Latent Space: The AI Engineer Podcast
01:22:14 · Mihail Eric, Shawn Wang
[01:22:14] S1: That's correct. [01:22:15] S0: You you look at the the dependency. You're like, cool depend... Cool implementation, bro, but I'm just gonna [01:22:20] S1: make my own. That's absolutely right. That's absolutely right. And and that's an interesting insight because it's sort of to the limit. And, you know, I think it's it's probably easier said than done. But if you believe that with code now being commoditized, code being easy and cheap, why not just build everything in house? Right? Like that... Like, of course, that's... And that would be the safest thing, because you've seen everything. You control everything instead of, you know, depending on Axios or whatever. But, you know, we'll see how many people actually act on that. That is the safest thing. I agree with you.
01:22:20 · Mihail Eric, Shawn Wang
[01:22:20] S1: make my own. That's absolutely right. That's absolutely right. And and that's an interesting insight because it's sort of to the limit. And, you know, I think it's it's probably easier said than done. But if you believe that with code now being commoditized, code being easy and cheap, why not just build everything in house? Right? Like that... Like, of course, that's... And that would be the safest thing, because you've seen everything. You control everything instead of, you know, depending on Axios or whatever. But, you know, we'll see how many people actually act on that. That is the safest thing. I agree with you. [01:22:46] S0: No. I... So that statement is dangerous because then you would just make your mistakes instead of making... On other people to discover mistakes. The whole point of open source is that, you know... What what is it? Like, sunlight is the best disinfectant. It's like Linus Torvalds' thing. It's it's like, well, yeah, you will be very slow to discover your own custom software dependencies because you only have your users, and they won't report it to you. But if this this thing has a 100,000 users worldwide, someone will find something. Then you can depend on it more. Right? Yeah. This is it Yeah. This is the... There's no... Basically, I I don't want to be... I'm trying to be a voice of, like Yeah. Reason. Right. Right. And you cannot be absolutist in both. And you you... I I kinda trapped you there. I talked I talked to you into the talk track of Yeah. Vendor everything. Right. Right. And there is a bug there.
01:23:34 · Mihail Eric
[01:23:34] S1: Yeah. Yeah. Yeah. It's an interesting one. I I wonder how much that that... How much is that? I I buy some aspects of that, but how much of that is impacted by the fact that everything... I I have this belief that most OSS repos, if not all them, will just become software factories that are effectively agent run-in the future. What happens then where, like... I mean, even... Even if you look at Warp, right? Like Warp, which is a Monaco agent, of course, also selling a software factory product, but but they are running their Warp, open source Warp terminal, as a software factory. And that almost suggests that there's a part where, yes, teams are still involved, but increasingly less so. Certainly not every single person is reviewing every single thing that comes into maybe the same exact level that we did in the past. Does that make this code base more or less vulnerable to security? It's bit hard to say. Right? I think that's just where there's a little bit of nuance that I think we're still... And even the folks that I know that I... That work in OSS are just trying to figure out exactly what that stable point is.
01:24:26 · Shawn Wang, Mihail Eric
[01:24:26] S0: Yeah. There... There's a couple of related arguments, and then I'm I'm happy to Yeah. To keep going. So, like, security is, like, it's like a nonstop, like, huge Yeah. Huge, huge surface area thing. There's one argument from Malte of Vercel who's like, okay. Guys, let's take every single, like, high depend... Highly dependent on software that's written in c c plus plus, port it to Rust. And it's like, we'll be faster, more secure. And, like, it it won't... It'll probably take, like, $6,000,000, and... But you'll you'll you'll get it done. And and then there's there's another argument for... This this also links to pacing the frontier from the the open source... From the model labs Mhmm. Who are like, okay. Let's slow down so that we... Or, like, we'll do Daybreak. We'll do what's... Glasswing. We'll make sure everyone's patched, and then we can let loose on rampant acceleration. So I think, like, there... There's there's there's an inherent belief that the models will fix all security. [01:25:19] S1: Mhmm. [01:25:19] S0: And I think it's just unproven to me because what if they introduce new bugs and they're just different bugs? [01:25:26] S1: That's right. [01:25:26] S0: That's right. [01:25:27] S1: That's right. [01:25:28] S0: So so I mean, well, I'm I'm looking for pushback. I'm looking for like, well, no. You're you're you're an idiot. Like, obviously, your models are way better at this.
01:25:28 · Shawn Wang, Mihail Eric, S2
[01:25:28] S0: So so I mean, well, I'm I'm looking for pushback. I'm looking for like, well, no. You're you're you're an idiot. Like, obviously, your models are way better at this. [01:25:36] S1: Yeah. I I guess, like, that's almost like in the limit. There... There's this... The question is like, is is a model... Do we believe a model will create perfect software? Right? If a model is creating perfect software, then then you're [01:25:47] S0: Is there such a thing? [01:25:48] S1: Then then that's done. Right? Then then we have... Then we're done here at all. Like, then then then we're just gonna go home and and and chill on the beach with the rest of our lives. [01:25:55] S2: I I think there's also the question of, is it good enough to first give it for security? So let people patch then just delay the release and do it after. Or is there a problem of, Oh no, it'll be much better at finding vulnerabilities. You can full send test it for longer, even if you've patched or like how long, right? You can give it for three months, someone can try to exploit it for six months. The problem is not solved. [01:26:19] S0: Right. Yeah. My whole problem with, and again, like this is a whole rant that we don't need to go into, but like, you know, you name a 100 plus organizations that, like, okay. These are, like, priority. They they have access to to cyber model that... You've just created a 100 attack factors for me to go compromise. And, like, they're... By the way, they're pretty easy to compromise. Mhmm. Mhmm. [01:26:40] S1: Mhmm. Yeah. I don't know.
01:26:40 · Mihail Eric, Shawn Wang, S2
[01:26:40] S1: Mhmm. Yeah. I don't know. [01:26:42] S0: Anyway, above our pay grade. [01:26:46] S2: It's always fun to get juicy in, you know, security. Like [01:26:50] S0: I mean, security is right now very juicy. Right? Like... And and, like, I think actually the security folks love it because they're... Like, they usually don't get that much attention, and now they have, like, a ton of attention. [01:26:58] S1: Is that true? Like, I I mean, that they don't get attention. I find that I find that, at least from, like, a VC perspective, people love... VCs love investing in security companies and have, like, pretty good... Like, whiz or something. Like, it's done very, very well. [01:27:09] S0: Like, what what Wiz is... Wiz... Let's argue... Wiz and Socket, I I literally had this conversation with VC two days ago. Yeah. Apparently, Wiz and socket were the only security companies in the last five years that have worked. What about, like, abnormal? I don't know. It worked for a VC point of view of [01:27:24] S1: I see. Like, from, like, an economic economics perspective. Yeah. Yeah. Interesting. Yeah. [01:27:28] S0: Not not not not for me to say. [01:27:30] S1: Right.