and here's how we think you should remediate this how we think you should remediate this how we think you should remediate this you can just click accept and move on you can just click accept and move on you can just click accept and move on from there and then in the secret from there and then in the secret from there and then in the secret scanning space we're using AI to not scanning space we're using AI to not scanning space we're using AI to not just detect high confidence patterns just detect high confidence patterns just detect high confidence patterns which is kind of where we've been to which is kind of where we've been to which is kind of where we've been to date you know things like Azure tokens date you know things like Azure tokens date you know things like Azure tokens or AWS tokens or things like that but or AWS tokens or things like that but or AWS tokens or things like that but also lower confidence patterns like also lower confidence patterns like also lower confidence patterns like username and passwords or SSH keys or username and passwords or SSH keys or username and passwords or SSH keys or RSA keys so um that's kind of the full RSA keys so um that's kind of the full RSA keys so um that's kind of the full kind of get up Advanced Security package kind of get up Advanced Security package kind of get up Advanced Security package most of that is also available for free most of that is also available for free most of that is also available for free on public repos on GitHub you know and I on public repos on GitHub you know and I on public repos on GitHub you know and I I have to admit I have abused all of I have to admit I have abused all of I have to admit I have abused all of those things like if there's a free

those things like if there's a free those things like if there's a free thing on a public repo I turn it on and thing on a public repo I turn it on and thing on a public repo I turn it on and like dependabot I could just gush I like dependabot I could just gush I like dependabot I could just gush I could do a whole show on dependabot you could do a whole show on dependabot you could do a whole show on dependabot you know people don't realize how good it is know people don't realize how good it is know people don't realize how good it is because it's not on by default right you because it's not on by default right you because it's not on by default right you get the vulnerability dependencies is on get the vulnerability dependencies is on get the vulnerability dependencies is on by default but if you're an admin on a by default but if you're an admin on a by default but if you're an admin on a public repository you just go and you public repository you just go and you public repository you just go and you check and you turn it on and then you check and you turn it on and then you check and you turn it on and then you get dep pendot and it's like an employee get dep pendot and it's like an employee get dep pendot and it's like an employee that makes poll requests while you sleep that makes poll requests while you sleep that makes poll requests while you sleep and it's it's amazing I I I gush about and it's it's amazing I I I gush about and it's it's amazing I I I gush about how awesome dep pendot is yeah it's how awesome dep pendot is yeah it's how awesome dep pendot is yeah it's really fantastic and then we're seeing really fantastic and then we're seeing really fantastic and then we're seeing just a huge I mean secret scanning is a just a huge I mean secret scanning is a just a huge I mean secret scanning is a newer capability for us but that newer capability for us but that newer capability for us but that combined with push protection we're just combined with push protection we're just combined with push protection we're just seeing some incredible things happening seeing some incredible things happening seeing some incredible things happening I mean I'll just give you an example I mean I'll just give you an example I mean I'll just give you an example inside of GitHub we've really worked to inside of GitHub we've really worked to inside of GitHub we've really worked to you know reduce and eliminate secrets you know reduce and eliminate secrets you know reduce and eliminate secrets and code in our own codebase using get and code in our own codebase using get and code in our own codebase using get up Advanced security and being able to up Advanced security and being able to up Advanced security and being able to keep it eliminated with push protection keep it eliminated with push protection keep it eliminated with push protection so that nothing's getting in there after so that nothing's getting in there after so that nothing's getting in there after we've cleaned everything up is just an we've cleaned everything up is just an we've cleaned everything up is just an absolutely amazing capability but you absolutely amazing capability but you absolutely amazing capability but you know being able to offer that for public know being able to offer that for public know being able to offer that for public repos is critical because you know it's repos is critical because you know it's repos is critical because you know it's not a cheap thing for us to do from an not a cheap thing for us to do from an not a cheap thing for us to do from an infrastructure perspective but it's the infrastructure perspective but it's the infrastructure perspective but it's the right thing to do because we take that right thing to do because we take that right thing to do because we take that responsibility kind of at the center of responsibility kind of at the center of responsibility kind of at the center of a lot of the software development a lot of the software development a lot of the software development ecosystem very seriously yeah and this ecosystem very seriously yeah and this ecosystem very seriously yeah and this push protection we should explain that a push protection we should explain that a push protection we should explain that a little bit because like one of the little bit because like one of the little bit because like one of the number one questions on stack Overflow number one questions on stack Overflow number one questions on stack Overflow like the top questions is I've pushed a like the top questions is I've pushed a like the top questions is I've pushed a secret into GitHub I pushed a connection secret into GitHub I pushed a connection secret into GitHub I pushed a connection string how do I make it go away yeah I string how do I make it go away yeah I string how do I make it go away yeah I mean that's also one of the number one mean that's also one of the number one mean that's also one of the number one questions we talk to customers about a questions we talk to customers about a questions we talk to customers about a lot as well because it's once it's in lot as well because it's once it's in lot as well because it's once it's in it's in right it's super expensive to

it's in right it's super expensive to it's in right it's super expensive to remediate it's super difficult to know remediate it's super difficult to know remediate it's super difficult to know it's good and from and if you talk to it's good and from and if you talk to it's good and from and if you talk to any security team they're going to say any security team they're going to say any security team they're going to say well like once it's there you got to you well like once it's there you got to you well like once it's there you got to you have to deactivate it you have to roll have to deactivate it you have to roll have to deactivate it you have to roll it you got to change the credential and it you got to change the credential and it you got to change the credential and so push protection basically sits in so push protection basically sits in so push protection basically sits in between the editor and the GitHub between the editor and the GitHub between the editor and the GitHub service itself and inspects you know service itself and inspects you know service itself and inspects you know it's secure it's encrypted but it it's secure it's encrypted but it it's secure it's encrypted but it inspects what's coming in looking for inspects what's coming in looking for inspects what's coming in looking for credential secrets in the code before it credential secrets in the code before it credential secrets in the code before it actually goes into the get system itself actually goes into the get system itself actually goes into the get system itself and if it finds anything it'll block it and if it finds anything it'll block it and if it finds anything it'll block it and then there's options depending on and then there's options depending on and then there's options depending on what you're doing you come back to the what you're doing you come back to the what you're doing you come back to the developer and say do you want to developer and say do you want to developer and say do you want to override this or you know Enterprises override this or you know Enterprises override this or you know Enterprises have the ability to adjust some of the have the ability to adjust some of the have the ability to adjust some of the responses there as well so it's a pretty responses there as well so it's a pretty responses there as well so it's a pretty powerful tool yeah and it it really this powerful tool yeah and it it really this powerful tool yeah and it it really this this idea of these these sass these this idea of these these sass these this idea of these these sass these shared access security tokens and their shared access security tokens and their shared access security tokens and their potential vulnerabilities it's just it's potential vulnerabilities it's just it's potential vulnerabilities it's just it's a magic number and if somebody gets it a magic number and if somebody gets it a magic number and if somebody gets it they own you and the amount of like they own you and the amount of like they own you and the amount of like responsibility that can be assigned to responsibility that can be assigned to responsibility that can be assigned to one of these tokens that is just easily one of these tokens that is just easily one of these tokens that is just easily copy pasted and given to someone is huge copy pasted and given to someone is huge copy pasted and given to someone is huge and I understand I saw some stuff cuz I and I understand I saw some stuff cuz I and I understand I saw some stuff cuz I work at Microsoft in my day job this is work at Microsoft in my day job this is work at Microsoft in my day job this is all public there was some nation state all public there was some nation state all public there was some nation state actor that got a hold of some tokens and actor that got a hold of some tokens and actor that got a hold of some tokens and was running around on some you know was running around on some you know was running around on some you know non-production build servers recently non-production build servers recently non-production build servers recently and it all starts with those freaking and it all starts with those freaking and it all starts with those freaking tokens that you could paste to someone tokens that you could paste to someone tokens that you could paste to someone in a slack so you're going to want to in a slack so you're going to want to in a slack so you're going to want to catch those so it makes me wonder though catch those so it makes me wonder though catch those so it makes me wonder though as devs how can we have them without as devs how can we have them without as devs how can we have them without ever seeing them like I don't want it in ever seeing them like I don't want it in ever seeing them like I don't want it in my clipboard because once it gets into my clipboard because once it gets into my clipboard because once it gets into my clipboard it could be given it could my clipboard it could be given it could my clipboard it could be given it could be moved away is there a way to have be moved away is there a way to have be moved away is there a way to have secrets that we simply can't see that

secrets that we simply can't see that secrets that we simply can't see that wouldn't even show up in GitHub it's a wouldn't even show up in GitHub it's a wouldn't even show up in GitHub it's a great question you know and I think when great question you know and I think when great question you know and I think when I think about the proactive security I think about the proactive security I think about the proactive security space and kind of all the advances that space and kind of all the advances that space and kind of all the advances that are happening I think this is an area are happening I think this is an area are happening I think this is an area that a lot of Enterprises work towards that a lot of Enterprises work towards that a lot of Enterprises work towards through things like Enterprise vaults through things like Enterprise vaults through things like Enterprise vaults and kind of accessing these secrets on and kind of accessing these secrets on and kind of accessing these secrets on demand through apis which is probably demand through apis which is probably demand through apis which is probably that's one of the right ways to do it I that's one of the right ways to do it I that's one of the right ways to do it I won't say it's the only right way to do won't say it's the only right way to do won't say it's the only right way to do it but you know having that accessible it but you know having that accessible it but you know having that accessible to a normal Dev is more of a challenge I to a normal Dev is more of a challenge I to a normal Dev is more of a challenge I think because it's just it's so easy think because it's just it's so easy think because it's just it's so easy just to go grab that token and toss it just to go grab that token and toss it just to go grab that token and toss it in the repo and keep moving to deploy in the repo and keep moving to deploy in the repo and keep moving to deploy the blog or do whatever so I think this the blog or do whatever so I think this the blog or do whatever so I think this is where normalizing things like secret is where normalizing things like secret is where normalizing things like secret scanning and normalizing and making it scanning and normalizing and making it scanning and normalizing and making it clear where to put secrets in places clear where to put secrets in places clear where to put secrets in places like GitHub or you know Cloud compute like GitHub or you know Cloud compute like GitHub or you know Cloud compute like Azure is helping but we can still like Azure is helping but we can still like Azure is helping but we can still do more I think as a community here yeah do more I think as a community here yeah do more I think as a community here yeah I like the the call out of like I like the the call out of like I like the the call out of like normalizing it like right now when I normalizing it like right now when I normalizing it like right now when I start a new project it usually ends up start a new project it usually ends up start a new project it usually ends up in some Json file and that's just wrong in some Json file and that's just wrong in some Json file and that's just wrong that should be it's wrong by default and that should be it's wrong by default and that should be it's wrong by default and it should be right by default and I need it should be right by default and I need it should be right by default and I need to like get that into my head so that it to like get that into my head so that it to like get that into my head so that it is normal and of course GitHub will is normal and of course GitHub will is normal and of course GitHub will catch me 99.9% of the time or as you catch me 99.9% of the time or as you catch me 99.9% of the time or as you said it'll warn you and say are you sure said it'll warn you and say are you sure said it'll warn you and say are you sure you want to do this this this token's you want to do this this this token's you want to do this this this token's used for testing but even then I used for testing but even then I used for testing but even then I shouldn't push it through I should do it shouldn't push it through I should do it shouldn't push it through I should do it correctly from from the beginning yeah correctly from from the beginning yeah correctly from from the beginning yeah agreed and you know for like that normal agreed and you know for like that normal agreed and you know for like that normal Dev out there at a minimum storing it as Dev out there at a minimum storing it as Dev out there at a minimum storing it as part of the secret management capability part of the secret management capability part of the secret management capability inside GitHub is a good first step I inside GitHub is a good first step I inside GitHub is a good first step I think once you start to scale that think once you start to scale that think once you start to scale that though there's probably more though there's probably more though there's probably more sophisticated ways to share that across

sophisticated ways to share that across sophisticated ways to share that across an Enterprise team so I want to also an Enterprise team so I want to also an Enterprise team so I want to also talk about the the Third Leg of that talk about the the Third Leg of that talk about the the Third Leg of that stool we talked about secret scanning stool we talked about secret scanning stool we talked about secret scanning independent bot but then code ql it's independent bot but then code ql it's independent bot but then code ql it's this code analysis tool and it'll this code analysis tool and it'll this code analysis tool and it'll analyze your code it'll give you quality analyze your code it'll give you quality analyze your code it'll give you quality uh but it's really becoming a security uh but it's really becoming a security uh but it's really becoming a security tool like it's spotting like bad tool like it's spotting like bad tool like it's spotting like bad practices but you have to do this across practices but you have to do this across practices but you have to do this across a plurality of languages right like a plurality of languages right like a plurality of languages right like there's all kinds of you you could be there's all kinds of you you could be there's all kinds of you you could be doing llang you could be doing rust you doing llang you could be doing rust you doing llang you could be doing rust you could be doing C code ql has to manage could be doing C code ql has to manage could be doing C code ql has to manage all of that it does it does indeed and all of that it does it does indeed and all of that it does it does indeed and we have we have an amazing team who is we have we have an amazing team who is we have we have an amazing team who is building essentially language models for building essentially language models for building essentially language models for each one one of the languages we support each one one of the languages we support each one one of the languages we support and continue to evolve them and it's not and continue to evolve them and it's not and continue to evolve them and it's not just a once andone build either because just a once andone build either because just a once andone build either because as you know these languages evolve all as you know these languages evolve all as you know these languages evolve all the time there's new releases there's the time there's new releases there's the time there's new releases there's new versions of python coming out you new versions of python coming out you new versions of python coming out you know constantly and so how do we keep up know constantly and so how do we keep up know constantly and so how do we keep up with that I think there's there's kind with that I think there's there's kind with that I think there's there's kind of two angles here one is how does the of two angles here one is how does the of two angles here one is how does the team continue to model and create what team continue to model and create what team continue to model and create what is considered a vulnerability we is considered a vulnerability we is considered a vulnerability we approach this a few different ways one approach this a few different ways one approach this a few different ways one is we actually have researchers inside is we actually have researchers inside is we actually have researchers inside of GitHub who are doing vulnerability of GitHub who are doing vulnerability of GitHub who are doing vulnerability research on open source projects and research on open source projects and research on open source projects and they are actively contributing what they are actively contributing what they are actively contributing what they're learning back into the cql base they're learning back into the cql base they're learning back into the cql base which then is then made available to all which then is then made available to all which then is then made available to all of our customers and open source users of our customers and open source users of our customers and open source users typical devs all the way to you know big typical devs all the way to you know big typical devs all the way to you know big Enterprises and then we have started to Enterprises and then we have started to Enterprises and then we have started to use AI to help automodel languages use AI to help automodel languages use AI to help automodel languages faster and open source projects that are faster and open source projects that are faster and open source projects that are widely used so that we can actually widely used so that we can actually widely used so that we can actually increase the rate that we are modeling increase the rate that we are modeling increase the rate that we are modeling and supporting new capabilities in that and supporting new capabilities in that and supporting new capabilities in that program now I was picking random program now I was picking random program now I was picking random languages but I do want to come and to

languages but I do want to come and to languages but I do want to come and to give a brief brief correction I ran I give a brief brief correction I ran I give a brief brief correction I ran I called out rust and llang which are you called out rust and llang which are you called out rust and llang which are you know I thought about them a little bit know I thought about them a little bit know I thought about them a little bit more on the far side of the bell curve more on the far side of the bell curve more on the far side of the bell curve there but those are not supported you there but those are not supported you there but those are not supported you have cess plus C go cotlin is in beta have cess plus C go cotlin is in beta have cess plus C go cotlin is in beta you've got Swift in beta which is pretty you've got Swift in beta which is pretty you've got Swift in beta which is pretty cool python Ruby you know what I'm cool python Ruby you know what I'm cool python Ruby you know what I'm struck by with this list is you've got struck by with this list is you've got struck by with this list is you've got both compiled and interpreted languages both compiled and interpreted languages both compiled and interpreted languages which are two different universes that which are two different universes that which are two different universes that you're going to have to treat as if you're going to have to treat as if you're going to have to treat as if they're the same but they're very they're the same but they're very they're the same but they're very different they're really different in different they're really different in different they're really different in terms of how we approach it the team's terms of how we approach it the team's terms of how we approach it the team's making some incredible progress to be making some incredible progress to be making some incredible progress to be able to tackle even the compiled able to tackle even the compiled able to tackle even the compiled languages in uh faster and I'll just say languages in uh faster and I'll just say languages in uh faster and I'll just say like easier to set up ways because right like easier to set up ways because right like easier to set up ways because right now you often have to like integrated now you often have to like integrated now you often have to like integrated into the build uh as you're thinking into the build uh as you're thinking into the build uh as you're thinking about like a Java build the goal here is about like a Java build the goal here is about like a Java build the goal here is to really make this easy to turn on easy to really make this easy to turn on easy to really make this easy to turn on easy to use and and kind of easy to get to to use and and kind of easy to get to to use and and kind of easy to get to that first meaningful alert that moves that first meaningful alert that moves that first meaningful alert that moves the needle on the security here and the needle on the security here and the needle on the security here and they're making a ton of progress on that they're making a ton of progress on that they're making a ton of progress on that so I'm I'm excited to see where we're so I'm I'm excited to see where we're so I'm I'm excited to see where we're headed as a as a a program there the headed as a as a a program there the headed as a as a a program there the amount of like work happening to to just amount of like work happening to to just amount of like work happening to to just push a hello world like the back behind push a hello world like the back behind push a hello world like the back behind the scenes work must be insane you were the scenes work must be insane you were the scenes work must be insane you were talking about free compute like if I go talking about free compute like if I go talking about free compute like if I go and make hello.c and I check it in for and make hello.c and I check it in for and make hello.c and I check it in for me it happens instantly I see the file I me it happens instantly I see the file I me it happens instantly I see the file I can set up a GitHub actions I can make a can set up a GitHub actions I can make a can set up a GitHub actions I can make a release executable pops out and then I release executable pops out and then I release executable pops out and then I can start hitting raw. whatever whatever can start hitting raw. whatever whatever can start hitting raw. whatever whatever and I can start DR I can curl it and I can start DR I can curl it and I can start DR I can curl it immediately but behind the scenes you've immediately but behind the scenes you've immediately but behind the scenes you've run code ql you've scan for viruses like run code ql you've scan for viruses like run code ql you've scan for viruses like there's a whole bunch of compute that there's a whole bunch of compute that there's a whole bunch of compute that happen and you did that on a public happen and you did that on a public happen and you did that on a public repository is this going to be

repository is this going to be repository is this going to be sustainable you just make it more sustainable you just make it more sustainable you just make it more efficient I don't understand how that's efficient I don't understand how that's efficient I don't understand how that's going to be something that'll be around going to be something that'll be around going to be something that'll be around in 10 years but it needs to be it's a in 10 years but it needs to be it's a in 10 years but it needs to be it's a good question I think some of it's about good question I think some of it's about good question I think some of it's about the efficiency and I think some of it is the efficiency and I think some of it is the efficiency and I think some of it is about the fact and and this is one of about the fact and and this is one of about the fact and and this is one of the things I love about GitHub is that the things I love about GitHub is that the things I love about GitHub is that you know the leadership and the company you know the leadership and the company you know the leadership and the company generally values this community and generally values this community and generally values this community and values the work we're doing here and is values the work we're doing here and is values the work we're doing here and is investing in that as well and so I think investing in that as well and so I think investing in that as well and so I think you know it's not necessarily a question you know it's not necessarily a question you know it's not necessarily a question of like can we make this cheaper to to of like can we make this cheaper to to of like can we make this cheaper to to run or not for public repos it's like run or not for public repos it's like run or not for public repos it's like how do we do it is is it scalable at all how do we do it is is it scalable at all how do we do it is is it scalable at all you know period for some of the you know period for some of the you know period for some of the capabilities and I think it gets a capabilities and I think it gets a capabilities and I think it gets a little harder when we talk about GPU little harder when we talk about GPU little harder when we talk about GPU bound AI features but generally you know bound AI features but generally you know bound AI features but generally you know it's an important part of what we're it's an important part of what we're it's an important part of what we're doing as a company and as a business to doing as a company and as a business to doing as a company and as a business to support the open source community and support the open source community and support the open source community and continue to lean into that continue to lean into that continue to lean into that responsibility so kind of over all of responsibility so kind of over all of responsibility so kind of over all of this like looming over all of this is this like looming over all of this is this like looming over all of this is GitHub co-pilot which is generating code GitHub co-pilot which is generating code GitHub co-pilot which is generating code there's a large language model at its there's a large language model at its there's a large language model at its base but large language models are tuned base but large language models are tuned base but large language models are tuned for different stuff some are good at for different stuff some are good at for different stuff some are good at generating Shakespeare and limeric and generating Shakespeare and limeric and generating Shakespeare and limeric and some are good at generating code but some are good at generating code but some are good at generating code but some are just confident bsers how do I some are just confident bsers how do I some are just confident bsers how do I know that co-pilot or some code language know that co-pilot or some code language know that co-pilot or some code language model is not going to go and generate model is not going to go and generate model is not going to go and generate insecure code and then run it down my insecure code and then run it down my insecure code and then run it down my pipeline my security pipeline sure so pipeline my security pipeline sure so pipeline my security pipeline sure so kind of starting at the the left side of kind of starting at the the left side of kind of starting at the the left side of this the models we're using are very this the models we're using are very this the models we're using are very much focused and tuned towards software much focused and tuned towards software much focused and tuned towards software development and the way we're development and the way we're development and the way we're incorporating those and so we're going incorporating those and so we're going incorporating those and so we're going to continue to work on what's the right to continue to work on what's the right to continue to work on what's the right model to use for the right situations

model to use for the right situations model to use for the right situations here and that will evolve as the product here and that will evolve as the product here and that will evolve as the product evolves as well but then kind of if you evolves as well but then kind of if you evolves as well but then kind of if you move a little bit to the right then we move a little bit to the right then we move a little bit to the right then we are working with uh Microsoft and we've are working with uh Microsoft and we've are working with uh Microsoft and we've got our own filters in place as well got our own filters in place as well got our own filters in place as well that we've partnered with Microsoft on that we've partnered with Microsoft on that we've partnered with Microsoft on that do things like security filtering that do things like security filtering that do things like security filtering and toxicity filtering so they're and toxicity filtering so they're and toxicity filtering so they're looking for common MySQL injection looking for common MySQL injection looking for common MySQL injection vulnerabilities and are going to prevent vulnerabilities and are going to prevent vulnerabilities and are going to prevent those from even being suggested to those from even being suggested to those from even being suggested to developers before they even get there developers before they even get there developers before they even get there now this is early days and I think this now this is early days and I think this now this is early days and I think this is going to continue evolve and I'm is going to continue evolve and I'm is going to continue evolve and I'm really excited actually to see over time really excited actually to see over time really excited actually to see over time if we see fewer and fewer if we see fewer and fewer if we see fewer and fewer vulnerabilities introduced in the editor vulnerabilities introduced in the editor vulnerabilities introduced in the editor to begin with because actually think we to begin with because actually think we to begin with because actually think we are we're already seeing that now but are we're already seeing that now but are we're already seeing that now but you know I think getting these filters you know I think getting these filters you know I think getting these filters getting the tuning necessary after the getting the tuning necessary after the getting the tuning necessary after the suggestions to make sure it's relevant suggestions to make sure it's relevant suggestions to make sure it's relevant to the context of what the developer to the context of what the developer to the context of what the developer doing what they're trying to do what doing what they're trying to do what doing what they're trying to do what question they asked is something we're question they asked is something we're question they asked is something we're very focused on and then you know we very focused on and then you know we very focused on and then you know we always say even though these suggestions always say even though these suggestions always say even though these suggestions are good and we're seeing huge are good and we're seeing huge are good and we're seeing huge acceptance rates here it's it's a acceptance rates here it's it's a acceptance rates here it's it's a co-pilot so you should still run co-pilot so you should still run co-pilot so you should still run Advanced security you should still check Advanced security you should still check Advanced security you should still check the code you should still make sure your the code you should still make sure your the code you should still make sure your builds work and do all your normal tests builds work and do all your normal tests builds work and do all your normal tests as you would normally I appreciate the as you would normally I appreciate the as you would normally I appreciate the call out about the idea of context I use call out about the idea of context I use call out about the idea of context I use that in my talks about not just co-pilot that in my talks about not just co-pilot that in my talks about not just co-pilot but AI in general is that if you you but AI in general is that if you you but AI in general is that if you you know if you walk up to someone and you know if you walk up to someone and you know if you walk up to someone and you say that they're going to like I joke say that they're going to like I joke say that they're going to like I joke about this my wife and I we finish each about this my wife and I we finish each about this my wife and I we finish each other's sandwiches you know that's like other's sandwiches you know that's like other's sandwiches you know that's like maybe it's context that we have because maybe it's context that we have because maybe it's context that we have because we've been married for 25 years but when we've been married for 25 years but when we've been married for 25 years but when you say to GitHub co-pilot hey write me you say to GitHub co-pilot hey write me you say to GitHub co-pilot hey write me a for Loop how much context is a for Loop how much context is a for Loop how much context is appropriate does it need to know what I

appropriate does it need to know what I appropriate does it need to know what I wrote last week does it need to know wrote last week does it need to know wrote last week does it need to know what I wrote earlier today or can it what I wrote earlier today or can it what I wrote earlier today or can it produce what I need it to produce now produce what I need it to produce now produce what I need it to produce now maybe it doesn't know that I'm in the maybe it doesn't know that I'm in the maybe it doesn't know that I'm in the middle of red teaming or maybe it middle of red teaming or maybe it middle of red teaming or maybe it doesn't know I'm in the middle of doesn't know I'm in the middle of doesn't know I'm in the middle of whatever context that get up co-pilot whatever context that get up co-pilot whatever context that get up co-pilot knows can get into an uncanny valley of knows can get into an uncanny valley of knows can get into an uncanny valley of creepiness where I might feel creepiness where I might feel creepiness where I might feel uncomfortable that the AI knows stuff uncomfortable that the AI knows stuff uncomfortable that the AI knows stuff but if it's permissive and it says but if it's permissive and it says but if it's permissive and it says follow-up questions like I don't know follow-up questions like I don't know follow-up questions like I don't know not like clippy but you know what I mean not like clippy but you know what I mean not like clippy but you know what I mean like looks like you're doing some like looks like you're doing some like looks like you're doing some naughty things with red teaming would naughty things with red teaming would naughty things with red teaming would you like help versus it looks like you like help versus it looks like you like help versus it looks like you're really focused on security and you're really focused on security and you're really focused on security and you want your code to be extra secure you want your code to be extra secure you want your code to be extra secure how much context should co-pilot have how much context should co-pilot have how much context should co-pilot have when it's trying to help me sure I think when it's trying to help me sure I think when it's trying to help me sure I think you know this is something we we talk to you know this is something we we talk to you know this is something we we talk to customers about and I know our product customers about and I know our product customers about and I know our product and Engineering teams are are really and Engineering teams are are really and Engineering teams are are really focused on as well and I think some of focused on as well and I think some of focused on as well and I think some of this is going to come down to where in this is going to come down to where in this is going to come down to where in the product and where in the workflow the product and where in the workflow the product and where in the workflow that the developers engaging AI as it is that the developers engaging AI as it is that the developers engaging AI as it is and so you know the context going into and so you know the context going into and so you know the context going into co-pilot GitHub co-pilot from Auto co-pilot GitHub co-pilot from Auto co-pilot GitHub co-pilot from Auto completion maybe open files in the completion maybe open files in the completion maybe open files in the editor that they're working on now but editor that they're working on now but editor that they're working on now but if they've got chat GitHub co-pilot chat if they've got chat GitHub co-pilot chat if they've got chat GitHub co-pilot chat up as well and they're asking questions up as well and they're asking questions up as well and they're asking questions then that can tune and help it then that can tune and help it then that can tune and help it understand a bit more and so as we kind understand a bit more and so as we kind understand a bit more and so as we kind of are building GitHub co-pilot into of are building GitHub co-pilot into of are building GitHub co-pilot into more and more of the GitHub platform in more and more of the GitHub platform in more and more of the GitHub platform in terms of enabling developer productivity terms of enabling developer productivity terms of enabling developer productivity and to end I think we're going to and to end I think we're going to and to end I think we're going to hopefully see that be more evident to hopefully see that be more evident to hopefully see that be more evident to developers where it's getting it and how developers where it's getting it and how developers where it's getting it and how it's helping them be more productive I it's helping them be more productive I it's helping them be more productive I like that the evident part like I don't like that the evident part like I don't like that the evident part like I don't want magic I want code ql or dependabot

want magic I want code ql or dependabot want magic I want code ql or dependabot or any number of these tools in GitHub or any number of these tools in GitHub or any number of these tools in GitHub Advanced security and my pipeline to let Advanced security and my pipeline to let Advanced security and my pipeline to let me know hey I found a thing here's why I me know hey I found a thing here's why I me know hey I found a thing here's why I think it's a thing and here's what I think it's a thing and here's what I think it's a thing and here's what I think you should do about it like don't think you should do about it like don't think you should do about it like don't just say this is a problem tell me why just say this is a problem tell me why just say this is a problem tell me why you figured it out so then I can learn you figured it out so then I can learn you figured it out so then I can learn and be better myself sure yeah no I and be better myself sure yeah no I and be better myself sure yeah no I totally agree and I think you know when totally agree and I think you know when totally agree and I think you know when I will pull up co-pilot chat and start I will pull up co-pilot chat and start I will pull up co-pilot chat and start asking questions I that's one of my asking questions I that's one of my asking questions I that's one of my favorite Parts about it actually is it's favorite Parts about it actually is it's favorite Parts about it actually is it's explaining to me here's what we're explaining to me here's what we're explaining to me here's what we're suggesting here's why hey this is suggesting here's why hey this is suggesting here's why hey this is vulnerable hey if you want to read more vulnerable hey if you want to read more vulnerable hey if you want to read more about why it's vulnerable go click this about why it's vulnerable go click this about why it's vulnerable go click this link and it just honestly it's a much link and it just honestly it's a much link and it just honestly it's a much richer experience than going to a search richer experience than going to a search richer experience than going to a search engine and trying to find help for the engine and trying to find help for the engine and trying to find help for the thing I'm trying to do and it's also way thing I'm trying to do and it's also way thing I'm trying to do and it's also way way faster I was editing a jupyter way faster I was editing a jupyter way faster I was editing a jupyter notebook the other day to like analyze notebook the other day to like analyze notebook the other day to like analyze some data for the teams and I needed to some data for the teams and I needed to some data for the teams and I needed to make some changes to it and I wasn't make some changes to it and I wasn't make some changes to it and I wasn't super familiar with the language and I super familiar with the language and I super familiar with the language and I was like H this is going to take me was like H this is going to take me was like H this is going to take me hours I'm not even going to bother with hours I'm not even going to bother with hours I'm not even going to bother with this and and I was like oh wait actually this and and I was like oh wait actually this and and I was like oh wait actually let me fire up co-pilot and see what I let me fire up co-pilot and see what I let me fire up co-pilot and see what I can do I had it fixed in like five can do I had it fixed in like five can do I had it fixed in like five minutes it did exactly what I wanted it minutes it did exactly what I wanted it minutes it did exactly what I wanted it to do and I understand why it did it and to do and I understand why it did it and to do and I understand why it did it and that was just a a fun thing for me given that was just a a fun thing for me given that was just a a fun thing for me given that I don't really develop every day that I don't really develop every day that I don't really develop every day anymore in my day job you know it's it's anymore in my day job you know it's it's anymore in my day job you know it's it's interesting that you call that out interesting that you call that out interesting that you call that out though because you you know that idea though because you you know that idea though because you you know that idea that there are co-workers or relatives that there are co-workers or relatives that there are co-workers or relatives who are really good googlers you know who are really good googlers you know who are really good googlers you know I'll have like non-technical relative I'll have like non-technical relative I'll have like non-technical relative try to Google for something and they'll try to Google for something and they'll try to Google for something and they'll just keep banging their head against the just keep banging their head against the just keep banging their head against the wall and then I just I'll notice like wall and then I just I'll notice like wall and then I just I'll notice like you used Too Many Words use less and you used Too Many Words use less and you used Too Many Words use less and then I'll find it on the first try or then I'll find it on the first try or then I'll find it on the first try or there's a particular term hopefully there's a particular term hopefully there's a particular term hopefully co-pilot and AIS will equalize that more

co-pilot and AIS will equalize that more co-pilot and AIS will equalize that more so that everyone will get the answer so that everyone will get the answer so that everyone will get the answer that they want because what happens now that they want because what happens now that they want because what happens now is my non-technical relative will be is my non-technical relative will be is my non-technical relative will be like oh you're just a really good like oh you're just a really good like oh you're just a really good googler it's like well no you know I googler it's like well no you know I googler it's like well no you know I want I want to teach you how to be able want I want to teach you how to be able want I want to teach you how to be able to do that but I noticed that their to do that but I noticed that their to do that but I noticed that their solution is to Simply restart and try solution is to Simply restart and try solution is to Simply restart and try again yeah like give up on the query and again yeah like give up on the query and again yeah like give up on the query and phrase it differently but with with with phrase it differently but with with with phrase it differently but with with with a with an AI or with a co-pilot I don't a with an AI or with a co-pilot I don't a with an AI or with a co-pilot I don't just give up and start a new just give up and start a new just give up and start a new conversation I try to refine it I think conversation I try to refine it I think conversation I try to refine it I think that's a skill we're going to have to that's a skill we're going to have to that's a skill we're going to have to teach our non-technical Brethren I agree teach our non-technical Brethren I agree teach our non-technical Brethren I agree I also think at least to me it feels I also think at least to me it feels I also think at least to me it feels more intuitive to do that with an AI more intuitive to do that with an AI more intuitive to do that with an AI co-pilot I mean just being able to have co-pilot I mean just being able to have co-pilot I mean just being able to have that context we were talking about a few that context we were talking about a few that context we were talking about a few minutes ago that it's already got it minutes ago that it's already got it minutes ago that it's already got it already sort of knows roughly what I'm already sort of knows roughly what I'm already sort of knows roughly what I'm trying to do or at least what I'm seeing trying to do or at least what I'm seeing trying to do or at least what I'm seeing on my screen to a certain degree and say on my screen to a certain degree and say on my screen to a certain degree and say like hey can you explain this file to me like hey can you explain this file to me like hey can you explain this file to me I don't have to tell it which file it is I don't have to tell it which file it is I don't have to tell it which file it is or can you help me rewrite this file or can you help me rewrite this file or can you help me rewrite this file from cobal to python there's things like from cobal to python there's things like from cobal to python there's things like that where if I went and Googled that it that where if I went and Googled that it that where if I went and Googled that it would take me hours and hours and hours would take me hours and hours and hours would take me hours and hours and hours to figure out roughly the same thing to figure out roughly the same thing to figure out roughly the same thing because I would have to keep doing that because I would have to keep doing that because I would have to keep doing that iterative thing and even though I'm not iterative thing and even though I'm not iterative thing and even though I'm not quite as good of a googler as my wife is quite as good of a googler as my wife is quite as good of a googler as my wife is I'm still fair at it very cool well I I'm still fair at it very cool well I I'm still fair at it very cool well I think that our in conclusion what I'm think that our in conclusion what I'm think that our in conclusion what I'm hearing is I need to make sure that I've hearing is I need to make sure that I've hearing is I need to make sure that I've got Advanced security turned on on all got Advanced security turned on on all got Advanced security turned on on all of my repositories which I can do if I'm of my repositories which I can do if I'm of my repositories which I can do if I'm an admin on a public repository I can an admin on a public repository I can an admin on a public repository I can turn these on and that'll give me turn these on and that'll give me turn these on and that'll give me dependabot which I already love a code dependabot which I already love a code dependabot which I already love a code ql which I can use and if I interact ql which I can use and if I interact ql which I can use and if I interact with it I will get nothing with good with it I will get nothing with good with it I will get nothing with good stuff and then secret scanning and push stuff and then secret scanning and push stuff and then secret scanning and push protection is going to be fantastic as protection is going to be fantastic as protection is going to be fantastic as well this is all combined within the well this is all combined within the well this is all combined within the context of GitHub advaned security this

context of GitHub advaned security this context of GitHub advaned security this is pretty cool stuff Jacob thanks for is pretty cool stuff Jacob thanks for is pretty cool stuff Jacob thanks for hanging out with me today thanks so much hanging out with me today thanks so much hanging out with me today thanks so much for having me enjoy chatting we've been for having me enjoy chatting we've been for having me enjoy chatting we've been chatting with Jacob the priest he's a chatting with Jacob the priest he's a chatting with Jacob the priest he's a deputy chief security officer at GitHub deputy chief security officer at GitHub deputy chief security officer at GitHub this has been another episode of Hansel this has been another episode of Hansel this has been another episode of Hansel minutes and we'll see you again next minutes and we'll see you again next minutes and we'll see you again next [Music] [Music] [Music] week