WEBVTT 00:00:00.040 --> 00:00:04.580 Hello and welcome to Python Bytes, where we deliver Python news and headlines directly to your earbuds. 00:00:05.120 --> 00:00:09.600 This is episode 475, recorded March 30th, 2026. 00:00:10.260 --> 00:00:11.040 And I'm Brian Okken. 00:00:11.220 --> 00:00:12.120 And I'm Michael Kennedy. 00:00:12.560 --> 00:00:16.379 And this episode, as is regular lately, is brought to you by us. 00:00:16.480 --> 00:00:20.680 All of the stuff, the books, courses, head on over to Python Bytes. 00:00:21.120 --> 00:00:22.980 Wait, yeah, Python Bytes.fm. 00:00:22.980 --> 00:00:26.940 We have links to everything, but there's also Talk Python.com. 00:00:27.320 --> 00:00:27.620 That's right. 00:00:28.420 --> 00:00:29.580 Talk.com will get you there. 00:00:29.920 --> 00:00:31.160 You know, just redirect to.fm. 00:00:31.260 --> 00:00:31.560 It's all good. 00:00:31.820 --> 00:00:32.099 Okay. 00:00:32.460 --> 00:00:33.320 Talk Python.fm. 00:00:33.620 --> 00:00:33.740 Right. 00:00:34.000 --> 00:00:34.100 Okay. 00:00:34.999 --> 00:00:36.580 And Talk Python training, of course. 00:00:37.600 --> 00:00:40.380 I've watched and done so many courses on there. 00:00:40.660 --> 00:00:41.680 It's a great resource. 00:00:42.180 --> 00:00:44.820 And if you'd like to learn pytest, there's a course there. 00:00:45.100 --> 00:00:46.900 But there's also pythontest.com. 00:00:47.220 --> 00:00:49.920 And thank you to our Patreon supporters, as usual. 00:00:50.380 --> 00:00:54.300 And also, thanks to everybody to subscribe to the newsletter, because it's fun to put together. 00:00:55.619 --> 00:00:57.680 And we have a lot of background information. 00:00:57.740 --> 00:01:01.560 So we like to send out all of the links to everything we talk about on there. 00:01:02.320 --> 00:01:08.320 And you can reach us to send us topics that you'd like us to talk about or topics you'd like us to stop talking about, whatever. 00:01:10.800 --> 00:01:16.420 The contact stuff is on pythonbytes.fm, but we're on Mastodon and Bluesky. 00:01:17.880 --> 00:01:20.860 And yeah, and there's also a contact form there that you can get. 00:01:21.180 --> 00:01:22.900 And if you're listening to this, thank you. 00:01:23.440 --> 00:01:28.540 And also, if you'd like to watch the show live or at least watch it, the recording later, 00:01:28.790 --> 00:01:36.680 you can go on to pythonbytes.fm/live and either be part of the audience or like a ghost. 00:01:37.140 --> 00:01:38.160 Like a ghost. 00:01:38.740 --> 00:01:39.920 Let's lock the ghost. 00:01:39.930 --> 00:01:40.580 How about that? 00:01:40.710 --> 00:01:44.860 So there's this interesting article at CERT.at. 00:01:45.090 --> 00:01:46.540 I'm guessing that is the way. 00:01:46.590 --> 00:01:48.260 And this one is super relevant to us. 00:01:48.260 --> 00:01:51.580 This is a security place, security website. 00:01:52.060 --> 00:01:52.840 Lock the ghost. 00:01:53.400 --> 00:01:58.620 In the software world, remove is not always equal to gone, completely gone. 00:01:59.100 --> 00:01:59.940 This is crystal clear. 00:02:00.200 --> 00:02:03.460 There's always a good reason for that, but even the best reasons do not, 00:02:03.800 --> 00:02:06.020 does not have to be intuitive or expected by the users. 00:02:06.520 --> 00:02:10.460 Let's take a short trip through how Python package index handles removals 00:02:10.580 --> 00:02:14.940 and how we can lock the ghost in a uv lock file forever, forever. 00:02:15.420 --> 00:02:21.560 So this is a security thing and it's specifically, uniquely an issue for uv 00:02:22.140 --> 00:02:25.200 and the uv lock file in particular. 00:02:25.320 --> 00:02:28.540 So if you're using uv like I do with like uv pip compile, 00:02:29.240 --> 00:02:32.760 uv and then requirements.txt, that kind of thing, 00:02:33.220 --> 00:02:33.540 doesn't apply. 00:02:33.820 --> 00:02:34.760 uv.lockfile. 00:02:35.000 --> 00:02:36.120 We're both huge fans of uv, 00:02:36.720 --> 00:02:38.320 and one of the reasons we are fans 00:02:38.380 --> 00:02:40.580 is because of the performance, right? 00:02:41.200 --> 00:02:43.800 It's so fast and it bundles so many tools together. 00:02:44.480 --> 00:02:47.220 Some of these are making really interesting trade-offs. 00:02:47.860 --> 00:02:50.160 Often those trade-offs are certainly fine, 00:02:50.380 --> 00:02:52.240 you know, like a short caching period. 00:02:52.350 --> 00:02:54.220 So if you ask it to install something 00:02:54.250 --> 00:02:55.580 and it did it 10 seconds ago, 00:02:55.800 --> 00:02:58.500 it's not going to go and ask the APIs for it again 00:02:58.590 --> 00:02:59.580 and that sort of thing. 00:03:00.140 --> 00:03:03.440 Or uv Python install, which is awesome. 00:03:03.570 --> 00:03:05.100 It gets you Python in a couple of seconds 00:03:05.370 --> 00:03:06.880 instead of forever with a bunch of buttons, 00:03:07.380 --> 00:03:09.180 you know, next, next, next, confirm, agree, 00:03:09.540 --> 00:03:10.340 confirm, next, next, yes. 00:03:10.720 --> 00:03:12.180 You know, like that installer experience. 00:03:12.600 --> 00:03:13.460 So those are all good, 00:03:13.760 --> 00:03:17.020 but I guess this is a bit of a negative consequence 00:03:17.310 --> 00:03:18.860 of having some of these optimizations. 00:03:19.180 --> 00:03:20.960 So I pulled out some, I'll read my notes here. 00:03:21.340 --> 00:03:24.080 So the essence is in the uv lock file, 00:03:24.180 --> 00:03:29.160 it points directly to the final file on the CDN, I'm guessing, 00:03:29.400 --> 00:03:30.100 or even the storage. 00:03:30.280 --> 00:03:32.640 But, you know, even if you remove something from the storage, 00:03:32.700 --> 00:03:35.880 it doesn't necessarily remove it from the CDN fastly and so on, right? 00:03:36.240 --> 00:03:39.720 So however it is, it points to the very final file. 00:03:40.260 --> 00:03:43.020 In when something is yanked or removed from PyPI, 00:03:43.440 --> 00:03:44.340 it goes out of the listing. 00:03:44.720 --> 00:03:45.560 You can't find it. 00:03:45.580 --> 00:03:46.700 You ask pip to install it. 00:03:46.780 --> 00:03:47.260 It's not there. 00:03:47.600 --> 00:03:50.520 but the underlying file is still hanging around. 00:03:50.760 --> 00:03:53.940 So if you have a direct URL to the result file, 00:03:54.300 --> 00:03:55.800 instead of following the redirects or whatever, 00:03:56.240 --> 00:03:57.660 that file doesn't necessarily get removed. 00:03:57.980 --> 00:03:59.400 That's what that opening was about, right? 00:03:59.640 --> 00:04:01.360 So that's basically the problem. 00:04:01.700 --> 00:04:03.200 If the file is still there, 00:04:03.740 --> 00:04:05.820 the file is still there even if it gets yanked, right? 00:04:06.020 --> 00:04:08.220 So there's a couple of interesting knock-on effects. 00:04:08.680 --> 00:04:10.820 So uv lock uniquely preserves this, 00:04:11.280 --> 00:04:13.540 these ghost packages, they call them in this file. 00:04:13.720 --> 00:04:14.840 So instead of removing them, 00:04:15.240 --> 00:04:16.880 they just link directly to them as an optimization, 00:04:17.220 --> 00:04:23.740 I presume, however, no other thing like Hatch or PDM or whatever links to them. 00:04:23.780 --> 00:04:23.900 Right. 00:04:24.160 --> 00:04:25.300 So they don't do that. 00:04:25.520 --> 00:04:25.600 Right. 00:04:25.600 --> 00:04:26.980 This is specifically about uv. 00:04:27.360 --> 00:04:29.800 So it creates an interesting supply chain problem. 00:04:29.920 --> 00:04:34.860 I mean, that's just like the security problem du jour or the year, right? 00:04:35.100 --> 00:04:41.040 Whatever your year and fridges, the problem that all these things are getting some level 00:04:41.060 --> 00:04:47.440 of takeover and then, you know, that's blowing into packages and other libraries that are 00:04:47.460 --> 00:04:48.320 built into code. 00:04:48.320 --> 00:04:50.480 And then obviously that amplifies them massively. 00:04:50.780 --> 00:04:56.220 So in this case, an attacker could upload a malicious package and then immediately remove 00:04:56.500 --> 00:04:59.800 it, but still have the uv lock file point at it. 00:05:00.140 --> 00:05:00.240 Okay. 00:05:00.340 --> 00:05:00.500 Yeah. 00:05:00.960 --> 00:05:06.600 So if you immediately remove it, you might outrun the scanners, the automated scanners 00:05:06.620 --> 00:05:11.000 to go, let me scan the new inbound PyPI packages, 00:05:11.410 --> 00:05:12.620 because that package doesn't exist anymore. 00:05:12.670 --> 00:05:13.520 We don't need to scan it. 00:05:13.960 --> 00:05:17.240 But you could craft a specific uv lock file 00:05:17.760 --> 00:05:19.800 that still points to the ghosted remnant. 00:05:19.950 --> 00:05:20.500 You know what I mean? 00:05:21.260 --> 00:05:23.900 Yeah, but aren't the lock files on the client side? 00:05:23.950 --> 00:05:26.960 So it would be just people that created the client lock files 00:05:27.440 --> 00:05:27.960 during the... 00:05:27.980 --> 00:05:29.400 Yes, that seems possible. 00:05:29.570 --> 00:05:33.720 But imagine this, I create Molting Claw or whatever, 00:05:33.760 --> 00:05:39.500 like the world's third most popular GitHub project out there, put it up, get it working normally. 00:05:39.880 --> 00:05:45.280 And then after it gets really popular, I update a lock file, not even the input, 00:05:45.480 --> 00:05:46.860 not the pyproject.tom or nothing. 00:05:46.940 --> 00:05:54.160 I just link, I just update the lock file itself to point at this ghosted malicious file. 00:05:54.500 --> 00:05:59.760 So anybody who installs it, well, they uvsync, that installs everything in the lock file, 00:06:00.240 --> 00:06:00.900 and off it goes. 00:06:01.100 --> 00:06:05.200 So it's not that you ran and installed the thing. 00:06:05.620 --> 00:06:09.620 It's that somebody could craft a lock file such that if you sync that project, 00:06:10.360 --> 00:06:13.980 then it's installed on your machine and off to its regular badness, 00:06:14.080 --> 00:06:15.440 you know, with its setup.py or whatever. 00:06:16.000 --> 00:06:16.800 So beware, folks. 00:06:17.360 --> 00:06:17.640 Beware. 00:06:17.680 --> 00:06:19.880 I'm not sure exactly what the solution here is, 00:06:20.100 --> 00:06:21.420 but it's something that could happen. 00:06:21.460 --> 00:06:23.740 And maybe the Astral team, 00:06:24.020 --> 00:06:25.980 I'm sure the Astral team has already heard about this. 00:06:26.120 --> 00:06:26.980 This was from last week. 00:06:27.260 --> 00:06:27.440 Okay. 00:06:27.960 --> 00:06:28.100 Interesting. 00:06:28.420 --> 00:06:30.500 Well, we'll wait to hear back. 00:06:30.800 --> 00:06:34.780 so yeah i haven't heard anything i mean i guess if i go to the end there's not like an update 00:06:35.220 --> 00:06:43.840 how should i live this is how should i live to sum it up i presented that removed packages could 00:06:43.840 --> 00:06:51.220 still be i don't know yeah well i mean there's a lot this it it's a security is a big thing um 00:06:51.640 --> 00:06:56.060 anyway yeah supply chain security is extra bad because it's not even necessarily the things that 00:06:56.120 --> 00:07:00.520 you're using it could be the things that you're using what they're using you know right and 00:07:00.540 --> 00:07:04.860 something could change there like i'm not checking on i don't know care debt for example just pick 00:07:04.940 --> 00:07:09.220 something out of thin air because i'm not using it directly i'm not tracking its releases i happen 00:07:09.240 --> 00:07:12.940 to maybe be using something that uses care debt that then you know if something happened to that 00:07:13.100 --> 00:07:16.700 package i'm not saying it has right just like thinking of like really popular third party 00:07:17.140 --> 00:07:23.280 third level dependencies yeah yeah and uh yeah there's there's anyway we'll get into there's 00:07:23.540 --> 00:07:27.940 we've got more security topics coming up so let's uh let's we're not gonna we're not gonna run out 00:07:27.960 --> 00:07:35.140 are we? No. So the next step, I want to talk about a little bit more security, but this is 00:07:35.800 --> 00:07:42.780 how to, how to rein in your AI a little bit. So this really, what am I going to talk about? This 00:07:42.900 --> 00:07:50.760 is suggested by Martin Hecker. I think it's Hecker. It's German name, H-A-E-C-K-E-R. Anyway, 00:07:51.020 --> 00:07:51.380 Thanks, Martin. 00:07:52.660 --> 00:07:58.780 Anyway, for context, this seems so long ago, June of 2025. 00:07:59.280 --> 00:08:00.360 It was less than a year ago. 00:08:01.340 --> 00:08:07.960 Simon Willison wrote a blog post about the trifecta of AI agents of lethal, the lethal trifecta, 00:08:08.460 --> 00:08:13.680 which is giving them access to private data, exposure to untrusted content, and ability 00:08:13.760 --> 00:08:14.900 to externally communicate. 00:08:15.300 --> 00:08:19.879 That's pretty much what coding agents are like now, especially if you run it in YOLO mode 00:08:19.900 --> 00:08:25.340 or dangerous mode because, and it seems like people wouldn't do that, right? 00:08:25.580 --> 00:08:26.920 But it's so much faster. 00:08:28.199 --> 00:08:32.960 So if you have your agents on like ask mode, it's just like, 00:08:33.099 --> 00:08:33.940 hey, can I run this command? 00:08:34.240 --> 00:08:34.400 Yes. 00:08:34.620 --> 00:08:35.780 Can I run this other command? 00:08:36.020 --> 00:08:36.180 Yes. 00:08:37.140 --> 00:08:40.599 And so you can say, just stop asking right now. 00:08:40.780 --> 00:08:41.580 I trust you. 00:08:41.960 --> 00:08:43.060 But should you? 00:08:43.190 --> 00:08:43.580 I don't know. 00:08:44.060 --> 00:08:47.140 So if you've got private data on your device, 00:08:48.420 --> 00:08:50.300 So there's something to be concerned about. 00:08:50.610 --> 00:08:53.520 So one of these solutions is sandboxing. 00:08:53.740 --> 00:08:57.840 And you can, or one of the solutions is create a VM 00:08:57.990 --> 00:08:59.700 and just don't put the stuff on the VM 00:08:59.840 --> 00:09:02.800 that you only want the AI to use. 00:09:03.200 --> 00:09:05.840 That's a lot, that's a little, that's a extra. 00:09:06.040 --> 00:09:06.900 That's a little extra. 00:09:07.220 --> 00:09:11.160 And it's for people that are normally using VMs 00:09:11.340 --> 00:09:14.799 might be fine or either virtual machines 00:09:14.940 --> 00:09:16.980 or those other things. 00:09:18.079 --> 00:09:18.860 Containers, right. 00:09:18.950 --> 00:09:20.860 If they're normally using containers, great. 00:09:21.130 --> 00:09:23.160 But if that's not your normal workflow, 00:09:24.480 --> 00:09:25.700 it's a tough ask. 00:09:26.060 --> 00:09:27.640 So Claude Code has sandboxing. 00:09:28.340 --> 00:09:31.020 I haven't tried it out to see how clear it is. 00:09:31.420 --> 00:09:35.920 It's a little, it apparently works great on macOS, Linux, 00:09:37.259 --> 00:09:39.580 and WSL2 uses bubble wrap. 00:09:39.940 --> 00:09:43.380 So if you're using WSL2 for Cloud Cursor, 00:09:43.820 --> 00:09:46.180 or Claude Code, that might be okay. 00:09:46.780 --> 00:09:48.460 But what about other agents and stuff? 00:09:48.700 --> 00:09:53.980 So what we got a suggestion was that Claude Code has this built in. 00:09:55.360 --> 00:10:00.000 I'm not sure how well, if it's really restricted or if it's suggestions. 00:10:00.760 --> 00:10:02.680 Anyway, I haven't tried it out. 00:10:03.000 --> 00:10:06.300 So I'd love to hear what other people think about the sandboxing stuff. 00:10:06.620 --> 00:10:09.320 Anyway, the same kind of idea that Claude Code uses 00:10:09.800 --> 00:10:13.780 is pulled out as something else you can use with different... 00:10:13.800 --> 00:10:19.520 AI agents if you want. So this is a project called Fence. It's lightweight sandboxes for terminal 00:10:19.920 --> 00:10:27.060 agents, and it uses this similar sort of stuff that Claude Code does. And this is pretty exciting 00:10:27.090 --> 00:10:33.180 to be able to restrict what it has access to, like file permissions. You can restrict how much 00:10:33.890 --> 00:10:41.860 your file system it has access to. You can restrict the network access, which websites and stuff it 00:10:41.800 --> 00:10:47.700 can access and even GitHub repos, restrict which repos. 00:10:48.380 --> 00:10:48.940 That's all cool. 00:10:49.370 --> 00:10:51.380 And it's also really cool that this is open source. 00:10:51.740 --> 00:10:58.000 So this is Go code, but it's a fence project that people can contribute to. 00:10:58.480 --> 00:10:59.960 And it's very active right now. 00:11:00.160 --> 00:11:06.660 So I'd be excited to hear what other people think of fencing, if you think it's safe enough. 00:11:07.520 --> 00:11:16.540 Anyway, I'm definitely going to try it out because I was actually considering buying an extra computer so that I could run it isolated. 00:11:16.800 --> 00:11:22.960 I mean, I know that a container is way cheaper than an extra computer, but also an extra computer is not that much either. 00:11:23.120 --> 00:11:23.800 So, yeah. 00:11:24.640 --> 00:11:25.580 What do you all think about this? 00:11:25.740 --> 00:11:26.400 What do you think, Michael? 00:11:26.720 --> 00:11:27.520 Yeah, it's interesting. 00:11:27.800 --> 00:11:29.940 I mean, a Mac mini is very cheap, right? 00:11:30.060 --> 00:11:35.200 If you 400 bucks or something like that, it's a pretty cheap computer if you want to have a separate machine. 00:11:35.740 --> 00:11:39.400 But also a VM potentially would work if you wanted to have some isolation. 00:11:39.780 --> 00:11:41.060 I think this is a neat idea. 00:11:41.320 --> 00:11:42.380 I like that it's open source. 00:11:42.920 --> 00:11:46.940 The one thing I don't like, and I don't know that there's necessarily a great fix for that, 00:11:47.180 --> 00:11:54.220 just given the way that it works, is it seems like you can have it work on any terminal command. 00:11:54.740 --> 00:11:59.260 So like Claude Code or Codex CLI or Gemini CLI, whatever. 00:11:59.720 --> 00:12:05.380 But say VS Code, Cursor, iCharm, you want to run one of those. 00:12:05.700 --> 00:12:09.580 but have the agents that run in those more proper editors limited, 00:12:09.940 --> 00:12:11.300 that seems harder, you know? 00:12:11.480 --> 00:12:12.600 It doesn't seem like it supports that. 00:12:12.740 --> 00:12:13.000 Yeah. 00:12:13.300 --> 00:12:15.260 So that's the way I like to work. 00:12:15.480 --> 00:12:18.680 Honestly, this might be a minority opinion, 00:12:18.920 --> 00:12:21.920 but I think Claude Code and friends, the way that they work, 00:12:22.260 --> 00:12:26.740 are an anti-pattern for how real software developers should be coding. 00:12:27.100 --> 00:12:30.520 And what I mean by that is Claude Code and other CLI ones 00:12:30.880 --> 00:12:33.920 encourage you to just have the code just like rip by, like do this. 00:12:34.160 --> 00:12:37.280 And it's just like, you see the code screaming by and it's like, okay, I'm done. 00:12:37.700 --> 00:12:40.860 And then your job is to like, accept that or whatever. 00:12:41.100 --> 00:12:42.840 Or you wait 10 minutes for it to do a thing. 00:12:43.120 --> 00:12:44.700 I was doing a project a few days ago. 00:12:45.120 --> 00:12:50.060 Claude Code spun up five agents that all ran for 15 minutes in parallel. 00:12:50.500 --> 00:12:51.580 And then it gave me the result. 00:12:52.020 --> 00:12:53.800 So that's a lot of code changes. 00:12:55.700 --> 00:13:00.980 And that's a lot of my credits in addition to just time to wait 15 minutes and see how it came out. 00:13:01.280 --> 00:13:07.320 So what I much prefer is to have some kind of editor, VS Code, PyCharm, whatever, where the work is happening. 00:13:07.490 --> 00:13:11.660 And as it's making changes, I can roll up, okay, made this change. 00:13:11.660 --> 00:13:12.000 Let me look. 00:13:12.240 --> 00:13:13.260 Actually, it's going down the wrong path. 00:13:13.260 --> 00:13:13.880 Hey, stop, stop, stop. 00:13:14.080 --> 00:13:14.440 No, don't. 00:13:14.630 --> 00:13:15.340 Look, you did this wrong. 00:13:15.820 --> 00:13:16.360 Go that way. 00:13:16.740 --> 00:13:18.360 You know, you're not following the patterns of this. 00:13:19.110 --> 00:13:25.120 So with the just like streaming by like a social media feed, it encourages you not to review it while it's working. 00:13:25.390 --> 00:13:27.160 And I think that that is not right. 00:13:27.240 --> 00:13:29.480 I know the trend is to like not review code at all, 00:13:29.620 --> 00:13:32.620 but the trend is also to get a bunch of like unstable software. 00:13:32.770 --> 00:13:33.680 So I think you're paying. 00:13:34.120 --> 00:13:36.500 Anyway, I don't like the CLI ones because of that. 00:13:36.900 --> 00:13:39.940 Therefore, I probably won't be using this, but I would like to. 00:13:40.280 --> 00:13:40.680 That's my take. 00:13:40.750 --> 00:13:40.860 Yeah. 00:13:41.500 --> 00:13:44.860 It's interesting because like this is similar to, you know, hiring, 00:13:45.340 --> 00:13:47.220 hiring somebody to do work for you or, 00:13:48.100 --> 00:13:53.859 or having an intern or a new hire or something that you don't quite trust yet 00:13:54.620 --> 00:13:57.460 of saying, hey, I want you to do this job, 00:13:57.820 --> 00:14:02.180 but I'd like you to work for like four hours at most 00:14:02.230 --> 00:14:03.000 and then check in. 00:14:03.570 --> 00:14:03.820 Right, right. 00:14:03.900 --> 00:14:04.840 Work on it this morning 00:14:04.940 --> 00:14:06.100 and then check in with me after lunch. 00:14:06.480 --> 00:14:07.200 Something like that, right? 00:14:07.580 --> 00:14:07.700 Yeah. 00:14:07.950 --> 00:14:11.840 So you wouldn't want like four hours of cursor 00:14:12.120 --> 00:14:13.460 or Claude Code to run, 00:14:13.570 --> 00:14:17.780 but you might go use this many tokens or something 00:14:18.180 --> 00:14:20.380 and then check in to make sure 00:14:20.430 --> 00:14:22.440 that you're in the right track or something. 00:14:22.980 --> 00:14:23.080 Yeah. 00:14:23.180 --> 00:14:24.580 Also, testing helps. 00:14:25.600 --> 00:14:26.780 Testing absolutely helps. 00:14:26.840 --> 00:14:27.180 It does. 00:14:28.020 --> 00:14:31.140 But the problem is sometimes the agents are like, that test doesn't seem relevant. 00:14:31.300 --> 00:14:33.100 It was also hard to make it fixed, so we took it out. 00:14:34.500 --> 00:14:35.920 You know, that's happened to me. 00:14:36.420 --> 00:14:42.060 And if you got enough tests, it's like, oh, there's some 1,100 something number of tests. 00:14:42.580 --> 00:14:44.980 You don't notice that the one that you really needed is gone, you know? 00:14:45.180 --> 00:14:45.460 Yeah. 00:14:45.780 --> 00:14:50.799 Yeah, we're getting on a tangent, but I was listening to a podcast this morning or interview 00:14:50.820 --> 00:14:57.000 with somebody that had used a like clause which I haven't I haven't done any clause yet or anything 00:14:57.240 --> 00:15:03.700 but having a thing that controls lots of agents to do things like control his house with his pool 00:15:03.860 --> 00:15:10.720 temperature and lights and everything and I'm like if I want my lights on in my room I turn the light 00:15:10.770 --> 00:15:17.019 switch on it's I haven't coded anything in theory I want a smart home and practice I'm like boy that's 00:15:17.100 --> 00:15:23.120 not really that helpful buttons are really easy though uh anyway okay um well let's go on to the 00:15:23.220 --> 00:15:30.180 next thing what do you got indeed let's go on to the next thing and this one is this one is a 00:15:30.400 --> 00:15:36.980 it's called malicious and it it has to do with it's also an ai one so i know some people are 00:15:37.340 --> 00:15:41.700 overwhelmed or uninterested in the ai stuff but i don't think this is the ai in the sense that 00:15:41.520 --> 00:15:42.100 that you're thinking about. 00:15:42.240 --> 00:15:43.280 This is crazy. 00:15:43.740 --> 00:15:47.080 So this is an open source copyright concept 00:15:47.220 --> 00:15:48.780 and it doesn't necessarily have to do with AI. 00:15:48.920 --> 00:15:51.600 It just happens to be that AI is the workhorse of it. 00:15:51.900 --> 00:15:52.720 So check this out. 00:15:53.180 --> 00:15:55.740 And I don't know if this is a real project 00:15:55.900 --> 00:15:57.300 that people are making real money. 00:15:57.720 --> 00:16:00.420 You can, there's like real pricing here. 00:16:00.880 --> 00:16:01.760 So what is the idea? 00:16:01.900 --> 00:16:04.560 The idea is, so I don't know if this is a real project 00:16:04.680 --> 00:16:07.240 because it could be put out here to cause such a backlash 00:16:07.420 --> 00:16:08.500 that it causes a lawsuit. 00:16:08.940 --> 00:16:09.860 That's what I'm saying. 00:16:10.160 --> 00:16:10.920 But there is real pricing. 00:16:11.400 --> 00:16:12.120 So here's the thing. 00:16:12.780 --> 00:16:15.160 Remember how we had that, there was like this big debate, 00:16:15.380 --> 00:16:17.020 just I think last week about Chardet, right? 00:16:17.480 --> 00:16:17.540 Yeah. 00:16:17.640 --> 00:16:20.800 Chardet, Chardet, that the current maintainer, 00:16:20.880 --> 00:16:23.040 who is not the original copyright holder, 00:16:23.520 --> 00:16:26.200 had AI recreate one, create the library, 00:16:26.440 --> 00:16:30.720 basically one generate the description and the specifications, 00:16:31.100 --> 00:16:33.320 and then another one that has never seen any of the code, 00:16:33.480 --> 00:16:36.580 take that and then turn that into the new project 7.0 00:16:36.860 --> 00:16:40.120 and then change the license because this new bit of code 00:16:40.140 --> 00:16:41.540 the same thing, right? 00:16:42.020 --> 00:16:44.420 Basically this is that as a service. 00:16:45.240 --> 00:16:45.760 - Interesting. 00:16:46.180 --> 00:16:48.960 - Yeah, so it calls a clean room as a service. 00:16:49.180 --> 00:16:51.480 Finally, liberation from open source obligations. 00:16:51.740 --> 00:16:52.840 It's pretty shady, you guys. 00:16:53.040 --> 00:16:54.260 This is bad news. 00:16:54.640 --> 00:16:57.960 Our proprietary AI robots independently recreate 00:16:58.090 --> 00:16:59.320 open source projects from scratch. 00:16:59.490 --> 00:17:02.720 The result, legally distinct code 00:17:02.730 --> 00:17:04.560 with corporate friendly licensing. 00:17:05.160 --> 00:17:07.760 No attribution, no copy left, no problem. 00:17:07.920 --> 00:17:09.060 And there's pricing for this. 00:17:09.640 --> 00:17:10.939 I know, it's really crazy. 00:17:11.069 --> 00:17:14.980 So the pricing is transparent pay per kilobyte pricing. 00:17:15.560 --> 00:17:17.319 So it's focused on JavaScript at the moment. 00:17:17.680 --> 00:17:21.339 Every package is priced by its unpacked size on npm. 00:17:21.550 --> 00:17:22.160 How about that? 00:17:22.520 --> 00:17:25.400 So for example, left pad, left pad, 00:17:25.520 --> 00:17:29.300 if you wanted a copyright, not copy left, left pad, 00:17:29.740 --> 00:17:31.080 it would cost 50 cents. 00:17:31.510 --> 00:17:37.700 If you want to express the Node.js powered web framework, 73 cents. 00:17:38.180 --> 00:17:43.100 want um moment i don't know what moment is apparently it's pretty big it costs 42 dollars 00:17:43.500 --> 00:17:51.500 what do you think about this brian this is nuts huh is this is real i mean like it could be um 00:17:51.800 --> 00:17:55.520 that's like you said i don't know if this is real or not but i think it is it is a real 00:17:56.539 --> 00:18:03.539 copyright conversation and it is a called malice i know m-a-l-u-s yeah i think i we need we need 00:18:03.460 --> 00:18:11.020 to create a competing one that's called spite spite and malice anyway amazing liberate open 00:18:11.180 --> 00:18:17.140 sources the h2 like how how nutso is this like i said i think it could be something that's just 00:18:17.300 --> 00:18:22.640 trying to get attention to this problem and like cause some kind of final legal decision to come 00:18:22.820 --> 00:18:26.080 down about it or it could be something people are just paying money well yeah we'll take it yeah i 00:18:26.240 --> 00:18:32.480 honestly don't know you know what what what's creepy is like a decent like an evil but decent 00:18:32.500 --> 00:18:37.160 business model might be to do something like this and just keep track of all the companies that have 00:18:37.280 --> 00:18:46.960 paid you to steal from open source um and then you know and then like you know sue them or um or like 00:18:47.130 --> 00:18:53.920 you know uh anyway yeah well i i leave this here for people to riminate about but i do think it's 00:18:54.210 --> 00:19:00.100 pretty wild i think it's pretty wild i also i guess it's good to talk about it because people 00:19:00.120 --> 00:19:05.660 are going to do this anyway right people are going to try to do clean room solutions and yeah around 00:19:05.780 --> 00:19:13.020 stuff yeah clean room solutions have worked i mean there was um i mean goel de casa i don't know 00:19:13.340 --> 00:19:20.080 that i'm not sure how to spell it the guy created mono um the which was the open open source version 00:19:20.200 --> 00:19:26.200 of dot net when dot net was or yeah of dot net and C# when it was still completely commercial 00:19:26.200 --> 00:19:29.220 and just made sure that whoever they hired to work on it 00:19:29.420 --> 00:19:32.000 had never looked at the source code or worked, you know, 00:19:32.260 --> 00:19:32.900 and they rebuilt it. 00:19:32.900 --> 00:19:35.760 And ultimately the outcome was that Microsoft bought them 00:19:35.900 --> 00:19:37.840 because they thought that open source was better later 00:19:38.340 --> 00:19:40.720 instead of a virus or whatever they called it at the time. 00:19:41.200 --> 00:19:43.400 So, I mean, that's a historical precedent 00:19:43.700 --> 00:19:45.140 for this clean room concept. 00:19:45.360 --> 00:19:48.420 But if you just, the difference is that took multiple people 00:19:49.000 --> 00:19:51.600 six months to a year, whereas this is like an afternoon. 00:19:51.900 --> 00:19:52.460 You know what I mean? 00:19:52.720 --> 00:19:54.300 If you turn Claude Code loose on it. 00:19:54.460 --> 00:19:56.080 Such is the world right now, yeah. 00:19:56.240 --> 00:19:57.360 Yeah, such as the world right now. 00:19:57.540 --> 00:20:00.160 But anyway, I honestly don't know how I feel about this. 00:20:00.480 --> 00:20:03.160 I mean, it seems like a really crappy thing to do. 00:20:03.500 --> 00:20:09.140 At the same time, it seems like you should be able to, you know, in the Google versus, 00:20:09.540 --> 00:20:15.540 I think, Oracle case, the case about Java, and I think it was Java and Android, the Supreme 00:20:15.740 --> 00:20:20.420 Court, whatever the highest court it went to, ruled that APIs, the signature of the APIs 00:20:20.760 --> 00:20:22.360 are not copyrightable, right? 00:20:22.500 --> 00:20:27.200 So that's part of the precedence, but this is the internals. 00:20:27.320 --> 00:20:31.320 But if you take something and scrape out, these are all the APIs, and here's a description of what it does, 00:20:32.020 --> 00:20:35.500 and you feed that to an AI, that's pretty close to doing what Google did, 00:20:35.620 --> 00:20:37.320 but they had a team of hundreds of people or something. 00:20:37.520 --> 00:20:37.840 You know what I mean? 00:20:38.640 --> 00:20:39.040 I don't know. 00:20:39.420 --> 00:20:40.780 Like I said, I don't know how to feel about this. 00:20:40.920 --> 00:20:44.860 I'm just going to put this out there for people's awareness and move on to your next topic, Brian. 00:20:45.580 --> 00:20:50.280 Well, I want to talk about, just change it up a little bit and talk about security. 00:20:53.420 --> 00:20:59.340 So this one comes from us, from Matthias Schotl, I think. 00:20:59.600 --> 00:21:01.040 Anyway, thanks, Matthias. 00:21:01.460 --> 00:21:06.080 I sent it in through email, which, yeah, very easy to find email. 00:21:06.460 --> 00:21:11.440 So the article, this is kind of fun because in the email he said, 00:21:11.580 --> 00:21:16.360 you know what, I wanted to suggest this, but also this topic, 00:21:16.580 --> 00:21:20.080 but also I'm trying to get better about writing blog posts, 00:21:20.480 --> 00:21:23.140 And I appreciate that because we like blog posts. 00:21:23.540 --> 00:21:24.720 I like to read blogs. 00:21:25.080 --> 00:21:27.320 So he's got an article called 00:21:27.400 --> 00:21:30.380 Harden Your GitHub Action Workflows with Zizmor, 00:21:31.559 --> 00:21:33.860 Dependency Pinning and Dependency Cooldown. 00:21:33.910 --> 00:21:34.800 So there's three topics. 00:21:35.380 --> 00:21:37.800 So you've got, and actually this came up 00:21:38.000 --> 00:21:40.140 because he was looking at an article like, 00:21:40.460 --> 00:21:41.360 please let me get this. 00:21:41.530 --> 00:21:41.660 Okay. 00:21:42.040 --> 00:21:46.100 Like from Step Security saying an AI-powered bot 00:21:46.120 --> 00:21:54.460 actively exploited GitHub actions involving Microsoft Datadog, CNF projections, lots of things. 00:21:54.870 --> 00:21:59.540 So this sort of, you have to basically making sure your GitHub actions are secure also, 00:22:00.090 --> 00:22:05.580 not just your whatever thing you're building, but your actions might have a problem. 00:22:06.460 --> 00:22:15.160 So we had actually covered Zismore, but I went and looked to see when it was. So it was episode 00:22:15.180 --> 00:22:22.980 408 November 2024 we covered Zizmor and uh and then look at the look at the uh the repo so 00:22:23.180 --> 00:22:29.280 Zizmor repo um it's Zizmor is a static analysis tool for GitHub actions uh I thought it was pretty 00:22:29.380 --> 00:22:34.600 cool so we covered it and it's got a bunch of sponsors now and look at the start count hmm we 00:22:34.620 --> 00:22:40.700 covered it in in November 2024 and right after that it kind of took off that thing totally hockey 00:22:40.720 --> 00:22:47.340 stick how about that maybe it's because of us who knows probably not but anyway um so that's pretty 00:22:47.420 --> 00:22:52.320 cool i'm sure at least one of those stars is from us at least one of the stars yeah like the one i 00:22:52.480 --> 00:23:01.480 put on there maybe um anyway so the uh so what what can you do so there's supply chain issues um uh 00:23:02.020 --> 00:23:07.340 doing static analysis of your GitHub actions definitely um something to do and this is not 00:23:07.460 --> 00:23:12.100 What I'd like to put out is this is not just business-critical stuff. 00:23:12.260 --> 00:23:15.660 It's really anything that you're putting out on GitHub, 00:23:16.160 --> 00:23:19.360 and especially things that you're releasing through PyPI, 00:23:19.580 --> 00:23:23.780 because even your little left pad thing might get exploited, whatever. 00:23:23.980 --> 00:23:26.480 You might not think about it, but somebody else could take advantage of it 00:23:27.160 --> 00:23:28.200 to lock stuff down. 00:23:28.580 --> 00:23:31.720 So we've got the static analysis. 00:23:32.140 --> 00:23:35.880 The other thing he brought up is dependency pinning. 00:23:36.160 --> 00:23:44.840 So, and this is related to the LiteLLM exploit from last week, which I don't think we covered, but hopefully everybody heard about this. 00:23:45.670 --> 00:24:05.400 So there's one of the, and this one is creepy because apparently the, even if you pinned the dependency with version numbers, that wasn't enough because a malicious package overrode the binary with the same version number. 00:24:05.820 --> 00:24:12.600 so you really should be checking the sha key is that shah or sha i don't know how to pronounce 00:24:12.730 --> 00:24:17.500 that but i think typically said shah but if you call you talk about the hashing algorithm i think 00:24:17.680 --> 00:24:23.760 people say sha so it could go either way right so but some of those that some of those are a little 00:24:23.900 --> 00:24:30.920 bit um uh a little bit hard to i mean it's hard to do deal with it's not really hard but it's it's 00:24:31.140 --> 00:24:35.140 less of a it's more of a pain than just typing out the version so there's a there's a tool 00:24:35.380 --> 00:24:42.000 apparently called renovate that helps um uh for um helps for that that part of it um and you know 00:24:42.200 --> 00:24:47.320 uv pins you like i was gonna say uv locks but now we have a problem with the uv locks on 00:24:48.240 --> 00:24:56.160 uh so um it's like whack-a-mole it's definitely whack-a-mole so uh so using things to to check 00:24:56.799 --> 00:24:58.120 to check those 00:24:58.500 --> 00:25:00.060 SHAs also. And then dependency 00:25:00.420 --> 00:25:02.100 cooldowns. I think you brought this up either last 00:25:02.240 --> 00:25:03.820 week or recently. Yeah. 00:25:04.540 --> 00:25:05.520 To be able to say, 00:25:06.380 --> 00:25:07.960 hey, I'm going to update everything, but 00:25:08.280 --> 00:25:09.220 don't update if 00:25:10.340 --> 00:25:12.120 anything's newer than seven days or 00:25:12.220 --> 00:25:14.140 something like that. I would like to point out that 00:25:14.140 --> 00:25:15.900 I do not do this. I do not. 00:25:16.240 --> 00:25:17.680 When I say it, I say one week. 00:25:18.559 --> 00:25:20.160 That's an improper fraction right there 00:25:20.160 --> 00:25:21.740 is what that is. No, I'm just kidding. 00:25:22.100 --> 00:25:24.100 Literally, mine says one week. That says seven days, but 00:25:24.300 --> 00:25:26.140 whatever. Same idea. I think it's a very 00:25:26.400 --> 00:25:33.280 It solves the problem that I talked about, and it solves the problem because after seven days, that thing's not going to exist on the package manifest, right? 00:25:33.660 --> 00:25:34.540 And it solves the problem here. 00:25:35.160 --> 00:25:38.700 It's a super simple thing, and it's not perfect, but it's a layer of defense. 00:25:39.100 --> 00:25:42.540 Yeah, so I don't think this is too much. 00:25:42.620 --> 00:25:47.500 So I think that I've got a project that I'm going to try this out. 00:25:47.640 --> 00:25:48.460 I'm going to try these things. 00:25:48.560 --> 00:25:53.280 And my guess is it's going to take me longer to figure out what to do than to actually implement everything. 00:25:54.420 --> 00:25:54.740 Yeah. 00:25:55.580 --> 00:25:56.380 That's how a lot of stuff is. 00:25:56.470 --> 00:25:58.700 Like I changed, I had to change one line, 00:25:58.910 --> 00:26:00.280 but it took me two days of research 00:26:00.560 --> 00:26:01.620 to figure out what the right choice 00:26:01.670 --> 00:26:02.620 of that one line was. 00:26:03.040 --> 00:26:04.560 I mean, and let's get real. 00:26:04.700 --> 00:26:07.260 I'm just going to point an agent at this article 00:26:07.410 --> 00:26:09.520 and say, could you do all this stuff for my project? 00:26:09.560 --> 00:26:10.340 This seems like a problem. 00:26:10.620 --> 00:26:11.380 Read it, fix it. 00:26:11.760 --> 00:26:12.520 Research it, fix it. 00:26:12.660 --> 00:26:13.260 Yep, exactly. 00:26:14.140 --> 00:26:14.320 Maybe. 00:26:15.080 --> 00:26:16.980 You can get a non-GPL version 00:26:17.070 --> 00:26:19.400 if you pay a few cents and send it through malicious. 00:26:19.760 --> 00:26:19.960 All right. 00:26:20.280 --> 00:26:21.380 So a real-time follow-up. 00:26:21.390 --> 00:26:23.740 I just want to, I forgot to credit Paul Bauer 00:26:24.020 --> 00:26:25.360 who sent in the thing about malicious. 00:26:25.540 --> 00:26:26.100 So thanks for that. 00:26:26.500 --> 00:26:27.460 And you mentioned left pad. 00:26:27.460 --> 00:26:28.920 I was curious, is there a Python left pad? 00:26:29.140 --> 00:26:29.340 Yes. 00:26:29.560 --> 00:26:31.120 In fact, there is a Python left pad. 00:26:31.640 --> 00:26:31.840 Really? 00:26:32.360 --> 00:26:32.580 Yes. 00:26:33.220 --> 00:26:36.580 Inspired by the famous left pad package on NPM 00:26:36.780 --> 00:26:37.380 that broke the internet. 00:26:37.520 --> 00:26:38.020 It's a joke. 00:26:38.440 --> 00:26:39.100 I mean, but it works. 00:26:39.220 --> 00:26:40.300 You can pip install it. 00:26:40.900 --> 00:26:44.520 It's called a port of the infamous left pad npm package. 00:26:45.040 --> 00:26:45.400 Interesting. 00:26:45.880 --> 00:26:45.980 Okay. 00:26:46.860 --> 00:26:46.980 Yeah. 00:26:47.900 --> 00:26:48.080 Okay. 00:26:49.039 --> 00:26:51.180 I think we're on to extras. 00:26:52.400 --> 00:26:53.720 I just said I have one. 00:26:53.820 --> 00:26:54.840 Do you have some extras? 00:26:55.360 --> 00:26:56.380 Yeah, I'll go ahead and go first. 00:26:57.740 --> 00:26:58.200 All right. 00:26:58.280 --> 00:27:01.140 So I want to talk about a new SaaS that I released, Brian, 00:27:01.480 --> 00:27:03.540 that people have seen me using, 00:27:03.580 --> 00:27:05.900 but they don't know that necessarily had anything to do with me 00:27:06.120 --> 00:27:07.020 called InterviewCue. 00:27:07.700 --> 00:27:11.520 So this is a Python built platform for doing podcasts. 00:27:12.100 --> 00:27:13.720 So if people are out there, they're content creators, 00:27:14.000 --> 00:27:16.120 they're podcasters, they do interviews, whatever. 00:27:16.560 --> 00:27:17.820 Give this thing a look. 00:27:18.060 --> 00:27:21.900 The whole idea is from starting out with like Brace or about an idea, 00:27:22.040 --> 00:27:23.700 all the way until you push something out 00:27:23.860 --> 00:27:26.240 as a final bit of audio file or video or whatever. 00:27:26.940 --> 00:27:29.100 It's there to like make every step a little bit easier 00:27:29.340 --> 00:27:29.960 and guide that. 00:27:30.280 --> 00:27:32.720 So I knew I was gonna talk about that this week. 00:27:32.880 --> 00:27:35.500 So last week I pressed a stopwatch start stop 00:27:35.840 --> 00:27:38.440 when I, from the time I had downloaded the audio files 00:27:38.600 --> 00:27:40.580 from our interview last week until I had shipped it 00:27:40.760 --> 00:27:43.300 with chapters, with album art, all that kind of stuff. 00:27:43.720 --> 00:27:47.900 Edited final, like raw audio downloaded to final audio 00:27:48.200 --> 00:27:51.480 and the podcast feed, 18 seconds, 51, 18 minutes, 51 seconds. 00:27:52.020 --> 00:27:52.360 - Oh, wow. 00:27:52.640 --> 00:27:54.120 - So super excited about this. 00:27:54.300 --> 00:27:55.860 Mostly I built it for myself, but I thought, 00:27:55.940 --> 00:27:57.180 you know, I'll put in some extra effort. 00:27:57.680 --> 00:28:00.580 Keep finding, I actually had to rewrite it three times 00:28:00.860 --> 00:28:02.560 'cause I'm like, yeah, this is the right UI metaphor 00:28:02.740 --> 00:28:03.320 for how this works. 00:28:03.720 --> 00:28:05.340 And I tried it on a few podcast episodes. 00:28:05.440 --> 00:28:06.680 I'm like, nope, no, it's not. 00:28:06.800 --> 00:28:07.660 This is horrible. 00:28:07.780 --> 00:28:09.560 I can't, it's just so disorienting. 00:28:09.740 --> 00:28:11.580 Do it again, I think it's really nailed now. 00:28:11.740 --> 00:28:13.340 So people are doing podcasts or interviews. 00:28:13.400 --> 00:28:14.720 I know that's not most people listening, 00:28:14.920 --> 00:28:16.140 but it's a really cool Python app. 00:28:16.200 --> 00:28:17.460 It's a mega app. 00:28:17.540 --> 00:28:19.500 It's like 75,000 lines of Python or something. 00:28:19.600 --> 00:28:20.260 It does a bunch of stuff. 00:28:20.460 --> 00:28:21.200 - Okay, nice. 00:28:21.740 --> 00:28:22.260 Yeah, thanks. 00:28:22.640 --> 00:28:23.300 Good dogfooding. 00:28:23.760 --> 00:28:24.560 Yes, dogfooding. 00:28:24.600 --> 00:28:25.360 I built for myself. 00:28:26.000 --> 00:28:28.940 One of the things that I learned as part of that, 00:28:29.100 --> 00:28:33.060 so that gives people 250 megs of free storage unlimited. 00:28:33.240 --> 00:28:34.780 It does free transcripts. 00:28:34.780 --> 00:28:35.660 It does all that kind of stuff. 00:28:36.020 --> 00:28:40.380 One of the things that makes that work is you need to be able to store stuff 00:28:40.880 --> 00:28:42.220 that's not too expensive. 00:28:42.440 --> 00:28:46.660 So if you store something on S3 or something like that, 00:28:47.220 --> 00:28:48.900 Azure Blob Storage, probably the same price. 00:28:49.160 --> 00:28:50.280 They all seem to copy each other, 00:28:50.600 --> 00:28:53.540 except for DigitalOcean, which is a little bit cheaper at seven. 00:28:54.200 --> 00:29:01.000 No, it's at one cent per gigabyte per month for a regular S3 storage. 00:29:01.360 --> 00:29:03.960 But they just came out with this thing called Spaces, 00:29:04.020 --> 00:29:05.680 which is their S3 cold storage. 00:29:06.340 --> 00:29:07.840 So you can put something up and say, 00:29:07.920 --> 00:29:09.320 I'm not going to access it very much. 00:29:09.460 --> 00:29:12.480 And if I do access it, it costs a little tiny bit more. 00:29:12.960 --> 00:29:17.340 Like instead of it costs a cent per gigabyte when you access it. 00:29:17.600 --> 00:29:20.660 So which is, you know, more than their, their default pricing or whatever. 00:29:21.120 --> 00:29:28.100 But if you don't access it, it's 0.007 cents per gigabyte per month. 00:29:28.330 --> 00:29:29.280 Think how cheap that is. 00:29:29.290 --> 00:29:29.820 That is awesome. 00:29:30.360 --> 00:29:33.800 And you don't have to have like, oh, we have Glacier, which is its own storage system. 00:29:34.340 --> 00:29:38.120 And then if we want to, we can move it back into S3 and out of us, like it's literally 00:29:38.170 --> 00:29:39.760 the same API as S3. 00:29:39.810 --> 00:29:41.140 You just use Bodo to talk to it. 00:29:41.400 --> 00:29:45.960 But if you, your access pattern is very infrequently, which, you know, it is, you record a podcast, 00:29:46.040 --> 00:29:47.360 maybe you touch it once or twice. 00:29:47.940 --> 00:29:49.580 There's like a little cool trick with disk cache. 00:29:49.700 --> 00:29:52.360 So most of the time when it's sort of in an active mode, 00:29:52.430 --> 00:29:53.500 it doesn't even go to the internet. 00:29:53.590 --> 00:29:56.360 It just works with like a local volume at Hetzner. 00:29:56.710 --> 00:29:59.440 And then if it needs to go back, it's still pretty cheap. 00:29:59.780 --> 00:30:00.140 Isn't that cool? 00:30:01.440 --> 00:30:04.760 So what would you put in the cloud that you don't access very often? 00:30:05.600 --> 00:30:06.220 Backup files. 00:30:06.690 --> 00:30:08.960 Like, so for example, let's say you want to store the, 00:30:09.080 --> 00:30:11.160 let's go back to interview QS, something concrete, right? 00:30:11.210 --> 00:30:11.800 Just so it's concrete. 00:30:12.280 --> 00:30:15.520 One of the things that we'll do is it will generate transcripts for you. 00:30:15.820 --> 00:30:21.860 So it could take that VTT or SRT file or whatever, like a text file, put it into this cold storage. 00:30:22.430 --> 00:30:25.460 Also put like a 30-day local cache where it works with it. 00:30:25.510 --> 00:30:27.340 But after that, it just runs out of space. 00:30:27.510 --> 00:30:28.040 It throws it away. 00:30:28.460 --> 00:30:32.620 So maybe it's in this little local cache for like the two days that you're editing the podcast. 00:30:32.980 --> 00:30:38.300 But how often do you go back to a podcast you did last year and then pull up the transcript segment and want to look at it? 00:30:38.560 --> 00:30:43.540 Most people who would use a service like this would just go like, well, once I've produced it and downloaded the final transcript, 00:30:43.620 --> 00:30:47.880 like they don't go back and mess with it again right so it's that kind of thing it's like when 00:30:47.980 --> 00:30:51.720 you're creating something or you're actively editing it then you want those files there you 00:30:51.720 --> 00:30:55.720 want that access but then pretty soon it's going to fall into like i just want it historically kept 00:30:55.840 --> 00:31:00.420 for me okay i think there's a lot of access patterns for that all right uh back to fire and 00:31:00.480 --> 00:31:04.760 forget so i talked about this last week this fire and forget pattern and how this was pretty sketch 00:31:04.760 --> 00:31:10.659 that i thought i still believe that to be true um i have two things on it one i'm sorry i don't 00:31:10.680 --> 00:31:14.060 remember who sent me this message. I can't, I'm sorry. I can't remember who sent me this, but 00:31:14.150 --> 00:31:18.960 thank you for sending me. They said, actually, I said, starting in Python 3.12, this has been a 00:31:19.280 --> 00:31:24.640 problem. What they said is starting in Python 3.12, what happened is the documentation pointed out 00:31:24.780 --> 00:31:29.740 that this was a problem. Whereas previously it was a silent sort of unknown issue. So they think 00:31:30.020 --> 00:31:35.280 that it has been there since 3.4, 3.4, whenever, whenever create task got defined and asyncio got 00:31:35.420 --> 00:31:40.400 defined, you know, the year before async and await, which I think that's 3.5. Anyway, for a long, 00:31:40.460 --> 00:31:44.920 long time that it has been there but in 3.12 the documents were documentation was updated say hey 00:31:45.020 --> 00:31:50.080 this is a problem be aware of it so it could be that this has always been a problem and it's just 00:31:50.300 --> 00:31:55.780 that you know the for people who don't know if you just go and say hey i want to fire something off 00:31:55.880 --> 00:32:01.260 in the background to let it run on the event loop async io.create task and you give it the async 00:32:01.400 --> 00:32:07.319 function that's not enough that is not enough to keep it from getting garbage collected potentially 00:32:07.400 --> 00:32:09.380 because the loop itself doesn't hang on to it. 00:32:09.520 --> 00:32:11.200 Okay, so that's the issue, right? 00:32:11.280 --> 00:32:12.760 They think that that's been the case forever 00:32:13.200 --> 00:32:14.420 and they just document it in 3.12. 00:32:14.760 --> 00:32:15.480 So thanks for pointing that out. 00:32:15.510 --> 00:32:16.580 I don't know that should be true. 00:32:16.660 --> 00:32:18.320 I looked into it and didn't find a great answer. 00:32:18.720 --> 00:32:22.320 The next thing though is another person pointed out, 00:32:22.470 --> 00:32:25.860 Richard pointed out that Will McGugan wrote an article 00:32:26.100 --> 00:32:28.520 called the Heisenbug lurking in your async code. 00:32:28.820 --> 00:32:29.440 What does it talk about? 00:32:29.720 --> 00:32:31.940 Well, if you do create task, guess what? 00:32:32.160 --> 00:32:33.260 It could be garbage collected. 00:32:33.310 --> 00:32:35.380 It may disappear without warning during garbage collection. 00:32:35.660 --> 00:32:36.260 Da da da da da. 00:32:36.680 --> 00:32:37.780 And so that's all well and good. 00:32:38.160 --> 00:32:38.960 Thanks, Will, for writing that. 00:32:39.320 --> 00:32:41.640 So I did another post that sort of talked about that. 00:32:41.690 --> 00:32:46.880 But what's interesting is, luckily, Will added numbers and concrete search values. 00:32:47.440 --> 00:32:53.120 So if I go here, there are, wait for it, 586,000 separate code files that have this pattern. 00:32:53.720 --> 00:32:55.400 Because people have been telling me, it's not a problem, Michael. 00:32:55.500 --> 00:32:57.540 This is some weird edge case that only you care about. 00:32:57.900 --> 00:33:00.120 Me and the 586,000 other people, right? 00:33:00.190 --> 00:33:00.480 Look at this. 00:33:00.580 --> 00:33:01.960 The very first hit is like, boom. 00:33:02.300 --> 00:33:03.380 They're not putting it into like. 00:33:04.400 --> 00:33:06.720 So not every one of these 586,000, 00:33:07.260 --> 00:33:09.740 actually, like this is actually a documentation line here. 00:33:10.300 --> 00:33:11.680 This one, they are holding the task. 00:33:12.060 --> 00:33:13.220 But even on the first page, 00:33:13.240 --> 00:33:15.740 which is like a very small amount of those half a million, 00:33:16.160 --> 00:33:18.620 there's five instances where they're doing the thing 00:33:18.820 --> 00:33:20.200 that you said you're not supposed to do. 00:33:20.460 --> 00:33:22.300 So, all right, that's it for my extras. 00:33:22.660 --> 00:33:25.180 But I thought that would be a fun follow-up on two accounts. 00:33:25.440 --> 00:33:27.420 Yeah, I just have one extra. 00:33:27.640 --> 00:33:30.180 And that is that GitHub is, 00:33:30.780 --> 00:33:32.139 I went to GitHub this morning 00:33:32.460 --> 00:33:34.520 and notice that on April 24th, 00:33:34.530 --> 00:33:36.280 they're going to, GitHub Copilot 00:33:36.820 --> 00:33:38.840 is going to start recording interaction data 00:33:39.120 --> 00:33:41.300 for their AI model training unless you opt out. 00:33:41.640 --> 00:33:44.480 So a company is actually asking before they spy on you. 00:33:44.630 --> 00:33:45.180 So that's nice. 00:33:46.060 --> 00:33:47.220 But they're going to spy on you. 00:33:48.700 --> 00:33:48.800 Yeah. 00:33:49.460 --> 00:33:51.300 Well, you can opt, apparently you can opt out. 00:33:51.440 --> 00:33:52.560 Yes, I've already opted out. 00:33:52.900 --> 00:33:53.220 Have you? 00:33:53.540 --> 00:33:53.680 Yeah. 00:33:53.820 --> 00:33:55.200 I was going to, and I'm like, 00:33:55.290 --> 00:33:57.220 do I really care how they, 00:33:58.340 --> 00:34:00.240 my GitHub interactions are? 00:34:00.880 --> 00:34:05.180 And honestly, it's kind of a no-op for me or, you know, a tree falls in the forest. 00:34:05.290 --> 00:34:06.020 No one learns to hear it. 00:34:06.070 --> 00:34:07.360 Like, actually, the tree does still fall. 00:34:07.480 --> 00:34:09.740 That's a pretty human-centric perspective of the world. 00:34:09.879 --> 00:34:15.820 But this is GitHub Copilot interaction, not your repository data, right? 00:34:15.919 --> 00:34:16.399 That's what it says. 00:34:16.440 --> 00:34:21.639 On April 24th, we'll start using GitHub Copilot interaction data for AM model training, unless 00:34:21.730 --> 00:34:22.159 you say no. 00:34:22.470 --> 00:34:23.700 I don't use GitHub Copilot. 00:34:24.719 --> 00:34:27.520 So maybe they can have all my interactions or none of them. 00:34:27.679 --> 00:34:28.120 They'll be the same. 00:34:28.580 --> 00:34:35.820 When I first saw that, I thought, oh, they're going to start, they're asking for permission to use my code in my repository and my issues and stuff for training. 00:34:35.899 --> 00:34:37.340 But that doesn't sound like what it is. 00:34:38.100 --> 00:34:38.639 What are they? 00:34:39.240 --> 00:34:41.780 Okay, the GitHub Copilot interactions with. 00:34:42.060 --> 00:34:42.280 Yeah. 00:34:42.659 --> 00:34:47.220 So the ones, probably the ones I'm responsible for, like when am I using GitHub Copilot? 00:34:47.460 --> 00:34:47.580 Okay. 00:34:47.919 --> 00:34:48.060 Yeah. 00:34:48.240 --> 00:34:53.520 And like, if you go to the GitHub homepage, there's a ask Copilot sort of thing. 00:34:53.740 --> 00:34:56.879 and there's other areas where if you do a search, 00:34:56.899 --> 00:34:59.060 I think some Copilot stuff in the PR, 00:34:59.120 --> 00:34:59.660 you might be able to, 00:35:00.020 --> 00:35:01.840 especially if you're a paid user of Copilot, 00:35:02.080 --> 00:35:03.820 that's a much bigger thing. 00:35:04.160 --> 00:35:06.460 Yeah, one of the interesting things is you can ask, 00:35:07.340 --> 00:35:08.060 where'd it go? 00:35:08.340 --> 00:35:11.140 I think you can ask an agent to like, 00:35:11.240 --> 00:35:12.320 oh yeah, here we go. 00:35:12.360 --> 00:35:13.500 If I'm looking at an issue, 00:35:13.860 --> 00:35:16.720 you can assign it to an agent to have them fix it. 00:35:16.960 --> 00:35:18.040 I haven't tried this. 00:35:18.120 --> 00:35:19.480 I might try this on this one. 00:35:20.440 --> 00:35:22.480 I've already been having mine do that, 00:35:22.620 --> 00:35:29.760 but not through copilot in Claude Code i just say hey claude issue 199 of this repository i would 00:35:29.760 --> 00:35:34.680 like to work on that can you get can you plan that out with me and have a conversation and 00:35:35.020 --> 00:35:41.000 it just goes logs into GitHub using the gh cli pulls it down understands it and then and keeps 00:35:41.180 --> 00:35:48.619 working with it so it's not exclusive to uh to GitHub and copilot if you have the gh cli installed 00:35:48.640 --> 00:35:49.340 Which is very cool. 00:35:49.830 --> 00:35:49.940 Okay. 00:35:50.900 --> 00:35:52.660 Yeah, that looked more scary to me before. 00:35:52.930 --> 00:35:54.020 And now I'm like, actually, I don't care. 00:35:54.520 --> 00:35:54.920 I don't care. 00:35:55.960 --> 00:35:57.140 Should we talk about something funny? 00:35:57.580 --> 00:35:58.400 We shall make a joke. 00:35:59.000 --> 00:36:01.300 So for an InterviewCue, I'm going to press Mark as asked. 00:36:01.450 --> 00:36:01.800 There we go. 00:36:02.500 --> 00:36:07.560 So I can't tell for sure if we did this before, but if so, it's been long enough that I think it'll be fun. 00:36:07.880 --> 00:36:08.080 Okay. 00:36:08.680 --> 00:36:08.940 All right. 00:36:09.230 --> 00:36:16.040 So Will Smith and iRobot, I think that's a good sort of future, but looking back to like now type of thing, right? 00:36:16.360 --> 00:36:18.520 So Will Smith talking to one of these robots, 00:36:19.080 --> 00:36:22.160 can an LLM write maintainable code? 00:36:22.430 --> 00:36:26.540 The robot stares back with its mechanical eyes. 00:36:26.820 --> 00:36:27.280 Can you? 00:36:29.620 --> 00:36:30.140 Oh, snap. 00:36:30.680 --> 00:36:31.120 Oh, snap. 00:36:34.420 --> 00:36:34.780 Yeah. 00:36:35.260 --> 00:36:36.220 I mean, it's a funny joke. 00:36:36.310 --> 00:36:38.440 I think it's a funny joke just because of the time and so on. 00:36:38.920 --> 00:36:40.580 And there's a lot of variations that you could have on it. 00:36:40.640 --> 00:36:41.660 I haven't read the comments. 00:36:41.770 --> 00:36:42.460 We have to read the comments. 00:36:42.860 --> 00:36:50.440 But there are certainly co-workers I've had in the past who I would take Claude Code over that co-worker for working on my code together. 00:36:50.940 --> 00:36:51.540 Yeah, definitely. 00:36:52.160 --> 00:36:52.280 Yeah. 00:36:52.500 --> 00:36:53.960 Not saying the Claude Code is perfect. 00:36:54.090 --> 00:36:55.040 I just want to let it run loose. 00:36:55.560 --> 00:36:59.700 But I've had some people who are like pretty bad, especially people taking some of my training classes. 00:36:59.930 --> 00:37:01.560 And how did you get into this? 00:37:01.860 --> 00:37:02.700 I mean, this company? 00:37:03.210 --> 00:37:09.020 I had some, I'll tell you, I don't want people to feel like I'm making fun of people over like being too picky or elitist. 00:37:09.320 --> 00:37:14.220 This is a person who worked at a, either a bank, something, let's say a bank, like something like 00:37:14.220 --> 00:37:20.100 a bank, like a big enterprise company. And this was when I was teaching C-sharp way back in the day. 00:37:20.580 --> 00:37:25.220 And we would do like an hour's worth of presentation and demos. And then it was, 00:37:25.360 --> 00:37:29.040 okay, now you guys for the next hour, work on this thing. That's like a derivative version of 00:37:29.050 --> 00:37:32.940 what we've been talking about. Right. And this person who has been employed at this company for 00:37:33.100 --> 00:37:37.920 six months as a software developer, professionally at a bank, read the instructions. So Michael, 00:37:38.000 --> 00:37:41.340 I need help. I said, no, no problem. What's going on here? Like, well, I can't get this 00:37:41.760 --> 00:37:46.960 to work. And they had variable name equals some sentence, no quotes around it. I said, 00:37:47.020 --> 00:37:50.560 oh, you got a couple of problems here. That's a string. So you need to put quotes around the 00:37:50.720 --> 00:37:54.280 string. What are you talking about? Like, I don't know what to tell you. Like you need to put the 00:37:54.480 --> 00:37:58.840 quote character at the beginning and end. So like the compiler knows that this is actually a string 00:37:59.120 --> 00:38:04.899 bit, not just other keywords and stuff. Like see the thing left of the enter shift, press that 00:38:05.200 --> 00:38:05.780 and put it at the beginning. 00:38:05.820 --> 00:38:08.340 And it was like a challenge to get those quotes in there. 00:38:08.720 --> 00:38:09.560 And then it still wouldn't work. 00:38:09.640 --> 00:38:12.100 I'm like, oh, because you have to declare the variable as a string. 00:38:12.660 --> 00:38:15.860 Like, so you have to say string space email equals whatever, 00:38:16.160 --> 00:38:16.960 or whatever it was, right? 00:38:17.100 --> 00:38:17.580 What do you mean? 00:38:17.960 --> 00:38:21.600 I'm like, six months as a professional developer in this language. 00:38:21.720 --> 00:38:23.400 This was not like they're starting this language. 00:38:24.140 --> 00:38:26.300 I'm like, okay, I will take Claude Code all day. 00:38:26.440 --> 00:38:29.160 I will take this robot thing all day over that as a coworker. 00:38:29.620 --> 00:38:29.700 Seriously. 00:38:30.300 --> 00:38:32.020 So I don't think I'm being harsh to say that. 00:38:32.579 --> 00:38:34.540 That's out of bounds of like, you shouldn't be. 00:38:34.940 --> 00:38:37.400 You should have gotten past that step after six months, eight hours a day. 00:38:38.620 --> 00:38:43.740 So lesson out there, if you know what quotes are, you might be able to get a job. 00:38:44.200 --> 00:38:48.680 Yes, if you know how to make a string in a programming language. 00:38:49.060 --> 00:38:49.180 Okay. 00:38:49.520 --> 00:38:52.160 While we're on the tangent, I'll just get one more tangent. 00:38:52.670 --> 00:38:58.980 So I had an interview once somebody came in and it was a contract position. 00:38:59.380 --> 00:39:07.920 But still, I usually start with a real lowball question just to make sure. 00:39:09.240 --> 00:39:19.580 And I usually say something like, okay, I just want to write a function in Python that takes a user input string or takes a string. 00:39:20.320 --> 00:39:22.260 Or actually, what is it? 00:39:22.340 --> 00:39:25.720 Write a function that takes two numbers and adds them and returns the answer. 00:39:26.380 --> 00:39:53.480 This was a long, it took a while to get to the point where I could say, let's actually, let's stop. And I don't want to try to be cold. So I usually like ask about their background and whatever and fill out the hour. But it was clear that this wasn't going to work because they, this firstly started out with like print statements to the standard out and using the input command to get user data. 00:39:53.620 --> 00:39:55.280 And I'm like, no, it's a function. 00:39:55.350 --> 00:39:56.460 It just has parameters. 00:39:56.740 --> 00:39:57.020 That's it. 00:39:58.900 --> 00:39:59.080 Oops. 00:39:59.600 --> 00:40:01.080 So, yeah. 00:40:01.340 --> 00:40:04.720 Anyway, lots of different backgrounds that get into software. 00:40:05.180 --> 00:40:05.540 So, yeah. 00:40:05.800 --> 00:40:06.000 Yeah. 00:40:06.720 --> 00:40:09.020 Definitely some that I would take an agent over. 00:40:10.680 --> 00:40:11.740 But that's funny. 00:40:12.980 --> 00:40:14.380 Let's look at the comments real quick. 00:40:14.690 --> 00:40:14.820 Okay. 00:40:15.340 --> 00:40:17.940 John says, man, this is going to slay on LinkedIn. 00:40:21.360 --> 00:40:22.380 Oh, my gosh. 00:40:22.880 --> 00:40:23.000 Yeah. 00:40:23.580 --> 00:40:26.020 Right. Everyone acting like they're Linus Torvalds. 00:40:29.760 --> 00:40:33.140 Yeah. So would you, LinkedIn's weird. 00:40:33.640 --> 00:40:35.560 Every time I pick my head into LinkedIn, 00:40:35.680 --> 00:40:38.820 I like try to back out because I think it's all just full of bots. 00:40:38.940 --> 00:40:40.620 I don't think there's any people there left. 00:40:40.820 --> 00:40:41.680 So yeah, well, 00:40:41.720 --> 00:40:44.680 you haven't embraced your a hundred day ones attitude. 00:40:45.500 --> 00:40:47.920 Guess not. Anyway, good episode. 00:40:48.480 --> 00:40:49.380 Fun talking with you. 00:40:49.680 --> 00:40:53.220 Thanks to everybody that showed up to listen and we'll see you all next week.