Latest / Success Story with Scott Clary / Lessons - Building a $100M Open Source Empire | Ian Tien - SaaS Scaling Expert

Transcript

Lessons - Building a $100M Open Source Empire | Ian Tien - SaaS Scaling Expert · Success Story with Scott Clary

• 0:00
  In this lessons episode, explore what drives secure and scalable open source businesses amid
• 0:05
  growing cyber risks. Discover why security depends more on culture and investment than open or
• 0:10
  closed models. Understand how customer-led product development enables early enterprise adoption
• 0:15
  and uncover how impact, growth, and community attract and retain top technical talent.
• 0:20
  The other thing that I think about when I think about open sources, you've built this community
• 0:30
  of people that are always like pressure testing your software. Talk to me about security. Talk to
• 0:35
  me about why open source, I've watched a couple other interviews that you're in and just the
• 0:40
  security point is important. More important than ever before with the amount of people that do
• 0:44
  get compromised. When you roll this out and when you build an open source project, is it more
• 0:50
  secure than a closed source? That's a great question. It's not just the open or closed model.
• 1:01
  It's the investment on security. Your internal process security doesn't come down to one or two
• 1:06
  things. There are three principles to think about in security. One is nothing is secure. There's
• 1:13
  always going to be vulnerabilities. All you can do is move those around. That's one. When your
• 1:18
  open source software, you have a lot of visibility and your customers are very motivated to work with
• 1:23
  you on security. Everyone runs the secure customers. We're in public sector. We're in the US
• 1:29
  Air Force. There's 20,000 US Air crews that rely on Madermost in order to fly planes. The security
• 1:36
  and the rigor that we go through is at that level. Then you'll find us in many communities that
• 1:43
  have very, very high security standards. I think that community and that understanding that yeah,
• 1:48
  all software is vulnerable. We've got transparency and people can report to us and we have a system to
• 1:53
  address that. That's all super important. I think that's one on security that is for the open
• 1:58
  source model. I think the second is really about, there's a second principle which is the effort
• 2:04
  that goes behind a breach. That goes behind an attack is proportional to the value of that breach.
• 2:12
  What that means is if you can think of like, hey, I've got everything in this giant cloud system,
• 2:16
  everyone in the world uses this cloud. Great. Guess what? There's going to be an infinite amount
• 2:21
  of resources that will be dedicated to breaching that mega fortress. All they need is a crack in
• 2:29
  the armor and they're going to be going after it. What open source and self-hosting lets you do,
• 2:33
  we can do either cloud or self-hosting, but what it lets you do is put that behind your own
• 2:40
  defenses. One, your date is not mixed in with all these other honey pot targets. Your stuff is
• 2:46
  off the side and it's behind all your other security and the only people that are breaching it
• 2:50
  are the people that want to breach you, not breaching you by accident by hitting somebody else.
• 2:55
  I think that's the second piece. Then the third is really just about the dedication to security.
• 3:06
  One thing that I'm actually personally proud of is our security team and how it works with
• 3:13
  how it works with the community. We just brought on a wonderful person, Jerry Parello,
• 3:17
  who was the former CSO of the New York Stock Exchange as an advisor. That's just an example
• 3:23
  of how much we care about security and he doesn't hold back on his opinions and what we need to do
• 3:30
  and it's super helpful. What I'm really proud of is just a little while ago, we discovered,
• 3:37
  because we vet all the software that comes in a matter most and we vet it very carefully,
• 3:43
  as we were vetting a certain library for SSO, SAML authentication, we found a vulnerability
• 3:51
  in the GoLang language itself in the XML parser and this and we're like, wait, this can't be true
• 3:57
  and we looked at it and we're like, oh crap, this is true. We never, we never, you know, that never
• 4:01
  went into, we were never exposed to that vulnerability, our customers not exposed that vulnerability,
• 4:06
  but there were a lot of other people that used GoLang and used SAML SSO that had a vulnerability.
• 4:11
  It took us three months working with the GoLang team and working with the downstream libraries
• 4:16
  to figure out how do we do a coordinate disclosure. So the coordinate disclosure is tell the,
• 4:20
  like, we create the patch, matter most itself, not the GoLang, you know, folks, but we create the
• 4:24
  patch itself, we created, you know, a reference for how to fix it. We went through a very time
• 4:31
  series, we told the downstream libraries, we got them to prepare patches, we told the people,
• 4:35
  private and public companies and government institutions that were exposed to this vulnerability
• 4:41
  that was there so that they can fix it quickly and then we did a public disclosure.
• 4:46
  So we did it in a responsible way, we cascaded it, we gave people time, let people know it was
• 4:51
  important and this was a big deal. Like it would, you know, one of the tech giants, you know, had to,
• 4:55
  had a delay, one of, almost had a delay, one of their launches because of, because of this issue.
• 5:00
  So, you know, that's what it means to be part of the security community and really participate in
• 5:07
  not only the safety of our products and our customers, but of the general software community
• 5:11
  itself. So I think when you think about, you know, what it means to be great at security,
• 5:15
  I think it's not one or the other, it's about, you know, how do you, what is the whole story
• 5:20
  about your investment security? And that's the fact that it keeps things safe.
• 5:25
  I was going to say it's also the fact that it comes down to the culture of the company and where
• 5:30
  you put your focus and attention to. So, you know, I think it's probably less about closed versus open
• 5:37
  and more about how forward thinking and looking at the company is and where they want to spend their
• 5:41
  time and attention. I think that both both could, but if somebody is so, so hyper focused on building
• 5:47
  the best possible solution and is so hyper focused on security all the time, like you said, like
• 5:51
  you're probably, you're probably leading the way in some security and some of the things you do
• 5:55
  for security that any other company could do, but you're doing it just because it's a focus of yours.
• 5:59
  That's the sort of the takeaway that I get, but I want to, I want to pivot. So now we've spoken
• 6:06
  about like the engineering side of the business, but also, you know, the fact that you landed
• 6:11
  large enterprise customers starting a new company is also very impressive. So when you're taking
• 6:18
  a product like this to market, you just casually said we landed an enterprise customer. A lot of
• 6:23
  people would love that to happen to them when they're trying to take a new SaaS product to market.
• 6:28
  So how do you take a product like this to market? You understand you solve the problem that you have,
• 6:33
  but how do you identify your ICP, your buyer persona? How do you go in and how do you sell that
• 6:38
  first version when you have no other customers? What was your first customer strategy? How did that
• 6:43
  close? It's really about building something that people want. I think there's, you know,
• 6:48
  there's a simple algorithm to teach at YC, which is like, you know, talk to customers, build product,
• 6:54
  you know, exercise and exercise basically stay healthy, right? And that's that's so important
• 6:59
  because like people can burn out, but talk to customers and build product like that's the loop.
• 7:03
  And I think what happens is people realize how powerful that is. And talk to customers and just
• 7:08
  they're like, well, hey, you came to our website, you know, we open source Slack. Well, why open source
• 7:13
  Slack? And it's like, oh, we need this for like data privacy, like full stop. And we need this
• 7:17
  SSO feature. And we need we need this. It's like, would you pay for that? Yeah, we'll pay for that.
• 7:21
  Like, that's it. Like, that's the market discovery. Just, you know, put something on the web, create,
• 7:25
  like we use discourse as a forum. So we would like be able to talk back and forth. You know, we
• 7:29
  email, hey, contact us form. And people just filled the contact us form. Maybe like, okay, well,
• 7:33
  here's here's what I want to know. Like why why are you interested in Madermost? And like,
• 7:37
  and then you just put that down the drop down list. Oh, it's a hip chat replacement. Oh, it's for like,
• 7:41
  you know, we have we were deployed the free version. We want to get, you know, these paid features.
• 7:45
  So it's just conversations. And as you have more conversations, you can you can speed the
• 7:52
  conversations. You can have them. You can categorize things. So just don't stop talking to customers.
• 7:57
  And then don't stop building product. And then, you know, always stay healthy. That's really
• 8:01
  important. And do those three things. It's magical how quickly you can move. I think people,
• 8:05
  they get, especially in the early stages, they get very distracted. They're like, oh, should I be
• 8:08
  speaking to conference? Oh, should I be talking to investors? We spent very little time talking to
• 8:13
  investors. And everything just, you know, and the thing is investors don't really want to talk to,
• 8:21
  I mean, yeah, they want to kind of talk to the founders, but they really want to do is talk to your
• 8:24
  customers, right? So then, you know, whatever logo list you've got on your website, they're going
• 8:29
  in their back channeling. They're like, okay, what do you, why do you, why'd you buy that? And then
• 8:32
  when they, the good investors, when they're ready to talk to founders, they're very, very have the
• 8:37
  context. So just build a great business. And, and don't worry about like networking and speaking.
• 8:44
  And they're just just talk to customers, build the product like the business. Yeah.
• 8:51
  Yeah. Um, when you're scaling up, uh, and, and you, you're technical yourself, but one of the
• 8:57
  things that I thought was interesting, um, and one of the things that is interesting now, at least
• 9:02
  for me, because I came from a SaaS company where we had a lot of, we had a lot of difficulty with
• 9:07
  this, but hiring great talent and most importantly development talent, um, as a startup, when
• 9:14
  these are just obviously, uh, like these are numbers that I, I can't verify, but I, you know,
• 9:19
  you see the, the Netflix is of the world paying 300,000 plus for a developer, a software engineer.
• 9:26
  And, and, and then some, and then you look at some of the, you just look at some of the salaries
• 9:29
  in the valley. Like, how do you find and scale up great talent and retain great development talent
• 9:34
  when you don't have a 20, 50 million plus dollar investment? Yeah. That's a great question. I,
• 9:41
  like, so the people that are money motivated, great, go be, go work in hedge funds, right? Like just,
• 9:47
  you know, don't even think about Netflix. Just go straight to hedge funds. Like, and then, because
• 9:50
  they make a ton of money and, you know, they don't really create that much value, but like, you know,
• 9:55
  you're basically advanced day trading, like go create, you know, high, high velocity training,
• 9:59
  uh, trading, right? Like there's, if you want to make money, just go make money.
• 10:04
  If you want to build great software, if you want to, you know, think about, you know, the impact
• 10:09
  that you're going to have, if you're thinking to think about the personal growth that you're interested
• 10:14
  in, whether it's a technical, whether it's the languages or it's, you know, being on the manager
• 10:18
  track or however you think about it, you know, what, what is growth? Um, that is, you know, that's
• 10:25
  just a different frame. Think about the, with the frame we have is impact, it's growth and it's
• 10:29
  connections, right? Connecting, connecting to the other human beings that are in that are on the
• 10:36
  mission with you, right? So, um, for us, you know, the impact is about being open source. Like,
• 10:41
  you write it once and if you do it right, like, it never has to be written again, right? Like,
• 10:46
  we have, if you're going to open source slack, open source notion, open source trello, um, and,
• 10:51
  you know, coming up sort of open source, you know, huddles, right? Clubhouse, we're adding the
• 10:55
  audio piece too. You know, once you build that and it's an integrated suite, like, it never has to
• 11:00
  be built again. You've, you've made your mark in software history. Like if that's important,
• 11:05
  you know, that's, that's one of the pillars that we've got at Madermost. The second one is,
• 11:09
  is personal growth. Half of our managers at the company are promoted from within. So, you know,
• 11:14
  that track and that dedication to enabling managers and making them successful is also, you know,
• 11:19
  super important to us. Uh, and the third is, you know, we have staff in 20 countries. We have
• 11:26
  contribute, we have 4,000 contributors in the open source community and the ability to sort of like,
• 11:30
  you know, walk off a plane in like, you know, 20 different cities around the world and have people
• 11:34
  greet you at the airport. Have your friends, you know, show up and think that that connection that
• 11:39
  like concept that's like, oh, yeah, people aren't like machines in the, in the, and they're not
• 11:43
  cogs in a machine that they're here with other human beings to go build something that's meaningful
• 11:47
  together. You know, that's, you know, that's the people that we want. So if there's people that will
• 11:52
  care about, you know, we spend most of our life working. And if impact growth and connection
• 12:00
  is important, that's what your life's about, then we want to work with you. If your life is about,
• 12:06
  you know, how many Netflix options can I have in my portfolio, then you should work for Netflix.
• 12:14
  When you, when you try, so what are some of the strategies that you use to find people like that?
• 12:20
  Um, 56% of the staff that matter, 56% of our hires come from referrals. So the people that like,
• 12:29
  hey, I love working here. This is really great. You know, that's, that's more than half of our team.
• 12:34
  And I think when you, you think about NPS, Net Promoter Scores, like when people really enjoy
• 12:39
  working here and they tell their friends and they get, you know, more and more people and like that,
• 12:43
  those are the best hires.
• 12:45
  No, no, I was going to say so you focus on, you focus mostly on referrals and then you were going
• 12:51
  to say something else. Sorry. I think we're like the, it's like a two-second delay. So I never know.
• 12:54
  Go ahead. Sorry. Now the, so referrals is, is, um, referrals is the majority and we'd love to
• 13:00
  continue that and then keep going because that really means that people enjoy it here and love it
• 13:04
  and they're, they're bringing on, you know, all the folks that they know. The second biggest source,
• 13:07
  and then the early days definitely was, um, the open source community, 4,000 people contributing,
• 13:13
  and you're just saying, hey, let's work together. Like, let's, let's do this professionally. So,
• 13:19
  a few months after we released our commercial version, we got this person who pinged us and they're
• 13:26
  like, look, I've, I've never contributed open source before. But I would like to contribute a,
• 13:31
  a translation infrastructure for every string in your system. Like, I have got this pull request
• 13:37
  that localizes everything and I've translated everything to Spanish. And it's 10,000 lines of code.
• 13:44
  Would you be open to this pull request? Which is kind of bananas. So what happens is this person
• 13:49
  was working in South America and their company was reselling Manermost, but it had to be in Spanish.
• 13:54
  So this person actually translated all of Manermost the right way, not with hard-coded strings,
• 13:58
  but with the actual infrastructure. But every month, and we talked about why it's difficult to
• 14:03
  fork Manermost. Every month we're pushing out new features and innovations. It took them a week
• 14:06
  to like merge it back in. So it was in this person's best interest to offer that upstream so that we
• 14:13
  could, you know, put that in the product, make it better for everyone and make that person's life
• 14:17
  easier. We hired that person. So, you know, that's just a great way, you know, to, to say, because
• 14:24
  it's a great offer. It's like, well, just stop what you're doing and want to work on the main
• 14:28
  lane line product rather than derivative. So that's another great path to hiring.
• 14:33
  Thanks for tuning in. If you found this valuable, don't forget to hit that subscribe button so you
• 14:37
  never miss an episode. And if you want to dive deeper into this conversation, check out the links
• 14:41
  in the description to watch the full episode. See you in the next one.