Growth through Secure SaaS Solutions in the Devices world

Wade Erickson (00:00):

Welcome everyone to another episode of Tech Leaders Unplugged. I'm going to get unplugged today with Steve Barriault, VP FIeld Engineering IoT of Canonical, and we're going to be talking about growth through securing SaaS software in the device world talking about embedded software, IOT devices, securing the software that those IoT devices communicate to, and all things in that area. So, thanks Steve for joining us.

Steve Barriault (00:45):

And that's my pleasure. Thank you for the invitation.

Wade Erickson (00:48):

Appreciate your time, spending some time here with our community. So, yeah, I'd like to start out with just introducing a little bit about canonical yourself, and then let's just go into the topic.

Steve Barriault (00:59):

Sure. So basically, I'm heading a group that is field engineering. So what are we talking about pre-sales? So obviously we go and meet customers, discuss about their needs, what are their challenges, what keeps them awake at night, and try to come up with solutions with them. Often it's those are products, right? But it's also usually in the embedded world, there's quite a bit of customization that needs to be done. So my team is active on that. We also do some of the deliveries of these services that we can come up with. Now, just so if I backtrack for a second, people are like, okay, what, what is canonical, right? What, what are you guys doing? We are actually the organization behind a Linux distribution called Ubuntu. I'm kind of told it's pretty popular out there. So a lot of people on the Colorado say, ah, canonical, right? So they, they're doing Ubuntu, and so that's first off, you know, like people will say yes, you know, like, I have Ubuntu on my desktop, I have Ubuntu on my server. I know what you're talking about, but really, you folks are doing devices. You're doing you know, IO OT and embedded software. The answer is yes, and we are doing that partially with a version of Ubuntu OS that is called Ubuntu Core. So how is that different from your regular Ubuntu distribution? Well, it has been completely redesigned for few things. So first of all, smaller footprint, obviously you would, you would expect this, for example, being a board that we, you might use in your products to have a a need for, you know, smaller bandwidth, maybe not, not bandwidth, but footprint, obviously, maybe that there's is a screen, maybe there is not. So there's a lot of adaptation that you need to, to take into consideration. But maybe even more fundamentally, we designed it for security. So basically on core, what you can do is to have a secure boot mechanism that says, before I boot something, I want to make sure that what I'm going to boot is actually legit and genuine full disen encryption. So trying to protect Ip, try protect the, the data you know, all the communication that you would have with what we call a brand store, where all the containers that you would be publishing to that device will be located. Well. All of that communication is fully secured. And there's also in that same token, and this is where the SaaS offering comes in it's, you know, security is something that is not static in time. It's something that needs to be maintained. Because let's face it, in Linux you have millions of lines of code. So are you going to have flaws and exploits being detected ever so often the answer is yes. So then the question is that you're shipping something like this in the field through, in one of your products, and how are you going to make sure that this remains updated and remains secure? If there's, for example a flaw that you detect either it's quality or it's security, right? So we have an update mechanism called, you know, over the air mechanism. So ever so often, a device powered by Ubuntu Core will be calling a server and say, do you have updates for me? And it's going to try to install these updates, and there's a bunch of additional mechanisms that sometimes can also be invoked where the updates are also optimized for bandwidth. So that is also something that, that we've been working on. But even important is that if you have enough that fails, there's also an automatic rollback mechanism, because let's face it, if you have this in the field, and it's very unlikely you're going to have like an IT expert nearby. Maybe it's in the plane, maybe it's at the top of a Swiss mountain, and, and don't laugh because that, that's really like a, a use case that somebody told me, right? Like their, their, their embedded Linux was at the top of a Swiss mountain. It would take a day for somebody to go up there and actually troubleshoot. So this is also why we have something called the robot mechanism. So if there's a problem with the update, it can be rolled back automatically to, you know, the, the good state that it was before. So outside of Ubuntu, just to make my whole story complete, the company is also providing a lot of services, patching and, and basically caring for a number of open source projects you know, like through different offerings that we have. So for people that are Linux experts or in that field you know, like we can help you with security patches in Maine and also in universe. So there's a lot of things that we do besides only Yun two, and in this case Ubuntu core. But I will leave it like that. So, you know, if you never heard about Yun core, that's perfectly fine. That's partially why I'm here. But yeah, that's, that's basically a recap of what we do.

Wade Erickson (06:50):

Great. Great. So tell me a little bit about yourself too. You do have an interesting background. You grew up in Canada and Quebec and work in the US and went to some schooling down here. Yep. And oftentimes in LinkedIn you do post in multiple languages, and we'll get to that a little bit later. But yeah, just tell us a little bit about your experience in early career and, and how, because you went to computer science and you moved into sales pretty quickly, so and then we'll get into the topic again, but I just wanted the people to get to know you a little bit about you know.

Steve Barriault (07:26):

Sure. So basically, I, you know, what I tell people is that I have kind of four legs that I'm sitting on. So there's definitely that experience in sales and marketing. I have an MBA, for example, and I've been doing sales and technical marketing as well. I do have a pretty extensive background, I would say in computer science. Like I have a master's degree in that. I've been doing my own solutions. I've been my own engineer. And when people are a little bit maybe puzzled, they say, well, you know, like, you can either be a sales and or somebody that is technical. I kind of disagree because people actually, at the end of the day they want to have people speaking about solutions. So I'm not saying you, you need a degree in computer science in order to be good at sales, but you do need to, to know a little bit what you're talking about and being able to engage with their clients saying yes, I understand your pain. I understand what you're going through, and here are some of the solutions that I can be providing to you. Right? So those are kind of complimentary. And the two other legs are basically been putting teams together, leading teams you know, like doing the, the leadership thing for a number of years now, which I, I like, I like, I love to see people working for me spreading their wings you know, becoming, I would say becoming leaders in their own rights. That's, that's something that I've found incredibly satisfactory, satisfying personally. And then finally, there's this international background that you alluded to. I've always like the international sphere. Right now I'm managing a, a team that is spread across three continents. I did that before as well. Well, in that case it was mostly Asia. And I've always had this this ever since I can remember, like when I was six years old, I would be telling my parents, you know, like, I want to visit all of these places on the map and speak all of these languages. And then my parents were like, yeah, yeah, yeah, yeah. That, that's, he's saying that he's six years old, right? Well, actually I did I guess that I'm daring. So I speak French, I speak English, I speak Chinese, I speak some Japanese. It's, it's improving. And sometimes battle Battlefield Korean. So if you, if you drop me in South Korea, I can make sure that you get excellent local des I know where to go, and I know how to order them in Korea. Great.

Wade Erickson (10:15):

Awesome. Awesome. So let's get into the topic. You know, growth through securing SaaS solutions and devices in, you know, in the introduction on the company, we talked a little bit about, you know, patching and the importance of getting patches out when you do find you know bugs or, or, you know, vulnerabilities to the, the operating system. And then yeah, and how, how in particularly, you know, IOT was a, you know, big, big area of discussion probably two, three years ago. I think AI and some others have kind of pushed it a little bit in the background, but it is still a massive future area and then, you know, maybe even AI on these devices one day. As we're trying to push AI from the software world to the hardware world and get those speeds, improvement of AI, tell me a little bit about the topic area and what, what interested you about sharing that today?

Steve Barriault (11:15):

So obviously for me joining Canonical and the specifically the device division is that I could clearly see in my previous employment. Like I came from a, what we call a bare board background. So either you had no OS or you had an OS that was really simple, say free R cost or OTOs a, so it's just a scheduler. It's nothing like an OS you will have on your computer where you can interact. It's more like a big program that you flash on your board. And what I was seeing in the markets is that increasingly people that would be doing those bare board before now, they would be including free RTAs. And then the people that were doing free RTAs wanted to have something more added, like potentially a network stack to get, to take advantage of the development of the internet, to take advantage of offering additional services to their clients. Say for example, in, in, in Automo in automotive, right? I just bought a car a few months ago, and it comes with its own internet access. The company not only, well, obviously they, they like the fact that they might be able to have some a RR later on, like have a subscription, right? But they're also saying, well, I can also provide additional services, like maybe that the map that I'm displaying is going to remain up to date. You know, like the, it's not going to be still information maybe that I can have better access to traffic info. So there's also some value that can, that can be gathered from that. And it's, it's a movement that I saw in my previous employment. So when I said, when I, when I saw that Canonical had an opening for vp field engineering iot, I said, well, it's, it's kind of a, an up and coming field. It's something that is evolving quite quickly, and I think it's going to be very interesting from an intellectual perspective. And obviously, you know, like for a, a winning perspective, I, I won't lie to you. I like, I like to win, I want, I like to see revenues going up. It's my, my commercial side. So yeah, that, that was the reason why, why I joined.

Wade Erickson (13:43):

Great, great. And so can you so you talked a little bit about your passion for teams and building teams. And obviously teams are very dynamic, and especially in it, nothing static, we're always changing. Can you share a specific instance where your team, you know, had to pivot and adapt the product strategy based on marketing? You're obviously pre-sales, so you're getting a lot of that feedback from the industry or from your potential buying communities. So can you tell me a little bit about how that pivot affected team communications and implementation?

Steve Barriault (14:20):

I have lots of stories about that. Let me start with one, like when I joined Vector Software, we're selling a embedded testing tool. So, you know, like obviously the company was mostly focused on the US and it was mostly avionics, maybe a little bit of the other industries. So it was a startup, it was very early in its development. And when I got hired, they said, well, you're going to be a salesman and you're going to focus on Asia, because guess what? You can speak these languages and you, you enjoy going there and you enjoy eating the food. So it's like, okay, fine. So go there. And then quickly enough realize that the avionics feel, well, first of all, is much smaller in the us, but also it's I would say whatever was available there. We, we had an entrenched competition, but we had this thing going on in automotive, which at this, that particular point in time had a new standard called ISO 2 6 2, 6 2 that just came out. And it was mandating a number of activities. So it's like, okay I want to be in there, but you know, like, how am I going to do that efficiently? Because back in the days, it's like, okay you have a new compiler to support Steve. Well, please ask for a boatload of money from, from the people there before we can accommodate you. And then I was a bit trapped because, well people were asking me, well, show us first that this is going to work, and then after that, we can talk. So remember, like I said at the beginning, I have that multiple hat ability, but I said, okay, let me put my engineering hat on and learn how to do these integrations myself. And so I started with one compiler, then another one and another one, and then I also thought about what is a reasonable ask and that, that a customer could, could ask me without me doing all of that work upfront, and especially things that are not repeatable. And it turned out to be like, my, my strategy was if it's a simulator, well, it's repeatable across multiple clients, right? So maybe that I get you, I do a simulator integration just for you, but I know that maybe that there are 10 other people in, in the automotive industry that are going to be able to leverage that. And then if you want to execute on the board, well, it's more complicated. So this is when the, the money ask will will come. So I started that. It was successful, and this is what it did. It's, it created a critical mass of compilers that actually we didn't support before. And then it kind of punished our, our brand saying, well, you're, you're not credible, as long as you don't have support for that. Well, after 1, 2, 3 years, then suddenly it's like, did you ever do this? Yes. Did you ever do, you know Fujitsu compiler? Yes, we did. And as we started having money, then this is when the budget came in and say, well, okay how about you hire people? And this is, this was my vision there. It's like, okay, let's start hiring people. Let's first of all, teach them how did things, so good mix of technical prowess, but also salesmanship like engaging in solution selling, being able to, to negotiate with a client to, to a certain extent. So I had a team of SCS and NAES that would, would basically pick up where, where I left them, and then I put them on the spot and I said, look, this is, this is the book that I wrote, so it's not a literal book, but these are the strategies that I develop. But I made it clear to them, it's okay for you to improve on that book. So first try to master that book. And then after that you're telling me, well, it's automotive now, but we could actually be investing a little bit more time to that extra industry, like whether it's medical devices or in one case it was what was it again? Telecom. So, and then I would say it's okay, like sometimes to, to try and, and have that ability to innovate in the field, but do it in a way that you document what you're doing. So it's easy for the official product line to take what you did in the field and maybe productize it, which we did multiple times, right? So that's the other thing about the projects we're doing. It's like, do it in a way that can be assimilated by the rest of the company, so it can actually be used by them, which it was. And one last thing on this, and I'm sorry if I'm jumping all over the place, but as I said, I had lots of stories, that technical that, that telecom a company I remember that I, I did try telecom before and with a certain product mix because I thought that was low risk, and it turned out to be not the right solution. It kind of said, well, you know, there's not that much value into it. So then when my Japanese team member came to see me and said, I would like to do something else, to his credit, he, he fought long and hard and said one of the things that they're trying to do is to make sure that version one of their software they take it from one target and they put it on another. They want to make sure that there's an equivalence in functionalities and stability. So what we came up with is a way to generate a massive amount of unit tests here. So you have a baseline, and then you can actually run this very efficiently and automatically on that second target. And then you can compare. Now, you know, it's not what you would do in avionics for multiple reasons, like in avionics, extremely prescriptive, like you need to, to have a requirement, and then the requirement needs to be implemented in a test case and nothing else will do. But in a case that was not safety critical, it was business critical for them, it was worth gold because like requirement based tests, that's, that's hyperspace, that's not what they need. What they needed is a way to evaluate whether their software would fail on a new target. And that's what our solution, our very innovative solution did. And it opened again another field of, of potential clients. But you know, like that's what innovative innovations in the field can lead to. As long as it's done right, as long as it's you, you have a little bit of smarts about that. And also if you think what is the next step? So if it needs to be productized, what do you need to do in order to make sure that it's easily as submittable by the rest of the organization?

Wade Erickson (22:11):

Thanks for that. That's very complete answer. You know, we talked about you know, you talked about there in that last part about the, the unit testing across the embedded pieces of of software. And and, and that was an approach that you did to, to in a sense mirror the platforms to make sure that they operated in, in the same manner you know, often in software testing within the industry, we hear mainly about desktop, web, mobile, microservices, all those traditional customer facing, the stuff that people touch with UIs. Tell me a little bit about your embedded software testing experience, maybe some of the testing tools and some of those differences on to think about when you're dealing with embedded software, because it is often the area that is, is not given quite the same conversation that it absolutely deserves, and it's only getting more software into our with iot and other things into the things we touch, whether it's cars, appliances, all these other things.

Steve Barriault (23:19):

Absolutely. It's a vast topic, but I can tell you that it ranges from industries like avionics where, you know, it's very codified what you ought to do. Like there's a standard out there called do 178 C. It has been painstakingly put together by luminaries in the industry based on, you know, unfortunately accidents that happen to prevent people from dying. So I'm not going to dwell too much on that because it'll take the whole, the, you know, like it's, it's, it's a whole different topic, but in their case, it'll be, okay, you're guilty before you're proven innocent and prove to me, tell me what your software is going to do, and then verify that it's actually happening. So it's no shortcuts. It's very expensive. There will be code coverage too. So if you find out that after running out of your test, then there's some code not covered, why are you missing a requirement? Or is that not, not used? Right? And there's again, a very good reason why they did this. It's to prevent a plane from falling from the sky. You know, people that if you want to have the more, the crispy details, I can tell you that afterwards then you will have other industries that are safety critical. But frankly it's, it's another take on this. In automotive, it'll be very different. It's, it's not necessarily that the government will mandate you to do a standard compliance, but it's more like if, if you don't comply with some of the best practices defined by the standards, and then there's an accident happening, well, guess what? There's a few lawyers out there that might detect it and see that it's a, it's a good opportunity for them to make boatloads of money, right? And then, and this is like safety critical, but in embedded software, increasingly you also have business critical. So sure, that Tel Telco company that I talked to you about, this thing goes off, nobody dies, but some people may actually be, be quote unquote killed on that. So there's a, a say in, in Japanese kuru, it's like cutting your neck. That's what happens when you get fired. So, you know, like we don't want kuru to happen to anybody, at least of all of our Japanese customers. So yeah, that's why they wanted to do, to do testing. What I would say though is that the challenge in, in embedded software is, is, is especially trying to run as close to what the target is going to be. Because as you know, there's a lot more diversity in the type of platforms you have, and it does affect your ability to, to test in realistic conditions, right? So is my port, when, when I'm sending those signals, is that, is that, is my program going to be behave properly? And somewhere if it's bare board, you're, you're talking about ada, CNC plus plus, but now that we have increasingly a number of projects on Linux, like embedded Linux, then it's, again, it's, it's, it's, it opens another can of forms because now you have different languages. Some of them have things like automatic garbage collection, I can tell you that way. Like, go, go and talk to the FAA about automatic garbage collection. They're like, no, no, no, no, no, no, you're, you're not going to do any of that kind of stuff. At least not for, unless you're in the cabin, maybe, but, you know, like maybe at your seat and then entertainment system, it's level D, that's okay. But like the flight management system, don't, don't even think about it. But for other non-safety critical, but business critical application, it's still important. You want this to actually be secure and stable. And guess what? Those are very often people are using increasingly open source software. That code base keeps on evolving, and people do that for excellent reason. But that is why you need to have an update strategy in that case, because guess what? Bugs will be found, exploits may happen, and then you want to be at the top of it.

Wade Erickson (28:08):

Excellent, excellent. So we're getting later in the show, and this is when I like to kind of pivot a little bit and talk about you and you know, something that's kind of unique to you. And of course, we talked a little bit about your language and, you know oops, we turned that off. And what I would like to do, I would like to tell you to title your story a little bit more on the multi-language part and how you brought it into maybe your business experiences and those kind of things. But let's have you respond to the question in Chinese and maybe for our Japanese listeners as well. And then maybe just do a small summary of what you said in, in for the English speakers. Would that work?

Steve Barriault (28:52):

Yeah, absolutely. So let me answer why Chinese, right? So in Chinese first <CHINESE>, you know, so what I explain, and I can do it quickly in French, <FRENCH> and finally in English, not, not leaving you hanging any longer my wife is Chinese. But then what I explained in Chinese is that and this is like, so at some point in time there was a border agent that did a joke with me, like at the border, and that threw in a word that meant a gender of China. And then I didn't understand that, and then I got explained what it really meant. So now when I'm meeting a Chinese, I say, yeah, yeah, I'm not a typical foreigner, or I'm not a foreigner, I'm actually a gender of China. Then they, they get the joke, right? It's, it's, it's a great way of breaking the ice to complete my, my my, my answer here I guess is that I, as I said, I like to study languages. I like the international field. I'm daring, obviously, I understand sometimes I'm not perfect in any language, sorry, but if, if you're waiting for perfection in order to try things, you're never going to do it. Correct? Never. So, you know, I would, I would say this for the American audience, if you know some of, some language or even like one or two or three words, it's well received. Even if the, the person answers back in English, it's appreciated that you try the effort, you made the effort, okay?

Wade Erickson (31:12):

Yes. And it goes a long way when you're in those countries for them to hear the language when you come in as an American absolutely. You accept it. They, they're okay with that.

Steve Barriault (31:22):

Oh yeah, for sure. It's just like, as adults we're being raised thinking that, well, if I say something stupid, then people are going to judge me, right? Wrong. It's like people will, will understand that and trust me in order to learn. I said a few quite stupid things by accident, right? So, that's okay. That's how you learn. That's how you, awesome.

Wade Erickson (31:49):

Thank you so much for your time with us. I, I just wanted to introduce a show we have tomorrow if, if that's okay. We have Joseph Shorter, technology Executive at Fluid Genius. Topic's going to be software delivery, getting it right. So we're going to talk a little bit about developing software and some of the experiences that Joseph Shorter has. So with that again, I want to thank you for your time and sharing with us the experience that you have, which I think is, you know, unique and, and, and quite valuable to our community as well as the language. I, I enjoyed that particularly haven't had, haven't had the opportunity to learn a bunch, but I've always wanted to. So little bit envious of your abilities there.

Steve Barriault (32:39):

Thank you.

Wade Erickson (32:41):

Alright, well, I think that's it until tomorrow. Appreciate everybody joining us here and, and especially you, Steve.