Latest / The Data Flowcast: Mastering Apache Airflow ® for Data Engineering and AI / The Software Risk That Affects Everyone and How To Address It with Michael Winser and Jarek Potiuk

Transcript

The Software Risk That Affects Everyone and How To Address It with Michael Winser and Jarek Potiuk · The Data Flowcast: Mastering Apache Airflow ® for Data Engineering and AI

• 0:00
  SPEAKER_03: We have the Airfo Core, which has a number of dependencies directly.
• 0:04
  SPEAKER_03: They have their own dependencies as well.
• 0:06
  SPEAKER_03: So that's already a big number, around two hundred.
• 0:09
  SPEAKER_03: And all the rest, the five hundred of them, is all the extensions, but they are also released and published by us, by the community, the providers, so-called providers, and they bring even more dependencies in.
• 0:20
  SPEAKER_03: So for now, we are focusing on the core dependencies only and making sure that Airflow 3 that we release very soon, hopefully, will be much more secure in terms of dependencies than Airflow 2 was.
• 0:32
  SPEAKER_03: Like at least much more, we will be much more aware of potential problems that we have with our dependencies.
• 0:54
  SPEAKER_00: Hey Airflow community, Airflow3 is here and we are taking it on the road.
• 0:59
  SPEAKER_00: Join the Astronomer Roadshow for an exclusive deep dive into the latest features, hands-on demos, and expert insights, all in a city near you.
• 1:07
  SPEAKER_00: We'll be in London in May, New York City in June, Sydney in July, San Francisco in July, and Chicago in August.
• 1:15
  SPEAKER_00: Don't miss your chance to connect with the Airflow community and get the inside scoop on what's next.
• 1:20
  SPEAKER_00: Register now.
• 1:21
  SPEAKER_00: The link is in the show notes.
• 1:25
  SPEAKER_01: Hi everyone.
• 1:26
  SPEAKER_01: Welcome to the Data Flowcast.
• 1:28
  SPEAKER_01: I'm your host, Kenton Dannis, and today I'm joined by two lovely folks, uh Michael Windsor, who is a co-founder of the Alpha Omega Foundation, and Yarek Podjak, who is an Apache Airflow PMC member and committer.
• 1:40
  SPEAKER_01: Yarek and Michael, how are you both doing today?
• 1:42
  SPEAKER_03: I'm well, thanks.
• 1:43
  SPEAKER_03: It's great to be here.
• 1:44
  SPEAKER_03: Thanks for having us.
• 1:45
  SPEAKER_03: And I'm fantastic.
• 1:47
  SPEAKER_03: It's really great to be at the Data Flowcast.
• 1:50
  SPEAKER_01: Yeah, wonderful.
• 1:51
  SPEAKER_01: Great to have you both on.
• 1:52
  SPEAKER_01: I think you were both traveling recently.
• 1:55
  SPEAKER_01: Is that right?
• 1:56
  SPEAKER_04: Yeah, I was in Europe for we were both there at FOSDEM, and then I had a few other conferences before and after, and then offsite.
• 2:02
  SPEAKER_04: So of course I got sick.
• 2:04
  SPEAKER_04: He came back, I brought my cold home, which is now brewing with my wife's cold to create a super virus that will wipe us all out or something.
• 2:11
  SPEAKER_01: So of course.
• 2:12
  SPEAKER_01: I also just came back from an offsite with some sort of flu.
• 2:16
  SPEAKER_01: So fortunately recovered this week, but it is that time of year.
• 2:20
  SPEAKER_01: Yeah.
• 2:20
  SPEAKER_04: It's called the Fosdem flu for a reason.
• 2:23
  SPEAKER_04: But yeah, I didn't get it this deep on the road.
• 2:25
  SPEAKER_03: Usually I get it as well.
• 2:27
  SPEAKER_03: I didn't get it this time.
• 2:28
  SPEAKER_03: And it's three weeks' break for me from traveling.
• 2:31
  SPEAKER_03: But then thank mostly thanks to the thing that we do together with Michael, I'll be traveling like to five or six conferences every month, like two places or something.
• 2:41
  SPEAKER_03: Speaking about like security and airflow.
• 2:44
  SPEAKER_03: Yeah, it's gonna be a bit crazy.
• 2:46
  SPEAKER_01: Oh my gosh.
• 2:47
  SPEAKER_01: Yeah, lots of conferences.
• 2:49
  SPEAKER_01: That's how you both are very busy.
• 2:50
  SPEAKER_01: They are bearing the lead a little bit, but let's go ahead and dive in.
• 2:54
  SPEAKER_01: So, as you just said, for today's podcast, we're going to discuss a collaborative effort with Alpha Omega, uh, the PSF, and the ASF to help secure the Airflow ecosystem.
• 3:04
  SPEAKER_01: So, security-related discussion today, everybody's favorite topic.
• 3:08
  SPEAKER_01: Uh, but before we dive into security, I want to start with some background on both of you.
• 3:13
  SPEAKER_01: Uh, for folks who might not be familiar with either of you.
• 3:16
  SPEAKER_01: Let's start with how did you both get involved in the Airflow project?
• 3:20
  SPEAKER_03: So I was working at my software house, Polydia, in Poland.
• 3:24
  SPEAKER_03: And basically, Google hired our company to contribute to Airflow, and I did it for three years.
• 3:29
  SPEAKER_03: But I spent 150% of my time on Airflow.
• 3:33
  SPEAKER_03: Not only what Google asked, but I a lot of my own contributions and became a committee PMC member.
• 3:38
  SPEAKER_03: And then when my software houses were bought by Snowflake, after three months, I decided I want to stay with uh Airflow, and I quit Snowflake, principal engineer job.
• 3:48
  SPEAKER_03: I quitted and started to be a freelancer on Airflow without any revision like how I will earn money or what it means to me, because I wanted to stay with Airflow and I wanted to contribute to Airflow.
• 4:01
  SPEAKER_03: And I couldn't do it at the same time as working in Snowflake because I didn't have time.
• 4:05
  SPEAKER_03: But now I'm like full-time employed.
• 4:08
  SPEAKER_03: Companies like Astronomer, Google, World Simple, and a few other companies pay for my time as a contributor full-time, and I'm super happy for like almost four years now.
• 4:19
  SPEAKER_03: Uh just full-time freelancing on Airflow.
• 4:23
  SPEAKER_01: Yeah, that's great.
• 4:24
  SPEAKER_01: Based on the dev list, Yarek, I think you're certainly one of the most active committers for Airflow.
• 4:30
  SPEAKER_03: Certainly, I'd rather write the longest email.
• 4:33
  SPEAKER_03: There is absolutely no uh no competition there.
• 4:36
  SPEAKER_01: Yes.
• 4:37
  SPEAKER_01: That's great.
• 4:38
  SPEAKER_01: And Michael, what about you?
• 4:40
  SPEAKER_04: So I I'll skip the long story.
• 4:43
  SPEAKER_04: I co-founded Alpha Omega with a friend of mine at Microsoft at a time when we were both, I was at Google at the time, we were trying to figure out how do we actually make progress against sort of the open source security risks that we were all starting to wake up to.
• 4:59
  SPEAKER_04: And we started doing things and figuring things out.
• 5:03
  SPEAKER_04: And one of the first engagements we had was to pay for the Python Silver Foundation to hire a security engineer in residence.
• 5:11
  SPEAKER_04: And the basic idea here is that until then, security was everybody's job, which means it was nobody's job.
• 5:17
  SPEAKER_04: And there were a lot of things that were just not making as much progress as we all would have liked.
• 5:21
  SPEAKER_04: And a gentleman named Seth Larson, who had a long history in the community, took the job and really just did amazing work.
• 5:28
  SPEAKER_04: And last year, Seth and I presented at PyCon a little bit of a sort of what we got done in the past year.
• 5:36
  SPEAKER_04: And by we, Seth, I want to be super clear.
• 5:38
  SPEAKER_04: My role here is to unblock things and to help Alpha Omega find the right projects to invest in.
• 5:43
  SPEAKER_04: And then we gave a grant to the Python Software Foundation to hire Seth.
• 5:48
  SPEAKER_04: And then we just talked about it.
• 5:50
  SPEAKER_04: And it was actually one of the most fun talks ever because we had a lot of fun just doing it, putting it together.
• 5:55
  SPEAKER_04: But also we have genuinely built a lot of friendship and partnership in our work together.
• 5:59
  SPEAKER_04: And it has made a significant difference in the Python ecosystem.
• 6:03
  SPEAKER_04: And at that talk, unbeknownst to us, was Yarek, who was interested in learning about this, had already built up his background in security and cared about it.
• 6:12
  SPEAKER_04: And when he saw our talk, he's like, You got to come and give this talk at the Airflow conference.
• 6:16
  SPEAKER_04: And I'm like, sure, but let's not do the same talk.
• 6:19
  SPEAKER_04: Let's do something.
• 6:21
  SPEAKER_04: What can we do together that's worth talking about in the Airflow context?
• 6:24
  SPEAKER_04: And that's how we sort of started working together.
• 6:28
  SPEAKER_04: And I have to say, uh, I am the luckiest person in the world because I get to work on really meaningful work with open source security, and I get to work with people like Yarek and Seth and others in such a wonderful context.
• 6:39
  SPEAKER_04: So it's really great.
• 6:40
  SPEAKER_03: And just to tell it back, and I'm super lucky to work with people like Michael and all the other people that he brings together because Alpha Omega just brings people together.
• 6:48
  SPEAKER_03: They are talking about security together, and we exchange the knowledge, the information, the learnings.
• 6:54
  SPEAKER_03: And that's a very great place to be for if you want to do security in open source.
• 6:59
  SPEAKER_04: Yeah, of all the things that we do, the least obvious and I was to say most impactful is in fact how we have connected the security sort of thinking people and just the awareness of security across multiple different ecosystems, from languages to foundations to whatever.
• 7:19
  SPEAKER_01: Yeah, that's great.
• 7:20
  SPEAKER_01: I love that story.
• 7:22
  SPEAKER_01: So with that background, let's talk a little bit about more about security.
• 7:28
  SPEAKER_01: And before we dive into what you have done with the Airflow project, tell me a little bit more about software supply chain security in general.
• 7:36
  SPEAKER_01: What does that mean and why should people care about it?
• 7:40
  SPEAKER_04: So I'll dive in here.
• 7:41
  SPEAKER_04: I spend all my life talking about this.
• 7:43
  SPEAKER_04: There are, whether it's open source or otherwise, everybody using software is consuming components from someone else.
• 7:50
  SPEAKER_04: And a lot of it is open source today.
• 7:52
  SPEAKER_04: And there are very few software projects today that don't use at least some open source somewhere in their dependency.
• 7:59
  SPEAKER_04: And there are really three kinds of risks to think about here.
• 8:03
  SPEAKER_04: So a simple acronym is correctness, integrity, and availability.
• 8:08
  SPEAKER_04: So correctness is about the intrinsic vulnerabilities in the source code that you're using, not intentional ones, just accidents and errors in coding.
• 8:16
  SPEAKER_04: Integrity is about tampering, where an attacker is actually tampering with the source code in order to introduce weaknesses that can then use be used in an attack.
• 8:24
  SPEAKER_04: And availability is if the sustain it in other words is so the sustainability, like that code has to be a living, breathing thing, and is it being maintained, is it continuously available?
• 8:34
  SPEAKER_04: And if the component you're using stops updating, or in some cases is taken down from the internet and not available anymore, what do you do?
• 8:42
  SPEAKER_04: And so these are the three main types of risk.
• 8:46
  SPEAKER_04: Because so much of our entire software ecosystem depends upon open source components, much of which is maintained by volunteers or eager beavers like Yarrick who work too hard for their own good, right?
• 8:59
  SPEAKER_04: There is a technical debt that is accumulated around security issues, and it's also one of knowledge where not everybody is a security expert.
• 9:07
  SPEAKER_04: And so, how do we change that story?
• 9:08
  SPEAKER_04: That's really what Alpha Omega is about.
• 9:13
  SPEAKER_03: And let me add to that very quickly.
• 9:15
  SPEAKER_03: So Airflow is very interesting for Michael, Alpha Omega, and Python, because like we are very deeply embedded in the Python ecosystem.
• 9:23
  SPEAKER_03: And the number which Michael always said, but now I will tell you is like when we started, it was like Airflow had 719 independencies.
• 9:31
  SPEAKER_03: A lot.
• 9:31
  SPEAKER_03: This is like one of the biggest projects out there in PyPI.
• 9:35
  SPEAKER_03: Uh and we really, in order to get to get security, we really have to know all of them.
• 9:40
  SPEAKER_03: It's every security, every vulnerability can bring a new security vulnerability problem.
• 9:45
  SPEAKER_03: So we really have to, over the period of some some time, we have to learn a lot about all those dependencies.
• 9:52
  SPEAKER_03: And that's how all our discussion basically started.
• 9:57
  SPEAKER_01: Yeah, that's super interesting.
• 9:59
  SPEAKER_01: So tell me a little bit more about how this affects Airflow specifically.
• 10:04
  SPEAKER_01: Yarek, you just mentioned a little bit of it, but tell me more about your initial evaluation of Airflow's security and kind of what that led you to do.
• 10:13
  SPEAKER_03: Also, that to give a little bit of background.
• 10:15
  SPEAKER_03: We started two years ago with Sovereign Tech Fund, which is a German agency that also funds security in open source.
• 10:23
  SPEAKER_03: We started a project to improve security of airflow.
• 10:26
  SPEAKER_03: And I we succeeded, like in the sense that we have a very strong security team right now, very well established processors, and we take care about security of airflow very seriously.
• 10:37
  SPEAKER_03: And we have almost no vulnerabilities which are open.
• 10:40
  SPEAKER_03: We quickly answer to researchers and reporters and all the stuff.
• 10:45
  SPEAKER_03: The problem is that this only affects this is only about Airflow, and we have those 719 dependencies.
• 10:51
  SPEAKER_03: So we have to think, especially now when we go to Airflow 3, which is part of it, is really the part of the goal is to make it more enterprise ready.
• 11:00
  SPEAKER_03: It is enterprise ready, but we want to have it even more ready for enterprises.
• 11:05
  SPEAKER_03: It's just like how to adapt to the fact that we have those dependencies.
• 11:09
  SPEAKER_03: We have to, they are potentially impacting our security.
• 11:13
  SPEAKER_03: And also the regulations are coming.
• 11:16
  SPEAKER_03: So this is something that maybe Michael can talk about a little bit uh later.
• 11:20
  SPEAKER_03: But we have regulations coming in security in software development, and we have to be ready and we have to have answers if our users are asking us about our security, but also our dependency security.
• 11:34
  SPEAKER_03: And the impact it has on Airflow is that surprisingly, there is a small framework that also Michael would tell about what we do with our dependencies.
• 11:44
  SPEAKER_03: But even now, even after we started it and did the initial evaluation, we already made decisions and we are about to make more decisions about okay, this dependency is something that we want to uh work with.
• 11:57
  SPEAKER_03: And that dependency, yeah, we have to replace because something is uh not there is a potential problem.
• 12:03
  SPEAKER_03: We are afraid of of keeping that.
• 12:05
  SPEAKER_03: And we would like to do continue that and make sure that we basically review all of them, and we are pretty sure that what we are using is maybe not secure, but it has good processes, people who are maintaining it.
• 12:17
  SPEAKER_03: That they are they're responding to our requests, they are called collaborating when we ask them.
• 12:21
  SPEAKER_03: So all this all these things that make it much easier for us when so some problems happen in the future, when we have to talk to them and we have to resolve those security issues much quickly, quicker.
• 12:32
  SPEAKER_03: We know who to talk to and they know us.
• 12:34
  SPEAKER_03: So that's basically how it impacts Airflow.
• 12:37
  SPEAKER_03: We are building the ecosystem of people who are taking care about security, who depend on each other, and who can help each other when there is a need to quickly react when there is a security issue and even prevent the issues, because we also work on like improving their maintenance efforts, improving their processes, improving how they are approaching security, and we are helping them with that.
• 13:01
  SPEAKER_02: This episode is brought to you by Astronomer, creators of Astro, the leading fully managed airflow service designed for the modern data stack.
• 13:11
  SPEAKER_02: Whether you're orchestrating large language models, implementing a data mesh architecture, or streamlining complex workflows, Astro empowers your team to focus on innovation, not infrastructure.
• 13:22
  SPEAKER_02: To see how you can maximize Airflow's potential within your data ecosystem, visit www.astronomer.io.
• 13:31
  SPEAKER_01: I'm curious when you talk about the how many dependencies Airflow has because it's such a big project.
• 13:37
  SPEAKER_01: Are some of those dependencies coming through with the provider ecosystem that Airflow is built on?
• 13:42
  SPEAKER_01: Is that one of the biggest offenders, I would imagine, just when you're trying to plug into so many different tools?
• 13:47
  SPEAKER_03: It's one of the biggest.
• 13:48
  SPEAKER_03: So just to give a little bit of perspective, so we have the Airflow Core, which has a number of dependencies directly.
• 13:54
  SPEAKER_03: They have their own dependencies as well.
• 13:57
  SPEAKER_03: So that's already a big number, around 200.
• 14:00
  SPEAKER_03: And all the rest, the 500 of them, is all the extensions, but they are also released and published by by us, by the community, the providers, so-called providers, and they bring even more dependencies in.
• 14:11
  SPEAKER_03: So for now, we are focusing on the core dependencies only and making sure that Airflow 3 that we release very soon, hopefully, will be much more secure in terms of dependencies than Airflow 2 was.
• 14:24
  SPEAKER_03: Like at least much more, we will be much more aware of potential problems that we have with our dependencies.
• 14:30
  SPEAKER_03: And some of them are already removed, some of them will be removed, some of them will work with us on improving security, and then the providers will be next.
• 14:38
  SPEAKER_03: So we are now focusing mostly on the core part of our dependencies.
• 14:43
  SPEAKER_04: And a lot of what Yarick talked about there speaks to an organization that has a significant engineering set of resources contributed by the various partners around Airflow, starting to take care of their supply chain.
• 14:57
  SPEAKER_04: And so this approach, which honestly Yarick and I worked on together, came out of thinking about the uh somewhat infamous XZutils situation where there was a small component that most people were not paying attention to and all of a sudden became an attack vector.
• 15:13
  SPEAKER_04: And the problem was that it everything was fine until it wasn't.
• 15:18
  SPEAKER_04: And nobody was really paying attention upstream to an individual who was actually going through real challenges.
• 15:23
  SPEAKER_04: And unfortunately, every project, whether they are open source or commercial, has a habit of treating their upstream supply as if it came down from the sky on the back of unicorn with rainbows everywhere, like it's perfect, not our problem.
• 15:36
  SPEAKER_04: But in practice, every dependency you have and all the dependencies they have, that transitive closure of your dependencies, has total access to your runtime environment and your build environment.
• 15:47
  SPEAKER_04: And so the economics of it are really tricky.
• 15:50
  SPEAKER_04: It's very hard to go and help people in that context.
• 15:53
  SPEAKER_04: They're already working nights and weekends.
• 15:54
  SPEAKER_04: You can't buy more nights and weekends.
• 15:57
  SPEAKER_04: And sometimes they're not willing to have that help or they're not, they don't know you.
• 16:00
  SPEAKER_04: You're coming and saying, I'm here to do from the government, I'm here to help you.
• 16:02
  SPEAKER_04: Doesn't always get you the right reaction.
• 16:04
  SPEAKER_04: And now, so in the post-XEUTELS world, somebody showing up saying, I'm here from the government, I'm here to help you, is not going to generate an easy response, especially at a time of crisis.
• 16:15
  SPEAKER_04: And so we ended up thinking about this across what does a software project that consumes stuff need to do to make sure its dependencies are healthy, right?
• 16:24
  SPEAKER_04: The sustainability and health of those dependencies is actually more important than the current set of vulnerabilities they have.
• 16:31
  SPEAKER_04: And that was like a key thing that Yarrick and company put together was not to go off and try to audit the code of each of these projects, but to look at the projects as a whole and say, is this a healthy project?
• 16:42
  SPEAKER_04: Is it adding value to our world?
• 16:44
  SPEAKER_04: Do we need it?
• 16:45
  SPEAKER_04: And from there came a framework that we call the three F's.
• 16:48
  SPEAKER_04: Right?
• 16:48
  SPEAKER_04: And everybody using software needs to look at their dependencies and do one of the three F's.
• 16:53
  SPEAKER_04: They need to fix it, they need to fork it, which means taking the bits of the you need and making it your own, right?
• 16:59
  SPEAKER_04: Or they need to forget about it.
• 17:03
  SPEAKER_04: And they've done all three.
• 17:07
  SPEAKER_04: And one of the things that Yarek was hinting about was actually really amazing, which is when we would find we also did some automated vulnerability scans with a company called Open Refactory.
• 17:16
  SPEAKER_04: They helped us out and they did a bunch of scanning and found some vulnerabilities in some of the dependencies.
• 17:21
  SPEAKER_04: And when they found those reports, they were by and large ignored because they looked like automated AI type reports, and open source project maintainers are overwhelmed with these kinds of problems right now.
• 17:32
  SPEAKER_04: But when one of the Airflow community would show up on the bug report and mention, hey, we're from Airflow, this matters to us, would you mind taking a look and creating a human connection?
• 17:43
  SPEAKER_04: Everything changed.
• 17:45
  SPEAKER_04: And that's really what matters, right?
• 17:47
  SPEAKER_04: Is that the sustainability of a project actually depends as much on its community working on its own code as that same community able to invest in its upstream supply.
• 17:58
  SPEAKER_04: And that is really what's starting to happen in various ways within the Airflow engineering community.
• 18:03
  SPEAKER_04: And it's pretty exciting.
• 18:05
  SPEAKER_03: Yes.
• 18:05
  SPEAKER_03: And also to just to add to it, is just so like we can do it because we are open source maintainers.
• 18:11
  SPEAKER_03: And when maintainers talk to the maintainer, the the conversation is much more, much different than you have like a commercial user talking to you and expecting something from you.
• 18:20
  SPEAKER_03: When I'm thinking about that for the Apache Software Foundation, which also is a big part of this puzzle, and as main maintainers in the open source projects, just being there, we are the guarantee for our stakeholders, like Amazon, Google, Astronomer in case of Apache Airflow, and other projects have other stakeholders.
• 18:39
  SPEAKER_03: We are the guarantee that we can go and help those dependencies and they will be willing to work with us as maintainers, as open source people, rather than getting people from Amazon checking hundreds of projects they have, putting them in the spreadsheets, and analyzing them, and maybe sending the spreadsheets, spreadsheet reports to those maintainers, like those maintainers will not respond.
• 19:04
  SPEAKER_03: They will not be happy to help because they will be overwhelmed.
• 19:07
  SPEAKER_03: And it's a completely different story when you have uh your direct user, Apache Erfu, which you know that is important, and people from the project are coming to you, and they are the same people like you, like they're also maintainers, they understand your problems, they want to help you, and you can trust that they can help you because you you see their code.
• 19:26
  SPEAKER_03: That's what makes a huge difference in making the whole ecosystem responding to security issues and reacting to them and preventing them.
• 19:34
  SPEAKER_04: And this this is a pattern that can scale.
• 19:37
  SPEAKER_04: So if you think about the current Airflow community today, right, and imagine the number of companies and organizations using Airflow is dramatically larger than those contributing to it, right?
• 19:46
  SPEAKER_04: But those can all those companies still have the same risk.
• 19:50
  SPEAKER_04: And a lot of companies are sitting here saying, I don't know how to go off and start doing something that'll make a difference.
• 19:57
  SPEAKER_04: And the answer is not for those companies to start filing bug reports on vulnerabilities way upstream, right?
• 20:03
  SPEAKER_04: But if those companies that are using Airflow actually want to be part and control their destiny and to have a better sense of how to use Airflow effectively and how to keep it secure, right, it's easy.
• 20:14
  SPEAKER_04: Show up in the Airflow community, start working there, and take on some of this dependency graph risk as part of the work to be done.
• 20:21
  SPEAKER_04: And then when something happens and you need to make adjustments or apply one of the three F's, you're in a position to do so as opposed to having it happen to you.
• 20:29
  SPEAKER_04: And the companies that are most engaged in airflow today are those that have found a direct path to revenue for that product, right?
• 20:36
  SPEAKER_04: But they are doing so in a way that creates a common good for everybody, that's great.
• 20:40
  SPEAKER_04: But even those that are self-hosting it have operational costs and operational risks that they should be thinking about, and this is a way to invest in that.
• 20:50
  SPEAKER_01: Yeah, that makes sense.
• 20:51
  SPEAKER_01: And maybe it leads me to my next question.
• 20:54
  SPEAKER_01: So maybe you've already answered this, but that's if you could give a call to action for anybody listening to this podcast who might be using Airflow at their company, what is it?
• 21:04
  SPEAKER_01: Is it get involved in the open source project in the way that you just described?
• 21:09
  SPEAKER_04: I I I probably jumped a gun, yes.
• 21:11
  SPEAKER_04: I think in in the immortal words of uh of Jean-Luc Picard, engage.
• 21:16
  SPEAKER_04: And that engagement doesn't have to mean committing 10 engineers to work full-time on the project, but if you have no engineers engaged with the Airflow project, you are the tail being wagged by the dog, right?
• 21:29
  SPEAKER_04: You have you you and literally that's it.
• 21:31
  SPEAKER_04: You have no influence over the direction, you don't even know what's going on, right?
• 21:35
  SPEAKER_04: If you are a significant user of Airflow, whether you have an engineer or not, maybe it's an operational person, show up at the meetings, be involved and understand the risks that are there, and then help out.
• 21:47
  SPEAKER_04: Yes.
• 21:47
  SPEAKER_04: And there's remarkably, it doesn't require tremendous expertise to get engaged.
• 21:52
  SPEAKER_04: It's sometimes it's just a question of showing up and a bug and saying, hey, I'm from Airflow.
• 21:57
  SPEAKER_04: There's a vulnerability on your project, we'd love it if you You can fix it, feel free to give me a call.
• 22:02
  SPEAKER_04: That human connection is all that matters.
• 22:05
  SPEAKER_03: Yes.
• 22:05
  SPEAKER_03: And just to add to it, is the it's just showing up and showing the interest is a huge thing for maintainers.
• 22:13
  SPEAKER_03: Like very often, and uh I saw it because I spoke to a number of them already.
• 22:18
  SPEAKER_03: So, like in our project, I'm already establishing the connection.
• 22:21
  SPEAKER_03: I'm already will be helping very soon.
• 22:23
  SPEAKER_03: And a number of those maintainers are reached out to are very, very happy to talk to me and to explain what they are doing and listen what I want to tell to them.
• 22:33
  SPEAKER_03: But also, it's just it's the first time somebody who is using them is interested in their security and asking them, can I help?
• 22:42
  SPEAKER_03: Really?
• 22:42
  SPEAKER_03: Because a few of them is just they are just doing it on their own.
• 22:45
  SPEAKER_03: They they took it over from someone some time ago, and they know they have a big number of users, they those users are raising issues, sure.
• 22:52
  SPEAKER_03: But someone coming to them and said telling, okay, how can I help you with the security?
• 22:56
  SPEAKER_03: I have this and this idea.
• 22:57
  SPEAKER_03: Let's talk, let's do something together.
• 23:00
  SPEAKER_03: This is something new, and something that they see, oh, that's fantastic.
• 23:04
  SPEAKER_03: Let's just do it together.
• 23:05
  SPEAKER_03: That was the response mostly I had from people.
• 23:07
  SPEAKER_03: Not only, there was another thing, and this is also a very important uh aspect, I think, and and call to actions for me.
• 23:14
  SPEAKER_03: Know your dependencies and know which ones are risky and which are not.
• 23:18
  SPEAKER_03: Even if you don't talk to the maintainers.
• 23:21
  SPEAKER_03: And we I found just by reaching out, I found quite a few problems that we will have to get rid of very soon.
• 23:29
  SPEAKER_03: Just by knowing that, no, like this is probably a huge risk for the project if we keep it.
• 23:34
  SPEAKER_03: Because either the maintainer wants to get out and not maintain it anymore because they are afraid of security, which happened actually, they are afraid they will be responsible and they said, Okay, I'm just pulling out my project from the Pi PI and what?
• 23:49
  SPEAKER_03: Uh also either this or we find out that there is no one.
• 23:53
  SPEAKER_03: Like we try to read, but nobody nobody responds.
• 23:55
  SPEAKER_03: The project hasn't been maintained for two years, and what?
• 24:00
  SPEAKER_03: So knowing that and making decisions what to do, these three F's is very important.
• 24:05
  SPEAKER_03: Even today, just to give an example, as not only result of that, but Airflow 3, I two projects that we work with.
• 24:12
  SPEAKER_03: One of them I sent an email to the devilist, let's get rid of this project.
• 24:16
  SPEAKER_03: And the second one, I reached out to the maintainer.
• 24:19
  SPEAKER_03: What can we do to upgrade to the next version to get the new version because we need it?
• 24:24
  SPEAKER_03: Like uh otherwise, we'll have to do fork.
• 24:27
  SPEAKER_03: So, like the first forego, the second fork, and we already fixed uh a few numbers of issues.
• 24:32
  SPEAKER_03: So those those three Fs we already applied, actually, and we are doing that every day, basically, or continuously.
• 24:38
  SPEAKER_03: And something like that should happen with anyone, even commercial users or people who are using uh other software, just knowing what they have and assessing how risky those dependencies are, uh, and deciding what to do with them.
• 24:53
  SPEAKER_03: That's that's the important thing.
• 24:55
  unknown: Yeah.
• 24:56
  SPEAKER_01: I love the plug for engagement.
• 24:57
  SPEAKER_01: I know we've got some PMC members at Astronomer and Yard, maybe you have said this as well, but I uh that always throw around the term like open source is free as in puppy, which I love.
• 25:08
  SPEAKER_01: The this idea of yes, it's free, but it's not without work.
• 25:12
  SPEAKER_01: And I think as you're describing like that engagement, especially if you're using it in a commercial sense and relying on it as a lot of companies do, you should be engaged in that way.
• 25:22
  SPEAKER_04: Yeah, even if you are just using Airflow as is and you don't care about the upstream, right?
• 25:28
  SPEAKER_04: You are almost certainly going to encounter bugs and problems that need to be fixed.
• 25:31
  SPEAKER_04: And if you file those bugs as an anonymous bug filer with no connection to the community, you're gonna get a fairly anonymous response.
• 25:38
  SPEAKER_04: If you show up on a regular basis and they know you, and then you file a thing you've considered and you understand the context, then go, oh great, that's super helpful.
• 25:44
  SPEAKER_04: We'll get on it right away.
• 25:46
  SPEAKER_04: So even just very selfishly in terms of helping an organization use Airflow more efficiently, engagement wins every time.
• 25:54
  SPEAKER_01: I love that.
• 25:55
  SPEAKER_01: This is a super nuanced and important topic.
• 25:58
  SPEAKER_01: We could continue talking about it probably for hours, but we are about out of time.
• 26:03
  SPEAKER_01: So I will close this out and just ask the two of you what is the best way for folks to get in touch with you?
• 26:09
  SPEAKER_01: And I'll add to that if they are interested.
• 26:11
  SPEAKER_01: Hopefully they are after listening to this and engaging on this topic in particular.
• 26:15
  SPEAKER_01: What is the best way for them to do that?
• 26:20
  SPEAKER_03: With me, the easiest way to get hold of me is to ask a very difficult question and with good description of the problem you have at Airflow Slack, I will show up and we'll try to help you.
• 26:31
  SPEAKER_03: That's how to do it.
• 26:32
  SPEAKER_03: But this question has to be asked, explaining what the problem is and showing that you have done the work.
• 26:37
  SPEAKER_03: But to be like on the normal things, like the GitHub is one of those social networks I consider right now as one of the important ones.
• 26:45
  SPEAKER_03: Of course, LinkedIn, email.
• 26:47
  SPEAKER_03: Actually, my email is available on the GitHub.
• 26:49
  SPEAKER_03: You can actually reach out to me uh there if you want.
• 26:52
  SPEAKER_03: And yeah, though those are the those are the ways.
• 26:56
  SPEAKER_04: And I think I would suggest, first of all, if anybody wants to chat with me in the context of Alpha Omega, alpha-omega.dev is our website.
• 27:05
  SPEAKER_04: There's information there for contacting us, and that'll get through to me.
• 27:08
  SPEAKER_04: I would also encourage folks to show up in the OpenSSF working groups or Slacks where there's an awful lot of work being talked and discussed around supply chain security.
• 27:17
  SPEAKER_04: I'm active there as well, but there are a lot of really great people doing great work in that context as well.
• 27:23
  SPEAKER_01: Okay.
• 27:24
  SPEAKER_01: That's perfect.
• 27:25
  SPEAKER_01: Yeah, we'll throw all of that in the show notes as well so that people can click on it if they didn't catch that as you said it.
• 27:31
  SPEAKER_04: But that's I would encourage people to read our annual report, the Alpha Omega Annual Report.
• 27:36
  SPEAKER_04: Yarick has a great section in there about the airflow work as well.
• 27:39
  SPEAKER_04: And you can really see how this work gets done across all these different ecosystems.
• 27:43
  SPEAKER_04: And Yarick and I have done a bunch of talks on this now.
• 27:46
  SPEAKER_04: There'll be more to come as we keep diving into it.
• 27:48
  SPEAKER_04: So there'll be more material as we keep.
• 27:50
  SPEAKER_04: This is a rich mind vein of insight and improvements on security and has had tremendous influence on other work that we're doing as well.
• 27:57
  SPEAKER_04: So lots to come.
• 27:59
  SPEAKER_01: Amazing.
• 28:00
  SPEAKER_01: Love to hear that.
• 28:00
  SPEAKER_01: Thank you both so much for coming on.
• 28:02
  SPEAKER_01: It was great to have you.
• 28:03
  SPEAKER_04: Thanks for having us.
• 28:04
  SPEAKER_04: Thank you.
• 28:05
  SPEAKER_04: Thank you, Kenton.
• 28:08
  SPEAKER_02: Thanks for joining us for the latest episode of the Data Flowcast, mastering airflow for data engineering and AI.
• 28:15
  SPEAKER_02: You'll find links in the show notes to any resources mentioned in today's show.
• 28:19
  SPEAKER_02: If you're enjoying our podcast, please subscribe so you never miss an episode and leave us a five star review.