#473: A clean room rewrite?

00:00 Hello and welcome to Python Bytes, where we deliver Python news and headlines directly to your earbuds.

00:05 This is episode 473, recorded March 16th, 2026.

00:11 And I am Brian Okken.

00:12 And I'm Michael Kennedy.

00:13 And as often lately, this episode is sponsored by you and us.

00:20 For everybody that supports the show through Patreon or through, mostly through a lot of our offerings,

00:25 like the courses at Talk Python Training and PythonTest.com, and books.

00:31 We've got lovely books coming along.

00:34 I might bring up a book later in the show, but we'll talk about it.

00:37 Anyway, thanks a lot for everybody supporting us.

00:40 It keeps us going.

00:42 And also thank you to everybody that sends in topic ideas, either by going to pythonbys.fm

00:48 and submitting something through the contact form, or we're going ahead and sending it to us on socials.

00:54 So we're at BlueSky and at Mastodon and all those links are in the show notes

01:01 or at pythonbytes.fm.

01:03 You also can watch the show if you'd like, either real time or after the fact.

01:08 You can join us at pythonbytes.fm/live and be part of the audience.

01:12 And one of the fun things about that is while we're recording this, you can add comments and we might comment back

01:18 or highlight your comment.

01:20 That's fun.

01:20 anyway the last thing I want to bring up is that you don't have to take any notes while we're

01:26 talking because it's all the stuff is it's on the show notes to links but if you'd like that

01:32 delivered right to your inbox plus a little background information some extra stuff especially

01:37 helpful for for if we're covering a topic that you're slightly you think you know about but maybe

01:42 not we'll send you some extra information and you just sign up to be a friend of the show at

01:47 pythonbys.fm and say, join the newsletter. With that, what do we have to start with?

01:53 Well, I've got a doozy. Oh, as they say, a doozy. And this one comes to us from

01:58 Ian Lessing. So thank you for sending it in to your point about sending us ideas about the show.

02:03 This one somehow missed my radar, but shouldn't have. So yeah, it's a big one. So this,

02:10 you probably have seen char debt as in character debt. Maybe it's care debt. I don't know. I'm

02:17 It's always funny to think about abbreviations like lib or lib.

02:21 You know, it's if you pronounce it lib, I think it goes lib.

02:25 But if it's an abbreviation of library, shouldn't it be lib?

02:28 I don't know.

02:28 So anyway.

02:29 No, because that's weird.

02:30 I know it is weird.

02:32 So Caradet is a library that I believe was originally done, originally created by Mark Pilgrim, but now is maintained by Dan Blanchard.

02:43 So I think this alone makes it interesting because there's something happening with this project.

02:49 And a lot of people are pushing back, saying the maintainer can't make a change to it.

02:53 But they're the maintainer.

02:54 Like, I don't want you to, but you can't.

02:56 So here's the headline.

02:59 The care debt dispute shows how AI will kill software licensing, argues Bruce Perens.

03:05 And the subtitle, this comes from the register, alarm bells are ringing in the open source community,

03:10 but commercial licensing is also at risk.

03:12 so told me it's a doozy what is going on so earlier this week dan blanchard and i want to

03:17 point out the maintainer of the library released a new version of library under a new software

03:22 license it was lgpl and he released it under mit in doing so he may have killed copy left because

03:29 well mit is a do whatever you want just don't sue me about it you know what i mean license which

03:34 almost all the stuff that i do is mit as well i just want people to just i'd rather have people

03:38 just have access to do whatever.

03:39 Like, I don't want people to just, hey, could I get an exception to use this for this thing like that?

03:44 Like, nothing I'm doing is that important, you know?

03:47 Yeah, and I think of the MIT stuff as, like, a good license if you don't care if people use it in their commercial product.

03:54 Yes.

03:54 Yeah, so.

03:55 And look, if it's OK, I was not familiar with what this is.

03:59 I still don't quite get.

04:01 What does Caridit do?

04:02 So it is a character detection library that's used by millions of projects.

04:09 Let me see.

04:09 It has 130 million downloads a month.

04:12 So it's used by a lot of things.

04:16 Okay.

04:17 Character encoding detector.

04:18 Yes.

04:18 Yeah, exactly.

04:19 Like UTF, I think.

04:21 Is this UTF or Unicode?

04:23 Or is it how do I?

04:24 I have bytes.

04:25 What am I going to do?

04:26 So it takes a guess.

04:28 You're getting bytes and you're not really sure.

04:30 It wasn't declared or whatever.

04:32 So previously, this was an LGPL project.

04:36 Dan Blanchard wanted two things from what I can read between the lines, putting words into their mouth.

04:41 One, wanted to dramatically improve this library to make it better.

04:46 Check.

04:47 You'll see he did that.

04:48 Two, wanted to set the stage such that this can just be part of Python.

04:54 Could this just be part of the standard library?

04:56 So previously, there's this move to say we should have less in Python, and I agree, but detecting whether or not something is Unicode or ASCII or whatever,

05:06 maybe that does belong in the library. Anyway, that was the goal. Could we put it in there? Well,

05:10 LGPL says no. It would change the license of Python, I believe, right? So as long as it's a

05:16 GPL-based license, you can't move this library into the standard library. I don't know if the

05:22 core developers or even if Dan is a core developer was interested in this, but that was one of the

05:27 goals, right? So no problem. We're going to change it. Well, an individual claiming to be Mark Pilgrim

05:33 because verify people on the internet for sure, the original created the library. So it's a little

05:38 bit like Flask where Armin Roeneker created it. And then now David Lord maintains it. And David

05:43 Lord gets to do whatever he wants with it. It's his project now as the maintainer, but I'm sure

05:47 Armin still has influence over the community's opinion if he were to take a strong position one

05:53 way or the other right neither of them chimed into this as far as i know i don't think maybe

05:57 armin did i can't remember there's a lot there's a lot of chat about it kind of like giving somebody

06:02 a puppy and then telling them that what they have to where they have to take it what vet they have

06:07 to take it to yes exactly yeah exactly i'm i'm leaning on the side of of dan blanchard here just

06:13 just setting the state i have a slight there's a lot of complexity in this i'm i'm not like totally

06:18 just say this is how it is, but let's keep setting the stage. So Mark says, you can't do that. You

06:24 can't change an LPGL. I believe that's the typo LGPL license requirement. It requires that the

06:30 license remain unchanged. License code when modified must be released under the same GPL license.

06:37 But I get that when somebody gets it from the source, they make a change. It must be released

06:43 under the same license as the owner of the project i thought you could change the license on nuka i

06:49 don't know it's your software effectively if you want to change the license of it i don't know

06:55 this is a little bit of shaky ground here that to say that you can't change the license

06:59 as the owner of the license you know what i mean anyone else in the world should not they have to

07:05 follow what i just read but that as the owner license is that true well so what here's what

07:09 Dan said, here's what I'm going to create a new, better version.

07:13 I'm going to rewrite this entire project from scratch, not using any of its source code and

07:18 re-release it into the same package channel as the old one.

07:22 Okay.

07:23 Now, one of the problems under that is as the maintainer, he's deeply familiar with how it

07:28 works.

07:28 And one of the challenges is if you know how it works, your idea is like hard to do a fresh

07:34 from scratch rewrite.

07:35 If it's burned into your mind, how it works, you know what I mean?

07:39 So what he did is he just gave the specification to Claude and said, Claude,

07:44 write this so that the test pass and Claude wrote it and it wrote it extremely differently.

07:50 There's a, a plagiarism detection algorithm that was more probably more for

07:55 English, but whatever it said is only 1% similar to version six version seven

08:01 is only 1% similar to version six.

08:03 So that means it's pretty different.

08:05 Dan also said it's like structurally the files are not named the same.

08:08 They're not organized the same.

08:10 It is basically not at all the same thing.

08:12 Nothing.

08:13 The only thing that's that 1% is like arg pars structure and stuff because you have the same

08:18 arguments, you know?

08:19 And so they believe this is, there's nothing here.

08:22 This is a new project.

08:24 This is what gets the MIT license.

08:26 Now, to be clear, this is a mega improvement.

08:29 It results in a 48 times improvement in detection speed.

08:34 It now supports multi-threading for Python T.

08:38 So you can do free-threaded Python and it supports that.

08:40 There's a lot of benefits to this new version.

08:43 So I don't think anyone is saying you've messed up the library.

08:47 It's like clearly a better library.

08:50 It's only this, we hate AI or AI is theft or like there's a lot of these different angles

08:55 that are like focusing in like a laser onto this change.

08:58 You know what I mean?

08:59 Yeah.

09:00 So Dan says, I was just trying to accomplish these goals with the tools and times I had available.

09:05 I never have been paid to work on this and I have a full-time job, you know?

09:09 Software licensing and the laws around it haven't been tested a lot in this new world

09:13 of AI-assisted development and a long-time open source developer.

09:15 I'm also curious how this is going to shake out.

09:18 Yeah, but somewhere it says, yeah, after maintaining this library for years,

09:23 I've wanted to make these improvements, but I couldn't.

09:26 Quad gave me the ability to do this in roughly five days, right?

09:29 So I think this is also really interesting.

09:32 Why change the license?

09:33 Because he wants to put it into Python.

09:35 Oh, okay.

09:36 Yeah.

09:37 Or maybe he just wants people to be able to more freely use it, and he just doesn't care about copyleft.

09:41 I don't really know.

09:42 But I believe, for the article makes it imply, like, he wants to put it into Python and LGPL to make that not possible.

09:48 And Arnaker actually did, or Armin actually, Arnaker actually did a post about this,

09:53 saying that he welcomed the license change, and he's wanted it for years.

09:56 Kind of what I would expect that he wanted to say as well.

09:59 Now, there's a issue that has been created, that version seven presents unacceptable legal risk to users due to the copyright controversy.

10:09 There's so much.

10:11 There is so much going on here.

10:13 I don't know, because to me, the license only goes from less restrictive to more permissive,

10:18 or more restrictive to more permissive.

10:20 And if it turns out that it's the old version, you know, you're back to where you started.

10:25 So I don't know.

10:25 I'm telling you, there's a lot of, this may be the bigger issue, There's issue 327 fired by Mark Pilgrim.

10:33 Hi, I'm Mark Pilgrim.

10:34 The title is No Right to Relicense This Project.

10:37 And it's absolutely toxic is the word.

10:40 So I don't know.

10:41 It's very interesting here.

10:43 I mean, version six is still there.

10:45 People can just keep using that or fork it if they want, if they still want the old license.

10:50 I think what's happening is this is becoming a lightning rod for the debate of licensing intersecting with agentic AI.

10:57 I mean, how many people actually care that much about character detection?

11:01 You know what I mean?

11:01 I mean, it's apparently a lot of people.

11:03 I know a lot of it's extreme.

11:05 This is like there are just pages of stuff to go through on all of this, like pages.

11:10 It's crazy.

11:12 So, OK, I understand the sensitivity of it.

11:15 I forgot my popcorn.

11:17 I know.

11:17 I know.

11:18 And I get it that AI ingesting the world's work and then turning that into automation.

11:25 I'm not even sure where that sits.

11:27 legally. At the time, it felt like a lot of theft. I'm not sure if it's a good trade-off or not.

11:33 I don't get how that relates to this project, though.

11:36 Okay, so let me add in one more detail. Like I said, there's a lot going on here. We'll wrap

11:40 this up pretty soon, but it's a super interesting discussion. I think, so one of the reasons that

11:45 said, she said, well, I did it with Claude Code. They said, well, it doesn't matter. Claude Code

11:48 trained on GitHub. Therefore, it trained on the original source code of Kradet. Therefore,

11:52 it's not a clean room re-implementation.

11:55 So I ask.

11:55 I don't know if that matters because I can lead one company, go work at another company.

12:00 As long as I don't take the source code, if I just take what I remember and do similar work,

12:05 I'm allowed to do that.

12:06 Yes, you're a human being that gets to interact in the world.

12:10 Yeah, exactly.

12:10 It's not like, well, I saw a picture once and it was of a tree and it was copyrighted.

12:15 So I can never, ever create a picture of a tree again because I looked at it, right?

12:18 Yeah, that's why I said I'm on the side of, I'm, I'm, I'm done. I feel like I'm on Dan's side here. So I, let me look. So I pull, I wrote a

12:25 little, I didn't write. I asked Claude for some research on like, well, what is the legal precedence

12:30 of this? Here's the situation, at least in the U S are there rules, rulings that have come down

12:36 previously. So I put a little document up for people to look at, but it says the closest

12:42 precedence is this Thomas Reuters versus Ross intelligence where somebody can remember who they

12:47 They took a bunch of Westlaw head notes for legal advice and then did their own custom AI training on it and built an exact tool for legal research.

12:58 That turned out to be a violation.

13:00 But the exists here.

13:01 This is this is interesting.

13:02 The existing copyright framework requires two things to prove infringement.

13:06 Access to the original work.

13:07 Check.

13:08 Claude did have access to the original work.

13:10 And substantial similarity in output.

13:13 No.

13:13 Not even close.

13:14 Not even not even one percent.

13:16 I know it said 1.3%, but that was like structure of ARGPARs.

13:20 You know what I mean?

13:21 That's ARGPARs structure.

13:23 That's not CharDette structure, effectively.

13:25 So I think this strongly fails.

13:28 Those are the two criteria that you have to have to prove similarity.

13:33 But there's other stuff.

13:35 The emerging judicial consensus is developing that training a general purpose AM model is highly transformative, therefore is free use.

13:46 But there were some specific examples where it wasn't.

13:48 The U.S. Copyright Office's position is that using copyright materials for AI model development may constitute prima facie infringement.

13:57 And what's really crazy, Brian, is if things like that said, no, this is copyright infringement, like, what happens to everything created by AI?

14:05 Period.

14:06 You know what I mean?

14:07 And I don't know how that's going to shake out.

14:08 Well, not forever.

14:09 I mean, let's take, like, the extreme case.

14:11 And you go, well, you know what?

14:13 All the current models have been trained on licensed stuff.

14:17 So let's just not start over.

14:20 It's going to cost a ton of money to retrain a model.

14:22 But do it right.

14:25 Only train on the stuff that's available license-wise.

14:29 Right.

14:29 You could just look and say, is it a GPL license?

14:31 We're not trading on that.

14:32 Is it an MIT license?

14:34 It's on.

14:34 You know what I mean?

14:35 There's probably plenty of information still out there to build out your models.

14:39 Anyway, it's pretty wild.

14:41 I think people can have a look.

14:43 I would certainly say the folks who took the time to comment are very much against this.

14:48 There is a lot of toxicity and Dan's support going out to you just mentally because I've

14:54 been on the receiving end of these types of things and they're not fun.

14:57 But I think Dan has a point here.

15:02 However, this could all be solved if he just said, okay, version seven is char.2, new project

15:07 and just put like a strong warning like we will we will never change char dot one ever again except

15:13 for security patches and then all the things that depend upon it go fine we'll just take this one

15:17 like i want 48 times faster and multi-threaded sounds better to me let's just do that yeah but

15:22 and if like we push it too hard though one option is he just stops maintaining it and doesn't

15:27 transfer maintainership to anybody else um yeah and we don't want that either so yeah yeah i certainly

15:33 I think this debate has far outgrown character encoding concerns.

15:39 It's its own special lightning rod, like I said.

15:41 Yeah.

15:42 All right.

15:43 How are you?

15:44 Can we talk about, I got just a small tool that I, this is a small tool suggested by Matthias.

15:53 Well, it's not a small tool, but it's quick to cover.

15:57 Refined GitHub.

15:59 And this is awesome.

16:01 I didn't know about this.

16:02 So this is a web browser plugin.

16:08 Browser extension.

16:09 Browser extension.

16:11 Thank you.

16:12 That does some cool stuff if you work with GitHub a lot.

16:15 And looking through this, I'm like, what's wrong with GitHub right now?

16:21 Well, there's a bunch of stuff.

16:23 The highlights, there's some highlights at the top.

16:25 Makes white space characters visible.

16:27 That's cool.

16:28 I mean, that's not cool enough to get this, but there's a lot more coming.

16:34 Tells you whether you're looking at the latest version of the repository,

16:37 if there's any unreleased commits.

16:40 That's kind of neat.

16:41 The shows how far behind PR head branches, tells you it's base commit.

16:47 There's a bunch of stuff here.

16:48 I'm going to highlight down to some of the stuff that one of the nice things,

16:53 there's lots of features, but they put fire beside things that you might care about.

16:57 Like adds a build CI status icon next to the repo name.

17:01 Love that.

17:02 Adds a link back to the PR that ran the workflow.

17:05 That's cool.

17:08 This one, I installed it just for this one feature.

17:12 Enables tab and shift tab for indentation in comment fields.

17:17 Because, you know, if you're in a web browser, you hit tab, it goes to the next field.

17:21 I just want to put a tab in the field.

17:25 Anyway.

17:26 For Python people, it might not matter that much, but if you're doing C++ or something,

17:30 you don't want to mix spaces and tables.

17:32 I just expect it to add four spaces.

17:36 But anyway, let's see.

17:39 Auto resize the commit field.

17:42 Add reaction avatars showing who reacted to a comment.

17:46 That's interesting.

17:47 The other one that I want to highlight just to, because I think it's cool,

17:52 is highlights the most useful comment in an issue.

17:56 So if there's a lot of people talking about a comment or whatever, it'll highlight that.

18:01 So just scroll around.

18:03 And actually, I haven't really noticed.

18:05 I've turned this on, and it just sort of stays out of the way.

18:09 There's just more features and more.

18:11 It's just a nicer experience.

18:13 So yeah, kudos to them.

18:15 This is an absolutely mega.

18:17 So what's notable about this is you wouldn't look at your UI and know anything is different.

18:22 But there's like 100 little changes, right?

18:24 Yeah.

18:25 So yeah.

18:25 Anyway, I'm always nervous to install browser extensions.

18:29 I have maybe five or six that I really love from places I trust.

18:32 But go to the top, see how many stars this has.

18:35 30,000.

18:36 Yeah, at that level, I think it's all right.

18:39 It's probably totally trustworthy, right?

18:41 So let's-- yeah, I think it's good.

18:44 I think it's good.

18:44 I would probably install it.

18:47 I'll look and see if it'll inspire me.

18:49 Yeah, I don't know.

18:51 I'll play with it for a while, see if my entire computer blows up.

18:55 But yeah, if your computer gets-

18:58 It's all something around for a while, it looks like nine years or so.

19:02 Wow. Really? No kidding.

19:03 Well, at least in the front top, there's the editor config is nine years ago.

19:10 So at least there's some commits from nine years ago.

19:12 Yeah, exactly. I would imagine it is.

19:14 That's very, very wild. Awesome.

19:16 Okay. Let's move on to talk about databases and in particular Postgres.

19:22 So this project I want to talk about, I want to feature everyone across,

19:24 and I think it's been around for a little while, but it's called PG dog.

19:28 Okay.

19:28 And what it is, is it's a performance enhancing layer for Postgres.

19:32 So if you're using, you know, maybe you're using my SQL, not my SQL, using SQL light in dev, but then in production, you're using Postgres,

19:41 right?

19:41 Something like that.

19:42 And, and it's starting to outgrow its performance.

19:45 Okay.

19:45 So either it needs better uptime, the database is getting too large or something like that.

19:51 Postgres doesn't have certain features like, connection pooling and other

19:54 that could be better high performance, right?

19:57 So you don't have to reconnect as much.

19:59 This thing handles a whole bunch of those.

20:01 So we go down here to their repo.

20:04 It, by the way, has 4,000 stars and its age is a year, two years.

20:09 It looks like last year is all, it's probably its most recent things.

20:13 So there's been other projects like this as well.

20:15 For example, PG Bouncer is a friend, a colleague, it's a software, I guess, another thing that does the same thing.

20:23 So what this is, is it's a proxy for scaling Postgres.

20:26 And it does connection pooling, load balancing for queries, and it does sharding of databases, which sounds bad,

20:32 but is actually a potentially good thing.

20:34 So you just create a toml file to set it up, and then off it goes.

20:37 I got a bunch of notes here for all these little things that kind of spread around.

20:40 So for starters, it's a load balancer across Postgres.

20:45 So you can run Postgres in a replica network configuration.

20:50 So I can have a Postgres database, but then I let's say four other Postgres databases that are all copies of that same data and they stay in sync.

20:59 And from a read perspective, you could read from all five of them if they all have the same data,

21:03 and that basically 5Xs your database query performance, just by simply sending them to

21:10 different machines with exactly the same data, the same database. But the problem is the consistency,

21:16 so it knows which one is the primary database and it can do writing to that and make sure that it

21:21 propagates to the others before it tells you that it's committed, which is kind of the magic of

21:26 replicas. Because if you write to it and then immediately do another read, but it happens to

21:30 have gone to, this time it's round robin to a different database server, that's bad because it

21:36 might not be there, right? Like I saved the database, I queried and it wasn't there and I

21:39 went to test why it wasn't there. Then it was there. I don't get it. What is going on with the

21:43 world, right? So you want it to definitely manage that kind of stuff. It also does health checks.

21:47 And you've got this read primary replica configuration that I'm talking about.

21:54 If one of them goes down, it will just take it out of its rotation.

21:58 And if it's the primary one, it'll pick another primary, I believe.

22:01 So it has a single endpoint behavior, which I talked about.

22:04 So it understands the Postgres structure, like basically T-SQL.

22:10 And so it knows if it sees an update or insert or create table and things like that and sends that to the primary

22:16 and then leaves the other ones chilling to do their thing.

22:19 Has the failover I talked about, and it has sharding, which is really cool.

22:22 And it does a bunch of stuff to manage and keep that in sync.

22:25 You can even have different sets, different clusters of database and say, keep this one in sync with that one.

22:31 So for example, imagine you've got an e-commerce site and it's starting to go too slow.

22:37 People do a request for, I don't know, let me give you an example that probably resonates more with people.

22:43 a health provider database.

22:45 I don't know about yours, but whenever I go to figure out something with my next doctor appointment or something,

22:50 it's like the page slowly loads in and then it spins, it says checking records,

22:54 checking records, checking records, and like five seconds later, chunk will come in and more of it.

22:58 And like, what is going on with this?

23:00 Why is this so slow, you know?

23:02 And there's probably just some huge database with a bunch of insane joins

23:07 and weird queries and stuff just to tell me that my appointment is at 10 o'clock.

23:11 So what you could do is you could say, okay, your health record ID is going to be the shard key,

23:16 and we're going to have 20 different servers, right, running our cloud setup.

23:20 And for that, we're going to somehow determine which database it goes.

23:25 So maybe we're going to say, take the hash of the health ID and use the first two letters to figure out

23:32 which database it actually goes in.

23:34 So like AA through B, whatever, right, goes to the first database server,

23:40 and the second, the third, the fourth, and so on.

23:42 So when you do a query, you say, I want the thing for this user.

23:45 It just goes, OK, great.

23:46 Well, that means I only query that one server.

23:49 Instead of trying to query the 100 million records, you query, what did I say, 25s?

23:54 You query 4 million, which is way, way faster, right, on any given server.

23:58 So that's a really cool aspect.

24:00 And one of its main features is the sharding capability.

24:03 OK.

24:04 So pretty neat.

24:05 Pretty neat.

24:05 Well, but if you're really trying to find out, like, health information, it might, the hash might be the problem.

24:11 Stop doing hash, man.

24:13 I don't know why these systems are so bad.

24:16 They're so bad.

24:17 Bad joke.

24:17 Sorry.

24:18 Yes.

24:18 Yeah, that's true.

24:21 I get it now.

24:22 I get it.

24:23 Awesome.

24:24 Over to you.

24:25 Okay.

24:25 Well, this is partly a public service announcement, maybe.

24:34 I want to cover Simon Willis.

24:36 And so we know Simon Willison's been playing with AI and agents and stuff since like since they came out or something.

24:43 And I appreciate all of Simon's work.

24:46 And and I've been watching here and there and just like learning from him and not having to do all the experimentation that he's doing.

24:55 But he's really great at explaining it.

24:57 So what I want to he's got this sort of book like thing together that we're going to link to called agentic engineering patterns.

25:06 and this is a series of blog posts but they're fairly concise and short and it's really good

25:12 writing as well um there uh and i think anybody especially well it might be useful for really

25:20 everybody but especially people with teams um it'd be good to make sure that everybody's kind of on

25:25 like good i i think there's the information here is right good for everybody so there's principles

25:31 getting started like some intro on how agents work and testing and QA.

25:38 There's three posts about that, which I love.

25:40 Understanding code, using it to walk through, using agents to walk through code and stuff.

25:46 Even these are, didn't notice these when I was looking at this the other day,

25:50 an appendix of prompts I use.

25:52 That might be interesting, but also GIF animation tool using WebAssembly and GIFsicle,

25:58 annotated prompts.

26:00 That might be fun, but maybe not appropriate for everybody.

26:04 But the one that I love right here is anti-patterns.

26:10 So in principles, there's some anti-patterns.

26:12 Well, everything.

26:14 Everything in the principles, definitely go read.

26:17 The writing code is cheap now.

26:19 What is agentic engineering?

26:21 Word things you know, basically.

26:23 Not basic, but keeping track of, for instance, making tools and doing snippets,

26:30 doing little tools, having those available, not only for you to remember, but you can also tell

26:35 an agent to say, hey, I already kind of solved this over here in this project. So use that,

26:40 but apply it to this other project here. Super cool idea. And also, these two, AI should help us

26:48 produce better code. So if you're having AI produce your code, I think it should be better

26:53 code than you would produce by yourself. Not worse. I don't like this notion of people not

27:02 reading their code at all. And I think that's going to blow up on us. And especially if you're

27:08 working in teams, a bunch of anti-patterns to watch out for. And the top one is about inflicting

27:14 unreviewed code on your collaborators. This anti-pattern is common and deeply frustrating,

27:19 both in open source and I'm dealing with it at work myself.

27:22 Don't file pull requests with code you haven't reviewed yourself.

27:26 I'm tired of reviewing reams and reams and reams of code that I know that nobody actually read that.

27:33 And so why did they expect me to read it?

27:36 So anyway, great resource here.

27:38 I love the cheat sheet on red-green refactor is pretty great also.

27:44 And I probably should highlight that since testing is kind of my thing, right?

27:49 And this is the, he has tested it and the phrase use red slash green.

27:54 So use red green TDD is a pleasingly succinct way to get better results out of your coding

28:00 agent.

28:00 So you can tell your coding agent to do this and it will know to write a test first and

28:07 test, you know, make changes until it's green.

28:10 What's interesting is normally we think of TDD as red green refactor.

28:13 The refactor part, that's when you need to get involved.

28:16 So you can have the agent do the red green part, which is come up with a test that describes what you want to do.

28:22 Write code until you have code that does that.

28:25 Now you go and review that code and you can talk to the agent.

28:28 You don't have to necessarily change it.

28:30 You can talk to the agent and go, this part of the code is weird.

28:33 Can we change it to a different pattern?

28:35 Or is there some way to clean this up?

28:37 And I've had really good results with that, actually, to just say, kind of good.

28:42 But this part, why did we do that?

28:44 And it's surprising to me to have the agent come back and say, oh, yeah, that's weird and change it to what I would expect.

28:51 Why didn't it just do that in the first place?

28:53 But it doesn't.

28:55 So and maybe it will.

28:56 And in the future and the future might be next week.

28:59 Who knows?

29:00 But for right now, these are great engineering pattern.

29:03 Great things to watch.

29:04 So thanks, Simon.

29:05 And I trust him to keep these up to date.

29:08 So anyway.

29:09 Yeah, this looks super interesting.

29:10 I definitely want to check it out.

29:11 I've already spread this around to to work.

29:14 and especially the people that have sent me code reviews that I'm like, you didn't read this.

29:20 I know you didn't.

29:23 I think that's part of the pushback as well.

29:25 People are lazy or they don't know what they're doing and they just, here's 2,000 lines of code

29:30 that fixes what I was asking for.

29:31 You're like, no, go away.

29:33 Where if they spend some time, you're like, actually, can you narrow this down to a 10-line change?

29:37 This is all I want.

29:38 Please don't go do other things.

29:39 Just help me understand this and why this needs to change.

29:42 And then I think we're still learning how all this stuff works.

29:45 And there are engineering practices, but it's so, the stakes are so low for getting started.

29:51 You know, normally you're like, okay, we're going to set up our build tool chain.

29:54 And then we're going to learn the language and the syntax and the structures and the keywords.

29:57 And now it's just like, oh, just use regular English to just tell it stuff.

30:00 And it'll probably figure it out, right?

30:02 That gives the sense that I don't need to learn this as a skill, but you do.

30:07 I also think that we're getting a lot of advice about how to utilize agents from startups and

30:13 startups have a different field. Startups are greenfield for the most part. They're writing

30:19 new code. Whereas a lot of software jobs are maintaining existing code bases that have been

30:25 around for decades, possibly, or at least years. And you can't just not care what goes into it.

30:35 you've been handed this thing that is making your company money.

30:38 You can't make it worse just because the agent decided to rewrite everything.

30:42 So yeah.

30:43 Yeah.

30:44 Anyway, for sure.

30:45 Well, do we have any extras?

30:46 I got a few extras.

30:48 Why don't you go first?

30:49 Okay.

30:49 A couple ones.

30:51 This, the first one comes from John Hagen.

30:53 Thanks for mentioning this because I almost made this a top level story,

30:57 but there's not much to say about it other than this is awesome.

31:00 Upgrading Python versions with uv.

31:02 So if you do, we know now that if to get all these new features, any new features from uv,

31:09 you have to say uv self-update.

31:12 I think, is that right?

31:13 I think self-update?

31:14 Yeah, uv self-update.

31:16 Yep.

31:17 But after you've done that, now you can say uv Python upgrade.

31:22 You can give it a specific one.

31:23 So like for instance, if you say uv Python upgrade 3.12, it updates 3.12 to the latest version,

31:32 the latest dot release, which is cool.

31:35 But if you leave that off, which that's what I do, it just looks at all of the Python versions

31:41 that you have installed on your computer through uv and updates them all to the most recent bug fix release.

31:50 And why not?

31:51 We should be doing that all the time.

31:52 I'm going to set this up as a cron job or something.

31:54 I don't know.

31:55 Yeah, that's cool.

31:57 And yeah, so thanks, uv.

31:58 Making things easier once again.

32:00 Awesome job.

32:01 I've already incorporated it into my little updater scripts that I run periodically.

32:05 Next is also something that's suggested by a reader.

32:09 And I understand New York Times Magazine is behind a paywall.

32:14 But for some reason, I was able to read this fine.

32:18 I don't know.

32:19 I do have a New York Times newspaper subscription, so maybe that's it.

32:23 Anyway, coding after coders, the end of computer programming as we know it.

32:28 This is a description of basically talking about whether or not, like, it's not just whether or not, like, AI is the end of coding jobs. I don't,

32:38 you know, we don't think it is. The conclusion here is it's not, but it's also more about that.

32:43 It's more than that. It's talking about basically kind of some different, different life, like,

32:48 different changes. And it also talks about, I believe it talked about the different differences

32:52 between percent of improved percent of efficiency improvement of Greenfield versus legacy code,

33:00 Whereas like a lot of startups say they're a hundred, a hundred times faster,

33:04 but Amazon has said it's on average 10% faster, but that's not nothing to get.

33:10 You should still get excited about 10% faster, but, but don't expect people maintaining your own code to be a hundred times

33:16 faster.

33:17 The reason why it was passed to me was, was because there's this great line.

33:21 If I could see if I can find it, I test pushing code that fails.

33:25 Pytest is unacceptable and embarrassing.

33:27 Apparently this is a, a, like a, an instruction that somebody has in their markdown files to instruct Claude to,

33:37 to always run the PyTist and be embarrassed if they don't.

33:42 I love it.

33:43 This is good.

33:44 But anyway, those are my extras.

33:46 I actually, I think this is a well-written article for somebody that doesn't understand

33:51 apparently this part of this, the author was has been covering the tech world for a while.

33:55 So nice.

33:57 And also, pytest got into the New York Times.

34:00 Yeah, that's pretty cool.

34:02 Anyway, what you got extra for us?

34:03 All right.

34:04 Well, I've got a few.

34:06 Let's start with TalkByThonTraining.

34:08 By per request from one of the users, they said, hey, I would be really great if I could,

34:12 when I log into my account, have more information.

34:14 So I updated the people who have accounts there.

34:18 If you go log into your account, it will show you all the courses you are actively learning.

34:23 I have 48 of them.

34:25 I haven't finished a bunch of them.

34:27 People might be like, Michael, you have courses on the website.

34:29 You haven't finished.

34:30 By the time it gets to the website, I've watched the videos two to three times.

34:33 I don't have to watch them a fourth time in sequence and have the system record me watching them.

34:39 So no, they're not all done.

34:39 But it'll show you things like the ones you're working on, how far are you through,

34:43 and when did you last watch it, and when did you start?

34:45 Apparently, this is things like if you're submitting this as a training evidence for your employer,

34:51 knowing when you started, when you finished, and so on, and whatever, how far you are.

34:55 There's also a whole bunch.

34:56 It shows you completed ones.

34:57 I'm going to be generating certificates for people.

35:01 It's easy enough for me to make PDF downloads, but I want to make stuff that you could say,

35:05 post to your LinkedIn profile as an accomplishment.

35:09 I've done the FastAPI course at Talk Python as part of your LinkedIn record and other places

35:14 you can put those kinds of things.

35:16 So it's not as simple as just a PDF, but hopefully stuff like that comes.

35:19 Anyway, this was fun to build.

35:20 I think it looks really neat.

35:21 I think especially if somebody is buying the bundle, they have access to a ton of courses and they might not remember like what course was I taking last

35:30 month? Exactly. You didn't even buy it, but you took it. Then you forgot which one you're doing.

35:34 This totally solves that problem. Yeah. Yeah. Exactly. Cool. Yeah. That's what the request was

35:38 like. I know I took a course. I don't remember which one I was working on in which order would,

35:42 you know, help me get back to that. And then of course, when you're in, in a course, it has a

35:46 resume button. So you just click that to presume what you left off, but it doesn't have a cross

35:50 cutting resume. You know what I mean? I do like that. How you split it up so that if, like you

35:54 said, if I took the whole course and there's something I want to go back and review, I can

35:58 just look through and go and watch those videos. It's labeled well.

36:02 Yeah, thanks a bunch. All right. I talked about using latency to increase security for

36:09 supply chain stuff, right? Like, hey, if I do a pip, a uv pip update or upgrade sort of thing,

36:15 or similarly with sync and add and so on, just doing like an exclude newer than or whatever,

36:22 Give it seven days or a week or however you do it.

36:25 There's this article by Andrew Nespen that says package managers need to chill.

36:30 And right at the top, we have this post requested by Seth Larson, the security guy at the PSF.

36:36 So yeah, anyway, it talks about all the different, how you make your dependency manager cool, chill.

36:42 Like uv has an exclude newer, which I've been using.

36:44 And it's mostly awesome, except for when there's a vulnerability that appears in one and you get a notification that you got to fix it.

36:50 but it just came out the fix.

36:52 So you don't want to exclude it.

36:54 But in general, it's, I think, a better thing than not.

36:59 Remind me why?

37:00 Why would you want to exclude newer stuff?

37:02 Because for popular packages, if somebody uploads a virus inside the package,

37:08 like they take over the build chain or they fish the person who created it,

37:12 like the sake shared it, they fish Dan, they get access to his GitHub and they install a subtle thing

37:18 that downloads some rootkit or whatever info stealer to your account, that usually gets

37:24 found within the first couple of days.

37:26 And if you're always just going update, update, update, give me the latest, give me the latest,

37:31 you know, the chances that you hit that are pretty high, right?

37:34 Cause they won't get found in the first hour.

37:36 Even if it's found in the first hour, will people be able to react and communicate within

37:40 the first hour to deal with it?

37:41 You know, but if you just say, give it a week, like probably most of the popular ones, if

37:46 there was something wrong, it would have been found out.

37:48 by then. But okay, what if it got found out and got fixed and the weak boundary is there and I like

37:55 upload the weak old one that has the bug or do they remove it completely from there? If there was a virus, they

38:02 remove it from PyPI. Okay. It's not even there, even if somebody picks an old one.

38:06 Exactly. I knew that. I was just sort of playing along. Yeah, yeah.

38:10 Yeah, yeah. Exactly. Yeah.

38:12 So basically, just more people singing the same message, but this is a nice

38:16 cross technology. Are you in.NET? Are you in Ruby?

38:18 here in JavaScript. Here's how you make it chill. Okay. So back to AI real quick. Paul Everitt and

38:24 I did this video debate, although it was not that much of a debate, but it was more of a

38:29 conversation, but in kind of debate format about will AI kill open source? Not the licensing part

38:35 of it, but just will it make open source unnecessary? Will it just stop using open source and so on?

38:41 We don't think so, but we had a really nice chat and did a little quick write-up, but mostly the

38:46 write-up links to the video. So check out the video. I also did a write-up called always activate

38:50 the VE and V, a shell script. So I talked about this before, I believe. This is not the thing.

38:55 This is the lead into the thing I want to talk about. And so as I change directories around my

39:00 computer with just the terminal, it automatically finds and activates virtual environments. But

39:06 there's like, this was a thing in dir-inf. They said, well, we can't do this. What if somebody

39:11 maliciously sends some kind of virus and like commits a virus called VE and V into the repo.

39:19 And like it runs the activate script.

39:21 What if that activate script is malicious?

39:23 You know, that kind of thing.

39:24 So with some nice feedback from Scott H, I made a much more secure version that whitelists

39:32 them.

39:32 And if it's not whitelisted, it says, hey, do you really trust this thing or do you not?

39:36 Because you might just open up a folder and go, oh my gosh, there was a virtual environment

39:40 somewhere and it activated and ran something that I didn't know was going to happen. Right.

39:44 All that I think is super polished and really nice and I'm loving it. So here's the news.

39:49 Viraj Kenwande said, I wrote the antidote for ZSH plugin management and I ran across Michael's

39:58 secure aware virtual environment activator script, which was pretty awesome. So this is now a Zshell

40:04 plugin or ohmyzsh plugin a z sh safe v and v auto is what it's called which i thought it's

40:10 pretty awesome that's pretty cool yeah all right that's it for my extras cool we each got a joke

40:15 right uh yeah i took mine down though uh so i'm gonna have to rely on you to bring it into your

40:22 thing so all right i'll find it no worries so this one is so good and it follows this ai theme

40:28 that we've been going i remember the stack overflow keyboard and this is exactly the same

40:33 Vive is the Stack Overflow keyboard. The Stack Overflow keyboard was like the coder's keyboard,

40:38 and it's had a control and a C and a V for the joke of just copy and pasting from Stack Overflow.

40:44 Yeah. Well, if you've done anything with Claude Code, it often asks permissions to make changes,

40:49 and it says, do you want to allow this once, allow this always, or do you want to reject this change?

40:54 And so it's the super fancy Apple-looking keyboard that just says, allow once, always allow, or reject.

41:00 So this is funny on its own.

41:02 You all have to check out the picture.

41:03 I put it in the show notes.

41:04 It may or may not show up in your podcast player.

41:07 I don't know.

41:08 Maybe I can, I'll just make it the poster art.

41:10 But also there's two, there's two, too many buttons.

41:14 I think you just all need allow always.

41:17 I know.

41:18 Well, let's, let's review the comments because, oh my gosh, they're so good.

41:22 There's 223 comments.

41:24 Yeah, exactly.

41:25 Issue says, waste of two buttons.

41:27 A truly productive agent should only have allow all.

41:31 um somebody this is like the remember the little joke last week that was like so you're new to uh

41:39 sarcasm the person that looks like an ai generated image yeah exactly it didn't obviously

41:46 and there's the secret button dangerously skip permissions somebody added it to their stream

41:50 deck for real that it actually allows it yeah matt says too too many buttons but if we go down

41:56 Oh my gosh.

41:57 There's, there's, there's, this is the one, the actual one, Brian.

42:02 There's, there's a used version.

42:04 It says update after day one, it shows the same picture, but the allow always is like

42:09 cracked and smashed.

42:10 And just like, it's just been hit like brutally.

42:13 Just used, yes.

42:16 Oh, this is really good.

42:18 And so someone says, you got to be safe.

42:20 And they create a little like Rube Goldberg machine that just like automates hitting allow

42:24 once, but forever.

42:25 Yeah, just a little bobber thing that just hits it all the time.

42:30 That's funny.

42:30 Yeah, Devon says, no, no, no, we need the--

42:33 Claude code will say, I got to ask you a few questions.

42:36 Here's three options.

42:37 Do you want one, two, or three?

42:38 Or sometimes there's four.

42:39 Or you got to choose other.

42:41 So there's one that has a second row that says one, two, three, four, other.

42:45 I would actually use that.

42:46 I know.

42:47 It's so good.

42:48 Another one has the three, the allow ones.

42:51 Allow always rejected.

42:51 It has a microphone button to dictate to it.

42:54 These are so good.

42:56 You got to look at the comments.

42:58 That's funny.

42:59 Anyway.

43:00 That's good.

43:01 Yeah, that's my joke.

43:02 But my favorite one of it is where it's like crushed with like after day one.

43:06 Yeah.

43:07 So, well, let me try to get mine up.

43:10 Let's see.

43:11 I can pull it for you if you don't have me yet.

43:13 Okay.

43:13 Yeah, just go ahead and pull that link up or something or the picture.

43:17 So this was submitted with something else submitted by Paul Cutler.

43:21 Has some news about AI too.

43:24 Are you getting it?

43:25 You want me to?

43:25 I get it.

43:26 It's just slow.

43:27 Okay.

43:27 It's just slow loading.

43:28 There we go.

43:29 So set this over on Mastodon, Paul Cutler.

43:33 Today, it was mandated at work that we install Claude Code because, as they said, it has built-in PowerPoint creation capabilities.

43:43 What a reason.

43:44 FML.

43:46 Yeah.

43:46 Because you know what's coming next, hour-long meetings with lots of PowerPoint.

43:52 You know, I thought this was super funny at first, but also like it drives me kind of nuts with it

43:57 because, you know, I'm a coder.

43:59 So if I have to write a PowerPoint presentation, it's unusual.

44:03 So this probably is a good idea that I could save some time and not waste time on creating PowerPoint.

44:08 So yeah, no kidding.

44:10 Well, it's actually, it's a pretty neat integration.

44:12 It's not just that it knows how to do PowerPoint, but if you open up the Claude desktop app,

44:17 the same one that does co-work, It has like a little what's new button and you click it and it says install into PowerPoint.

44:24 And it actually adds like a Claude section inside of your PowerPoint presentation.

44:30 Why?

44:31 So you could like highlight a picture and say, could we get a different picture for this or highlight the text?

44:35 And could you could you animate this in from the left?

44:38 Oh, like not while you're presenting, though?

44:41 Like, no, it's during the building time.

44:43 OK, yeah, that makes more sense.

44:44 You know, you got like format picture animation tab and then you've got Claude now.

44:48 Yeah, it's actually pretty as opposed to just read my PowerPoint file and do this, you know.

44:53 Sorry, Paul.

44:54 I want it to be during the presentation.

44:56 So when you're presenting and go, hey, Claude, does anybody in the audience stopped at Starbucks

45:01 before they got here or something like that?

45:04 I forgot what I'm talking about, Claude.

45:06 Please tell the audience what this means.

45:09 Yeah.

45:09 Anyway.

45:10 Yeah.

45:10 Awesome.

45:11 Well, fun talking with you as always.

45:13 And I don't know if we need to change the name of the podcast to like Claude Bytes or probably not.

45:22 I don't think so.

45:23 But I mean, honestly, it's a good point.

45:28 But as a meta comment for the audience out there, it's really challenging to cover this stuff because so much of the energy in software development and tech in general is in AI.

45:39 Yeah.

45:39 But we obviously realize that there's plenty of stuff that's not really AI at all.

45:43 At the same time, it's transforming the industry, basically like the web, when the web came around.

45:49 And it's like, well, now we have the web, but we don't talk about it because it's, I don't know, it's tough.

45:53 It's a balance.

45:54 Also, I just am aware that there's people that care about Python, but also they have to care about this right now, whether they want to or not.

46:02 So it's something I'm willing to cover as well.

46:05 Yeah.

46:06 And it's wild.

46:07 May we live in interesting times.

46:10 Bye.

46:10 Later, Brian.