Screaming in the Cloud - Quantum Leaps in Bioinformatics with Lynn Langit

Episode Date: February 24, 2022

About LynnCloud Architect who codes, Angel InvestorLinks:Lynn Langit Consulting: https://lynnlangit.com/Groove Capital: https://www.groovecap.com/groove-capital-minnesotas-first-check-fundTwitter: https://twitter.com/lynnlangitGitHub: https://github.com/lynnlangit

Hello, and welcome to Screaming in the Cloud, with your host, Chief Cloud Economist at the Duckbill Group, Corey Quinn. This weekly show features conversations with people doing interesting work in the world of cloud, thoughtful commentary on the state of the technical world, and ridiculous titles for which Corey refuses to apologize. This is Screaming in the Cloud. Today's episode is brought to you in part by our friends at Minio, the high-performance Kubernetes native object store that's built for the multi-cloud,

creating a consistent data storage layer for your public cloud instances, your private cloud instances, and even your edge instances, depending upon what the heck you're defining those as, which depends probably on where you work. It's getting that unified is one of the greatest challenges facing developers and architects today. It requires S3 compatibility, enterprise-grade security and resiliency, the speed to run any workload, and the footprint to run anywhere. And that's exactly what Minio offers. With superb read speeds in excess of 360 gigs and a 100 megabyte binary

that doesn't eat all the data you've got on the system, it's exactly what you've been looking for. Check it out today at min.io slash download and see for yourself. That's min.io slash download and be for yourself. That's min.io slash download, and be sure to tell them that I sent you. This episode is sponsored by our friends at Oracle HeatWave, a new high-performance query accelerator for the Oracle MySQL database service, although I insist on calling it MySquirrel. While MySquirrel has long been the world's most popular open source database, shifting from transacting to analytics required way too much overhead and, you know, work. With

HeatWave, you can run your OLAP and OLTP, don't ask me to pronounce those acronyms ever again, workloads directly from your MySquirrel database and eliminate the time-consuming data movement and integration work, while also performing 1,100 times faster than Amazon Aurora and two and a half times faster than Amazon Redshift at a third the cost. My thanks again to Oracle Cloud for sponsoring this ridiculous nonsense. Welcome to Screaming in the Cloud. I'm Corey Quinn. So I've been doing this podcast for a little while now. By my understanding, this is episode 300 and something. But back when the very first episode aired, I had pre-recorded the first 12 episodes. Episode number 10 was with Lynn Langit, who is, among many other things, the CEO of Lynn Langit Consulting.

She is also the first person to achieve the AWS Community Hero and Equivalent designations at all three of the primary Tier 1 hyperscale cloud providers, which I can't even wrap my head around what it takes to get that at one of those companies lynn thank you so much for agreeing to come back now that i'm no longer scared of the microphone well thank you for having me it's great to be back cory so it's been a few years now since we really sat down and caught up and what an interesting few years it's been that there's been a whole minor global pandemic thing that wound up hitting us from unexpected and unpleasant places. There's been a significant, I would say, not revolution,

but evolution in how adoption of cloud services has been proceeding. The types of problems that customers are encountering, it's moved, the conversational discourse has moved significantly away from should we be using cloud into, okay, we obviously should be using cloud. How should we be using it? And the industry keeps on churning. Sure, there's still rough parts. There are still ridiculous aspects of it. But what have you been up to?

Well, as you might remember, I have an independent consultancy where I do really what my customers need. I work across different clouds, which keeps it interesting and fun. But I've had a focus over the past few years in supporting bioinformatics research. Before the pandemic, it was mostly cancer research. Since the pandemic, it's been all COVID all the time sort of has been the unofficial theme of this and it's weird i know we're in 2022 now but it still feels like on some level it's like man this march 2020 is still dragging on on some level there have been a number of stories in the world that is let's say medicine adjacent more so than we're all sort of medicine adjacent these days but there's been a lot of refocusing away from things like cancer research into COVID and similar pandemic respiratory diseases. Do you think that

there's a longer-term story where we're going to start seeing progress stall on things that were previously areas of focus, in your case cancer, in favor of reducing infectious disease? Or is it really one of those rising tides lifts all boats type of scenarios? Yeah, it's the latter. It's been really interesting without getting too much into the details. You know, when you think of genomic research for drug discovery, you know, we started with this idea of different DNA sequencing cohorts. So like people from the, you know, that started from the United States, people that started from Africa, you know, different cohort as a normative to evaluate the effectiveness of diseases. What was an area of

research already was to go down to the level of what's called single-cell RNA. So look at the expression of the genomics by cell area, so by the different, you know, parts of your body. Well, this is similar to what has been done to understand the impact and the efficacy of potential COVID drugs. So this whole single-cell RNA mapping cohorts of what is normal for different types of populations has resulted in this data explosion that I've never seen before. And I see it as positive for the impact of human health. However, it really drives the need for adoption to the cloud. These research facilities are running out of space if they're still working on-prem. I spend an awful lot of time thinking about data and its storage from a primarily cost-focused

perspective for obvious reasons. And that is nuanced and intricate and requires sort of an end-to-end life cycle policy. There's this idea of, ideally, you would delete old data you don't need anymore. But failing that, you maybe aspirationally don't need 500 copies of the same thing lying around. Maybe there are ways to fix that. And that's all within one cloud ecosystem. You work across all of the clouds. How do you keep it all straight in your head, trying to figure out things around life cycles, things around just understanding the capabilities of the various platforms? Because I got to say, from my perspective, it's challenging enough only bounding it to one. Yeah, it's the constant problem. The big clients I had over this

past year were not on Amazon. They were on other platforms. So it seems like it sort of goes in cycles. And what I'll sometimes need to do is hire subcontractors that have been working on those platforms because you can't. I mean, you can't even know one platform, much less all of them to the level of complexity in order to implement. One thing that is kind of interesting though in bioinformatics is, and different than the other domains, is when you talk about data, it's a function of time first and cost second. So they will run on less computational resources so that they can, for example, not overspend their research grant and wait longer for the results. And this has been really an interesting shift in my work because I used to work with FinTech

and AdTech where it's all about get it out there fast and we don't really care how much it costs. We just want it super fast. So this continuum of time or money shifts by vertical. And that's been something that, I don't know, it's kind of obvious in hindsight, but I didn't really expect until I got into the different domains. It's always been fascinating to me watching how different organizations and different organization types wind up interacting with cost. I mean, I've been saying for a while now that cost and architecture are the same thing when it comes to cloud. What are your trade-offs? What are your constraints? In many venture-backed companies, it's when you have a giant pile of other people's

money raring to go, and it's a spend it and hit your milestone if you want to get another round of funding, or this has been an incredible journey medium post in the making, then yeah, okay, go ahead and make the result happen faster. Save money is not the first, second, or third order of business as far as what you're trying to achieve. In academia, where everything's grant-powered, and it's a question of we need to be able to deliver, and we need to be able to show results and be able to go play the game and understand the cultural context we're operating in and ideally get another grant next year.

It completely shifts the balance of what needs to be prioritized and when. And I don't think there's been a lot of discussion around that because most cloud cost discussions inherently center around industry. They do, and they focus on the industries where they're willing to spend the most. So most of the reference examples are they always prioritize for time and money is sort of unlimited.

I'll give you an example, and this is from a few years back. Some work I did with a research group in Australia, and again, it was a genomics example. They were running on-prem, and to do a single query, it took them 500 hours. And I was just like, are you kidding me? And they're like, hey, cloud lady, what can you do, right? So we gave two solutions. And the first solution was kind of more of a lift and shift kind of a solution because they didn't know anything about cloud.

And it took a few hours. The second solution was what was, in our opinion, super elegant. It was one of the earliest data lakes. It took minutes. Well, it was a big hit to the ego that they adopted the easier solution. But again, it's a learning because another dimension about cloud architecture is usability. The fintechs are like, we're going to get it really done fast. We'll hire who we need to hire.

The biotechs, they can't afford to hire who they need to hire because they're already being hired by the fintechs. So you have these different dimensions you need to optimize for that aren't really obvious if you just work in the industries that optimize for time. And the thing that always gets overlooked is that in most environments, the people working on things are more expensive than the infrastructure themselves. And back when Lambda and all the serverless joy came out, my first iteration of the last week in AWS.com website was powered entirely by Lambda functions, S3, and other assorted bits of nonsense. Today it's on WordPress, and it's not because I think that is somehow the superior architecture from a purely technologist point of view, but because I have to find other people who aren't me or whatever six people in the world at the time

who could stuff all that into their head and work on it effectively, should be able to make changes to the website. That is not something I need to be focusing on. There's something to be said for going to where there's a significant talent pool rather than pushing the frontiers of innovation in areas that don't directly benefit

whatever it is your organization is targeting. Yeah, it's really interesting. When COVID hit back in 2020, kind of an interesting little story here. One of my clients is the Broad Institute at MIT and Harvard. They're a well-known research organization for cancer genomic data sets. They were tasked with pivoting their labs so that they could provide COVID testing capability. And I was a long-term contractor with them. So they brought me in for an architectural cloud consult. And I said, this clearly is a serverless. And I guess haven't done this before, but this is going to be burstable. You don't know how big this is going to need to go. And then just to make life interesting

in the middle of the build of that, I was one of the first people in Minnesota to get COVID. So I actually wasn't able to go and complete it, nor was able to get a test because there weren't tests. I mean, you can't make this stuff up. I was in the ER saying, okay, is this the end of me or can I go back and get you some tests? So it's really kind of two things, kind of a weird story. And also life situations will cause change. And so the Broad did launch that pipeline and it was serving up to 10% of the COVID tests in the United States, but they had never done anything serverlessly or had considered it before because they didn't need to have that amount of change. It was really, again,

a big thing when I came into human health. Prior to that, I was doing all serverless all the time. You know, I came into human health and they were saying, okay, we're going to have massive VMs. And I was like, no, but you know, you have to meet the client where they are. I think it's the easiest thing in the world, particularly as a junior consultant, because you do not see senior consultants doing this ever, you know, after the first time to walk into an environment, look around and have zero context into what's going on, because you're a consultant, you haven't been there, and say, this is ridiculous. What fool built this? Invariably to said fool. Now, most people don't show up in the morning hoping to do a terrible job at work today. So there are constraints that you are certainly not seeing. And maybe it was an offering wasn't available then. Maybe they weren't aware of it. Maybe there was a constraint that you're not seeing, but the best case is you're right and you just made them feel terrible,

which is not generally a great way to land more consulting projects. It's always frustrating to me because it's, even looking at a bill and having a pretty good idea of what's going on, I always frame it as, can you help me understand why this is the case? Had you considered this, or is that not an option? As opposed to categorically saying, well, this is not the way to do it. Because once you're wrong, when you're delivering expertise, it takes a lot to build that back if it's even possible. Well, again, from human health, because, you know, they were consuming the vendor information, they thought they wanted to learn how to use Kubernetes. But what they really needed to learn was how to do archiving to reduce their storage costs.

Yes, Kubernetes is a terrific solution for a bunch of problems and creates several orders of magnitude more somewhere along the way. My somewhat accurate, somewhat snarky observation is that Kubernetes is great if your primary problem is you want to pretend you work at Google but didn't pass their technical screen. I don't really want to cosplay as a cloud

provider myself most days. That said, there are use cases for which it makes sense, but context is everything. And generally speaking, I don't tend to follow a hype trend to figure out whether or not it's going to solve my particular problem. Well, here's the soundbite. Kubernetes is today's Hadoop. Oh, there are people who are not going to like that. I made a tweet, I think, three years ago now. It's true. Oh, yeah. I had a tweet three years ago or so that said,

hot take, in five years, nobody's going to care about Kubernetes. And I think I have a year or two left on that prediction. And what I said at the time was that not that it's going to go away and not be anywhere because enterprises do not move that quickly, but it's no longer going to be the sort of thing that everyone is concerned about at a very high level. The Linux kernel has a bunch of aspects to it that we used to have to care about a fair bit. Now, a few people really, really need to care about those things because of those folks' hard work. The rest of us don't have to think about it at all. And that is the nature of technology in the fullness of time.

Well, another way to think about it is Kubernetes is a that is the nature of technology in the fullness of time. Well, another way to think about it is Kubernetes is a C++. Certain people are going to be experts in it and need to, and that's valid, right? But what percentage of developers code in C++? Like 10, 5? You know, it's kind of analogous, right? So it's one of the signatures of my consultancy. You know, I'm this pragmatic Midwesterner and I love to say, look, like you said, if you think you need this, you really need to understand the actual cost of it because it's non-trivial on all clouds. And I get to say that because I'm independent. You know, they're doing solid work to abstract it into a higher level implementation. But when I hear a customer say, I need Kubernetes,

the burden of proof is on them before I'm going to build that. Speaking of hype-driven emerging technologies, you are arguably one of the few people on the planet I can have this conversation with. And I do not mean that as an insult to other people operating in this space. For context, a couple of years ago, AWS launched Bracket, which they spelled Bracket without a C,

because it's Amazon, and spelling is hard, presumably. I know, I know, there's a reason behind it. And it is their service that enables you to get access to quantum computers the same way we get access to any other AWS service through a somewhat janky console and some APIs. And okay, quantum computing, we've heard a lot about it forever. It always seemed a bit like science fiction. It was never really clearly articulated

what kind of value it can solve for us. So aha, now it's here. I don't need to go and build or buy a quantum computer somewhere else. And I tried using the Quickstart. And it turns out that the Hello World tutorial for quantum computing, at least to my mind, was basically an application for a PhD program at Berkeley. And I am not that type of academic, for better or worse. So I kept smacking my head off of that and realizing, okay, whatever this is, is clearly not for me.

You have been doing some deep dives in the quantum computing space, but as we've just mentioned, your day job is not, to my understanding, a college professor. You are a consultant. You run your own consultancy solving data problems, particularly towards bioinformatics. What is the deal, to the layperson, of quantum computing these days? Well, yeah, like you, I was introduced years ago and tried to read the books and I didn't have the math and just, you know, saw it as a curiosity. Last year, I picked up a book from O'Reilly called Practical Quantum Computing, which of course, because the name, was attractive to me. I read it, I felt like I was getting a little bit more knowledge. It implemented a learning JavaScript library

with a browser-based editor, so zero install. And it was a simulator. You couldn't run it on actual QPUs. So I decided to see if there's any other interest in my tech community. And I got about five other developers and we ran a 15 week long book club because we all just wanted to move forward

with our knowledge. Because there is this fundamental difference in the information you can get from a qubit versus a bit. Because a qubit can basically be like a globe. And so it has a superposition. And so you can have all the different mathematical points on the globe versus a bit is on or off. I mean, that's intuitive. Like, hey, I could get more information out of that. So the potential usages, it's always been tech that leads the way, is on figuring out what are called NP-hard or computationally complex problems. And again, this is at the edge of my knowledge,

but this is where bioinformatics is. I think of it in an oversimplified way as N by N by N by N, all by all by all. We want to see all possible combinations of all possible inputs. So for example, we can figure out which COVID drug we should try, which set of drugs we should try. And we want that as fast as possible. So I wanted to see, okay, you know, where's this at? Plus, like you said, Amazon introduced Bracket.

When Amazon introduced something, then there's some customers somewhere that are using it. I mean, that's, you know, kind of pay attention to it now. So as I was doing this book club, I investigated all the different cloud vendors and captured all that learning in a GitHub and just recently recorded a LinkedIn learning course, which again, in the learning ladder is,

if this is, you know, Hello World and this is actual implementation, it's like right here, but right here doesn't exist. Like there's nothing there. So I tried to make something to say, okay, the Amazon bracket example, how does that actually work? What is a Hadamard gate? Why do you care? What is amplification? How do you measure it? Like, what would you do with that? And so, you know, I tried to interpret some academic papers and do that learning layer

in the middle to help move people towards productivity. Am I fully there? No. Did I move further? I hope so. Do you want to come along with me? Great. You've done something, though,

that I don't think anyone else yet has when I've had conversations with them about quantum computing, which is we all are shaped by our own needs and our own experiences when we interact with a cloud provider. To me, I, perhaps foolishly, took Amazon seriously when they called it Amazon Web Services. Oh, okay, clearly this is going to be things to help me build websites and

website accessories, more or less. So it's always odd to me when I'll see something like, oh, and here's our IoT solution that winds up powering a fleet of 10,000 robots. And I'm looking around my website going, I don't really have a problem that could be a fleet of 10,000 robots. And I'm looking around my website going, I don't really have a problem that could be solved by the 10,000 robots. I have a bunch that could be made a lot worse, but it feels like it's this orthogonal thing that is removed. With some areas, it's okay. I can see the points of commonality and how you get there from here. And if I think really hard, I can do that with IoT stuff. For example, iRobot is a cloud-connected robot that talks to something that looks like a website

and vacuums my house. Whereas with quantum computing, it always felt very isolated, very much an island as far as being connected to anything else that I could recognize. Bioinformatics research, as you describe it, well, yeah, I can see you get to bioinformatics research from web services,

and now I can see how you can get to quantum you get to bioinformatics research from web services, and now I can see how you can get to quantum computing through the bioinformatics side of things. Well, the other thing that really was useful for me, I am doing TensorFlow, finally. It took me a few years, but for neural networks. And so I am using, with some of my bioinformatics clients, acceleration with GPUs and TPUs, if I happen to be on Google, because it's a known thing that when you're training a neural network, again, similar, you have complexity. So you have a specialized chip where you can offload some of the linear algebra onto that chip. So you split the classic and the tensor portion, if you will, and you do computation on both sides. And so it's not a huge leap to say,

well, I'm not going to use a GPU. I'm going to use a QPU because you split, and that's the way it actually works. There's actually a really interesting paper I put in my GitHub. It is a QCNN, and it's a quantum convolutional neural network that is used to analyze images of breast cancer. Because again, on the image, you can think of the pixels as what's called a tensor, which is just vectors in multiple dimensions. You need the all by all by all again. That's really how it goes in my head. You have the globe of the qubit and you want to get the all possible combinations faster so that you can analyze all combinations, in this case, the image. And they found not only was it faster, it was more accurate. And that's why I am interested in this. with built-in access via key value, SQL, and full-text search. Flexible JSON documents align to your applications and workloads.

Build faster with blazing fast in-memory performance and automated replication and scaling while reducing cost. Capella has the best price performance of any fully managed document database. Visit couchbase.com slash screaming in the cloud to try Capella today for free and be up and running in three minutes with no credit card required. Couchbase Capella, make your data sing. The neat part is that this might be one of the first clear-cut stories where what could I use a quantum computer for? And the answer isn't something that's forward-looking or theoretical. I mean, the obvious gag when you said reading

about practical quantum computing is that that book is probably in pre-release, I would assume. But it's a hard thing to solve for. And I do have the awareness that I am not an academic. Academia has never been my friend. So I bias heavily for, well, can we use this to solve real world problems slash make money because industry and academia focuses ideally and aspirationally on the expansion of the limits of human knowledge. And sometimes it's okay to do those things without an immediate, well, how can I turn a profit on it next quarter? What a dismal, bleak society we have if that's all that we wind up focusing on at any given point in time. Yeah, that's for sure.

Which, of course, sets us up for one other thing that's a relatively recent change for you. You now have mentioned in your bio, which I believe is new since the last time we spoke, that you are an angel investor. And that is something that I recently found being applied to me as well after I made investment in a startup that I was very excited about. I've talked about it in the show previously. It's called ByteCheck. But honestly, I didn't realize

that what I was doing was called angel investing until I read the press release, because strategic angel are two words that no one ever applies to me, particularly in that order. What happened? What are you doing these days? Well, I live in Minneapolis, and I moved there in 2019. So my 2020 story is first I had COVID, got over that, and then I was there during the tragedy of George Floyd. So I wanted to understand more about what were the root causes and what I could do to make an impact in the recovery of my city.

And I was really surprised to find that Minnesota is one of the most charitable states in the United States. It ranks one or two. But yet we have in the Twin Cities in Minneapolis and St. Paul, we have really unacceptable income equality and poverty. So something's not working. I'm a pretty charitable person. I always allocate a certain percentage of my money to charity, but I said, I want to accelerate this. So at the same time, there was a new angel investment fund launched. It's called Groove Capital that was going to focus on women owned and BIPOC businesses. And I thought, hmm, this seems good. Now I was super intimidated because I lived in California for so many years and check sizes in California, you just add a zero. And I thought, you know, I don't have generational wealth.

This is my own money. You know, I'm well compensated, but I'm not loaded. Yeah, there's a common trope right now that, oh, angel investor is a polite way of saying I am rich, but I rent my home at this point. Living in San Francisco, it is, I am not exactly sitting here diving into a money bin out back, Scrooge McDuck style either. Right. Well, I mean, you know, I am not exactly sitting here diving into a money bin out back Scrooge McDuck

style either. Right. Well, I mean, you know, I'll just be transparent about it. Like everybody else or many people, I moved out of California because of the cost of doing business there and reduced my cost of living by 40% moving to the Midwest, which is awesome. So anyway, I joined this fund and it's been just fantastic because I've listened to deals on my own and felt just like a complete, like, I don't know what I'm doing. But I'm taking advantage. How do you evaluate an idea that someone has that's early stage, barely better in some cases than back of an envelope scrawlings? For sure, right? But what I found through the fund is I can contribute both money and time because, you know, I did this cloud expertise.

And in addition to writing checks for a couple of companies that I really believe in, for example, I got all these companies on the X cloud company for startups program, because that wasn't just a known thing in my ecosystem. I was like, why are you paying a cloud bill? You could be on the startup program for the first year. So I'm impacting these new businesses

with both my experience and my dollars. And I just really love it. I just really, really love it. And one of the reasons I want to talk about it is because more people who have expertise in tech should do this because you can really, really be impactful. One of the companies that I invested in is called TurnSignal. They are coming to Los Angeles. It was three attorneys and one of their brothers is a police officer. They wanted to de-escalate situations that happen with traffic stops. So it's a mobile app where you push a button and you're connected to an attorney and they do training for the community

and police officers. And the idea is to record the conversation and to get an attorney involved to de-escalate and get everybody home safely. And that was my first investment. And it's going national. And I'm like, really, really, those are the kind of things I want to do. And it's simultaneously such a terrific idea and such a stunning indictment of the society that makes something like that necessary. Well, you know, we have to find practical solutions. We have to find ways forward. Oh, please don't interpret anything I'm saying as shade on that. I wish the world were differently. Yeah, I think most people do. But you have to find ways forward. Oh, please don't interpret anything I'm saying as shade on that. It's like, well, I wish the world were differently. Yeah, I think most people do. It's, but you have to deal for better or worse with the hand that you're dealt. And this is for better or worse at the time of recording this, the society that we have and finding the best path

forward is often not easy, but it beats just sitting here complaining about everything every day and not doing anything to be part of that change. The surprising thing I learned as I went through it was that, in many cases, the value of individual angel investors is not the check that they're writing. That's basically just almost a formality on some level. It is the expertise. It is the insight into particular markets and the rest. The part of what you're saying that surprises me that I hadn't really considered, but of course it must exist, is the idea of angel funds. Is this generally run by an existing VC firm? Is it a group of like-minded friends who decide, ah, we're going

to just basically do the investing equivalent of a giving circle. Everyone puts some money in the pot and then that decides where to go. How is it structured? Yeah, the way ours worked is you do pay a fee. It's a small fee to be part of it. And then they have people who vet deals for you. And then what I really like about is the community aspect. Because just like in tech, when you're learning something new in tech, you have a community. Same thing here. We have a Slack. We have a website for each deal. We have in-person meetups when COVID situation allows. And we have chosen to start by investing in Minnesota. Although we're going to, in fund two, we're going to invest in Upper Midwest.

And for example, here's something I would have never known. There's an angel tax credit in Minnesota that for certain businesses, you can get a 25% tax credit, which, hey, do good, be good, get good. I would have never known about that. I've never known how to do it. All my investments so far have qualified. Fantastic.

My money goes further. Yeah. Well, what are you talking about worrying about taxes? That is about to be doing something good. Yeah, great. If you believe in a cause, take advantage of the tax code as written. I am not advocating tax fraud. I pay every cent that you owe. Let's be serious here. They have no sense of humor about that. And take advantage of that. That means you have additional money to do good with. I wish that more people had an awareness around that particular school of thought. Well, make your money go further. Make your money effective. Because we are, like it or not, we run on money.

We run on money. And so be smart from everything where you shop to how you spend. That's how we're going to make change. One last area I want to explore with you is that for a long time, you've been working on effectively data pipelines and similar things in that space tied to your consulting work. You are clearly skilled across all of the various cloud providers. And even tying into the expertise side of what you're doing as an angel investor, you've always been a staunch advocate for, I guess we'll call it doing security the right way. And I've always been tangentially related to security throughout the course of my career. And somewhat recently, I launched another day of my newsletter focused on security within AWS for folks who are not themselves in the security space of what do you need to know? But so much of it comes down to the, do the easy thing

now, the right way to do it before you wind up having to do a whole bunch of damage control. And you've been advocating for that since before it was trendy to do so. I imagine you're still somewhat passionate about that perspective. Well, I always like to say, you know, Werner Vogels doesn't talk anything about tech. He just talks about, please use our security. And I don't blame him. I mean, you know, I joke that I am an AWS community hero because I made a bunch of YouTube videos about securing buckets. And that was like seven years ago. And I just had a financial client literally in November, and their buckets, you know, it was made public because it was easy for the developer. I'm like, can we just do our

foundations? I don't know why it is not seen as a valuable skill. I mean, I've made crap loads of money because people come after they have an incident, but, you know, I wish we would be better. And I'm worried because as we start to get more and more of our health information in these big repositories, granted, we have some laws. Yay, good. But it's just not valued like coding up a new feature with Node or something. And why not? I don't understand. So I make all these educational resources.

I make courses. I have GitHub repos. I have videos, you know, just do it. Plus the people who learn security, I mean, we are always in demand. I'm not a security professional, but I always do security kind of like as a courtesy. And people are like, oh, you know, oh, you're great. Oh, my friend needs you, da, da, da. I mean, you'll be working forever. It feels like it's aligned with cost in that it is almost a reactive function. You can spend all your time on it, but it's not going to advance the state of your org further toward its stated goals.

You've got to do it, but there's also never really any done there. It's just easier for me on the cost side because I can very easily quantify the return on investment, whereas with security, it's much more nebulous. And of course, you wind up with the vendor, well, I'm going to call it what it is in some cases, nonsense, that is in the space where, oh, you're completely doomed unless you buy their particular product. You know, walk up and down the aisle at RSA a few times and your shopping cart is full, and great. Are you more secure? You're a lot more complex, but does this get you to a better outcome? And it's, I am so continually frustrated by all of these fancy

whiz-bang solutions that are sort of going around the easy stuff. Well, not easy, but it's the baseline level of things. Secure your S3 buckets, or for users themselves, it's use a password manager that has a strong password on it. Use it for everything. Use MFA for the important things that you need to use. Make sure your email is secure. Don't click random nonsense, which is a whole separate pile of things. If I can click the wrong link in an email and it destroys my company, maybe it's not me clicking that link in the email that's the root problem here. Maybe there's an entire security model revisitation that's due. But I'm sorry, I will rant like a loon about the dismal state

of security these days if you let me, and you absolutely should not. Well, I would just entreat the audience, basic threat modeling is not complicated. It's like cost modeling. It's just a basic of having successful business on the cloud. I wish the world worked differently than it does. And yet here we are. Lynn, I really want to thank you for taking the time to come on the show a second time. If people want to learn more about what you're up to and talk to you about anything we've discussed, what's the best way to find you? So if you can't find me, you're not looking. I have an internet easy name, but two places that I'm pretty active, Twitter, just my name, Lynn Langit. And go to my GitHub. In particular, I have a learning cloud kind of meta repository that has over a hundred links to mostly free things on every cloud. And just use them, have at it,

learn, be a practitioner, use the cloud more effectively. And we will, of course, put links to that in the show notes. Thanks so much for coming back on i really appreciate it thanks for having me it's been fun lynn langett ceo of lynn langett consulting and oh so much more i'm cloud economist cory quinn and this is screaming in the cloud if you've enjoyed this podcast please leave a five-star review on your podcast platform of choice whereas if you've hated this podcast please leave a five-star review on your podcast platform of choice. Whereas if you've hated this podcast, please leave a five-star review on your podcast platform of choice, along with an angry comment talking about how security really isn't that important.

And right before you submit that comment, accidentally type your banking password into the form, too. If your AWS bill keeps rising and your blood pressure is doing the same, then you need the Duck Bill Group. We help companies fix their AWS bill by making it smaller and less horrifying. The Duck Bill Group works for you, not AWS. We tailor recommendations to your business and we get to the point. Visit duckbillgroup.com to get started.

This has been a HumblePod production. Stay humble.