Latent Space: The AI Engineer Podcast
01:19:23 · Mihail Eric, Shawn Wang
[01:19:23] S1: I forget his name, but yeah. [01:19:24] S0: Scott. Scott. So I think there's a lot of people going after this, and I think there's the question of, like, really what is the ideal representation of tasks? And I think the winner, probably not me, linear. [01:19:40] S1: Really? [01:19:41] S0: Because that's where [01:19:43] S1: Yeah, yeah. The tasks [01:19:45] S0: clearly they have decided to become a coding agent company. And well, they have all the sorts of truth there as long as you buy into linear. [01:19:55] S1: Yeah. Yeah. That that is true. That is true. I I wonder... I I have, like, this somewhat, like, kind of held belief that I think a lot of companies are gonna evolve into some version of a coding agent company, which is any company that has, like, an interaction with b to b software where you're collecting something about the user or some, like, product insight, I think you can also close the loop. Because ultimately, like, a coding agent is... The purpose of coding agent is to act on some adventure thing that's happening, where a user is involved or a customer is involved, and they use that to, like, fix, ideally, aspect of the product. Right? I think what Linear is doing, I imagine the same thing like Amplitude could do as well. Right? Because they're also getting insights about user analytics, user problems. I imagine even, like, you wanna really stretch it. You could even have, like, Decagon or CRM, do something similar, where, you know, here's what's broken. Go close the loop. Mhmm.
01:19:55 · Mihail Eric, Shawn Wang
[01:19:55] S1: Yeah. Yeah. That that is true. That is true. I I wonder... I I have, like, this somewhat, like, kind of held belief that I think a lot of companies are gonna evolve into some version of a coding agent company, which is any company that has, like, an interaction with b to b software where you're collecting something about the user or some, like, product insight, I think you can also close the loop. Because ultimately, like, a coding agent is... The purpose of coding agent is to act on some adventure thing that's happening, where a user is involved or a customer is involved, and they use that to, like, fix, ideally, aspect of the product. Right? I think what Linear is doing, I imagine the same thing like Amplitude could do as well. Right? Because they're also getting insights about user analytics, user problems. I imagine even, like, you wanna really stretch it. You could even have, like, Decagon or CRM, do something similar, where, you know, here's what's broken. Go close the loop. Mhmm. [01:20:37] S0: Yep. Alright. So set all those things up for agent ready code base and set up code review. Security is week seven. It's not week one. Students. What do you mean security is not important? No. I make fun of because I always say, like, you know, at Amazon, job zero is security, and they always say this. Yes. But... Yeah. Security review at the end. [01:20:56] S1: Okay. I was at Amazon, and I don't remember that. But I I believe This is [01:20:59] S0: the thing Andy Jassy says.
01:20:59 · Shawn Wang, Mihail Eric
[01:20:59] S0: the thing Andy Jassy says. [01:21:00] S1: Okay. Okay. Okay. I see. I see. And that was... I guess he... I I was there partly during Jeff's time and then partly through... When this transition to Andy. So... But, yes. I I think this is a thing... A topic last year as well, and it's, and it's also won this year. And I think that there I... Isaac also spoke last year. I find that he's an incredibly thoughtful thinker, thoughtful thinker, I've done it. You know, a thoughtful thoughtful leader in sort of this space. I think Semgrep is an interesting company because they've been around even before sort of agents. Right? I mean, the the OSS repo was... Well, it was well before, like, kind of traditional SaaS kind of defense mechanisms. But I think they've done a good job of pivoting and... Or not pivoting, really, augmenting their offering to... Into this space. You know, I think it's it's it's an interesting time. Right? There's just a lot going on where these these attack vectors are now kinda coming to the surface. There's a lot more slop and AI generated code. And I think maybe one of the core insights that I wanna drive here is just the idea of, like, dependency... Kinda dependency tracking and supply management, basically, like supply chain. Right? You have to be careful about, like, your dependencies and and pin things appropriately, and don't just arbitrarily hit NPM install and expect the chain to go. [01:22:10] S0: Yeah. So potentially, the most secure code base is one with no dependencies. Yes. Right? [01:22:14] S1: That's correct.
01:22:14 · Mihail Eric, Shawn Wang
[01:22:14] S1: That's correct. [01:22:15] S0: You you look at the the dependency. You're like, cool depend... Cool implementation, bro, but I'm just gonna [01:22:20] S1: make my own. That's absolutely right. That's absolutely right. And and that's an interesting insight because it's sort of to the limit. And, you know, I think it's it's probably easier said than done. But if you believe that with code now being commoditized, code being easy and cheap, why not just build everything in house? Right? Like that... Like, of course, that's... And that would be the safest thing, because you've seen everything. You control everything instead of, you know, depending on Axios or whatever. But, you know, we'll see how many people actually act on that. That is the safest thing. I agree with you.
01:22:20 · Mihail Eric, Shawn Wang
[01:22:20] S1: make my own. That's absolutely right. That's absolutely right. And and that's an interesting insight because it's sort of to the limit. And, you know, I think it's it's probably easier said than done. But if you believe that with code now being commoditized, code being easy and cheap, why not just build everything in house? Right? Like that... Like, of course, that's... And that would be the safest thing, because you've seen everything. You control everything instead of, you know, depending on Axios or whatever. But, you know, we'll see how many people actually act on that. That is the safest thing. I agree with you. [01:22:46] S0: No. I... So that statement is dangerous because then you would just make your mistakes instead of making... On other people to discover mistakes. The whole point of open source is that, you know... What what is it? Like, sunlight is the best disinfectant. It's like Linus Torvalds' thing. It's it's like, well, yeah, you will be very slow to discover your own custom software dependencies because you only have your users, and they won't report it to you. But if this this thing has a 100,000 users worldwide, someone will find something. Then you can depend on it more. Right? Yeah. This is it Yeah. This is the... There's no... Basically, I I don't want to be... I'm trying to be a voice of, like Yeah. Reason. Right. Right. And you cannot be absolutist in both. And you you... I I kinda trapped you there. I talked I talked to you into the talk track of Yeah. Vendor everything. Right. Right. And there is a bug there.
01:23:34 · Mihail Eric
[01:23:34] S1: Yeah. Yeah. Yeah. It's an interesting one. I I wonder how much that that... How much is that? I I buy some aspects of that, but how much of that is impacted by the fact that everything... I I have this belief that most OSS repos, if not all them, will just become software factories that are effectively agent run-in the future. What happens then where, like... I mean, even... Even if you look at Warp, right? Like Warp, which is a Monaco agent, of course, also selling a software factory product, but but they are running their Warp, open source Warp terminal, as a software factory. And that almost suggests that there's a part where, yes, teams are still involved, but increasingly less so. Certainly not every single person is reviewing every single thing that comes into maybe the same exact level that we did in the past. Does that make this code base more or less vulnerable to security? It's bit hard to say. Right? I think that's just where there's a little bit of nuance that I think we're still... And even the folks that I know that I... That work in OSS are just trying to figure out exactly what that stable point is.