1 00:00:01,080 --> 00:00:05,679 How'd you like to listen to dot NetRocks with no ads? Easy? Become 2 00:00:05,679 --> 00:00:09,839 a patron For just five dollars a month, you get access to a private 3 00:00:10,000 --> 00:00:14,439 RSS feed where all the shows have no ads. Twenty dollars a month will 4 00:00:14,439 --> 00:00:19,039 get you that and a special dot NetRocks patron mug. Sign up now at 5 00:00:19,039 --> 00:00:23,839 Patreon dot dot NetRocks dot com. Hey, Carl and Richard here with your 6 00:00:23,879 --> 00:00:29,199 twenty twenty four NDC schedule. We'll be at as many NDC conferences as possible 7 00:00:29,239 --> 00:00:33,520 this year, and you should consider attending no matter what. Ndcoslo is happening 8 00:00:33,640 --> 00:00:37,840 June tenth through the fourteenth. Get your tickets at ndcoslo dot com. The 9 00:00:37,920 --> 00:00:45,520 Copenhagen Developers Festival happens August twenty sixth through the thirtieth. Tickets at Cphdevfest dot 10 00:00:45,520 --> 00:00:50,719 com. Ndcporto is happening October fourteenth through the eighteenth. The early discount ends 11 00:00:50,840 --> 00:00:56,079 June fourteenth. Tickets at Ndcporto dot com. We'll see you there, we 12 00:00:56,240 --> 00:01:11,760 hope. Hey, guess what this is dot net rocks. I'm Carl Franklin 13 00:01:11,319 --> 00:01:15,040 Campbell and we're still at build. I like it. I like it here 14 00:01:15,079 --> 00:01:18,640 too, Man I love this little corner office looking down at the I don't 15 00:01:18,640 --> 00:01:21,560 know why we have a view, but we have a view. I'm not 16 00:01:21,640 --> 00:01:26,239 complaining. So listeners, just close your eyes and think of a nice Seattle 17 00:01:26,280 --> 00:01:30,319 city scape on a perfectly gray and rainy day. Yeah, up close too. 18 00:01:30,359 --> 00:01:33,200 So there's like a lot of detailed buildings and stuff. Yeah, very 19 00:01:33,239 --> 00:01:37,599 cool. Yeah. Uh, I feel like I don't see you but five 20 00:01:37,680 --> 00:01:42,640 times a year, you know, even though we you know, talk every 21 00:01:42,680 --> 00:01:45,799 week. But it's it's really cool. We have this circle of friends that 22 00:01:46,519 --> 00:01:51,480 we only see at conferences. Yeah, you know, and I think those 23 00:01:51,519 --> 00:01:53,560 are some of my closest friends. Yeah. Well, we do the same 24 00:01:53,599 --> 00:01:57,120 work, right, Like often most of our work is very by ourselves, 25 00:01:57,840 --> 00:02:01,799 and so this little club that we're in that does just kind of where it's 26 00:02:01,799 --> 00:02:06,040 goodell compare notes, but heck, that's what the show's about too, right 27 00:02:06,120 --> 00:02:08,919 exactly, yeah, exactly the time. Damien Brady's here. We'll be talking 28 00:02:08,960 --> 00:02:13,319 to him in a minute, but first let's get started with better note framework. 29 00:02:13,400 --> 00:02:22,599 Awesome, all right, man, what do you got? All right? 30 00:02:22,639 --> 00:02:25,960 So we had a little party last night for miss Mary Joe Foley MJA 31 00:02:27,120 --> 00:02:29,879 was here. Yeah, yeah, she's already flown out this morning. Yeah, 32 00:02:29,919 --> 00:02:31,960 yeah, a whole bunch of people. Paul Throatt was there, some 33 00:02:32,159 --> 00:02:37,560 rds, some MVPs, some Canadian people in your neck of the woods, 34 00:02:38,360 --> 00:02:43,960 and uh, this guy Mayde had thought came and sat down next to us 35 00:02:44,199 --> 00:02:46,800 and was telling us about how much he loved dot net. Rocks is from 36 00:02:46,879 --> 00:02:50,919 Israel and he said, I have a better no framework for you. I 37 00:02:50,960 --> 00:02:53,120 was like, okay, what is it? And he told me that you 38 00:02:53,159 --> 00:02:57,360 are. I went there. It's like, hey, that's you, so 39 00:02:57,560 --> 00:03:00,280 shameless from me. You are right there. But it's pretty cool. So 40 00:03:00,319 --> 00:03:04,840 if you've used link pad d I you link use link pad I have. 41 00:03:05,639 --> 00:03:13,520 So there's a dot dump extension method that you can add to the console similar 42 00:03:13,560 --> 00:03:22,000 to link pads called dumpify dumpify you know, uh, you can leave it 43 00:03:22,080 --> 00:03:24,879 up to your imagination, but basically, when you call this, you can 44 00:03:24,960 --> 00:03:30,960 dump any object in a structured and colorful way into the console, trace debug 45 00:03:31,120 --> 00:03:36,439 events, or your own custom output. So the people who love link pad 46 00:03:37,120 --> 00:03:42,240 really missed this feature in dot net console apps. So that's what it's for. 47 00:03:42,360 --> 00:03:46,159 It's for those people, Hey, we are thinking of you, my 48 00:03:46,280 --> 00:03:50,560 friend. Nice or more to the point, way it is thinking of you 49 00:03:51,159 --> 00:03:55,439 somebody's Yeah, but it's very cool. It's an MIT license open source tool. 50 00:03:55,479 --> 00:04:01,719 And there's also a video with John Galloway interviewing him and talking about it. 51 00:04:01,840 --> 00:04:04,199 Yeah, so go there, know and learn it, love it. 52 00:04:05,080 --> 00:04:08,360 Who's talking to us, Richard, if you can believe it. We have 53 00:04:08,479 --> 00:04:12,479 not had Damien on the show since twenty seventeen. That is ridiculous. Yeah, 54 00:04:12,520 --> 00:04:15,719 and then on us the very last time. It was actually when we 55 00:04:15,719 --> 00:04:20,360 were together in Orlando for I guess it was. It was an IG night. 56 00:04:20,759 --> 00:04:24,519 Yeah, that's the only reason I think we'd be in Orlando altogether with 57 00:04:24,560 --> 00:04:28,800 the inimitable Donovan Brown. No less. I remember this because it was like 58 00:04:29,079 --> 00:04:30,800 it was in the West wing, yeah, of the Ortlanta Convention, which 59 00:04:30,839 --> 00:04:33,399 I think is actually in a different time zone. Like I think we walked 60 00:04:33,399 --> 00:04:36,120 for a day and a half to get there. And I remember confusing your 61 00:04:36,199 --> 00:04:41,040 names because they're both DP and you know, yeah, two DB's a row. 62 00:04:41,079 --> 00:04:43,000 But I did not take a comment off of that show. I took 63 00:04:43,040 --> 00:04:46,279 the comment off of a different show we did the same year, in March 64 00:04:46,319 --> 00:04:47,800 of twenty seventeen. So there was a time when you did two shows at 65 00:04:47,720 --> 00:04:51,839 a year and now it's been seven years, Like, let's have we talk 66 00:04:51,879 --> 00:04:56,519 on run as all the time. It's been a while. This was the 67 00:04:56,560 --> 00:05:01,279 Brownfield DevOps show again at DC London. Notice the pattern. There's a pattern 68 00:05:01,319 --> 00:05:06,759 Brownfield dumpify. You know, we have a pattern here going right? So 69 00:05:06,839 --> 00:05:13,279 this cant Yeah, and then we were talking and so this was the Brownfield 70 00:05:13,279 --> 00:05:16,279 DevOps. So it's like, how do we put DevOps into an existing application, 71 00:05:16,600 --> 00:05:20,040 try and modernize and get it under better control, especially simply the people 72 00:05:20,040 --> 00:05:25,399 who are doing that are not the ones who built it. Free conversation and 73 00:05:25,399 --> 00:05:27,399 we had a bunch of good comments on this show and I just had to 74 00:05:27,399 --> 00:05:30,160 pick one and this is from Simon Tims. This is seven years ago. 75 00:05:30,879 --> 00:05:34,079 Great episode. Good to hear that more adopted Canadians on the show. You're 76 00:05:34,079 --> 00:05:39,120 an adopted Canadian. My company is one of the blips on the internal dashboard 77 00:05:39,120 --> 00:05:43,040 that Octopus has because I think you were Octopus then, Yeah, we first 78 00:05:43,120 --> 00:05:45,639 met you when you worked for Puss. Yeah, we've been using an octopus 79 00:05:45,680 --> 00:05:47,560 for a while and we've been very pleased direction it's taking. The work done 80 00:05:47,600 --> 00:05:51,360 around transient machines has been especially helpful as you run on top of an ever 81 00:05:51,439 --> 00:05:56,879 changing number of machines on ALUs. There seems to be a bit of a 82 00:05:56,920 --> 00:06:00,480 theme going on about what defines a legacy system. I'd agree that a legacy 83 00:06:00,519 --> 00:06:03,720 isn't necessarily bad. It may be working fine. We have some micro services 84 00:06:03,759 --> 00:06:08,279 that just haven't been updated in six months because they appear to just work what 85 00:06:08,399 --> 00:06:13,639 a concept. Sometimes software is done. The problem occurs when the tribal knowledge 86 00:06:13,639 --> 00:06:16,199 for that piece of code disappears. Ideally, the code is well structured and 87 00:06:16,240 --> 00:06:20,000 understandable enough that even if the knowledge is lost, we can rebuild it pretty 88 00:06:20,040 --> 00:06:25,240 easily. Avoiding unmaintainable legacy code, in my mind, goes hand in hand 89 00:06:25,279 --> 00:06:28,839 with structuring your code well, having tests, and running bills and deployments from 90 00:06:28,839 --> 00:06:31,120 time to time even if nothing in the code has changed. M hmm. 91 00:06:31,560 --> 00:06:34,040 That's a fair thought. I mean, we really were talking about people move 92 00:06:34,040 --> 00:06:38,279 on and they go into other projects. But honestly, like within a couple 93 00:06:38,319 --> 00:06:41,680 of days of me writing code, it's gone. I got whiskey to store 94 00:06:41,720 --> 00:06:45,480 in my head like there's only so much space, right, so anybody could 95 00:06:45,519 --> 00:06:47,720 be working on it at that point. So I agree, the documentation is 96 00:06:47,759 --> 00:06:55,680 one thing, the tests are another, and they fast forward seven years today, 97 00:06:55,720 --> 00:06:58,720 you'd just get copilot to write those tests for you as much less, 98 00:06:58,800 --> 00:07:01,399 right, And what does this code do? Certainly it's writing my prs, 99 00:07:01,560 --> 00:07:04,000 that's one thing. And I think I said this on the last show. 100 00:07:04,079 --> 00:07:08,160 I love using code Pilot to say, hey, take this code and comment 101 00:07:08,240 --> 00:07:11,040 it. Yeah, yeah, yeah, everything is well commented Simon. You 102 00:07:11,040 --> 00:07:14,680 give us a little nostalgia run plus reminded us of how different the world is 103 00:07:14,759 --> 00:07:16,560 now seven years on. So thanks so much for that. A copy of 104 00:07:16,600 --> 00:07:18,920 music Coby is on its way to you. If you'd like a copy music 105 00:07:19,000 --> 00:07:21,560 Code by, we're in a comment on the website at dot net rocks dot 106 00:07:21,600 --> 00:07:25,439 com or on the social media's. We put every show on Facebook. And 107 00:07:25,439 --> 00:07:27,399 if you comment there and I read the show, wasn't you a copy of 108 00:07:27,439 --> 00:07:30,959 music Code buy? Yeah? Music to code by good? And uh, 109 00:07:30,160 --> 00:07:34,000 you know, we've been on x I still can't get over since it was 110 00:07:34,040 --> 00:07:39,519 Twitter, since the old days. Remember what I remember when it was called 111 00:07:39,560 --> 00:07:44,040 Twitter? Uh, And of course we've been on there for years and you 112 00:07:44,079 --> 00:07:46,040 can send us a tweet or an ex or whatever the heck you call it. 113 00:07:46,040 --> 00:07:48,720 But the cool kids are hanging out. I'm masses on, I'm at 114 00:07:48,759 --> 00:07:51,800 Carl Franklin at tech hub dot social, and I'm Rich Campbell at mass it 115 00:07:51,839 --> 00:07:55,639 on dot social. Send us a two. That's another way that you can 116 00:07:55,639 --> 00:08:00,759 get yourself some music to code by excellent. Uh, let's bring on Damian 117 00:08:00,800 --> 00:08:07,319 Brady and he is currently staff developer advocate for gi hub. That's right, 118 00:08:07,399 --> 00:08:09,560 Yeah, what is a staff developer? That's a great question. Yeah, 119 00:08:11,720 --> 00:08:13,680 you have a great answer. Yeah, staff developer. It's it's just a 120 00:08:13,759 --> 00:08:18,920 level thing that we need, so we do like developer advocate, senior and 121 00:08:18,920 --> 00:08:20,920 then staff and then it's probably principal or something. I don't know, I 122 00:08:20,920 --> 00:08:24,160 haven't looked that far ahead. And then it's greater puba developer advocates. There's 123 00:08:24,199 --> 00:08:28,040 yeah, way more important people. You know what if they just numbered things 124 00:08:28,079 --> 00:08:31,839 like you know, level one, level two, level three, then we 125 00:08:31,959 --> 00:08:33,200 actually know where you are in the hierarchy. But why do they come up 126 00:08:33,240 --> 00:08:37,159 with these cryptic names. I mean they do number them, they put a 127 00:08:37,200 --> 00:08:41,639 dollar sign in front and you can't share that one really? Yeah, yeah, 128 00:08:41,679 --> 00:08:46,080 that's the one. Having a good time right now? Do you think 129 00:08:46,240 --> 00:08:50,440 we are? Yeah, we're doing well. And you guys invented the best 130 00:08:50,559 --> 00:08:54,080 name for a large language model ever. We're calling it co pilot. Yeah, 131 00:08:54,159 --> 00:08:56,919 that that tool has been well, the name for the tool is being 132 00:08:56,960 --> 00:08:58,720 adopted by Microsoft. I don't know. I don't know how much you've walked 133 00:08:58,720 --> 00:09:01,879 around and to build where we are a little bit. Have you heard? 134 00:09:03,480 --> 00:09:05,759 You know, I originally had this idea that I have a drinking game every 135 00:09:05,759 --> 00:09:11,840 time you said co pilot first hour you're in the hospital. Yeah, in 136 00:09:11,879 --> 00:09:16,919 fact, every two seconds. You know, they're using the word co pilot 137 00:09:16,960 --> 00:09:24,120 all over the the keynotes. And there's more than one co pilot, right, 138 00:09:24,919 --> 00:09:28,200 so now you build your own co pilots with co Pilot Studio, and 139 00:09:28,360 --> 00:09:31,559 yeah, there's there's so many. I think honestly though, that speaks to 140 00:09:33,200 --> 00:09:39,720 how descriptive that name is and how accurately I mean it represents what it's supposed 141 00:09:39,759 --> 00:09:41,960 to do. Sure, I mean it's a it's a perfect name in the 142 00:09:41,000 --> 00:09:45,000 sense of you know what it means. It also, you know, mitigates 143 00:09:45,080 --> 00:09:52,360 legal liability. You're the pilot. But I think GitHub pilot copilot is especially 144 00:09:52,360 --> 00:09:54,919 a good name because it also talks about the source of data. You know 145 00:09:56,000 --> 00:09:58,960 what the model was built one and I think it's been very successful because develop 146 00:10:00,120 --> 00:10:05,759 first get this like it's just something like I worry about consumers trying to use 147 00:10:05,759 --> 00:10:09,039 technology about this far more than I worry about developers, just because we're used 148 00:10:09,080 --> 00:10:13,799 to explaining code and having code explained, and we were used to evaluating code 149 00:10:13,960 --> 00:10:18,320 and making assessments on it. I have been talking to a bunches of pms 150 00:10:18,320 --> 00:10:22,360 that have had teams now using Copilot for more than a year, and first 151 00:10:22,399 --> 00:10:24,519 I talked to the devs, and then after a while started talking to the 152 00:10:24,600 --> 00:10:28,759 pms and one of the things they were saying this particular time is that checking 153 00:10:28,799 --> 00:10:33,639 behaviors completely changed. Yeah. Yeah, but the one thing they said. 154 00:10:33,759 --> 00:10:39,519 One thing that they said was there are far more reverts, right, but 155 00:10:41,000 --> 00:10:45,879 if they don't revert within like the first hour, there's almost no changes after 156 00:10:45,919 --> 00:10:48,600 that. And so we were talking about, like, why do you think 157 00:10:48,600 --> 00:10:52,399 this is the case? Is I think they're still learning, So they're getting 158 00:10:52,399 --> 00:10:54,679 a chunk of code and they don't fully understand it, and then they push 159 00:10:54,759 --> 00:10:58,600 it and then it goes to the test pipeline, it gets crucified, and 160 00:10:58,639 --> 00:11:03,960 they were it, Yeah, or they do understand the code and make a 161 00:11:03,960 --> 00:11:05,840 few tweaks on it and they push it and it's pretty good. Yeah, 162 00:11:07,080 --> 00:11:09,919 and I mean that's the that's the issue and the concerns I guess with these 163 00:11:09,960 --> 00:11:15,799 AI tools where there's a there's a legitimate concern that you know, it just 164 00:11:15,840 --> 00:11:18,840 blindly puts something out and you blindly accept it. And it does really this 165 00:11:18,879 --> 00:11:22,879 stuff with stack overflow meme, right, And I got to say this again, 166 00:11:22,919 --> 00:11:28,080 we really have to differentiate between AI that generates code from repositories or whatever 167 00:11:28,519 --> 00:11:33,480 and AI that gives you business advice or you know, it gives you text 168 00:11:33,720 --> 00:11:39,240 or language, right. And I think that the first case is a home 169 00:11:39,320 --> 00:11:41,559 run, and it's especially for developers because you know, the compiler has to 170 00:11:41,559 --> 00:11:45,919 have its say and you have to get it past the compiler before it'll run. 171 00:11:46,879 --> 00:11:50,759 And also you know the stuff about you know, looking against your data 172 00:11:52,080 --> 00:11:56,320 and trying to find things that are just black and white. The data is 173 00:11:56,360 --> 00:12:00,440 either there or it's not right. So those things are great, But it's 174 00:12:00,480 --> 00:12:07,360 the small language models and the large language models in those things that you either 175 00:12:07,440 --> 00:12:11,080 have to trust them completely, yeah, or else what's the point? Yeah? 176 00:12:11,279 --> 00:12:13,759 Well, I mean this is part of and I know we'll talk about 177 00:12:13,759 --> 00:12:16,919 this in a sect, but part of the direction that the team has been 178 00:12:16,960 --> 00:12:24,000 thinking about in terms of how to do more than just be a smart code 179 00:12:24,039 --> 00:12:28,480 completion engine. And the code completion stuff is great. You acceptance acceptance rates. 180 00:12:28,840 --> 00:12:33,639 I don't know the official stat but acceptance rates are well over fifty percent. 181 00:12:33,759 --> 00:12:37,639 So in some code bases, you know, it's seventy percent of the 182 00:12:37,639 --> 00:12:41,679 code is written by co Pilot technically, but that's one part of the tool. 183 00:12:41,679 --> 00:12:46,759 But there's a huge amount of work that developers do that is not cutting 184 00:12:46,799 --> 00:12:50,159 code. Right. There's been a bunch of studies and they all kind of 185 00:12:50,159 --> 00:12:54,320 differ obviously because it's a bit you know, subjective, but around three quarters 186 00:12:54,360 --> 00:12:58,279 of the work that developers do is not writing code. It's interpreting requirements and 187 00:12:58,320 --> 00:13:03,600 figuring out where to put the changes and all of that stuff. You do 188 00:13:03,639 --> 00:13:07,039 all that pre work so that the coproper becomes easy. Yeah, but it 189 00:13:09,000 --> 00:13:13,320 is the knowing what needs to be done next. But yeah, the architecture, 190 00:13:13,399 --> 00:13:18,519 right, would you consult Copilot on how to best create an architecture for 191 00:13:18,559 --> 00:13:22,159 your application? There's a little gray area right there. Yeah, absolutely, 192 00:13:22,240 --> 00:13:26,080 and it's good. Yeah, it's good at some things, it's not good 193 00:13:26,080 --> 00:13:30,039 at other things. I think just repetition of using it. Lets you know 194 00:13:30,080 --> 00:13:33,039 what it's good at and what it isn't good at. But it's also the 195 00:13:33,080 --> 00:13:37,519 tool itself. I mean a lot of the discussion I think it build has 196 00:13:37,519 --> 00:13:41,159 been around this kind of agent model where you have these lowercase a agent, 197 00:13:41,399 --> 00:13:46,519 where it's an agent that's particularly good at a specific task, and the prompts 198 00:13:46,559 --> 00:13:50,039 and the meta prompts and the models that are used and the data like the 199 00:13:50,159 --> 00:13:56,360 rag patterns and all of that stuff is tuned to answer that question, to 200 00:13:56,399 --> 00:14:01,000 help you solve that question. And that's kind of how you and make it 201 00:14:01,000 --> 00:14:03,240 a little less gray, I guess in those areas. But yeah, the 202 00:14:03,320 --> 00:14:09,440 tooling is definitely being it's evolving, I guess it's being you know, slowly 203 00:14:09,559 --> 00:14:13,159 we're getting closer and closer to these tools that help with some of the other 204 00:14:13,159 --> 00:14:16,240 stuff. I'm appreciating that models are getting smaller. That's to me signed that 205 00:14:16,240 --> 00:14:18,200 they're actually getting mature, right. You know one of the pushes they had 206 00:14:18,240 --> 00:14:24,360 in the keynote was six times more efficient, one twelfth the costs. Yeah, 207 00:14:24,399 --> 00:14:26,679 and it's like, okay, well that's the kind of thing we want 208 00:14:26,720 --> 00:14:28,080 you to do. We don't want you to just keep making the model bigger 209 00:14:28,080 --> 00:14:31,799 and bigger and bigger, but along with that has to go accuracy. Yeah, 210 00:14:31,799 --> 00:14:35,559 and you would presume that those numbers go alongside at least as good, 211 00:14:35,960 --> 00:14:39,159 if not better. Well, I don't know. That's one of the problems 212 00:14:39,200 --> 00:14:43,080 I have with like to summarize this code. What if it's wrong. It's 213 00:14:43,120 --> 00:14:45,840 wrong. Yeah, that's right, and so you either have to trust it 214 00:14:45,879 --> 00:14:48,759 completely or don't use it. And there unless the problem, which is not 215 00:14:48,919 --> 00:14:54,799 just for co pilot but for everything. We were talking to Barry O'Reilly and 216 00:14:54,279 --> 00:15:00,360 he kind of put his future hat on and saw that someday he thinks we'll 217 00:15:00,360 --> 00:15:03,840 be the co pilots. Yeah, that's a good way of putting it. 218 00:15:03,879 --> 00:15:07,759 I've had that similar thought where we will be a supervisors amongst like yeah, 219 00:15:07,840 --> 00:15:09,600 yeah, but does not make us a copilot. Like I didn't agree with 220 00:15:09,679 --> 00:15:13,360 that on that. Yeah, in the sense that software has no intent, 221 00:15:15,000 --> 00:15:16,879 right, it doesn't, you know. I think it would be good at 222 00:15:16,879 --> 00:15:22,639 managing a checklist, giving it a parted the data set that was requirements. 223 00:15:22,080 --> 00:15:26,200 Then it would go and map those requirements to what was being built and then 224 00:15:26,399 --> 00:15:28,879 just bring up like, hey, there's this requirement and I can't find a 225 00:15:28,960 --> 00:15:31,559 mapping for this. So it was a kind of a you know, shock 226 00:15:31,639 --> 00:15:33,519 value absolute statement. But if you think about it, you have the people 227 00:15:33,559 --> 00:15:37,240 at the top who are driving the AI, and then you may have co 228 00:15:37,399 --> 00:15:43,000 pilots to the AI underneath that that that do the checking and do the It 229 00:15:43,080 --> 00:15:46,720 might be more of a balance of work right where the AI is doing them, 230 00:15:46,919 --> 00:15:50,360 Yeah, the majority of the actual work. But you're alongside. And 231 00:15:50,799 --> 00:15:54,080 I don't know who said this, it might have been you, Richard that 232 00:15:54,159 --> 00:15:58,320 you know, don't be afraid of the chances that your job is going to 233 00:15:58,320 --> 00:16:03,679 be replaced by and AI are small, but the chances that your job is 234 00:16:03,720 --> 00:16:08,320 going to be replaced by another developer that uses AI are obviously there. Yeah, 235 00:16:08,399 --> 00:16:15,399 because they're more productive, they're more Productiveyeah. Yeah, I didn't really 236 00:16:15,399 --> 00:16:18,559 want to talk about copole all that much, but it's kind of the monster 237 00:16:18,639 --> 00:16:22,240 in the room, like it's unavoidable. And obviously there's new integrations and things 238 00:16:22,240 --> 00:16:25,600 with that. But the bigger announcment that came out last month was that I 239 00:16:25,639 --> 00:16:29,039 thought that was new forgetthub like that again, gethubs having a good time right 240 00:16:29,080 --> 00:16:32,639 now, you're making new things. Yeah, and workspaces to me sort of 241 00:16:32,639 --> 00:16:36,679 came out of nowhere. Yeah, it was. So we have a team 242 00:16:36,720 --> 00:16:41,799 inside gethub called getthub Next and it's kind of the R and D of getub. 243 00:16:41,840 --> 00:16:45,559 It's like the it's like the concept car department of getthub and they experiment 244 00:16:45,600 --> 00:16:49,039 with a bunch of stuff. That's how copilot came to be. That started 245 00:16:49,080 --> 00:16:55,240 there and then it you know, it gains kind of product fit and maturity 246 00:16:55,279 --> 00:16:57,279 and stuff like that, and then it goes to you know, the products 247 00:16:57,320 --> 00:17:00,399 team. But one of the things that been working on is how do we 248 00:17:00,600 --> 00:17:04,920 look at that other seventy five percent of the work and how can generate code 249 00:17:06,160 --> 00:17:08,359 yeah that isn't coding, yes, and how does generative AI help with that? 250 00:17:08,440 --> 00:17:12,839 And the model they kind of landed on with this thing called copilot workspace 251 00:17:12,920 --> 00:17:18,400 or GitHub copilot workspace. So like to run through the scenario, you start 252 00:17:18,400 --> 00:17:22,200 with an idea, an issue or just a sentence, like a task something 253 00:17:22,279 --> 00:17:27,319 like that. Using that and its knowledge of your code, semantic index of 254 00:17:27,359 --> 00:17:33,079 your code base which understands and I'm doing air quotes around the world understands it 255 00:17:33,119 --> 00:17:37,440 knows how that all fits together. It identifies the relevant parts of your code 256 00:17:37,880 --> 00:17:42,119 and builds a specification which is the current state of those relevant parts of the 257 00:17:42,119 --> 00:17:47,240 code, and then the proposal of what should change there, and then from 258 00:17:47,240 --> 00:17:49,359 that it's all completely under your control. So you can change that, you 259 00:17:49,400 --> 00:17:52,480 can remove things, you can refine the original task, you can provide more 260 00:17:52,480 --> 00:17:56,839 information. But then when you're ready, you go from that specification to a 261 00:17:56,880 --> 00:18:00,880 plan and then it's identifying the files that need to change and how they need 262 00:18:00,920 --> 00:18:03,519 to change, and again you can add files to it, you can remove 263 00:18:03,519 --> 00:18:07,279 things, you can correct understanding. So it's almost if you had chat GPT 264 00:18:07,559 --> 00:18:11,960 that had the context of your application. Yeah, already known exactly, but 265 00:18:12,079 --> 00:18:15,279 the important thing is it kind of goes through the same flow that you would 266 00:18:15,279 --> 00:18:18,799 as a developer, and they experimented with a bunch of ways of doing this, 267 00:18:18,920 --> 00:18:22,920 right, But that is kind of the way that we work when we 268 00:18:22,039 --> 00:18:26,400 approach a problem. We think about what it looks like now and what it's 269 00:18:26,440 --> 00:18:27,720 going to look like in the future, and then what does that mean we 270 00:18:27,799 --> 00:18:32,119 need to change and how, and then when you're done, you click on 271 00:18:32,359 --> 00:18:36,720 you know, implement these files and it will go and write the changes into 272 00:18:36,799 --> 00:18:38,920 the files for you. Again, completely under control. You can change that 273 00:18:38,960 --> 00:18:41,559 code, you can revert it, you can do all that sort of stuff, 274 00:18:41,759 --> 00:18:45,920 and then there's there's some other tech around it, like you're being able 275 00:18:45,920 --> 00:18:48,920 to do a live preview with a code space underneath it and things like that. 276 00:18:48,960 --> 00:18:52,920 But that flow of let's find the places in the code that need to 277 00:18:53,000 --> 00:18:57,640 change, identify how they should change, of work, you get a work 278 00:18:57,680 --> 00:19:00,680 item in that says hey, we need to update such and such. You're 279 00:19:00,680 --> 00:19:03,319 like, well, where is that in this hour? Yeah, the idea 280 00:19:03,319 --> 00:19:07,440 that the tool would just go it's here. I think it should look like 281 00:19:07,519 --> 00:19:11,279 this. Ye. So I mean first did it find the right location? 282 00:19:11,400 --> 00:19:15,799 And then the second question is this is the correct change? Yeah, and 283 00:19:17,079 --> 00:19:22,359 where the team is incredibly conscious that it's not a case of let's just write 284 00:19:22,359 --> 00:19:26,400 some natural language description of what needs to change and then magically it just gets 285 00:19:26,440 --> 00:19:30,000 done. You know, there's got to be human guidance in that, like 286 00:19:30,039 --> 00:19:33,400 the experts need to be able to look at what it's doing and saying, 287 00:19:33,400 --> 00:19:36,960 well that that's clearly not right, or we need to refine it this way, 288 00:19:37,160 --> 00:19:41,799 or even the team itself uses it internally. They do a lot of 289 00:19:41,799 --> 00:19:45,920 dog fooding. So some of Copilot workspace has been written with workspace, which 290 00:19:45,960 --> 00:19:48,759 is kind of a little bit cursive. Yeah, we don't call it dog 291 00:19:48,759 --> 00:19:52,440 feeding. By the way, it's drinking your own champagne. That's a little 292 00:19:52,440 --> 00:20:00,960 disgusting. Dog is eating dog food, wasn't Yeah, dog champagne, I 293 00:20:00,960 --> 00:20:08,000 don't know. Even worse so drinking your dog's champagne. Drink champagne. I'll 294 00:20:08,039 --> 00:20:11,759 propose that asn't anyone. But they've been doing a lot of this stuff internally. 295 00:20:11,880 --> 00:20:15,599 Some of the things I use it for is just like ideation, like, 296 00:20:15,160 --> 00:20:18,480 hey, what would it look like if we did this, and then 297 00:20:18,519 --> 00:20:21,079 it goes through and identifies the changes. You have a look at what it's 298 00:20:21,079 --> 00:20:22,640 done and then be like ah, but it does go to an origin of 299 00:20:22,720 --> 00:20:26,640 code every time, right, Yeah, that's yeah. This is not a 300 00:20:26,680 --> 00:20:30,400 collaborative tool for writing a menu or you know, it's always code. Yeah. 301 00:20:30,440 --> 00:20:34,359 Yeah, So the context and to your point Carl about you know, 302 00:20:34,359 --> 00:20:40,119 knowing and trusting that it's doing the right thing. You can go some way 303 00:20:40,240 --> 00:20:42,599 to doing that by saying here's the code, and here's the searchability of the 304 00:20:42,640 --> 00:20:48,519 code. We've indexed it. So there's some ground code. The whole code 305 00:20:48,519 --> 00:20:52,920 milieu of AI is not really a problem. Yes, yeah, so yeah, 306 00:20:52,920 --> 00:20:56,119 they're working on that. That's that's workspace that was kind of announced. 307 00:20:56,160 --> 00:21:02,319 It's in technical preview at time of recording, but it was can you can 308 00:21:02,359 --> 00:21:04,119 add yourself to the weight list? You can? Yeah? So yeah, 309 00:21:04,160 --> 00:21:07,839 so yeah, it should be pretty easy to find that weight list, but 310 00:21:07,839 --> 00:21:11,359 we're slowly letting people on and trying to look. I've got a link comment 311 00:21:11,400 --> 00:21:12,759 for the show notes, so you can go get on the It has the 312 00:21:12,839 --> 00:21:15,400 thing that says join the weight list if you want to take a look at 313 00:21:15,359 --> 00:21:19,799 it. So, I mean, I would argue that get he copilot ten 314 00:21:19,839 --> 00:21:23,000 bucks a month is too cheap. Yeah, it's interesting. We get them 315 00:21:23,039 --> 00:21:27,279 one one side or them through sixty five is thirty dollars. Yeah, and 316 00:21:27,279 --> 00:21:32,799 that and some folks complain about that, although again talking to an organization's maybe 317 00:21:32,799 --> 00:21:37,119 we have a run has had on and they're like, these people are worth 318 00:21:37,119 --> 00:21:40,599 fifty bucks an hour. Yeah, you see me an hour in a month. 319 00:21:41,079 --> 00:21:44,240 There was a there's one of the guys at the booth, Dave Bernison, 320 00:21:44,359 --> 00:21:48,559 you probably know, you know everyone. Dave Bernison did some back of 321 00:21:48,599 --> 00:21:52,240 the envelope math about you know, how much you would need to save and 322 00:21:52,319 --> 00:21:57,119 developer time to cover that copilot license. And I think he worked out at 323 00:21:57,119 --> 00:22:03,119 something like twenty minutes a month at an average develop a salary in the US. 324 00:22:03,200 --> 00:22:07,839 Yeah. Yeah, it's ridiculously cheap and the benefits are huge, right, 325 00:22:07,960 --> 00:22:11,079 Like, it's just it's crazy to think about with the effects of that 326 00:22:11,759 --> 00:22:15,319 extensive to not use, Yeah, exactly. And then you throw in I 327 00:22:15,319 --> 00:22:18,839 mean at some point you're going to workspace is going to be a product, 328 00:22:18,920 --> 00:22:21,400 isn't yet, and you're going to charge for that, and same sort of 329 00:22:21,400 --> 00:22:25,480 thing, Like I have wasted an hour looking for the right place to make 330 00:22:25,480 --> 00:22:27,480 a modification to some code. Yeah, just chasing around, going I'm in 331 00:22:27,480 --> 00:22:32,240 the wrong freaking project. Yeah, especially if you have a lot of projects 332 00:22:32,240 --> 00:22:34,279 inside your organization. Yea, yeah, how do you find where the right 333 00:22:34,279 --> 00:22:37,359 thing is? Because I've been on dot net. This is a React project 334 00:22:37,359 --> 00:22:41,279 that somebody wrote twelve years ago. Like, I don't know if React's been 335 00:22:41,279 --> 00:22:45,920 around for twelve years, but I definitely have a twenty year experienced text pervoding 336 00:22:45,960 --> 00:22:49,640 though. That's right, tell my resume yep. Oh man, Well, 337 00:22:49,759 --> 00:22:53,119 I mean I'm looking forward to spending some time. I got it on here 338 00:22:53,200 --> 00:22:56,720 on the early wait list, so we snuck you in. Yeah, I 339 00:22:56,720 --> 00:22:57,880 appreciate that. And you know what, I'm going to do. I'm going 340 00:22:57,920 --> 00:23:02,640 to work on the run as site with nice exactly that. And because there's 341 00:23:02,680 --> 00:23:03,759 things I need to do and I'm not paying close enough attention to it. 342 00:23:03,759 --> 00:23:07,960 So it's like I can sit down for a day, get run As in 343 00:23:07,039 --> 00:23:10,960 there and just say, oh, these are the changes I need to make 344 00:23:11,039 --> 00:23:14,960 and see what it suggests. You know, that's good to do some real 345 00:23:14,960 --> 00:23:17,160 work, and goodness knows, I don't have a real job before, so 346 00:23:17,200 --> 00:23:18,599 I have to maintain you know, the run ass sight. That's what I'm 347 00:23:18,599 --> 00:23:23,799 going to do. The enterprisiness of Remember when get hub was not couldn't make 348 00:23:23,839 --> 00:23:27,160 money? Yeah, yeah, you know, and I remember that. Yeah, 349 00:23:27,279 --> 00:23:30,359 and then it was bought by Microsoft. You're like, ah, good, 350 00:23:30,440 --> 00:23:32,000 you know, now they don't have to make money. It's gonna be 351 00:23:32,000 --> 00:23:33,599 fine. In fact, they made a bunch of stuff free that they were 352 00:23:33,599 --> 00:23:38,640 trying to charge row before. And now you've got one point eight million subscribers 353 00:23:38,680 --> 00:23:42,079 to get hub, I think to get up coipilot copilot, yeah, which 354 00:23:42,119 --> 00:23:45,559 I think satcha out at that number, and I'm like ten bucks a month, 355 00:23:45,759 --> 00:23:48,079 that's a that's a bit of cash flow. I mean, in the 356 00:23:48,119 --> 00:23:52,559 tech giant world, it's nothing like Microsoft rings in what's sixty billion a quarter 357 00:23:52,680 --> 00:23:56,839 or something like that. Something absurd, But that's money, it is. 358 00:23:56,960 --> 00:24:00,279 And I mean there's that's still only a fraction of the number of people on 359 00:24:00,319 --> 00:24:04,240 GitHub. There's one hundred million people using yeah, maybe two million of amusing 360 00:24:04,240 --> 00:24:07,960 coppilts so far. So you just barely touching the potential customer base. But 361 00:24:08,440 --> 00:24:11,799 you know, I'm wearing my enterprise hat full on. It's like, there's 362 00:24:11,839 --> 00:24:14,839 a bunch of stuff I need from GitHub. Yeah, I want a good 363 00:24:14,880 --> 00:24:18,640 bill of materials app Yeah, across a large organization. How many of these 364 00:24:18,680 --> 00:24:22,400 applications use log for j please? Ye, Like you can figure that out, 365 00:24:22,400 --> 00:24:26,920 but I've seen people spend days figuring that out. Yeah, the data 366 00:24:27,039 --> 00:24:32,039 is there, like we we things like depend a butt as well can which 367 00:24:32,079 --> 00:24:34,759 is fantastic. Yeah, I can identify those things and then surface that up 368 00:24:34,759 --> 00:24:38,160 to your org level and to your enterprise level as well. If you have 369 00:24:38,240 --> 00:24:41,240 the right licensing and and be able to say, well, look of your 370 00:24:41,680 --> 00:24:45,200 one hundred projects that you've got, you know, fifty of them are using 371 00:24:45,440 --> 00:24:49,000 like have have DEPENDABT problems here, and then you can drill into those and 372 00:24:49,000 --> 00:24:52,720 find them as well. But yeah, there's there's a lot of those enterprise 373 00:24:52,759 --> 00:24:56,480 problems that that the teams are working pretty hard on because, yeah, githubs 374 00:24:56,480 --> 00:25:00,440 still we talk about being the home for open source, which we are, 375 00:25:00,559 --> 00:25:03,680 but the but the enterprise is in your open source. Yeah, and frankly, 376 00:25:03,720 --> 00:25:08,680 the enterprise has the money. They have to have money, they're using, 377 00:25:08,720 --> 00:25:11,319 they're using a bunch of these libraries and they expecting things from them that 378 00:25:11,640 --> 00:25:15,759 they aren't intrinsic. Yeah, exactly. We had the what was it called 379 00:25:15,759 --> 00:25:21,759 the xf scare. You know, they they the bad state actor. Pretty 380 00:25:21,759 --> 00:25:26,920 sure it was China that was slipping a back door into a low level compression 381 00:25:27,039 --> 00:25:33,599 utility that things like S s H depended on. And only because one meticulous 382 00:25:33,640 --> 00:25:41,240 guy at Microsoft noticed a half second or a five millisecond delayed his benchmark and 383 00:25:41,279 --> 00:25:45,599 they didn't let it go. He wasn't looking for bad actors, He just 384 00:25:45,599 --> 00:25:49,440 wouldn't why is that slower, and just kept pursuing pursuer because apparently they hit 385 00:25:49,519 --> 00:25:53,240 it really well. Well. Also, this guy or this team, it 386 00:25:53,319 --> 00:25:59,319 was probably a team, you know, was that when their first check, 387 00:25:59,599 --> 00:26:06,240 their first check in of rogue code was where bugs that were easily spottable like 388 00:26:06,440 --> 00:26:07,839 and and so they asked him to fix them. He's like, oh, 389 00:26:07,880 --> 00:26:11,720 I'm sorry, I'll fix that. And the next one he put out, 390 00:26:11,920 --> 00:26:14,799 this was the one that they were like, hmm, we're going to check 391 00:26:14,839 --> 00:26:22,519 that out because it wasn't as obvious. But this They spent years checking code 392 00:26:22,519 --> 00:26:26,599 into this project. Yes, like that's a they ingratiated themselves to them, 393 00:26:26,920 --> 00:26:30,640 and the project hadn't been updated in like three years or so, so it 394 00:26:30,680 --> 00:26:33,400 was like the perfect vector to just slide in and be a hero for a 395 00:26:33,400 --> 00:26:38,400 while, get the confidence, and then boom. Yeah, but the level 396 00:26:38,440 --> 00:26:42,440 of expertise and dedication required to do that because and this is where you're talking 397 00:26:42,440 --> 00:26:47,880 about the enterprise in open source, like, how do we have confidence that 398 00:26:47,880 --> 00:26:51,160 that code is safe? And he told me this, great, you had 399 00:26:51,160 --> 00:26:53,279 this great comment. We were talking about this in the bar, which is 400 00:26:53,440 --> 00:26:59,480 the alternative to open source is much worse. Absolutely, yeah, and we 401 00:26:59,519 --> 00:27:03,079 forget that now the state actor breaks into your code base because your system starts 402 00:27:03,119 --> 00:27:06,799 a secure and modifies your code in an invisible way. But there's more people 403 00:27:06,839 --> 00:27:10,400 looking at it, and there's so many Yeah, well was it the log 404 00:27:10,480 --> 00:27:15,079 for jay vulnerability? I think that popped up and we noticed that, and 405 00:27:15,440 --> 00:27:18,359 you know, secur it all of our stuff. And then because because where 406 00:27:18,359 --> 00:27:21,359 I am or the source of this information, you know, if there's a 407 00:27:21,359 --> 00:27:25,559 security vulnerability, we are aware of it and we publish those. Yeah, 408 00:27:25,559 --> 00:27:27,480 and it bubbles up to visual Studio. You know, you load a visual 409 00:27:27,480 --> 00:27:32,400 Studio project from a GitHub repon and it says, hey, there are vulnerabilities 410 00:27:32,440 --> 00:27:36,920 in this in your chain. Yeah. I mean every every company, whether 411 00:27:36,960 --> 00:27:37,839 they know it or not, or whether they admit it or not. I 412 00:27:37,839 --> 00:27:42,000 guess it is using open source of course to a huge degree, and question 413 00:27:42,119 --> 00:27:47,079 of do they know it? But from that, from that perspective, when 414 00:27:47,119 --> 00:27:52,359 trying to build software with a secure supply chain, it's like do I maintain 415 00:27:52,039 --> 00:27:56,599 my own copies so that I know when they change and they're and their pristine, 416 00:27:56,640 --> 00:27:59,519 And even when I do, the question is and when I pick it 417 00:27:59,599 --> 00:28:03,119 up, did I pick it up with a with a hidden back door in 418 00:28:03,160 --> 00:28:04,839 it? Like it's it's incredibly hard to know. Like, I think we're 419 00:28:04,880 --> 00:28:10,839 still working through the policies that are going to need to say yeah, this 420 00:28:10,920 --> 00:28:14,079 software is fine, this is what you expect. Yeah. I think one 421 00:28:14,119 --> 00:28:18,039 of the things that highlights as well is that there's not really as clear a 422 00:28:18,079 --> 00:28:22,279 separation between enterprise development and open source development. It's the same people for a 423 00:28:22,359 --> 00:28:27,240 start doing that work. But also everything that's being done in the enterprise is 424 00:28:27,240 --> 00:28:33,839 dependent on open source people like people donating their time. So when we think 425 00:28:33,880 --> 00:28:37,359 any defects, is that more well, companies need to contribute to this project. 426 00:28:37,440 --> 00:28:38,720 Yeah, and we have we have like sponsors and things like that to 427 00:28:38,720 --> 00:28:41,880 do it. But yeah, it's a bit it is. You know, 428 00:28:41,960 --> 00:28:44,119 I would argue, if you solve the bill of materials problem, you could 429 00:28:44,119 --> 00:28:47,400 also solve the sponsor problem. So there is and I realize I'm going out 430 00:28:47,400 --> 00:28:48,839 on a limb here because I don't know the exact details. But you can 431 00:28:49,119 --> 00:28:56,160 do an export I think of the projects that you're REPO depends on, and 432 00:28:56,200 --> 00:29:00,680 then use that to import into the sponsors that you look we're talking about here, 433 00:29:00,799 --> 00:29:03,160 all right, So I no, no, what I mean, that's 434 00:29:03,200 --> 00:29:04,839 not what I mean. I mean, AI should be able to figure this 435 00:29:04,839 --> 00:29:07,599 stuff out, like it shoul bubbled up to visual Studio that when I have 436 00:29:08,119 --> 00:29:12,160 I open up my you know, updates panel in the package manager console and 437 00:29:12,240 --> 00:29:17,599 visual Studio and there's thirteen or fourteen projects there. When I go to update 438 00:29:17,640 --> 00:29:21,160 them all blindly, which is what everybody does. Let's face it, right, 439 00:29:21,880 --> 00:29:23,640 I want some AI in there to say, you know, hey, 440 00:29:23,720 --> 00:29:27,400 maybe this this one right here, I would you know, it's kind of 441 00:29:27,440 --> 00:29:33,319 like so what wow, should a great set up there? Well, which 442 00:29:33,359 --> 00:29:36,119 I don't think you knew. But one of the things that we announced a 443 00:29:36,119 --> 00:29:40,839 little while ago was so get up Advanced security can review the code and says 444 00:29:40,880 --> 00:29:45,279 there's a vulnerability. But we've got this new feature called auto fix where it 445 00:29:45,279 --> 00:29:49,359 will look at that vulnerability that's been identified and then say, and autofix is 446 00:29:49,359 --> 00:29:52,519 maybe a bit misleading, but it'll say, here's what I think the fix 447 00:29:52,599 --> 00:29:56,920 for that should be. And then you can review those changes in a code 448 00:29:56,920 --> 00:30:00,119 space or an editor, or you can just say yeah, that's right, 449 00:30:00,200 --> 00:30:06,359 that's fine, and then apply or submit a pool request for that change. 450 00:30:06,400 --> 00:30:10,359 And that's AI jumping in to say, this thing happened in a pool request 451 00:30:10,400 --> 00:30:14,920 that introduced a vulnerability. Here's a fix for that if you wanted to apply 452 00:30:14,960 --> 00:30:17,279 it, or if you want to investigate more. And again, this is 453 00:30:17,279 --> 00:30:21,359 where I think AI shines is in the code, you know, in data 454 00:30:21,519 --> 00:30:26,160 that's ours and looking at repos and things. This is this is all good 455 00:30:26,200 --> 00:30:30,160 stuff. People. There's no reason to be afraid of this stuff, and 456 00:30:30,200 --> 00:30:33,200 if you're not using it, you should be afraid. You should be concerned 457 00:30:33,200 --> 00:30:36,640 because you're only missing an opportunity to leave yourself more vulnerable. And with that, 458 00:30:36,680 --> 00:30:42,400 we should interrupt for one moment for this very important message, and we're 459 00:30:42,440 --> 00:30:45,720 back. It's done at Rocks. I'm Carl Franklin, I'm Richard Campbell, 460 00:30:47,000 --> 00:30:51,599 that's Damian Brae. We're built. And by the way, sorry, that's 461 00:30:51,640 --> 00:30:57,279 Donovan Brown. And by the way, if you want an ad free feed, 462 00:30:57,640 --> 00:31:02,559 just become a patron. Go Toreon dot dot NetRocks dot com. Five 463 00:31:02,599 --> 00:31:04,759 bucks a month will get you an ad free feed. Okay, yeah, 464 00:31:04,880 --> 00:31:07,920 I had to say that. Yeah, it's a good idea. Yeah. 465 00:31:07,960 --> 00:31:11,079 On the sponsorship side, I think I said this in the show some time 466 00:31:11,119 --> 00:31:15,559 ago. It's like, listen, I've worked with enough CFOs. They will 467 00:31:15,559 --> 00:31:18,319 cut a check a year. Yep, that's all they're going to do. 468 00:31:18,920 --> 00:31:22,200 Give them a number, let them know the money is going to be well 469 00:31:22,200 --> 00:31:26,119 spent. They'll cut a check a year. And actually, in an enterprise 470 00:31:26,200 --> 00:31:30,279 where they would do that, it's too many projects, Like it's just hard 471 00:31:30,440 --> 00:31:33,480 to say, you know, say I cut a check for ten thousand dollars, 472 00:31:33,519 --> 00:31:37,359 who should it go to? Right, And you've got to have a 473 00:31:37,400 --> 00:31:41,880 responsible way to say here where our dependencies are, you know, and these 474 00:31:41,920 --> 00:31:44,480 projects need to be supported, like, don't cut a check the Microsoft. 475 00:31:44,519 --> 00:31:48,039 They're okay, but you know, if you're if you if your productivity comes 476 00:31:48,039 --> 00:31:52,039 out of autumn Apple, Jimmy deserves a little taste. Yeah, agreed, 477 00:31:52,400 --> 00:31:53,599 And I'll make sure like I'll give you this show notes for this one, 478 00:31:53,599 --> 00:31:57,640 but i'll point you with those that because the sponsor program does actually fun to 479 00:31:57,720 --> 00:32:01,799 fIF you up until absolutely. I just wonder how hard it is to make 480 00:32:01,839 --> 00:32:05,680 sure you're spending money wisely. Yep, I will. I'll send you some 481 00:32:05,720 --> 00:32:07,599 stings. Yeah, no, I'd like to see that. And I can 482 00:32:07,680 --> 00:32:09,720 encourage people like you can go pitch us upstairs. But I just know how 483 00:32:10,240 --> 00:32:14,880 cfo's minds are. I don't want to be marred into details. If you're 484 00:32:14,880 --> 00:32:16,839 telling me this is going to help resolve the issue, which is where dependent 485 00:32:16,880 --> 00:32:21,400 on software we don't control, then I'm interested in supporting it. Do you 486 00:32:21,440 --> 00:32:27,759 guys know about the askcap slash BMI model of royalties for musicians in the music 487 00:32:27,839 --> 00:32:32,799 business? Nice? Yeah. So these are two agencies. Their job is 488 00:32:32,880 --> 00:32:38,240 to collect royalties on behalf of artists and distribute them and they will be taking 489 00:32:38,240 --> 00:32:43,240 a cut. Oh totally. And I'm not saying it's the best model because 490 00:32:43,319 --> 00:32:46,680 let's face the music business sucks and it's full of corruption. Yes I said 491 00:32:46,680 --> 00:32:52,279 that, don't email me. But basically the idea is that when I register, 492 00:32:52,279 --> 00:32:58,240 when I do a copyright, I register with BMI right and or ask 493 00:32:58,279 --> 00:33:04,160 cap, and then askap goes onto bars and places that play music, even 494 00:33:04,200 --> 00:33:07,599 if it's like Spotify, right, and they these guys have to if they're 495 00:33:07,640 --> 00:33:13,440 going to have music, live music piped in music, they have to pay 496 00:33:13,559 --> 00:33:17,480 a fee to ask ap and or BMI a couple hundred dollars four hundred dollars 497 00:33:17,519 --> 00:33:22,640 a year or something like that. And then those guys, based on whatever 498 00:33:22,720 --> 00:33:29,200 voodoo magic they do to figure out who gets what, distributes royalties. But 499 00:33:29,319 --> 00:33:31,319 it's only based on you know, what is the most pop what are the 500 00:33:31,319 --> 00:33:35,920 most popular artists and all that stuff, and there's a like a paramid. 501 00:33:36,279 --> 00:33:40,599 I'm not saying this is great, but it does take the how shall I 502 00:33:40,599 --> 00:33:45,319 say, the complexity and the guesswork out of it, so you know if 503 00:33:45,400 --> 00:33:50,599 if a company that uses open doors while introducing an extortion element, absolutely, 504 00:33:50,720 --> 00:33:53,359 Richard, I just don't know that people understand about this model, right, 505 00:33:54,000 --> 00:34:00,519 and you know so, so if we try to adapt this for the software 506 00:34:00,519 --> 00:34:05,920 world, you if your company uses open source software at all, you would 507 00:34:05,960 --> 00:34:10,840 pay an annual fee to some place and then they, based on not a 508 00:34:10,920 --> 00:34:15,440 based on what you use, but just based on the popularity of the most 509 00:34:15,440 --> 00:34:19,639 popular open source projects, will distribute checks to those people. Yeah. Yeah, 510 00:34:19,760 --> 00:34:21,400 I don't know that I'd be happy with that. I want to I'm 511 00:34:21,400 --> 00:34:23,000 not so sure I would either I want the money to go to the projects 512 00:34:23,000 --> 00:34:27,079 that if that guy doesn't get funded and he quits, right, or he's 513 00:34:27,119 --> 00:34:30,599 desperate for a maintainer and a state actor comes in as that maintainer, I 514 00:34:30,639 --> 00:34:35,039 get screwed, right, And so so that model is like you own a 515 00:34:35,079 --> 00:34:37,320 bar, but the only music you play is Bob Marley, right right, 516 00:34:37,440 --> 00:34:40,440 You want to pay all your money to Bob Marley. I have a repertoire 517 00:34:40,480 --> 00:34:43,679 of songs, yeah, and you know, and I want to make sure 518 00:34:43,719 --> 00:34:47,199 that it goes to those artists. Yeah, yep. So, because we're 519 00:34:47,239 --> 00:34:50,760 drilling in on this, I had I had a quick look, while we 520 00:34:50,760 --> 00:34:53,559 were While we were talking, it was about March last year, so more 521 00:34:53,559 --> 00:35:00,239 than a year ago. There's an export feature that'll, uh, if you've 522 00:35:00,239 --> 00:35:05,039 got to read access to a getub cloud repo, you can export an NTI 523 00:35:05,159 --> 00:35:09,840 a compliant s bomb so okay, yeah, in a software bill material software 524 00:35:09,840 --> 00:35:14,800 bill of materials. Yeah, and then you can apparently if you have one, 525 00:35:14,840 --> 00:35:16,840 you can upload it to the dependency graph and get dependent bot alerts for 526 00:35:16,880 --> 00:35:22,320 all of those. But if we're talking about sponsorship as well, that's yeah, 527 00:35:22,400 --> 00:35:25,039 that's a good way of finding out where your dependencies are. I guess 528 00:35:25,039 --> 00:35:30,760 we have the added advantage in the software world of knowing exactly what we're using, 529 00:35:30,400 --> 00:35:34,599 right, whereas a bar owner isn't going to write down every song that 530 00:35:34,639 --> 00:35:37,679 gets played throughout the year. Yeah, and we do have that advantage. 531 00:35:37,679 --> 00:35:40,400 But of course, at the enterprise scale, no given developer knows. Yeah, 532 00:35:40,480 --> 00:35:45,360 right, and that's literally no given developer. The architects don't know. 533 00:35:45,559 --> 00:35:51,039 The hunting down the wooly corners of software that are being written in your organization 534 00:35:51,159 --> 00:35:53,760 becomes a problem. But yeah, well you know there there's a job for 535 00:35:53,800 --> 00:36:00,639 AI right there. Okay, as a mini hunted down like rogue share point 536 00:36:00,719 --> 00:36:06,079 instances and sequel server instances. Right, Like the idea that you would actually 537 00:36:06,079 --> 00:36:09,079 know all the software that your organized running is hard, well, you know, 538 00:36:09,159 --> 00:36:13,119 but it's it's something that an AI could help you with, isn't it, 539 00:36:13,119 --> 00:36:15,559 Because this is what you're talking about with the holy crap, you know, 540 00:36:15,639 --> 00:36:19,599 the stuff that's being built into windows that you could just say, you 541 00:36:19,639 --> 00:36:22,079 know what, when did I look at this? When did I look at 542 00:36:22,079 --> 00:36:23,800 this thing? Or what am I using? Yeah, and I'll go through 543 00:36:23,840 --> 00:36:28,480 all my projects and give me a breakdown of all the dependencies that I have. 544 00:36:28,760 --> 00:36:31,840 Yeah, it's it's good. But again, I would pay, I 545 00:36:32,199 --> 00:36:37,440 know organizations would pay for a nice client on GitHub. That showed me I 546 00:36:37,440 --> 00:36:40,079 don't that I don't have to do that Excel work myself. Yeah, that 547 00:36:40,239 --> 00:36:45,079 just showed me this is the this is the the are the the dashboard of 548 00:36:45,159 --> 00:36:51,119 dependency that my organization has. Yeah, but then we also you know, 549 00:36:51,199 --> 00:36:53,760 now you can go and assess the projects and go who really needs support here 550 00:36:53,760 --> 00:36:57,880 and who doesn't? That's true, right, Like, that's that's that's the 551 00:36:57,960 --> 00:37:01,320 look I want to have when you go broad scam. I just I don't 552 00:37:01,360 --> 00:37:05,960 want us to get to a point where we're big corporate, you know, 553 00:37:06,000 --> 00:37:07,760 big companies. So I can't afford the security risk of open source. We're 554 00:37:07,760 --> 00:37:12,880 gonna we're going to change yeah, I mean yes, yeah, and just 555 00:37:13,000 --> 00:37:15,599 use onion in tonal. I mean, I can't imagine how much that would 556 00:37:15,599 --> 00:37:17,119 slay you down, Yeah, or how much it would cost for that matter. 557 00:37:17,280 --> 00:37:20,639 On the other hand, you know, take a look at the price 558 00:37:20,679 --> 00:37:23,840 of a of a of a major breach right of you know, it depends 559 00:37:23,840 --> 00:37:27,639 on the class of software. Like, you know, there's a great question 560 00:37:27,679 --> 00:37:31,679 to answer how much US government stuff is open source right now? Especially the 561 00:37:32,239 --> 00:37:36,400 secret you know, on the on the private networks that they have, Like 562 00:37:36,440 --> 00:37:39,840 how careful are they being? And I wonder if this is an arms race 563 00:37:40,239 --> 00:37:45,320 that we're going to get better and better tooling to and to identify backdoors that 564 00:37:45,400 --> 00:37:49,519 we can't we you know, you don't give up an open society because people 565 00:37:49,559 --> 00:37:54,039 are exploiting it. Yeah, you just fight back, and so you know, 566 00:37:54,159 --> 00:37:59,199 don't give up the advantage of open software. Fight back. One of 567 00:37:59,239 --> 00:38:04,559 the stories that we did on security this week lately was that it was a 568 00:38:04,960 --> 00:38:09,639 It was an article that basically they did some research day the canonical day somebody 569 00:38:09,679 --> 00:38:15,639 did some research that said that there are hope that there are ais now that 570 00:38:15,719 --> 00:38:23,639 are looking at zero day reports as they come out and then actively exploiting them. 571 00:38:23,679 --> 00:38:29,599 So hackers can use AI to the like the second a zero day bug 572 00:38:29,679 --> 00:38:34,840 is reported, go exploit it and take over and right. So now the 573 00:38:34,960 --> 00:38:37,119 question is, well, what's the use why? You know, you can't 574 00:38:37,159 --> 00:38:40,840 just throw up your hands. You can use AI again, if there's a 575 00:38:42,000 --> 00:38:45,239 if there's a tool for use for evil use, there's a tool for good. 576 00:38:45,599 --> 00:38:49,880 Yeah, and the good guys generally have more skilled people working faster. 577 00:38:50,159 --> 00:38:52,440 Yeah, because they're the good guys. That's the advantage. You know, 578 00:38:52,039 --> 00:38:54,599 if you were really talented, you wouldn't be a bad guy. Well, 579 00:38:54,639 --> 00:38:59,280 I mean, that's that's a little bit of an argument for like putting your 580 00:38:59,280 --> 00:39:02,639 code in one of the major player's hands. I guess which I mean. 581 00:39:02,760 --> 00:39:05,920 I'm here at build, so I don't I'm not going to get kicked out 582 00:39:05,960 --> 00:39:08,760 by saying that. I don't think. But there is even like all of 583 00:39:08,800 --> 00:39:12,880 the AI stuff that happened in the keynotes, the point that they made was, 584 00:39:12,960 --> 00:39:15,159 yeah, you build your own co pilots, you build your own like 585 00:39:15,239 --> 00:39:19,119 tooling like that, But it sits on the platform of like the responsible AI 586 00:39:19,239 --> 00:39:23,000 stuff. Microsoft has teams of people working on this, Like there's there's a 587 00:39:23,079 --> 00:39:28,320 huge number of people attacking that problem, just the same as the vulnerability problem. 588 00:39:28,320 --> 00:39:30,800 There's a massive number of people just working on that. If you bought 589 00:39:30,840 --> 00:39:32,840 it all in house and said you're not going to do anything, you're going 590 00:39:32,880 --> 00:39:36,320 to be more vulnerable. We had the same We had the same argument back 591 00:39:36,320 --> 00:39:38,880 at the beginning of the cloud absolutely where people were afraid to go to the 592 00:39:38,880 --> 00:39:43,800 cloud because they thought it was insecure. And you know, hey, do 593 00:39:43,880 --> 00:39:45,639 you sleep at night? Oh you do? Well, these guys don't. 594 00:39:45,800 --> 00:39:50,079 Oh yeah, well, so it speaks to the idea that so we do 595 00:39:50,199 --> 00:39:53,639 have an open source exploitation happened that puts a backdoor into a library that a 596 00:39:53,719 --> 00:39:58,119 munch of projects depend on. But because they're running in the cloud, it's 597 00:39:58,159 --> 00:40:00,159 the actual security guys that noticed from the back door gets utilized. That's right 598 00:40:00,199 --> 00:40:04,199 away, and go hey, that's not right. And now you know so 599 00:40:04,360 --> 00:40:07,800 instead of trying to stop everything at the beginning, it's only if it becomes 600 00:40:07,840 --> 00:40:12,400 exploited or something goes on that because you and hopefully you know this is part 601 00:40:12,440 --> 00:40:15,280 of changing the way we build software that in a manifest of that software, 602 00:40:15,280 --> 00:40:17,360 it says, these are the parts we communicate on. This is how this 603 00:40:17,440 --> 00:40:22,000 is going to work. And so these exploits go outside of that. You 604 00:40:22,039 --> 00:40:23,960 know, they open up a connection for RDP. You're like, that's not 605 00:40:24,079 --> 00:40:28,360 right, that's not how that's supposed to work. Close that and let's have 606 00:40:28,400 --> 00:40:30,239 a conversation. It's a bit of humorous, isn't it to think that we 607 00:40:30,559 --> 00:40:37,639 can do a better job of securing our machines and our software than a whole 608 00:40:37,239 --> 00:40:44,199 international company full of experts that one of what three that exists in the world 609 00:40:44,519 --> 00:40:46,679 that can afford to pay the best of the best to work twenty four hours 610 00:40:46,679 --> 00:40:52,599 a day hopefully with multiple shifts and all of those resources to come to it. 611 00:40:52,679 --> 00:40:54,159 Like, yeah, of course you count on them. You're paying it 612 00:40:54,159 --> 00:40:57,599 for it too. It's not free, like they're not doing all the goodness 613 00:40:57,639 --> 00:41:00,920 of the heart. That's their business. Do you think it's a it's a 614 00:41:00,920 --> 00:41:04,599 better way to go, and it's not an excuse to give up on open 615 00:41:04,639 --> 00:41:08,039 source, but the threat is there, yeah, and ongoing? Oh, 616 00:41:08,079 --> 00:41:10,639 I mean I would also argue, you know, why did they target Windows 617 00:41:10,639 --> 00:41:13,719 back in the day was the most popular way to do things. Yeah, 618 00:41:13,760 --> 00:41:16,159 why are they targeting open source frien these days? It's the most proper way 619 00:41:16,199 --> 00:41:20,079 to do that. By the way, Max and Linux have just as many 620 00:41:20,320 --> 00:41:24,079 vulnerabilities nowadays this Windows does. Yeah, because they're popular. They're not popular 621 00:41:24,400 --> 00:41:31,239 as popular, Yeah, no question. Well, and watching midnight Blizzard go 622 00:41:31,320 --> 00:41:35,960 after Microsoft, Yeah, you know, always a very beneftation of exactly that 623 00:41:36,039 --> 00:41:38,239 same thing. But it's like click, why wouldn't you target them? They 624 00:41:38,280 --> 00:41:43,039 got the biggest surface area, huge menver developers, huge number of things, 625 00:41:43,159 --> 00:41:45,280 and best opportunity if you do get in. Well, the AI security thing 626 00:41:45,400 --> 00:41:51,519 that they talked about today, I was I was waiting for that. I 627 00:41:51,599 --> 00:41:57,280 was waiting for some metas service that is looking at the output of your RAG 628 00:41:57,559 --> 00:42:01,920 system or whatever it is. Yeah, and you know, smelling for that 629 00:42:01,960 --> 00:42:06,119 doesn't look right. You know, that doesn't smell right? Yeah. Yeah, 630 00:42:06,239 --> 00:42:08,760 And I would I would suggest I don't know for sure because I am 631 00:42:08,800 --> 00:42:13,159 not in those teams, but I would suggest that Microsoft, for example, 632 00:42:13,159 --> 00:42:15,639 has probably been doing a bunch of that stuff for a while. Yeah, 633 00:42:15,679 --> 00:42:22,320 but only now they're like letting you have that as a consumer product, I 634 00:42:22,320 --> 00:42:23,760 guess, or as a you know, I was a bit surprised when they 635 00:42:23,760 --> 00:42:28,800 started talking about the midnight Blizoo attack, like it didn't hurt anybody. Why 636 00:42:28,840 --> 00:42:32,159 are you talking about this you don't have a disclosure requirement. I wonder if 637 00:42:32,159 --> 00:42:36,719 they were like literally calling out the Russians, like we know you did this. 638 00:42:37,840 --> 00:42:40,920 I also think that part of that was talking to Microsoft internally effectively saying 639 00:42:42,440 --> 00:42:45,360 this is our problem and we need to fix this, and so everybody's on 640 00:42:45,440 --> 00:42:49,039 board with it, Like seeing it publicly has weight, yeah, and speaking 641 00:42:49,079 --> 00:42:53,519 internally that's definitely there's definitely a forefront of the work that's being done right now. 642 00:42:53,719 --> 00:42:58,119 But I think I like that trend. I think of how a thing 643 00:42:58,119 --> 00:43:00,280 has happened. Let's tell everyone that it happened, and this is what we 644 00:43:00,360 --> 00:43:07,559 did to fix Yeah, yeah, exactly. Anyway, it is interesting times, 645 00:43:07,639 --> 00:43:10,880 and it is and it is I think a factor of being successful that 646 00:43:10,920 --> 00:43:15,039 you also get to be a target. Yeah, but you know you're also 647 00:43:15,159 --> 00:43:17,159 fually aware and we don't even think of it, like the days of the 648 00:43:19,039 --> 00:43:24,119 university student making a worm. They are over right. There are nation states 649 00:43:24,159 --> 00:43:31,360 who are actively attacking infrastructure, governments and major companies through software uh and and 650 00:43:31,440 --> 00:43:34,519 some of them are doing it for money, and some of them are doing 651 00:43:34,519 --> 00:43:37,320 it because the government told them to. And we have to take that seriously, 652 00:43:37,400 --> 00:43:43,119 like they're nobody's doing this for fun anymore. It's business, and they're 653 00:43:43,159 --> 00:43:45,840 working hard at it, and you just got to work hard back. And 654 00:43:45,880 --> 00:43:51,199 I mean internally all of these companies there are red teams who employed the entire 655 00:43:51,239 --> 00:43:54,400 time to start to really try and break the stuff before before, get ahead 656 00:43:54,400 --> 00:43:58,719 of get ahead of it. Still, all the security in the world doesn't 657 00:43:59,719 --> 00:44:06,599 won't stop an idiot from relying on the output of some rag and believing everything 658 00:44:06,639 --> 00:44:09,320 it says a face value and then acting on it and potentially destroyed. Just 659 00:44:09,320 --> 00:44:14,639 don't give the many. Don't give them any privileges you cannot right to Maine 660 00:44:15,280 --> 00:44:21,000 submit. Yeah, the second second day keynote wrapped up with a conversation with 661 00:44:21,079 --> 00:44:24,159 Julia Lusen and it was it John one of the high security guys, and 662 00:44:24,199 --> 00:44:30,599 they were talking about this gamut of security issues and I've had the this Secure 663 00:44:30,679 --> 00:44:37,920 Future initiative something like that, and it certainly played into supply chain tax and 664 00:44:38,599 --> 00:44:42,239 all of all of the sets of issues. So you know, one of 665 00:44:42,280 --> 00:44:46,199 the things that you notice happened is when when criminals get organized enough the real 666 00:44:46,400 --> 00:44:52,039 serious white hat show up and roll them up. And what I really took 667 00:44:52,079 --> 00:44:54,519 out of the end of that keynote today was we're paying attention to this. 668 00:44:55,239 --> 00:44:59,559 We're all going to get some good tools from this, and by the way, 669 00:44:59,599 --> 00:45:01,519 the bad guy are outmatched. Yeah. Yeah, the trip will be 670 00:45:01,599 --> 00:45:05,960 that we have to actually pick those tools up and use them for our software. 671 00:45:07,440 --> 00:45:10,360 Well, my friend, it's good to see you. Welcome. We 672 00:45:10,440 --> 00:45:13,960 updated Australia. Last time I saw you, I was actually I went to 673 00:45:13,960 --> 00:45:17,639 your place. What do I say? Yeah, you did come. You 674 00:45:17,679 --> 00:45:21,639 didn't go for a swim though, which I was disappointed about. Didn't know, 675 00:45:22,000 --> 00:45:23,719 but it was I guess it was summertime there. You know in Australia, 676 00:45:23,719 --> 00:45:27,119 when they say go for a swim, it's like, you know, 677 00:45:27,239 --> 00:45:31,280 ten degrees and it's fahrenheit and there's like man o wars in the water and 678 00:45:31,320 --> 00:45:35,079 we go swimming naked. We got we got rid of most of those in 679 00:45:35,719 --> 00:45:39,760 a pool. So yeah. Probably growing up in the Pacific Northwest, I 680 00:45:40,239 --> 00:45:44,480 was taught very early on if you find yourself in the ocean you've done something 681 00:45:44,519 --> 00:45:49,000 wrong. That stuff will kill you. And it's not like sharks or anything. 682 00:45:49,119 --> 00:45:53,360 It's cold, you've got a few minutes before you're not coherent enough to 683 00:45:53,400 --> 00:45:57,519 get yourself back out of the water. I remember standing putting my feet in 684 00:45:57,559 --> 00:46:01,760 the Saint Lawrence River in August when I was a kid, and my bones 685 00:46:02,639 --> 00:46:07,679 freezing like my I could feel my bones were frozen solid. The ocean out 686 00:46:07,679 --> 00:46:12,679 front of my place is ten DeGreasy all year round, and in the summertime 687 00:46:12,719 --> 00:46:15,000 that's great. It's quick, way to cool down, quick quick. And 688 00:46:15,039 --> 00:46:21,000 in any other time, yeah, you're gonna die. Even moneray, I 689 00:46:21,039 --> 00:46:24,119 went surfing a monerey on my feet were the only things that weren't covered, 690 00:46:24,159 --> 00:46:28,400 and within about five minutes I couldn't stand on the board anymore because I couldn't 691 00:46:28,400 --> 00:46:30,480 feel them. They were gone. Now we got surfers at Long Beach in 692 00:46:30,480 --> 00:46:35,639 British Columbia. They wear dry suits. Dude, no kidd, they need 693 00:46:35,679 --> 00:46:37,880 them anyway. Well, on that note, Damien, thanks a lot. 694 00:46:37,960 --> 00:46:42,639 It's been great talking to you too, and we'll see you next time. 695 00:46:43,159 --> 00:47:07,199 I'm dot net Rocks. Dot net Rocks is brought to you by Franklin's Net 696 00:47:07,320 --> 00:47:13,159 and produced by Pop Studios, a full service audio, video and post production 697 00:47:13,280 --> 00:47:16,920 facility located physically in New London, Connecticut, and of course in the cloud 698 00:47:17,559 --> 00:47:22,599 online at pwop dot com. Visit our website at d O T N E 699 00:47:22,679 --> 00:47:28,559 t R O c k s dot com for RSS feeds, downloads, mobile 700 00:47:28,559 --> 00:47:31,760 apps, comments, and access to the full archives going back to show number 701 00:47:31,800 --> 00:47:37,079 one, recorded in September two thousand and two. And make sure you check 702 00:47:37,119 --> 00:47:40,119 out our sponsors. They keep us in business. Now go write some code, 703 00:47:40,480 --> 00:48:00,760 See you next time you got a javans Hey