Speaker 1: How'd you like to listen to dot NetRocks with no ads? Easy?
Speaker 1: Become a patron for just five dollars a month. You
Speaker 1: get access to a private RSS feed where all the
Speaker 1: shows have no ads. Twenty dollars a month, we'll get
Speaker 1: you that and a special dot NetRocks patron mug. Sign
Speaker 1: up now at Patreon dot dot NetRocks dot com. Hi,
Speaker 1: this is Carl Franklin.
Speaker 2: And this is Richard Campbell.
Speaker 1: We've got two special shows coming up soon, episode nineteen
Speaker 1: ninety nine and two thousand.
Speaker 2: For episode nineteen ninety nine, we're collecting people's y two
Speaker 2: k stories what did you do to help the Y
Speaker 2: two k event not actually happen?
Speaker 1: And for episode two thousand, we're going to be sharing
Speaker 1: stories about how dot net shaped your career.
Speaker 2: We have a special page at dot netroocks dot com
Speaker 2: slash voxpop where you can record messages for us that
Speaker 2: we can play on these special episodes. So tell us
Speaker 2: what you did for Y two k and what dot
Speaker 2: net means to you, and of course how long you've
Speaker 2: been listening to dot net rocks. So go do dot
Speaker 2: NetRocks dot com slash vox pop now and leave us
Speaker 2: a message before the thought ev operates, like whiskey left
Speaker 2: in a glass overnight, do it?
Speaker 1: Hey, it's dot net Rocks, some Carl Franklin and I'm
Speaker 1: Richard Campbell, And you know what where I am it's cold.
Speaker 1: You know why there's so much fun snow. I'm supposed
Speaker 1: to get a pellet delivery. They can't even back the
Speaker 1: truck up to the basement to put the pellets in. Now,
Speaker 1: I got to pay two hundred bucks to have the
Speaker 1: guys trudge them through the house and down the stairs.
Speaker 1: Oh my god, it's snowmageddon.
Speaker 2: Is that cheaper than having someone plow all that out? Like?
Speaker 1: But it's grass. I don't know what the answer. There's
Speaker 1: no plowing, right, there's no plowing to be done otherwise
Speaker 1: ripping and tearing.
Speaker 2: I didn't even want to tell you how nice it
Speaker 2: is on the west coast now, like we've learned to
Speaker 2: shut up because the East coat's getting nails. Oh she
Speaker 2: got nothing here. It's ridiculous. It's ridiculous.
Speaker 1: We never had this much snow and also a cold
Speaker 1: snap that's been below freezing for like three weeks.
Speaker 2: Yeah, this is the polar vortex, right, the destabilization of
Speaker 2: the Arctic high is pushing down into different parts of
Speaker 2: the world. Yeah, and you are one of those parts.
Speaker 1: Yeah, we're we're getting more snow than the rest of
Speaker 1: the country.
Speaker 2: Yeah.
Speaker 1: All right, So let's talk about what happened in nineteen
Speaker 1: eighty nine. Oh, my god, so much stuff happened. Yeah,
Speaker 1: the fall of communism, well.
Speaker 2: The beginning anyway. I mean, it'll take a couple of years,
Speaker 2: but definitely the Eastern Block starts to unravel.
Speaker 1: Yep, and so Union basically says we give up, We're done. Yeah,
Speaker 1: we're not going to control all these countries anymore.
Speaker 2: Yeah, I mean, and then we've been to a bunch
Speaker 2: of them and there they're museums and things like I'm
Speaker 2: thinking about in Vilnius, the KGB Museum where they basically
Speaker 2: left it as it was as the Soviets pulled out
Speaker 2: in nineteen eighty nine. The duty uniform is still hanging
Speaker 2: on the wall, all the documents they have been shredding
Speaker 2: for months, like they knew things are coming.
Speaker 1: And next year, as in the next episode, we'll talk
Speaker 1: about nineteen ninety and that's where things really kind of well,
Speaker 1: some really good things happened, and you know, a lot
Speaker 1: of craziness happened.
Speaker 2: To you know, we in the West look at nineteen
Speaker 2: eighty nine and the collapse of the Eastern Bloc as
Speaker 2: a dramatic progress in the world. But you understand that
Speaker 2: for Russians and for the Chinese it was the ultimate disaster. Right, Like,
Speaker 2: there's so much of the current conflict going on today
Speaker 2: that start with the collapse in nineteen eighty nine, right,
Speaker 2: because you know the other thing that happens in nineteen
Speaker 2: eighty nine, that's tim and Square, Tiana and Square. Yeah, yeah,
Speaker 2: and that was you know, there's this idea that as
Speaker 2: they opened up and became more Western, they would adopt you,
Speaker 2: the Western culture, and this is the closest the China did.
Speaker 2: But after the crackdown of Tienum and Square, the establishment
Speaker 2: of the technocracy at that point when today would just
Speaker 2: plain old call it at an autocrat really turns at
Speaker 2: that moment.
Speaker 1: There's a lot of that still happening. It's like, we
Speaker 1: like democracy, but don't you dare protest?
Speaker 2: Yeah, well they you know, don't like democracy. You will
Speaker 2: there's one party. You follow the system, and you don't
Speaker 2: follow the system, you will be re educated.
Speaker 1: Yeah, yep. Excellon Valdez of course. Yeah, biggest oil spill
Speaker 1: currently eleven million gallons.
Speaker 2: Yep. We're you know, talking about putting a pipeline through
Speaker 2: the west coast British Columbia, and Valdez comes up because
Speaker 2: it's not that far away that when stuff like Bitaman
Speaker 2: leaks into the ocean, it's a big deal.
Speaker 1: And that's when the dishwasher detergent dawn got very popular.
Speaker 2: Well, it saves a lot of birds. And we don't
Speaker 2: let's not leave out the fall of the Berlin Wall
Speaker 2: because that's December of nineteen eighty nine.
Speaker 1: Yeah, all right, so what happened in technology and space
Speaker 1: in nineteen eighty nine.
Speaker 2: Let's do space first. So there are five Shuttle flights,
Speaker 2: and again I'm not going to go into detail on
Speaker 2: all of them, just every flies twice, just launching satellites.
Speaker 2: Columbia does a single mission and it's a secret military
Speaker 2: flight that they don't televise anything on. It's probably a satellite,
Speaker 2: but we don't really know. But the two cool flights
Speaker 2: are both on Atlantis, which are satellite launches, but their
Speaker 2: interplanetary probes. They launched the Magellan probe to Venus and
Speaker 2: the Galileo probe to Jupiter. This Galileo probe was one
Speaker 2: of the great observatories, although it had a problem. Its
Speaker 2: main high speed antenna never deploys properly, and it'll be
Speaker 2: bandwidth limited its entire existence. Wow, But it'll still do
Speaker 2: its job, just take longer to do it. I have
Speaker 2: been remiss, my friend, since we got into the eighties
Speaker 2: to talk about space dation mirror, because it's an incredibly
Speaker 2: important piece of science, and it started in eighty six,
Speaker 2: and I really haven't mentioned a lot, But in nineteen
Speaker 2: eighty nine they actually launched a third module. So the
Speaker 2: core module goes up in eighty six, which is basically
Speaker 2: a modified Salute. Oh and by the way, at this moment,
Speaker 2: the Soviet Union is operating two space stations in space
Speaker 2: they have, Yeah, they had the Salute seven. This is
Speaker 2: in nineteen eighty nine, which you'll continue operating till nineteen
Speaker 2: ninety one. The last of the Salutes and Mirror, which
Speaker 2: started in nineteen eighty six, which I'll keep grunning until
Speaker 2: nineteen ninety six. So an eighty six they launch the
Speaker 2: car module. In eighty seven they do Cavan one. And
Speaker 2: this is the first time ever in civilization that a
Speaker 2: multimodule space station was built. Mirror is the beginning of that.
Speaker 2: And in nineteen eighty nine they launched Event two, and
Speaker 2: so while Covent one was almost entirely astrophysics and sensors
Speaker 2: and things, plus some infrastructure like gyroscopes, Event two has
Speaker 2: the airlock EVA airlock on it for the Orlan space
Speaker 2: suit and their maneuvering units, as well as more life support,
Speaker 2: sensor and so forth. And there'll be a few more modules,
Speaker 2: including the eventually the docking port for the Space Shuttle.
Speaker 1: You know, the only thing I remember about Mer was
Speaker 1: there was some sort of leak and they had to evacuate.
Speaker 2: There was an accident with the Progress supply ship. They
Speaker 2: lose control of it and it collides with the station.
Speaker 2: It's an incredible story. Yeah, it's huge, and they lost
Speaker 2: one of the newest modules, the Spectro module depressurized, although
Speaker 2: they were able to still use it. They just have
Speaker 2: to go to space suits to go into it. On
Speaker 2: the interplanetary side, Voyager two makes it to Neptune, takes
Speaker 2: our best pictures of Neptune ever, and last but not least,
Speaker 2: the Phobos missions. So again into the Soviet Union. The
Speaker 2: Soviet Union tried so many times ago to the Mars
Speaker 2: and they and they failed consistently, and they were still
Speaker 2: launching in the pairs like the Mariner missions the Americans
Speaker 2: used to do. Phobos one and Phobos two, these were
Speaker 2: two of the largest vehicles ever flown or attempted to
Speaker 2: fly to Mars. They were sixty two hundred kilows each,
Speaker 2: so that's like twelve thousand pounds. Like these were huge,
Speaker 2: huge vehicles. Phobos one has a very agnomal experience where
Speaker 2: it's launched in nineteen eighty eight but a mis entered
Speaker 2: manual command disables its thrusters and they lose control of
Speaker 2: it almost immediately.
Speaker 1: Ben, that was you right, totally.
Speaker 2: That wasn't It was a program and who was ultimately
Speaker 2: punished for was kind of a big deal. But what
Speaker 2: happened this is almost exactly what happened to Maritor one,
Speaker 2: where they put in a command wrong and literally lost
Speaker 2: the vehicles and process. There was test code in the
Speaker 2: computer for Phobos one, and this is a very logical
Speaker 2: test code. When you're on the ground, it's one of
Speaker 2: the things you do after you finished a test sequence
Speaker 2: is you disable the maneuvering thrusters because those things are
Speaker 2: full of toxic chemicals and when it's on the ground,
Speaker 2: you really don't want those going off, right, and so
Speaker 2: when you complete the test sequence, it would immediately shut
Speaker 2: those off. Now you don't need that test code in flight.
Speaker 2: But because it's the nineteen eighties, they only have proms,
Speaker 2: and so the only way way to remove that code
Speaker 2: would be to dismantled computer and replace the prom So
Speaker 2: they don't do it. They leave the code in with
Speaker 2: a big sign saying don't run this code anyway. Guess
Speaker 2: what They ran the code. So a misinjured command ended
Speaker 2: up firing that code, which disables those controlers, and there's
Speaker 2: no way to restart them. And so Phobos won it.
Speaker 2: Never it never gets to Mars, never gets used. But
Speaker 2: Phobos two they have more success with the original. They
Speaker 2: supposed to fly in eighty six, it flies in eighty eight,
Speaker 2: and it actually enters Mars orbit in nineteen eighty nine,
Speaker 2: which is a huge success. However, and it was called
Speaker 2: Phobos for a reason. They were there was a very
Speaker 2: much it's gentle political maneuvering, right, this is parastroic and
Speaker 2: so forth. So they don't want to step on the Americans.
Speaker 2: So they're trying to do things that Mars and the
Speaker 2: Americans haven't done. These were called Phobos because they were
Speaker 2: specifically going to map and explore Phobos. They even want
Speaker 2: to put a little rover down. All these kinds of things.
Speaker 2: They didn't get to do most of them. And they
Speaker 2: used this triple computer system, which is just the same
Speaker 2: thing they Shuttle did, where you have three computers and
Speaker 2: whichever two agree that's the correct command. Except one of
Speaker 2: the computers completely fails on the way to Mars, so
Speaker 2: now they're down to two, and then the second one,
Speaker 2: a second one starts to fail and gets erratic, so
Speaker 2: the one that's working correctly can't send commands because it's
Speaker 2: only one.
Speaker 1: See, this is further proof that everybody who goes to
Speaker 1: space should always send a programmer with them.
Speaker 2: You know, I don't know if that guy would like
Speaker 2: that ride. It's not very comfortable, wow, and the bandwidth
Speaker 2: is mediocre anyway. They if you manage to get thirty
Speaker 2: seven photos of Phobos in map about eighty percent of it,
Speaker 2: they're the most detailed pictures we've ever had of that.
Speaker 2: Before they lose control of the vehicle because the computer
Speaker 2: just kick So that's space in nineteen eighty nine.
Speaker 1: All right, I know what's coming next, Richard. What the
Speaker 1: birth of the World Wide Web nineteen eighty nine.
Speaker 2: Oh yeah, no, it's a There's three important Internet things
Speaker 2: that happened in nineteen eighty nine. The first is the
Speaker 2: Internet passes one hundred thousand hosts, which is tiny when
Speaker 2: you think about it, but at the time, and we
Speaker 2: understand in nineteen eighty nine, the Internet's not a for
Speaker 2: sure thing. It's sort of a sideline academic thing. It's
Speaker 2: not that important. Yeah, the big initiative in industry is OSI.
Speaker 2: This is IBM and Sun and even Microsoft. This is
Speaker 2: what Bill was talking about at the time. He won't
Speaker 2: change his mind for a couple of years yet, but yeah,
Speaker 2: one hundred thousand hosts worldwide. It's also the first commercial
Speaker 2: dial up connection. So a company called the World std
Speaker 2: which is kind of a bad name. Did you ever
Speaker 2: check that?
Speaker 1: Should have picked a better name?
Speaker 3: Yeah, World, I mean maybe they knew that virus is
Speaker 3: we're going to be coming along.
Speaker 2: Who knows.
Speaker 1: Oh, there you go.
Speaker 2: This isn't okay, Yeah, funny you should mention that. I'll
Speaker 2: be talking about that a little later there, Ben. So, yeah,
Speaker 2: that was the first time you could actually buy a connection,
Speaker 2: a dialut connection of the Internet in North America was
Speaker 2: you know, this company called world STD and of course,
Speaker 2: our buddy tv L Tim berners Lee submits a proposal
Speaker 2: to CERN for a distributed document management system which will
Speaker 2: laterally know as the World Wide Web.
Speaker 1: I have a quick story. I was working at Crescent
Speaker 1: Software in the nineties, the early nineties, between ninety and
Speaker 1: ninety four and eighty nine to ninety four, I can't remember,
Speaker 1: and we came out with a control for visual Basic
Speaker 1: called the hypertext control. And all it was was you
Speaker 1: were able to you know, show text with a code
Speaker 1: that it wasn't HTML, but it was a code that
Speaker 1: had a hyperlink and then it fired an event with
Speaker 1: the hyperlinks that you could do whatever. And we thought
Speaker 1: this was like totally amazing. But it was around this
Speaker 1: time that that and it wasn't even one of our
Speaker 1: programs that came up with it. It was somebody who we
Speaker 1: had worked with a consultant, and that control went in
Speaker 1: our collection. Isn't that cool?
Speaker 2: Yeah, it's cool, and you know it speaks to that
Speaker 2: whole embedded WebView and so forth. Like you guys were
Speaker 2: ahead of this time with doing that. All right, a
Speaker 2: few other computery things Microsoft releases. The first version of
Speaker 2: Office of the Map correl draw comes out. Oh yes,
Speaker 2: I remember SimCity woo. Yeah, the zip file format, Philip
Speaker 2: Katz's encryption algorithm. Yes, the first version of sql server
Speaker 2: one point zero. It's a sixteen bit version of server
Speaker 2: for OS two a year. It's a yeah. It's a
Speaker 2: port of sybase sql Server a collaboration to Microsoft side
Speaker 2: Base and Ashton Tate remember for dBase those guys dBase
Speaker 2: there you go. And sound Blaster. Yes, so creative technology
Speaker 2: out of Singapore. It's actually their third sound card. They
Speaker 2: code name on this one was Killer Card. Of course,
Speaker 2: nine voice fms and the size are using the Yamaha
Speaker 2: YM thirty eight twelve and it was not, oddly enough
Speaker 2: compatible with the ad lib card, which was really the
Speaker 2: first of the PC sound cards to storm in the
Speaker 2: mar They crushed the ad lib card and they will
Speaker 2: crush them all. Yeah. By far be the dominant product space.
Speaker 1: I had dinner with mister sim who was the engineer
Speaker 1: behind the sound Blaster when I worked for Voyetra.
Speaker 2: Well, in the fact they called the Killer Card. I
Speaker 2: think they knew we're going after this market and we're
Speaker 2: going to take it.
Speaker 1: Yeah, and they did.
Speaker 2: Intel releases the forty six DX, so our thirty two
Speaker 2: bit processes, they're getting bigger and faster, and it will
Speaker 2: of course, you will also be able to get the
Speaker 2: four eighty seven math co processor for it. And Phillips
Speaker 2: and Sony, in a rare collaboration, produced the first recordable CD.
Speaker 2: They called it the CdWO for Compact disc Right once,
Speaker 2: which of course is the standard for all CD back.
Speaker 2: That's right you. Once you write on it, you can't
Speaker 2: write on again. And reference to Ben's comment about viruses,
Speaker 2: The very first recorded case of ransomware, the Aid's trojan
Speaker 2: encrypted and hid files and then you could pay one
Speaker 2: hundred and eighty nine dollars to get the encryption decryption key,
Speaker 2: although later security analysts decompiled the code and found the
Speaker 2: ransomware key in the code, so you didn't need just
Speaker 2: showing that the bad guys are usually not that smart.
Speaker 1: You know, if you're gonna ask for money, ask for
Speaker 1: more than one hundred and eighty nine dollars.
Speaker 3: I was going to say, I think we've had a
Speaker 3: lot of inflation since then.
Speaker 1: Yeah, Well, yeah, this is some pure criminal career advice.
Speaker 2: It's nineteen eighty nine, so one hundred and eighty nine
Speaker 2: kind of makes sense. I think. I don't know. Yeah, Okay,
Speaker 2: that's what I got.
Speaker 1: All right, I guess it's time for better no a framework.
Speaker 2: Awesome? Alright, man?
Speaker 1: What you got? Well, it's kind of a meatball softball.
Speaker 1: I just want to bring some more attention to my
Speaker 1: security podcast since we're talking about that with Ben today
Speaker 1: AI Security Security this week. So what's different about this podcast?
Speaker 1: First of all, what it is we talk about I
Speaker 1: don't know, six or seven stories from the week where
Speaker 1: there have been breaches, where there have been attacks, or
Speaker 1: somebody got caught, or somebody did something great, or there's
Speaker 1: some nasty zero day bug that we need to pay
Speaker 1: attention to. But a lot of it has been centering
Speaker 1: on AI stories lately, and it just is abundantly clear
Speaker 1: that once the AIS get a hold of, you know,
Speaker 1: creating zero days, and they already do zero day exploits
Speaker 1: and exploiting them like at an insane clip that you know,
Speaker 1: we're all kind of screwed and unless we're taking some
Speaker 1: real precautions and guardrails. But anyway, it's a security This
Speaker 1: Week podcast. And the other thing about it is we
Speaker 1: laugh to keep from crying, you know, because some of
Speaker 1: this stuff is just so horrible it's frightening. But we
Speaker 1: certainly do or laugh our way through it. So that's it.
Speaker 2: Awesome time.
Speaker 1: Who's talking to us today, Richard?
Speaker 2: I got a comment from a listener, actually a direct
Speaker 2: message in LinkedIn, and this is from Timo toy venone
Speaker 2: and I hope I pronounced your name correctly. I bet
Speaker 2: I didn't. And he said, I'm a longtime friend from
Speaker 2: Europe and I'm reaching out via LinkedIn because I couldn't
Speaker 2: find the listener email. I hope that's okay. It's Richard
Speaker 2: at PWOP dot com too, But yeah, okay. Your show
Speaker 2: has been instrumental in landing my dot net engineer and
Speaker 2: architect role back in twenty five to twenty thirteen, and
Speaker 2: thanks for all the great content over the years. Just
Speaker 2: a reminder we've been doing the show entirely too long.
Speaker 2: After a decade away in agile coaching, I'm transitioning back
Speaker 2: to dot net as roles now Blend's scrum master and
Speaker 2: product owner with technical dot net advisor and architect responsibilities.
Speaker 2: So my challenge how to efficiently relearn the stack after
Speaker 2: ten years away, what's fundamentally changed versus what stayed the same?
Speaker 2: Where would you focus?
Speaker 1: And this is a relatively new comment.
Speaker 2: Yeah, no, he just got it. So he left in
Speaker 2: twenty thirteen, and now it's twenty twenty six and he's
Speaker 2: got a new job and he's started looking at you
Speaker 2: and just trying to think, like twenty thirteen cloud is
Speaker 2: brand new and still very questionable.
Speaker 1: Yep, right, you're not automatically moved there there there's no
Speaker 1: open source do net nope.
Speaker 2: Or before the open source versions of dot net and
Speaker 2: open a sourcing of the dot net framework, before all
Speaker 2: the Roslin stuff, like it's before any of that. He
Speaker 2: left arguably at the height actually the beginning of the
Speaker 2: there really is the dark times, Like what would argue
Speaker 2: the height of dot net is twenty ten, right, studio
Speaker 2: twenty ten f sharp, the support for open sources just
Speaker 2: beginning in the in there, right, we've got early web
Speaker 2: tools I you know, I E nine still not out yet,
Speaker 2: like just sort of hit that, you know. Toy Studio
Speaker 2: twenty third, twenty twelve was the one that was all
Speaker 2: about Windows eight and they put the upper case menus
Speaker 2: items and all menus or uppercase in visual studios. So
Speaker 2: there was twenty thirteen edihoal we took that back out.
Speaker 2: So that's a great thing about a bad feature. You
Speaker 2: get two versions out of it and then he's gone.
Speaker 2: He goes off to live in a happy agile land.
Speaker 1: Yeah, so wow, a few things have changed.
Speaker 2: What all's changed? Yeah, I mean, oddly enough, you're going
Speaker 2: to have to think about AI tooling certainly coming in now.
Speaker 2: The nice thing is you've you've left, you can skip
Speaker 2: over a ton of stuff like you're you really need
Speaker 2: to restudy c sharp and the modern expressions of the
Speaker 2: language and the is it it looks very different today.
Speaker 1: The real thing here is that you know, dot net
Speaker 1: went from being a Windows technology to being a multi
Speaker 1: platform open source technology.
Speaker 2: Yeah.
Speaker 1: See sharp it cell his open source, A lot of
Speaker 1: the tools are open source. Visual Studio code is open source,
Speaker 1: and so you know you're not getting charged for you know,
Speaker 1: big enterprise I guess enterprise editions of visual Studio they
Speaker 1: still charge for but.
Speaker 2: Still out there.
Speaker 1: Yeah, still cost the same, but you don't need that.
Speaker 1: There's a free version, the community version of visual Studio
Speaker 1: if you want to stay there. That's sure. It's just free.
Speaker 2: But you know, thinking about Timo in his architect's role
Speaker 2: means he's also going to be dealing with web devs
Speaker 2: that have never touched studio in their life. They maybe
Speaker 2: use studio code, and they still going to be a
Speaker 2: part of the project, so that they're going to need
Speaker 2: the dot net kit for that. Yeah, as well as
Speaker 2: some traditional droppers like I hope they were cross to
Speaker 2: the modern version of dot net because life is better
Speaker 2: over there, without a doubt. Oh yeah, that depends on
Speaker 2: the kind of clients they're ultimately going to build. He's
Speaker 2: missed all of containerization for the most part.
Speaker 1: Yeah, that's right. Unless he kept up with it.
Speaker 2: He lay out our software a wee bit different.
Speaker 1: Now he might have caught up with it. Kept up
Speaker 1: with it on the other side, though.
Speaker 2: I know it's a big bite, but you know, if
Speaker 2: we were learning containers from scratch right now, I just
Speaker 2: go directly to aspire because you don't use canators for fun.
Speaker 2: You're doing it because you're going after cloud architecture, and
Speaker 2: whatever bit of scaffolding you can do is to get
Speaker 2: you to cloud style architectures will make your life easier.
Speaker 2: So yep, that's certainly an easier bite.
Speaker 1: Yeah, I agree.
Speaker 2: Anyway, I thought it was a fun comment. Yeah, Tiam,
Speaker 2: I hope this guy gave you some ideas. Certainly this
Speaker 2: show we're talking you know more about some of the
Speaker 2: contemporary TOOLI and the problems they're in. So and there's
Speaker 2: plenty more shows. So you dig through the catalog a bit,
Speaker 2: I'm sure you'll find it. Fuse it'll help you. So, Timo,
Speaker 2: thank you so much for a comment. And a copy
Speaker 2: of music co buy is on its way to you.
Speaker 2: And if you'd like a copy of music, go buy.
Speaker 2: I write a comment on the website at dot NetRocks
Speaker 2: dot com or on the facebooks or the LinkedIn's if
Speaker 2: you like, and if we read it on the show,
Speaker 2: we'll send you copy music.
Speaker 1: Go buy music to code buy dot net if you
Speaker 1: want to get it yourself MP three wave in flat format.
Speaker 1: All right, so let's introduce Ben Decree for the first
Speaker 1: time here on dot net rocks. Ben has been a
Speaker 1: software engineer for over twenty five years. He's a Microsoft MVP,
Speaker 1: and he's been knee deep in security and developer relations
Speaker 1: for most of his career. He's spoken at conferences like
Speaker 1: defcn NDC, dev Intersection, et cetera, et cetera. These days,
Speaker 1: he's co founder of ven Labs, a startup studio based
Speaker 1: in Kansas City, and he's just about to launch braid Flow.
Speaker 1: And that's br aid Flow, an AI platform that tackles
Speaker 1: the context drift problem keeping AI conversations focused when things
Speaker 1: get complex. Welcome Ben, Thanks, thanks for having me. Wow,
Speaker 1: where do we start? I mean, AI security is such
Speaker 1: a big problem, and I just want to preface this
Speaker 1: by saying, a couple of weeks ago, I got a
Speaker 1: brand new six thousand dollars multi machine here in ninety
Speaker 1: six gigs of RAM thirty two gig a fifty nine
Speaker 1: hundred series card for the purpose of turning it into
Speaker 1: my personal you know LM with Alama that I can
Speaker 1: use like a getthub co pilot. And it is not
Speaker 1: going well.
Speaker 3: No, we were trying something similar here the other day,
Speaker 3: my wife and I and we took a pretty good
Speaker 3: gaming rig and installed Lama CPP and it runs dog
Speaker 3: slow well.
Speaker 1: Lama runs great on it locally, and even if I
Speaker 1: do you know, if I'm running it just talking to Alama.
Speaker 1: But what I really want is an agent, you know,
Speaker 1: I'll a get ub copilot CLI that does everything and
Speaker 1: these things like I can't get them to get beyond
Speaker 1: you know, the the Jason that they're going to send
Speaker 1: and then they never send it. Like I've tried three
Speaker 1: or four of them and they all get stuck there.
Speaker 2: So I don't know.
Speaker 1: But that's not here nor there. I just want to
Speaker 1: I just want to preface that story.
Speaker 3: Sure, I mean we can dig into that as well
Speaker 3: if you want. It's somewhat related to the security thing.
Speaker 3: Like one of the big issues that a lot of
Speaker 3: organizations have at the moment when they're thinking about do
Speaker 3: we let our developers use these AI development tools is
Speaker 3: what happens to that code? Where does it go? Whose stories?
Speaker 3: And you have data sovereignty issues with countries as well,
Speaker 3: or even austrating client to the moment who is like.
Speaker 1: Yeah, that's exactly why I want to run alarm locally
Speaker 1: because my customers don't want me using.
Speaker 3: The the tools. So it's hugely I see a future
Speaker 3: where probably a lot of people, mostly people who use
Speaker 3: technology heavily already, will have their own influence machine at home.
Speaker 3: I think that's just going to be commoditized.
Speaker 2: Well, and it just gets rid of the token issue too,
Speaker 2: questioning the massformans. Of course you're going to get from
Speaker 2: it rather than sure, you know, although sooner or later,
Speaker 2: these all you can eat accounts are going to go away.
Speaker 3: Oh yeah, I mean they're heavily subsidized in the moment.
Speaker 3: They can't continue to do that. Even if if electricity
Speaker 3: prices and all the associated costs come down, it's still
Speaker 3: heavily subsidized.
Speaker 2: Yeah.
Speaker 3: But the other thing is, like I would be happy
Speaker 3: at the moment with an influence machine that was perhaps
Speaker 3: a little slower, but didn't have that. So I use
Speaker 3: cloud code and they have the five hour window, and
Speaker 3: if I could get it to do something for ten
Speaker 3: hours while I'm sleeping and not just stop halfway through, Yeah,
Speaker 3: it doesn't really matter to me if it's a bit slower,
Speaker 3: because it still gets more done overall.
Speaker 2: Yeah. Yeah, I've definitely got friends running multiple or you
Speaker 2: can eat accounts because they literally run them against each
Speaker 2: other overnight routinely. Like that's just the way you do work, right,
Speaker 2: You get up in the morning to see what your
Speaker 2: half a dozen bots have cooked off for yourself. I'm
Speaker 2: sure you're spending a couple of grand a month, but.
Speaker 3: Work just between me and my wife, we're spending easily
Speaker 3: five k a year if we're looking at two mexicounts each,
Speaker 3: sure five six k a year. And then we've got
Speaker 3: all the other TOOLI on top. How much does it
Speaker 3: cost to build a pretty good rig for home? How
Speaker 3: quickly could you pay that often? In terms of written
Speaker 3: on investment, I don't think take that long.
Speaker 1: Well, and like I said, this one costs six thousand, right,
Speaker 1: and it's all in one box. Right, it works great?
Speaker 3: Yeah, yeah, well I'll catch up with you afterwards. I'll
Speaker 3: find out what specs you're running.
Speaker 2: It's in true reality. And I was just reading Anthropic
Speaker 2: is now offering you for a fee faster service from them. Yeah,
Speaker 2: two and a half time, so you can sort of
Speaker 2: go fast laying with them. So I feel like those guys,
Speaker 2: the cloud guys, have got to figured out of all
Speaker 2: of the company, the new AI companies, rather than the
Speaker 2: tech shiants, the one that seemed to be making things
Speaker 2: that people want and will spend money on seems to
Speaker 2: be Anthropy and today anyway, the other.
Speaker 3: Thing I really like about Anthropic is their stems on security. Yeah,
Speaker 3: they've got huge research teams making sure that they're being
Speaker 3: as ethical as possible. They understand the repercussions, that they're
Speaker 3: fixing guardrails, all of those kind of things, Like if
Speaker 3: I had to put my money on which one's going
Speaker 3: to survive because they quote do the right thing or
Speaker 3: pay attention to the needs, and they do heavily focus
Speaker 3: on the coding side of things. It's where they've made
Speaker 3: their names so far. Yeah, I would say if there's
Speaker 3: going to be one frontier model or provider that comes
Speaker 3: out of this as the go to for software development center.
Speaker 2: Topic, it sure seems that way. And it's funny how
Speaker 2: little the sense of trust towards the tech giants is,
Speaker 2: Like you would have thought back in the day, it
Speaker 2: was like nobody ever went wrong for using IBM. It's
Speaker 2: like you would have thought Microsoft had sewn up. They
Speaker 2: offer the protection of will handle any lawsuits you're exposed to,
Speaker 2: and so forth, and still the reputation is shockingly bad.
Speaker 2: And here's this little company with minimal of anything. But
Speaker 2: we're willing to give them the chance.
Speaker 3: And I'm sure I probably don't want to get too
Speaker 3: much into politics, but if you look at what Opening
Speaker 3: Eye has been doing in terms of we're going to
Speaker 3: be open source. Now we're not open source, and people
Speaker 3: getting fired, and there's all sorts of stuff going inside.
Speaker 3: There's question mark surrounding that company. It's hard to work
Speaker 3: out what direction they're trying to go in.
Speaker 1: They're under a lot of monetary pressure, you know, and
Speaker 1: they've spent, they've taken lots of money. What are they
Speaker 1: they're giving they're giving back, but you know they have competitors,
Speaker 1: right sure, yeah.
Speaker 2: Yeah, And I don't see that same sense of this
Speaker 2: is a product you must use coming out of open
Speaker 2: AI the way I'm seeing over and over again, and
Speaker 2: not just one thing, like these new plugins for PowerPoint
Speaker 2: and Excel out of Anthropic are stunning, Like what has
Speaker 2: the M three sixty five team been doing that? Out
Speaker 2: of nowhere? Anthropy goes, hey, how about this? He's being Oh,
Speaker 2: you mean the thing I always wanted from Excel?
Speaker 3: Right, okay, So the chlaud cowork feature that came out
Speaker 3: recently was ideated. I'm not sure iver I like that word,
Speaker 3: but I'll go with it. It was ideated ten days before
Speaker 3: was released. Like the speed at which they bringing stuff
Speaker 3: out of there. And I read an article the other
Speaker 3: day that anthropic engineers are you take away the word
Speaker 3: software aren't actually coding anymore. They do sison Claud to
Speaker 3: make Claud better, right, Yeah, it's all our specifications. It's
Speaker 3: all about knowing what you want to build and getting
Speaker 3: the AI tooling to understand that to a sufficient enough
Speaker 3: level to build a good product. And they're eating their
Speaker 3: own on food literally in the best sense of that example.
Speaker 3: And they're doing redeveloped.
Speaker 2: Yeah, they're doing what everybody said they would do. These
Speaker 2: guys seem to actually be doing it. Are now sort
Speaker 2: of running away with what's possible here. Okay, but I
Speaker 2: think about the security on the dev side where I
Speaker 2: have teams now where when they use remote developers, the
Speaker 2: remote developers have to RDP into an instance with the
Speaker 2: dev tools on it because they won't allow anything to
Speaker 2: go onto even that remote desktop. You know, if you're
Speaker 2: going to steal from that code basis, because you're going
Speaker 2: to take pictures of the code like that's how tight they.
Speaker 3: Are, which you could probably automate with Claud cowork.
Speaker 4: Oh yeah, so much for protections, right, Although if you're
Speaker 4: willing to throw the vms up in the clouds, you're
Speaker 4: probably willing to use the AI in the cloud as well,
Speaker 4: Like I just I don't know that we can contain
Speaker 4: data all that Well, if you're going to be on
Speaker 4: the internet, you're on the Internet.
Speaker 3: I think the risk profile there is very interesting. If
Speaker 3: I was a Department of Defense type organization in a country,
Speaker 3: they didn't want my code to leave sovereign borders totally
Speaker 3: unset there, So my source control, my hosting, all of
Speaker 3: that needs to be within borders because when I'm pushing
Speaker 3: my code around, that code is literally being pushed around.
Speaker 3: When database dumps are being sent around, when people are
Speaker 3: signing up for accounts, that data is HGPSTLS, straw. But
Speaker 3: the essentially we've got a whole lot of plaintext data
Speaker 3: at some point that's been passed around. When you're pushing
Speaker 3: context to an infant server, there's plaintext in there, but
Speaker 3: then it gets tokenized, and then it gets stored in
Speaker 3: some kind of vector representation, and it's pulled out in
Speaker 3: interesting ways, and then you've got the key valuecation and
Speaker 3: there's a lot of obfuscation under the hood. So what
Speaker 3: is it that actually gets stored long term? A lot
Speaker 3: of the providers will say that we don't remember your prompts,
Speaker 3: and we don't remember the responses, but we remember some
Speaker 3: of the stuff that happens in between. So the risk
Speaker 3: profile there is interesting because it's no longer as clean
Speaker 3: cut as our data is at rest in another country,
Speaker 3: because it kind of is, but it also kind of isn't.
Speaker 3: So I think when we think about whether or not
Speaker 3: we can use these tools, we need to not so
Speaker 3: much to think about where is the data going, but what
Speaker 3: is the likelihood of that data representing a leaking kind of.
Speaker 2: Risk actually actually risky information of any kind that could
Speaker 2: be harmful to a company.
Speaker 3: So we've seen the examples where somebody would go to
Speaker 3: cloud code or chatchypt and they would say count from
Speaker 3: one to two thousand, or repeat the word organization one
Speaker 3: hundred times was a good example, and then after like
Speaker 3: the sixty fourth time, it would start leaking information that
Speaker 3: it was trained on. There was the report of the
Speaker 3: email signature of a legal firm being leaked that way,
Speaker 3: Because essentially all is doing is predicting an X word,
Speaker 3: and as the context kind of doubles, it's saying, okay, organizational, organization, organization,
Speaker 3: and it forgets what it's doing, says organizational the next
Speaker 3: likely word is is not liable for anything? Blah blah blah.
Speaker 3: So it starts it's doing what it's supposed to do.
Speaker 3: What's the most likely word to come next, and it
Speaker 3: protects the context.
Speaker 1: It feels like my brain first thing in the morning, Right, So.
Speaker 3: I was going to say we need need more coffee?
Speaker 2: I slept well, right, You.
Speaker 3: Copies of this context can get pulled out, right, But
Speaker 3: is there enough there for it to be a concern?
Speaker 2: Is it harmful in the right way?
Speaker 3: And how do you measure that?
Speaker 4: Like?
Speaker 3: That's the other thing is there's there's no way for
Speaker 3: us to actually know what's gone out to somebody else
Speaker 3: and what was that?
Speaker 2: And this is the challenge of a security person is
Speaker 2: there are no absolutes. Nothing's ever one hundred percent anything.
Speaker 2: Its scope of risk, right, And so you're looking at
Speaker 2: a situation going, well, this is seen to be much scoper. Yes,
Speaker 2: it's not absolute, but it's also not a high scope
Speaker 2: of risk. Here, totally interesting problem. All right, we should
Speaker 2: take a little break and maybe dig into some security
Speaker 2: fundamentals that folks can take a come away with. That's good,
Speaker 2: right after these important messages and we're back. It's don
Speaker 2: at Rock's amateur Campbell that's called Franklin Yo. Talking to
Speaker 2: our friend Ben Ben Deshry about well, you've been a
Speaker 2: security guy before AI was dominant on these things, right,
Speaker 2: you were the o off guy, Like you've done all
Speaker 2: of that sort of stuff, Like, how much has that changed.
Speaker 2: You've had the battle of trying to get developer security
Speaker 2: software all along.
Speaker 3: Developers love security insofar as they want to do a
Speaker 3: good job.
Speaker 2: Yeah, sure, but.
Speaker 1: They're not like implementing it or being restricted by it.
Speaker 3: Though I think we want to implement it. Maybe I'm
Speaker 3: just weird like that because I like security. But I
Speaker 3: think oftentimes the biggest story that I've seen the narrative
Speaker 3: of software development in the last twenty five thirty years
Speaker 3: is developers want to do it, but we need to
Speaker 3: watch back in the early days, like the early two thousands,
Speaker 3: it used to be that security was a future. You'd
Speaker 3: have like something in the backlog, we need to implement
Speaker 3: this feature, and then there's another ticket saying make sure
Speaker 3: it's secure.
Speaker 1: I would argue that back then the threats weren't as persistent, pernicious, or.
Speaker 3: There was different numerous but you still don't want credit
Speaker 3: card data leaked across the internet, like the fact that
Speaker 3: it was put in as a separate ticket that could
Speaker 3: get pushed to the next sprint was an issue. And
Speaker 3: then we started treating security. We realized that was probably
Speaker 3: a bad idea because we were separating implementation from the
Speaker 3: feature implementation from the security implementation. So we decided to
Speaker 3: put it all into one. And the problem with that
Speaker 3: is then, whereas before the team had visibility of we're
Speaker 3: not doing the security stuff that we should be doing,
Speaker 3: now because it was wrapped up into a single ticket,
Speaker 3: it became the developers problem because the project manager would
Speaker 3: come along on the Thursday morning and say, we need
Speaker 3: to get this out by the end of tomorrow, and
Speaker 3: you're like, well, I don't have enough time to do
Speaker 3: the full ticket. I can do the implementation and leave
Speaker 3: the security till later, but now we're not tracking that.
Speaker 3: So became invisible that we weren't doing it. So we've
Speaker 3: always had a problem.
Speaker 2: Right, I can build, I can build a building, but
Speaker 2: I can't put a door with a lock on.
Speaker 3: Right, I'll get round to it. We'll do that next week.
Speaker 3: And then next week they're like, nope, this week is
Speaker 3: Windows week. Yeah, yeah, still no locks on the Windows.
Speaker 1: So part yeah, part of this is meanwhile, somebody came
Speaker 1: in install your hammer.
Speaker 2: Right, and it's just so there's also a problem with
Speaker 2: the PMS or not prioritizing security there until obviously becomes
Speaker 2: a crisis.
Speaker 3: So this has been one of the things that I've
Speaker 3: tried to do as much as possible with helping developers
Speaker 3: understand how to write secure software and the processes to follow.
Speaker 3: Is it not just your processes or the engineering team's processes.
Speaker 3: It's an institutional understanding, systemic understanding within your organization that
Speaker 3: this is important. Get buying from people outside of the
Speaker 3: engineering department, not just the outside the engineering team. Because
Speaker 3: if if your marketing team and your sales team and
Speaker 3: your HR team all no, if we don't do this,
Speaker 3: this could be really bad for our pr This could
Speaker 3: be something that doesn't allow us to succeed beyond our
Speaker 3: competitives over the next few years. But give it to
Speaker 3: them in rational terms and say's a lot of that
Speaker 3: kind of stuff that we seltare engineers need to do.
Speaker 3: We kind of need to push the message up into
Speaker 3: the organization because if you don't get buy in, then
Speaker 3: there's no understanding of why right, you're spending time on.
Speaker 2: That, yeah, and it's yeah, just you can't ship without
Speaker 2: this anymore. That you can't. It's like, I guess if
Speaker 2: it was if I was in is shoes. It's like,
Speaker 2: so you don't actually need me to store the data either, right,
Speaker 2: Like that's not important totally. This is These are not features,
Speaker 2: This is infrastructure. These are basic things we need to
Speaker 2: do before we can do anything else. Well, I guess
Speaker 2: you know I've heard you say this line that the
Speaker 2: shift left of security is like part of the basic
Speaker 2: plumbing of the initial startup of this app includes it's
Speaker 2: security totally.
Speaker 3: So bringing AI into the picture, it doesn't change that
Speaker 3: at all. The way I like to think of AI
Speaker 3: as an engineering assistant is I used to describe it
Speaker 3: as the junior engineer that you're pair programming with.
Speaker 5: That's changing now because we're getting more into like the
Speaker 5: ralph loops and the orchestration and all of these kind
Speaker 5: of things that allow the LMS in the background to
Speaker 5: chug away for hours. We're gaining to the point now
Speaker 5: where we're having to make a decision between speed and oversight.
Speaker 5: I'm not sufficiently convinced that either way of the moment,
Speaker 5: I'm currently personally going for speed because I think they're
Speaker 5: bringing guardrails and test suites and all of those, all
Speaker 5: of those things that we used to do under the
Speaker 5: traditional software development life cycle that the waterflow life cycle,
Speaker 5: that kind of got diluted. I don't know if there's
Speaker 5: a pan in there somewhere with waterfall, but it got
Speaker 5: diluted when we went to more agile, the run fast
Speaker 5: and break stuff kind of methodology of the twenty tens,
Speaker 5: where we'd write software and it was relatively easy to
Speaker 5: go back and change if a client came back with
Speaker 5: with a change request.
Speaker 2: Yeah, but she also had a tight tight to the
Speaker 2: client the whole time. Right, It wasn't just don't have
Speaker 2: a plan, It's that the person you're planning with is
Speaker 2: sitting beside you, so you have a lot of imput.
Speaker 3: Sure, But the problem with this point is all of
Speaker 3: the information is now in the heads of two people,
Speaker 3: as opposed to documented and understandable. So if we think
Speaker 3: of developing with AI the same as it doesn't necessarily
Speaker 3: to be enterprise skill software development. But let's say you've
Speaker 3: got a team of four people working on a project. Sure,
Speaker 3: and one of those team members could be stopped out
Speaker 3: for another team member at the drop of hat. And
Speaker 3: that's kind of the equivalent of the context window. Right
Speaker 3: as soon as the LLLM wipes context window and starts again,
Speaker 3: it's like a new developer joining the team. How quickly
Speaker 3: can you onboard that developer? And before we had it
Speaker 3: in our heads and we were being handheld or handholding
Speaker 3: probably bidirectional handholding with a client trying to develop the software.
Speaker 3: It was fast because we were able to iterate quickly
Speaker 3: because the feedback loop was small, but the documentation and
Speaker 3: the persistence of that information was not there. So if
Speaker 3: we think about the way we used to write software,
Speaker 3: where specifications and understanding the problem was core before you
Speaker 3: even started coding, I see a change back to that direction. Yeah,
Speaker 3: we're getting specification driven development again, where you write some
Speaker 3: really good specs and then you can even use an
Speaker 3: element to convert that into an implementation plan and then
Speaker 3: you give that implementation plan.
Speaker 2: When we have tools like this, right, I get have
Speaker 2: spec Kit is literally that, right.
Speaker 3: Yeap spec it's great open spec I've been playing with
Speaker 3: as well. I actually find nowadays just chatting with Claude
Speaker 3: and talking as long as you give it a framework
Speaker 3: like this is what I want a specification a file
Speaker 3: to look like, and I want specification specification files to
Speaker 3: be around the topic of concern as opposed to functional specifications.
Speaker 3: You can just chat with an LM directly. A lot
Speaker 3: of these frameworks for developing specs are great, but if
Speaker 3: somebody wants to get into it and just chat with
Speaker 3: Claude for half an hour and then say, now build something,
Speaker 3: as long as you're able to define the outcome. And
Speaker 3: this is the biggest thing. I'm seeing memes come up
Speaker 3: all the time on Facebook and LinkedIn now of like
Speaker 3: the four panel cartoon where on the one side you've
Speaker 3: got a Vibe code and they're like, build me a game.
Speaker 3: That's awesome, and then the next frame is the computer
Speaker 3: catches fire. And then on the other side you've got
Speaker 3: what this particular cartoon called a Vibe engineer, which is
Speaker 3: build me a game that uses this technology on this
Speaker 3: platform and web sockets and this and then the other,
Speaker 3: and then in the next frame is a functioning app.
Speaker 3: The only difference there is the amount of specification and
Speaker 3: time taken to put the detail into that specification at
Speaker 3: the beginning.
Speaker 2: Sure well, and the nice thing is you keep iterating
Speaker 2: on this too. You know, I've seen these specs sort
Speaker 2: of evolve and make better and better code as we've
Speaker 2: learned the limitations of the tools. Although you get to
Speaker 2: a certain size of a spec where now you have
Speaker 2: to decompose it, like you can only feed so much
Speaker 2: data in any given agent. The other piece I've seen is,
Speaker 2: and we got this right away, it writes better prs,
Speaker 2: it writes better issues like you actually, naturally when you're
Speaker 2: using these tools, get better documentation to get someone back
Speaker 2: up to speed because so many details are automatically generated.
Speaker 2: But just got to get people to actually read that
Speaker 2: or have the tool read it too. Like I think
Speaker 2: there's probably a lot of insight.
Speaker 1: There, but the tool can usually read the source code
Speaker 1: and figure things out quickly.
Speaker 2: Yeah, but I wonder what you'd learn by reading through
Speaker 2: the issues, pull requests and iterations on that that is
Speaker 2: deeper than just what the ending code was, Like, what
Speaker 2: does the tool struggle with? What do we have to
Speaker 2: iterate the most on to be successful?
Speaker 3: That would be interesting.
Speaker 2: Yeah, I just I just feel like we're not that
Speaker 2: far away from having an agent that is your penetration tester,
Speaker 2: that is your is this app secure? And it gives
Speaker 2: you a rating that it actually hammers on the app
Speaker 2: and talks about the holes that are in it. Because
Speaker 2: this is the sort of meticulousness is what these tools
Speaker 2: are actually good at. A friend of mine who's deeply
Speaker 2: versus says, it didn't matter how many interns I had,
Speaker 2: I could never get a hundred percent code coverage till
Speaker 2: I got these tools. Then how to present code coverage
Speaker 2: john testing, which is not that difficult to happen, It
Speaker 2: just took time.
Speaker 1: Yeah, in the beginning, I talked about lllms or in
Speaker 1: different AI tools that are finding zero days and writing
Speaker 1: exploits for them at an amazing, alarming clip. And you
Speaker 1: know it's scary, yes, but you also can think about, well,
Speaker 1: let's deploy it on the other side, let's use AI
Speaker 1: to to test our constantly test our systems and find
Speaker 1: the holes in our systems so that they don't become
Speaker 1: zero days. And you know, as a defensive measure.
Speaker 2: Find them and fix them. Yeah, find them and fix them,
Speaker 2: because consistently the good guys have more resources than the
Speaker 2: bad guys.
Speaker 1: Anyway, well hopefully so, who knows.
Speaker 3: My brain's gone off on a slight tension to this point. Yes,
Speaker 3: to let's get the AIS to penetration test and do
Speaker 3: all the unit tests and functional tests and all of
Speaker 3: those kind of things would be a natural extension anyway.
Speaker 3: But as you were saying, let's find the zero days
Speaker 3: before the bad actors. Let's call them that find that
Speaker 3: open claw and multipook. Can you imagine if you have
Speaker 3: open clare running on your machine or a machine that
Speaker 3: has access to your code and the backlog and the
Speaker 3: decision tree and all of those kind of things, and
Speaker 3: one of your penetration agents finds a zero day that
Speaker 3: it then fixes in your code, and then open claw
Speaker 3: notices this and puts it on multbook saying, hey, one
Speaker 3: of our developer agents just found this thing. Isn't that interesting?
Speaker 3: And then suddenly all of these agents and there's a
Speaker 3: question as to where multipook is actually really what it
Speaker 3: purports to be. There's some news articles coming out saying
Speaker 3: that it's it's staged. But let's assume that it is
Speaker 3: what it purports to be. Now we've got this communication
Speaker 3: distitution distribution mechanism for all these agents to learn about
Speaker 3: zero days in real.
Speaker 2: Time, right like you could be parallelizing the fixes in
Speaker 2: a tremendous rate, right, or the attacks like that's the
Speaker 2: problem is, like what happens from here?
Speaker 3: Yeah, it would definitely be both. Can I can I
Speaker 3: abuse this before all of the fixes are in?
Speaker 2: Probably? Yeah? Yeah, you know, we've always looked for places.
Speaker 2: Science fiction has always talked about the superintelligence effect that
Speaker 2: at some point these tools get to a place where
Speaker 2: they're learning far faster and far more than humans can
Speaker 2: and become a super intelligence. It's science fiction, to be clear,
Speaker 2: and you know, the reality as we with these lms
Speaker 2: is we've largely seen it's all derivative work, even though
Speaker 2: it's potentially valuable, Like very few people make it through
Speaker 2: the whole checklist of actually securing an app and a
Speaker 2: tool would be far more persistent on it than a
Speaker 2: person would. All of that is good, but this abil
Speaker 2: this drag race of U code being generated, finding vulnerabilities
Speaker 2: in it, rippling those fixes out while the attackers are
Speaker 2: also running at it like that's a fast iteration cycle.
Speaker 2: That means if you're outside of that loop, the software
Speaker 2: that's going to come out the other side of being
Speaker 2: in that battleground is vastly more secure than the software
Speaker 2: that's not it, and it will happen fast. That to
Speaker 2: me is the first time I've really felt like that
Speaker 2: rush of speed from these tools would actually impact something real.
Speaker 2: I never expect these tools to create new knowledge, that's
Speaker 2: not what they are, but to press against all the
Speaker 2: weaknesses and systems and find them and potentially fix them.
Speaker 2: That makes total sense to me.
Speaker 3: Yeah, it's part of my build loop at the moment.
Speaker 3: Is as well as getting it to generate code. I'm
Speaker 3: saying right, tests, There's an interesting bit of research that
Speaker 3: I'm trying to dig deeper into at the moment. There's
Speaker 3: no one hundred percent certainty either way whether LM's writing
Speaker 3: tests that test LM generator code is a good thing.
Speaker 3: My original hypothesis was that at the the probability of
Speaker 3: an LM writing a test that passes against code that
Speaker 3: does the wrong thing, Yeah, is quite low. It turns
Speaker 3: out it isn't actually that low. Yeah, It's around about
Speaker 3: forty percent from some of the stuff that I was
Speaker 3: looking into. So we still need to be careful about
Speaker 3: who's writing the tests and how do we validate those.
Speaker 2: Sure, the same way we feel about any code it generates,
Speaker 2: Like the number of times that I get code generated,
Speaker 2: that's right, the first time is very low. But how
Speaker 2: many times do you generate test code and never go
Speaker 2: past the initial iteration?
Speaker 3: Well, ideally, why would you expect it to be any
Speaker 3: iterating on your code. If you're using an AI to
Speaker 3: iterate your code, you would have them iterate your tests
Speaker 3: as well. Yeah, And I think the reason why I
Speaker 3: was hoping that it would be a lower chance of
Speaker 3: that going wrong than it might actually be is because
Speaker 3: it's not just like the LM is not going to
Speaker 3: write a test that tests the wrong thing and then
Speaker 3: write code to satisfy the test, because it has a
Speaker 3: whole lot of extra context in there part of the
Speaker 3: test or the testing quotes. Also, does it meet the
Speaker 3: requirement of the specs, does it meet my programming objectives
Speaker 3: like the overall system prompt of being a helpful coding
Speaker 3: a system that writes secure code, Like, there's all sorts
Speaker 3: of other stuff that goes into it other than just
Speaker 3: does it pass the test that I think that it's
Speaker 3: going to sway it more towards not necessarily good quality code,
Speaker 3: but does what it's supposed to do in the closest
Speaker 3: possible to the best way with as few issues as possible.
Speaker 2: Well, part of what you're writing out in that prompt
Speaker 2: is what quality code means to you, right, and part
Speaker 2: of that is secure code.
Speaker 3: Right, and they'll be bad. There's a whole lot of
Speaker 3: prompts that get sent to whichever coding agent of choice
Speaker 3: you're using that you don't even see. So if you're
Speaker 3: using code or open code or code X or any
Speaker 3: of these, they will have their own prompts built in
Speaker 3: that kind of set up the infrom server to understand
Speaker 3: the perspective of the following request. And then that request
Speaker 3: will be your code base, your specifications files, anything that
Speaker 3: you write into, like your actual message. All these kind
Speaker 3: of things get added into the context. But there is
Speaker 3: a large chunk of context, I say large. Claud code
Speaker 3: by default sins about seventeen k of context before anything
Speaker 3: in your code base or anything.
Speaker 1: Wow, that's a lot, right, But it has to be.
Speaker 3: It has to be because it's setting the scene.
Speaker 2: Right.
Speaker 3: Here's here's what Claude wants you to do, or what
Speaker 3: Anthropic want Claude to do, and then here's the context
Speaker 3: of the ACRO application. So there's extra stuff in there
Speaker 3: that is extra guardrails and extra safety.
Speaker 2: Right, and then most sophisticated AI tool user I see
Speaker 2: now have a prefix set ahead of their particular project
Speaker 2: specs as well that are more guidelines, so guidelines on
Speaker 2: top of guidelines or toper guidelines before we even start
Speaker 2: talking about and this is what you're making in this iteration.
Speaker 3: And we're surprised that when we come to the end
Speaker 3: of all of that and all we've written is one
Speaker 3: line saying fix this bug, and it's forgotten everything else
Speaker 3: before because the context windows kind of strolled way past,
Speaker 3: and it's right, it's in a rearview mirror some way.
Speaker 2: I banged into this with home my home Assistant instance
Speaker 2: the other day, where I was still using three or
Speaker 2: you know, three plus, and the context win was like
Speaker 2: sixteen K and the specification of my homes system instance
Speaker 2: now is nineteen K, so literally I could do nothing.
Speaker 2: I had to move up to four to get a
Speaker 2: sixty four K context window just to have anything work.
Speaker 2: And at the same time I was sitting back and going,
Speaker 2: why is this so big? Like this is not efficient,
Speaker 2: Like all of this fields a remarkably inefficient. Shouldn't we
Speaker 2: be narrowing the scope of these llms architecturally, not just
Speaker 2: by prompts every single time we call them. Like, no,
Speaker 2: wonder we're wasting so much.
Speaker 1: Another reason we should be running local inference engines. Yeah,
Speaker 1: and that's totally that's where we're going. Yeah, I think so,
Speaker 1: and it won't be an issue.
Speaker 2: I just feel like we're still mailing two broader models.
Speaker 2: I know. I lived through the OLAP revolution, and every
Speaker 2: time we did a data analytics cube or you come
Speaker 2: the first time you started with the mother of all cubes,
Speaker 2: and it was never useful other than instructional for what
Speaker 2: to make next that it was far more important to
Speaker 2: de scope that make a smaller one once you get
Speaker 2: that initial explore and everything I look at so far
Speaker 2: in this is like we're still building mother all cubes
Speaker 2: every time and then and then fighting to scope it
Speaker 2: down to the work we actually need to do, rather
Speaker 2: than start with something that's tuned to the work. Totally.
Speaker 3: I'm wondering whether we're going to get roughly stack shaped
Speaker 3: small language models. Yeah, because the LM we use for
Speaker 3: coding knows everything about cobol and Java and c shop
Speaker 3: and PHP and javascripting. I don't need all of those, No,
Speaker 3: Can I get one that just does what I need to.
Speaker 2: Yeah, the three languages you're doing in this app at
Speaker 2: this time, and the architecture that you care about, like,
Speaker 2: just scope it down. I got a feeling a few
Speaker 2: years now we're going to be talking about an LM
Speaker 2: specific to an app. Yeah, that the more mature and
Speaker 2: application is, the better this tool is at making modifications
Speaker 2: to right, because it Yeah, ultimately the tool is going
Speaker 2: to know more about how the software was built than
Speaker 2: any person. Right, Those people are all gone, right, like,
Speaker 2: look at any mature piece of software that we have
Speaker 2: that problem.
Speaker 1: But these tools, well, that's if the tool was that's
Speaker 1: if the tool was stayful though, but it's not. It's
Speaker 1: like Groundhog Day. Every time you talk to it. You
Speaker 1: have to give it the context, as you were saying.
Speaker 3: But that's that's just the context, the underlying model that
Speaker 3: the context we do is then pass through in order
Speaker 3: to create the apport response can still be made a
Speaker 3: lot smaller.
Speaker 1: Right, but it's not going to know anything about your
Speaker 1: app unless that's built into the model or you use
Speaker 1: RAG or something like that, right, or it can just
Speaker 1: see what it sees every time.
Speaker 3: Yeah, I mean my assumption was that Richard was saying
Speaker 3: that you would take that code base and then train
Speaker 3: them all.
Speaker 2: Yeah, okay, train into it. Yeah, and that because again
Speaker 2: it's like I'm just trying to narrow the scope. Like
Speaker 2: if you know, one of the things you learn about
Speaker 2: third version of an app is we're not introducing in
Speaker 2: that language. Thanks, right, Like that, the bar for new
Speaker 2: architecture or any of that, it gets really really high.
Speaker 2: We have a known set are patterns that work for
Speaker 2: this app, and the making changes in those patterns are easy,
Speaker 2: and anything outside of that pattern is a heavy left.
Speaker 3: So here's another thing I've been wondering, why do we
Speaker 3: care about which language we use?
Speaker 2: Ah?
Speaker 3: Well, that's and this has been something people have been
Speaker 3: talking about already. Isn't something new, But why not just
Speaker 3: have a same carriage model that only?
Speaker 2: But why?
Speaker 1: I think, Well, because I need to be able to
Speaker 1: read and verify the code that gets published today, the
Speaker 1: last chain in the link.
Speaker 3: Today, in the chain, I would not be surprised. I
Speaker 3: still remember when like twenty twenty three AI has just
Speaker 3: come out, Everyone's like this is going to take away
Speaker 3: all the developers' jobs, and people are like, you know what,
Speaker 3: in five years time, this is going to be writing
Speaker 3: software for us, and I'm like, give it one or
Speaker 3: two well or two years later. It's writing all the
Speaker 3: code for us. So if when I'm thinking, you know what,
Speaker 3: in five years time, maybe it'll be good, you know,
Speaker 3: for taking human written specs by somebody who doesn't under
Speaker 3: understand architecture and write software that works.
Speaker 1: It's already happening.
Speaker 3: I reckon it'll be two or three years, maybe even
Speaker 3: by the end of twenty six.
Speaker 1: But it's already happening.
Speaker 2: Isn't that You.
Speaker 3: Still need to know enough about the code that I'm writing.
Speaker 3: I still need to handhold it after the loop. So
Speaker 3: I will build some really good specs. I'll get it
Speaker 3: to run for three, five, seven hours whatever, well not
Speaker 3: seven because token Windows, and I'll get back to it
Speaker 3: and it's ninety nine percent there. I'm happy with the code.
Speaker 3: It doesn't quite do what I wanted. Maybe it misunderstood
Speaker 3: a requirement. Maybe it didn't write a test that would
Speaker 3: make sure that the doc container was restarted. There's something missing.
Speaker 3: It hasn't done a perfect job. It's not hard for
Speaker 3: me to fix because I have a software engineering mind,
Speaker 3: but my mom wouldn't be able to fix that. I
Speaker 3: think in a year or two.
Speaker 1: Now would you want your mom to fix that?
Speaker 3: Why wouldn't you? Why would you not want any human
Speaker 3: in the world to build? Say I want a piece
Speaker 3: of software that's going to do this for me, and
Speaker 3: the software goes, okay, here I am. I think that's
Speaker 3: where we're heading.
Speaker 1: Yeah, of course, yeah, that's where that's we're not.
Speaker 2: That's where the club at really spoke to us, as
Speaker 2: everybody wants their own software around them.
Speaker 3: And at that point we don't care about the language.
Speaker 3: So now we can have a small language model that
Speaker 3: understands three or four core languages. Maybe we've got typescript, GO,
Speaker 3: a couple of others that kind of round out the
Speaker 3: whole ecosystem of what you might need, and then you
Speaker 3: don't need to get just compress it down and nobody
Speaker 3: will ever write Java, Cobal or PHP or again except
Speaker 3: for the hobbyists.
Speaker 2: Even those contemporary languages are really about the modern architectures
Speaker 2: and having you sort of fall into the pit of success.
Speaker 2: None of that means anything. Maybe all this stuff's going
Speaker 2: to be written and see when it's generated. Sure, just
Speaker 2: as fast as bare metal as you wanted to do
Speaker 2: directly an assembly right into assembly core processor specifically, what
Speaker 2: do you care get as much performance out of it
Speaker 2: as you can. You know, the ultimate tester is the user.
Speaker 2: User accept the testing is ultimately what it matters. And
Speaker 2: one thing the user doesn't look at is any of
Speaker 2: the code. So if the app does what it's supposed
Speaker 2: to do, does any of that matter?
Speaker 3: And even to that extent before the user is using it.
Speaker 3: My my process of the moment is it installs Playwright,
Speaker 3: it has a headless browser like it's testing the user
Speaker 3: experience before I look at it.
Speaker 2: It's operating it as if it was the user.
Speaker 1: Personally. That future scares the shit out of me. It does,
Speaker 1: just because of the loss of control and the loss
Speaker 1: of checks and balances in the absolute faith that you
Speaker 1: have and the AI to do the right thing, all
Speaker 1: of those reasons, the security.
Speaker 3: To be honest, I'm with you. I'm with you on that.
Speaker 3: It is scary. I don't know whether or not I
Speaker 3: like it. But if I take a step back and
Speaker 3: pragmatically look at where this is going as an industry
Speaker 3: and society is going with AI, I think it's somewhat inevitable.
Speaker 1: If she had a heart attack, he went to the
Speaker 1: hospital and the doctor says, we're going to install this
Speaker 1: new AI created pacemaker.
Speaker 3: Has it gone through the same testing, but a human
Speaker 3: created pacemaker has to go through Yeah? If so, And
Speaker 3: it's how I fail.
Speaker 1: Well, you know they're going to tell you. They're going
Speaker 1: to tell you everything is just wonderful and it's so
Speaker 1: much better than everything else.
Speaker 2: Well, they do they do? Anyway? Why would you know
Speaker 2: one way or the other? Sure? In fact, why are
Speaker 2: they even telling you anything other We're going to fix
Speaker 2: your heart today.
Speaker 1: What I'm saying is Okay, maybe that's a bad idea,
Speaker 1: but how about you know, you go to buy a car,
Speaker 1: or you go to do just something that's critical right?
Speaker 1: And oh no, humans were involved in the in the
Speaker 1: creation and making of this. This was completely done by
Speaker 1: AI and robots or whatever.
Speaker 3: It's why I give it a one to two year
Speaker 3: back because this isn't going to happen until we have
Speaker 3: enough evidence, whether that's testable or just through somewhat anecdotal,
Speaker 3: like self driving cars for example. Yeah, once we know
Speaker 3: that they're less likely to kill somebody than a human,
Speaker 3: which I think we're already at that point, then there
Speaker 3: will become mainstream adoptable an AI driven or AI created pacemaker.
Speaker 3: Maybe not right now, but once they've been around enough
Speaker 3: and tested in the right kind of control group environs
Speaker 3: to be shown to be as effective, if not safer,
Speaker 3: than human created ones, then it'll have to be. Society
Speaker 3: will adopt it eventually. But if it happened tomorrow, then
Speaker 3: maybe not. But that's because I don't think it's that yet.
Speaker 2: Yeah, there's great Harvard Studies says, the more you understand
Speaker 2: about these technologies, less you trust them, so the most
Speaker 2: are also the most ignorant. Right, yes, right, we're all
Speaker 2: in this far enough that we're concerned for very clear reasons, right, yeah, right.
Speaker 1: And by the way, if you don't know open Claude
Speaker 1: is you haven't been paying attention to the news. It's
Speaker 1: open c l A W D D. And then it
Speaker 1: became molt. What's that it was?
Speaker 3: It was Claude bought with a W before it was
Speaker 3: open claw. Yeah, so its clawed with a D.
Speaker 2: Right.
Speaker 3: Then it became multipot multipot and then then open claw
Speaker 3: without the D at the end.
Speaker 1: Yeah, okay, but it's uh.
Speaker 2: I've included the show links. If folks haven't seen it,
Speaker 2: go to take a look.
Speaker 1: It's basically a tool that connects to multiple APIs and
Speaker 1: things and integrates with your multiple agents. And you know, if.
Speaker 2: You're ready to give away your keys to piece of
Speaker 2: software like this is supposed to be a security show,
Speaker 2: so let's talk about the least possible secure that you
Speaker 2: could do.
Speaker 1: Well, that's that's the cautionary tale right there.
Speaker 2: Right, But for the average mortal, for the productivity benefit
Speaker 2: that these tools provide, Like, what they're really showing you
Speaker 2: is what the potential is stuff is.
Speaker 3: This is the AI we were promised. Yeah, this is jovis.
Speaker 2: That's the that's their pitch. The only problem is it's
Speaker 2: really scary to trust it, and most people aren't qualified
Speaker 2: to assess that trust in the first place. So right,
Speaker 2: we're going to have some bad fallouts from this yet.
Speaker 2: But the rest of us, I think again, we're I
Speaker 2: think we're experienced. Now we're all looking at going he
Speaker 2: know this is cool? You go first? Yeah, I see.
Speaker 3: Pretty much talking. Which I do have a laptop that
Speaker 3: I've wiped recently that will be getting open Chloor installed
Speaker 3: on it. It'll be put onto my isolated IoT network
Speaker 3: and it will not have access to my credit cards
Speaker 3: or one password yeah.
Speaker 1: Plan good. Let us know how that goes for you.
Speaker 2: I will nice all.
Speaker 3: Right, yeah, if you never hear from me again, it
Speaker 3: went very badly.
Speaker 1: Get a phone call. I don't know where I am.
Speaker 1: I'm in a phone booth somewhere.
Speaker 3: Very lawnmore man, I thought I were gonna say open
Speaker 3: CLO was going to call you. I am Ben.
Speaker 1: There you go nine wait a call back. Oh Ben.
Speaker 1: It's been such pleasure talking to you. I wish we
Speaker 1: could talk more, and I'm sure we're going to in
Speaker 1: the future.
Speaker 2: When you come back.
Speaker 3: Thanks for having me.
Speaker 1: Thank you, and we'll talk to you, dear listener next
Speaker 1: time on dot net rocks. Dot net Rocks is brought
Speaker 1: to you by Franklin's Net and produced by Pop Studios,
Speaker 1: a full service audio, video and post production facility located
Speaker 1: physically in New London, Connecticut, and of course in the
Speaker 1: cloud online at pwop dot com. Visit our website at
Speaker 1: d O T N E, t R O c k
Speaker 1: S dot com for RSS feeds, downloads, mobile apps, comments,
Speaker 1: and access to the full archives going back to show
Speaker 1: number one, recorded in September two thousand and two, and
Speaker 1: make sure you check out our sponsors. They keep us
Speaker 1: in business. Now, go write some code. See you next time.
Speaker 2: You got Jack, Middle Vans and