Latent Space: The AI Engineer Podcast
01:20:59 · Shawn Wang, Mihail Eric
[01:20:59] S0: the thing Andy Jassy says. [01:21:00] S1: Okay. Okay. Okay. I see. I see. And that was... I guess he... I I was there partly during Jeff's time and then partly through... When this transition to Andy. So... But, yes. I I think this is a thing... A topic last year as well, and it's, and it's also won this year. And I think that there I... Isaac also spoke last year. I find that he's an incredibly thoughtful thinker, thoughtful thinker, I've done it. You know, a thoughtful thoughtful leader in sort of this space. I think Semgrep is an interesting company because they've been around even before sort of agents. Right? I mean, the the OSS repo was... Well, it was well before, like, kind of traditional SaaS kind of defense mechanisms. But I think they've done a good job of pivoting and... Or not pivoting, really, augmenting their offering to... Into this space. You know, I think it's it's it's an interesting time. Right? There's just a lot going on where these these attack vectors are now kinda coming to the surface. There's a lot more slop and AI generated code. And I think maybe one of the core insights that I wanna drive here is just the idea of, like, dependency... Kinda dependency tracking and supply management, basically, like supply chain. Right? You have to be careful about, like, your dependencies and and pin things appropriately, and don't just arbitrarily hit NPM install and expect the chain to go. [01:22:10] S0: Yeah. So potentially, the most secure code base is one with no dependencies. Yes. Right? [01:22:14] S1: That's correct.
01:22:14 · Mihail Eric, Shawn Wang
[01:22:14] S1: That's correct. [01:22:15] S0: You you look at the the dependency. You're like, cool depend... Cool implementation, bro, but I'm just gonna [01:22:20] S1: make my own. That's absolutely right. That's absolutely right. And and that's an interesting insight because it's sort of to the limit. And, you know, I think it's it's probably easier said than done. But if you believe that with code now being commoditized, code being easy and cheap, why not just build everything in house? Right? Like that... Like, of course, that's... And that would be the safest thing, because you've seen everything. You control everything instead of, you know, depending on Axios or whatever. But, you know, we'll see how many people actually act on that. That is the safest thing. I agree with you.
01:22:20 · Mihail Eric, Shawn Wang
[01:22:20] S1: make my own. That's absolutely right. That's absolutely right. And and that's an interesting insight because it's sort of to the limit. And, you know, I think it's it's probably easier said than done. But if you believe that with code now being commoditized, code being easy and cheap, why not just build everything in house? Right? Like that... Like, of course, that's... And that would be the safest thing, because you've seen everything. You control everything instead of, you know, depending on Axios or whatever. But, you know, we'll see how many people actually act on that. That is the safest thing. I agree with you. [01:22:46] S0: No. I... So that statement is dangerous because then you would just make your mistakes instead of making... On other people to discover mistakes. The whole point of open source is that, you know... What what is it? Like, sunlight is the best disinfectant. It's like Linus Torvalds' thing. It's it's like, well, yeah, you will be very slow to discover your own custom software dependencies because you only have your users, and they won't report it to you. But if this this thing has a 100,000 users worldwide, someone will find something. Then you can depend on it more. Right? Yeah. This is it Yeah. This is the... There's no... Basically, I I don't want to be... I'm trying to be a voice of, like Yeah. Reason. Right. Right. And you cannot be absolutist in both. And you you... I I kinda trapped you there. I talked I talked to you into the talk track of Yeah. Vendor everything. Right. Right. And there is a bug there.
01:23:34 · Mihail Eric
[01:23:34] S1: Yeah. Yeah. Yeah. It's an interesting one. I I wonder how much that that... How much is that? I I buy some aspects of that, but how much of that is impacted by the fact that everything... I I have this belief that most OSS repos, if not all them, will just become software factories that are effectively agent run-in the future. What happens then where, like... I mean, even... Even if you look at Warp, right? Like Warp, which is a Monaco agent, of course, also selling a software factory product, but but they are running their Warp, open source Warp terminal, as a software factory. And that almost suggests that there's a part where, yes, teams are still involved, but increasingly less so. Certainly not every single person is reviewing every single thing that comes into maybe the same exact level that we did in the past. Does that make this code base more or less vulnerable to security? It's bit hard to say. Right? I think that's just where there's a little bit of nuance that I think we're still... And even the folks that I know that I... That work in OSS are just trying to figure out exactly what that stable point is.
01:24:26 · Shawn Wang, Mihail Eric
[01:24:26] S0: Yeah. There... There's a couple of related arguments, and then I'm I'm happy to Yeah. To keep going. So, like, security is, like, it's like a nonstop, like, huge Yeah. Huge, huge surface area thing. There's one argument from Malte of Vercel who's like, okay. Guys, let's take every single, like, high depend... Highly dependent on software that's written in c c plus plus, port it to Rust. And it's like, we'll be faster, more secure. And, like, it it won't... It'll probably take, like, $6,000,000, and... But you'll you'll you'll get it done. And and then there's there's another argument for... This this also links to pacing the frontier from the the open source... From the model labs Mhmm. Who are like, okay. Let's slow down so that we... Or, like, we'll do Daybreak. We'll do what's... Glasswing. We'll make sure everyone's patched, and then we can let loose on rampant acceleration. So I think, like, there... There's there's there's an inherent belief that the models will fix all security. [01:25:19] S1: Mhmm. [01:25:19] S0: And I think it's just unproven to me because what if they introduce new bugs and they're just different bugs? [01:25:26] S1: That's right. [01:25:26] S0: That's right. [01:25:27] S1: That's right. [01:25:28] S0: So so I mean, well, I'm I'm looking for pushback. I'm looking for like, well, no. You're you're you're an idiot. Like, obviously, your models are way better at this.
01:25:28 · Shawn Wang, Mihail Eric, S2
[01:25:28] S0: So so I mean, well, I'm I'm looking for pushback. I'm looking for like, well, no. You're you're you're an idiot. Like, obviously, your models are way better at this. [01:25:36] S1: Yeah. I I guess, like, that's almost like in the limit. There... There's this... The question is like, is is a model... Do we believe a model will create perfect software? Right? If a model is creating perfect software, then then you're [01:25:47] S0: Is there such a thing? [01:25:48] S1: Then then that's done. Right? Then then we have... Then we're done here at all. Like, then then then we're just gonna go home and and and chill on the beach with the rest of our lives. [01:25:55] S2: I I think there's also the question of, is it good enough to first give it for security? So let people patch then just delay the release and do it after. Or is there a problem of, Oh no, it'll be much better at finding vulnerabilities. You can full send test it for longer, even if you've patched or like how long, right? You can give it for three months, someone can try to exploit it for six months. The problem is not solved. [01:26:19] S0: Right. Yeah. My whole problem with, and again, like this is a whole rant that we don't need to go into, but like, you know, you name a 100 plus organizations that, like, okay. These are, like, priority. They they have access to to cyber model that... You've just created a 100 attack factors for me to go compromise. And, like, they're... By the way, they're pretty easy to compromise. Mhmm. Mhmm. [01:26:40] S1: Mhmm. Yeah. I don't know.