Latent Space: The AI Engineer Podcast
01:23:34 · Mihail Eric
[01:23:34] S1: Yeah. Yeah. Yeah. It's an interesting one. I I wonder how much that that... How much is that? I I buy some aspects of that, but how much of that is impacted by the fact that everything... I I have this belief that most OSS repos, if not all them, will just become software factories that are effectively agent run-in the future. What happens then where, like... I mean, even... Even if you look at Warp, right? Like Warp, which is a Monaco agent, of course, also selling a software factory product, but but they are running their Warp, open source Warp terminal, as a software factory. And that almost suggests that there's a part where, yes, teams are still involved, but increasingly less so. Certainly not every single person is reviewing every single thing that comes into maybe the same exact level that we did in the past. Does that make this code base more or less vulnerable to security? It's bit hard to say. Right? I think that's just where there's a little bit of nuance that I think we're still... And even the folks that I know that I... That work in OSS are just trying to figure out exactly what that stable point is.
01:24:26 · Shawn Wang, Mihail Eric
[01:24:26] S0: Yeah. There... There's a couple of related arguments, and then I'm I'm happy to Yeah. To keep going. So, like, security is, like, it's like a nonstop, like, huge Yeah. Huge, huge surface area thing. There's one argument from Malte of Vercel who's like, okay. Guys, let's take every single, like, high depend... Highly dependent on software that's written in c c plus plus, port it to Rust. And it's like, we'll be faster, more secure. And, like, it it won't... It'll probably take, like, $6,000,000, and... But you'll you'll you'll get it done. And and then there's there's another argument for... This this also links to pacing the frontier from the the open source... From the model labs Mhmm. Who are like, okay. Let's slow down so that we... Or, like, we'll do Daybreak. We'll do what's... Glasswing. We'll make sure everyone's patched, and then we can let loose on rampant acceleration. So I think, like, there... There's there's there's an inherent belief that the models will fix all security. [01:25:19] S1: Mhmm. [01:25:19] S0: And I think it's just unproven to me because what if they introduce new bugs and they're just different bugs? [01:25:26] S1: That's right. [01:25:26] S0: That's right. [01:25:27] S1: That's right. [01:25:28] S0: So so I mean, well, I'm I'm looking for pushback. I'm looking for like, well, no. You're you're you're an idiot. Like, obviously, your models are way better at this.
01:25:28 · Shawn Wang, Mihail Eric, S2
[01:25:28] S0: So so I mean, well, I'm I'm looking for pushback. I'm looking for like, well, no. You're you're you're an idiot. Like, obviously, your models are way better at this. [01:25:36] S1: Yeah. I I guess, like, that's almost like in the limit. There... There's this... The question is like, is is a model... Do we believe a model will create perfect software? Right? If a model is creating perfect software, then then you're [01:25:47] S0: Is there such a thing? [01:25:48] S1: Then then that's done. Right? Then then we have... Then we're done here at all. Like, then then then we're just gonna go home and and and chill on the beach with the rest of our lives. [01:25:55] S2: I I think there's also the question of, is it good enough to first give it for security? So let people patch then just delay the release and do it after. Or is there a problem of, Oh no, it'll be much better at finding vulnerabilities. You can full send test it for longer, even if you've patched or like how long, right? You can give it for three months, someone can try to exploit it for six months. The problem is not solved. [01:26:19] S0: Right. Yeah. My whole problem with, and again, like this is a whole rant that we don't need to go into, but like, you know, you name a 100 plus organizations that, like, okay. These are, like, priority. They they have access to to cyber model that... You've just created a 100 attack factors for me to go compromise. And, like, they're... By the way, they're pretty easy to compromise. Mhmm. Mhmm. [01:26:40] S1: Mhmm. Yeah. I don't know.
01:26:40 · Mihail Eric, Shawn Wang, S2
[01:26:40] S1: Mhmm. Yeah. I don't know. [01:26:42] S0: Anyway, above our pay grade. [01:26:46] S2: It's always fun to get juicy in, you know, security. Like [01:26:50] S0: I mean, security is right now very juicy. Right? Like... And and, like, I think actually the security folks love it because they're... Like, they usually don't get that much attention, and now they have, like, a ton of attention. [01:26:58] S1: Is that true? Like, I I mean, that they don't get attention. I find that I find that, at least from, like, a VC perspective, people love... VCs love investing in security companies and have, like, pretty good... Like, whiz or something. Like, it's done very, very well. [01:27:09] S0: Like, what what Wiz is... Wiz... Let's argue... Wiz and Socket, I I literally had this conversation with VC two days ago. Yeah. Apparently, Wiz and socket were the only security companies in the last five years that have worked. What about, like, abnormal? I don't know. It worked for a VC point of view of [01:27:24] S1: I see. Like, from, like, an economic economics perspective. Yeah. Yeah. Interesting. Yeah. [01:27:28] S0: Not not not not for me to say. [01:27:30] S1: Right.
01:27:30 · Mihail Eric, Shawn Wang, S2
[01:27:30] S1: Right. [01:27:30] S0: Obviously, many, like, great players in in in that field, but it's it's a tough tough industry, I think. And so, like, the the best time... But I think it's not controversial. Best time for any security company is when a high profile incident just happened. Yeah. Yeah. Right? Obviously. Right? Like, then, obviously, you're gonna sell a bunch of security. Totally. Yeah. So so I I think I think that's a fair thing. Like, people you... People should be aware. People should know the the basic mitigation... Mitigations. I do think, like, code scanning is important, but, like, I I just wanna give people the the idea that, like, oh, no. Models introduce bugs that you wouldn't make as a human. And, like, if you're you're not checking those bugs [01:28:08] S2: It's it's not even that they make bugs, it's that you have less awareness of what's being written. Right? Like when [01:28:14] S0: Yeah. Because you know you review everything. [01:28:16] S2: Yeah. Forget bugs. Models are pretty good. They'll have on average, I would say less bugs. The problem is also that you don't even know what you're putting out. Like Yeah. There's a lot of that. [01:28:29] S1: Yeah. And that's it. Think we're do top of mitigations and and like the... And there's sort of a combination of security and and c herdy as part of code review as well. Right? I mean, think this is like, doing those checks, I think, is important. Yeah.
01:28:29 · Mihail Eric, Shawn Wang, S2
[01:28:29] S1: Yeah. And that's it. Think we're do top of mitigations and and like the... And there's sort of a combination of security and and c herdy as part of code review as well. Right? I mean, think this is like, doing those checks, I think, is important. Yeah. [01:28:38] S0: So so I think maybe I would say one more thing here or or just check your... Check-in... Check my intuition on on this thing Yeah. Is that not all parts of the code base are created equal. The parts of the code base where security is very important is data storage [01:28:54] S1: Mhmm. Yep. [01:28:55] S0: And billing. So let's call it that data billing [01:28:59] S1: auth, [01:29:00] S0: and auth is obviously related to all those things. And those are basically don't Vibe code, and then everything else go go nuts. [01:29:08] S1: Yeah. Right? I think that's absolutely right. [01:29:09] S0: That's absolutely right. And and it's really funny how, like, okay. Well, if you don't know what the difference between auth n and auth z is, please learn it. [01:29:17] S2: Mhmm. [01:29:17] S0: And then, you know, if you if you don't know... If you have never looked at AWS IAM which you have, please learn it. Like, this... Like, these are basic, like, conceptual things to understand that you can prompt for. You know, once you have the language, you can prompt for it. If you don't have the language, you're fucked.