Latent Space: The AI Engineer Podcast
01:17:00 · Shawn Wang, Mihail Eric
[01:17:00] S0: So I push back on that because to me, of course, it's, you know, bare minimum, it should be internally consistent with the PR spec. Sure. Yeah. No. What I meant is the spec for the feature, the code base, because that is the submission of all PRs. That is like, if your if your PR spec got it wrong or missed something, it's gonna be the delta between what the whole code base or the whole history of the code base is supposed to do versus what your PR is trying to do. Mhmm. Yeah. So so I'd like... I mean, I don't I expect you to have an answer. Yeah. Because, like, I I really stress about this myself. I try to instruct models to do it. They're bad at it. That's it. So so the are the the spec gods of, like, well, five weeks ago, did this other thing, and now you're reversing it. [01:17:42] S1: Have you seen the post from Basis? Like, they have a... They had a tweet little thing, a tweet article. I thought they did a great job talking about, like, different sort of file artifacts they they... I just tracked via git, and some of them are, like, the specs, the intent of what is to be, and the other is, like, what they call, like, the canonical state of the code, which is, like, a little bit more maybe what you're describing, which is implicit knowledge, implicit intent, that also has to be codified somewhere, right? So that part, that's all version controlled. And I think they found that to work for them, so that might be another thing [01:18:12] S0: to share Yeah, as Vivo was trying to pull it up. This is based on the accounting company.
01:18:12 · Shawn Wang, Mihail Eric
[01:18:12] S0: to share Yeah, as Vivo was trying to pull it up. This is based on the accounting company. [01:18:15] S1: The accounting company, exactly right. [01:18:16] S0: Yeah, yeah. We're having Mitchell at my New York conference soon. Amazing. Talk to him about that. I like that they are coming out with this. My solution for this is, I don't know if like how ready I am to talk about it, because I may never ship it, is something that is replacing Git in order to capture all of this. So I call it a program database where it captures all traces and all... And it reifies specs to something that that we that we can ignore and and keep, and it also controls the skills that are attached to it as well. [01:18:49] S1: That's [01:18:49] S0: cool. So I think like, basically what Git... Git is only focused on code, and then you just need a source of truth that is not only everything else outside the code, including the the implicit... What what did call it? [01:19:00] S1: Implicit assumptions are like the constraints, the intent, the other stuff. [01:19:03] S0: But also, highly concurrent. Because Git, by design, introduces mutexes everywhere, which sucks. So you need super concurrency. [01:19:16] S1: Have you seen... Is it GitButler? Is it? Yes. [01:19:20] S0: I'm the guy who [01:19:21] S1: used to be CTO. Ian, [01:19:23] S0: I think is his name. [01:19:23] S1: I forget his name, but yeah.
01:19:23 · Mihail Eric, Shawn Wang
[01:19:23] S1: I forget his name, but yeah. [01:19:24] S0: Scott. Scott. So I think there's a lot of people going after this, and I think there's the question of, like, really what is the ideal representation of tasks? And I think the winner, probably not me, linear. [01:19:40] S1: Really? [01:19:41] S0: Because that's where [01:19:43] S1: Yeah, yeah. The tasks [01:19:45] S0: clearly they have decided to become a coding agent company. And well, they have all the sorts of truth there as long as you buy into linear. [01:19:55] S1: Yeah. Yeah. That that is true. That is true. I I wonder... I I have, like, this somewhat, like, kind of held belief that I think a lot of companies are gonna evolve into some version of a coding agent company, which is any company that has, like, an interaction with b to b software where you're collecting something about the user or some, like, product insight, I think you can also close the loop. Because ultimately, like, a coding agent is... The purpose of coding agent is to act on some adventure thing that's happening, where a user is involved or a customer is involved, and they use that to, like, fix, ideally, aspect of the product. Right? I think what Linear is doing, I imagine the same thing like Amplitude could do as well. Right? Because they're also getting insights about user analytics, user problems. I imagine even, like, you wanna really stretch it. You could even have, like, Decagon or CRM, do something similar, where, you know, here's what's broken. Go close the loop. Mhmm.
01:19:55 · Mihail Eric, Shawn Wang
[01:19:55] S1: Yeah. Yeah. That that is true. That is true. I I wonder... I I have, like, this somewhat, like, kind of held belief that I think a lot of companies are gonna evolve into some version of a coding agent company, which is any company that has, like, an interaction with b to b software where you're collecting something about the user or some, like, product insight, I think you can also close the loop. Because ultimately, like, a coding agent is... The purpose of coding agent is to act on some adventure thing that's happening, where a user is involved or a customer is involved, and they use that to, like, fix, ideally, aspect of the product. Right? I think what Linear is doing, I imagine the same thing like Amplitude could do as well. Right? Because they're also getting insights about user analytics, user problems. I imagine even, like, you wanna really stretch it. You could even have, like, Decagon or CRM, do something similar, where, you know, here's what's broken. Go close the loop. Mhmm. [01:20:37] S0: Yep. Alright. So set all those things up for agent ready code base and set up code review. Security is week seven. It's not week one. Students. What do you mean security is not important? No. I make fun of because I always say, like, you know, at Amazon, job zero is security, and they always say this. Yes. But... Yeah. Security review at the end. [01:20:56] S1: Okay. I was at Amazon, and I don't remember that. But I I believe This is [01:20:59] S0: the thing Andy Jassy says.
01:20:59 · Shawn Wang, Mihail Eric
[01:20:59] S0: the thing Andy Jassy says. [01:21:00] S1: Okay. Okay. Okay. I see. I see. And that was... I guess he... I I was there partly during Jeff's time and then partly through... When this transition to Andy. So... But, yes. I I think this is a thing... A topic last year as well, and it's, and it's also won this year. And I think that there I... Isaac also spoke last year. I find that he's an incredibly thoughtful thinker, thoughtful thinker, I've done it. You know, a thoughtful thoughtful leader in sort of this space. I think Semgrep is an interesting company because they've been around even before sort of agents. Right? I mean, the the OSS repo was... Well, it was well before, like, kind of traditional SaaS kind of defense mechanisms. But I think they've done a good job of pivoting and... Or not pivoting, really, augmenting their offering to... Into this space. You know, I think it's it's it's an interesting time. Right? There's just a lot going on where these these attack vectors are now kinda coming to the surface. There's a lot more slop and AI generated code. And I think maybe one of the core insights that I wanna drive here is just the idea of, like, dependency... Kinda dependency tracking and supply management, basically, like supply chain. Right? You have to be careful about, like, your dependencies and and pin things appropriately, and don't just arbitrarily hit NPM install and expect the chain to go. [01:22:10] S0: Yeah. So potentially, the most secure code base is one with no dependencies. Yes. Right? [01:22:14] S1: That's correct.
01:22:14 · Mihail Eric, Shawn Wang
[01:22:14] S1: That's correct. [01:22:15] S0: You you look at the the dependency. You're like, cool depend... Cool implementation, bro, but I'm just gonna [01:22:20] S1: make my own. That's absolutely right. That's absolutely right. And and that's an interesting insight because it's sort of to the limit. And, you know, I think it's it's probably easier said than done. But if you believe that with code now being commoditized, code being easy and cheap, why not just build everything in house? Right? Like that... Like, of course, that's... And that would be the safest thing, because you've seen everything. You control everything instead of, you know, depending on Axios or whatever. But, you know, we'll see how many people actually act on that. That is the safest thing. I agree with you.