Pia Mancini: Yeah, absolutely. And look, right now, this year, for me it’s about focusing a lot on the whole lifecycle of a collective. We’ve become really good at “You need to be up and running today? We’ve got you. This is what you need to sign, this is where you need to send the money, this is how you do it.” It’s super-clear, zero friction. But then as groups start to grow on the platform, we are not so good at taking care of that middle-sized group that – you know, they manage anything between $500,000 to over a million budget, or $300,000 to over a million. Then they are like “Alright, at what point is it worth for me to start doing my own thing, my own entity? Is it now, is it later?”

So we want to focus more now on also supporting those groups… And once they transition out, what I would really like to see is for OpenCollective to also accompany these groups as they transition out… So we become kind of the backend; this kind of transparency and open finances ethos that we bring stays with these organizations even as they become their own legal entities. You know, we just keep giving them for free the OpenCollective platform for them to kind of keep this transparency.

And then I guess maybe more future thinking, how can we more like strive for non-profits kind of style? So you become a collective, we help you grow, you grow with us, you raise funds… It’s time for you to kind of move on. We’ll give you OpenCollective as your backend, but look - it’s hard to do not-for-profits; we’ve been doing this for many years. We have legal advice. We’ll help you create your not-for profit and then you can go do your thing in the world. That kind of whole lifecycle for me is very interesting, without losing our core focus that is from zero to one, really helping initiatives today.

Karan Malhotra: I think that, of course, generally, US and international regulation on this stuff is evolving; the conversation is evolving very much. So naturally, you have to keep it top of mind; you have to think about these kinds of things. But thankfully, because all of our model releases are like open source, and we don’t profit from them… Like, if somebody goes off and creates a product using our model, good for them, but we don’t necessarily take on that liability or that worry of saying “Hey, we’re gonna sell you this model that was created with GPT 4 outputs.” We actually actively try to stay away from doing that. But because the data distillation paradigm is so effective… You know, if a model comes out that’s better than GPT 4, and it’s open source, and I can use it locally, and in their TOS it says “You can use this to make a commercial model”, that we can apply the same techniques that we’ve been preparing and researching and understanding from these closed models, and use it there.

[00:18:11.01] So right now, we don’t stand to, or try to, or have any plans to profit from using any of these outputs. We’re not about that, because we want to be careful and respectful of these model creators and these companies. But that being said, we’re learning all these techniques and developing all these techniques that will be useful for when that time comes, and for when that’s available, especially with the advent of something like Mistral. If we do distillation from a Mistral model, like Mistral Medium, or something like that, that’s completely, from my understanding - barring their TOS saying otherwise, but I believe it doesn’t - it’s completely okay in that situation for us to create models like this, that can be used commercially etc. Regarding the TOS stuff though, as much as we err on the side of caution, I’d find it hard to see a company enforce their TOS when these larger models are likely trained on not all copyright-free stuff. I’d find it hard-pressed to believe that these closed source companies, their models are totally copyright-free, and totally copyright-clean.

So if some other company that was feeling a little more rambunctious than ourselves was to say “We’re going to commercially release on this”, I imagine it’d be difficult for them to be come after without the other group opening their books. And there’s actually a pretty interesting interaction that happened regarding this between Google and Open AI, if you guys are familiar. [laughs]

Gergely Orosz: Yup. I have been writing on and off on my blog, about like one article per month, and I was thinking “Well, I might wanna turn that up, because I really enjoy writing about interesting stuff.” It does take time to research, so I actually came up with a compromise where I still write about once a month, a lot more detailed articles for anyone to read… So there’s a free tier where you can subscribe - and it also goes on my blog you don’t even need to sub to a newsletter although you do get it in your inbox. And then for people who are engineering leaders, I write about some more insider details that you don’t really see. So if you’re an engineering manager or a senior engineer at a high-growth startup or a big tech, it’s the type of information that you’re gonna look out for.

And a good example was the insane hiring market, which - I basically write about open secrets in the industry. If you’re in the right circles, you know this already; you’ve been talking about this with people. But a lot of people don’t… And a hiring market is a very crazy one, because – everyone was talking about a crazy market, but I actually did the research; I talked with hiring managers, recruiters, job seekers, I actually helped a lot of people negotiate their packages… And the crazy thing is that it has never been this crazy. When I say “never”, I’m not exaggerating. There was a dotcom boom where the hiring market was insane, and most of us were not even working then. There were some people who were, and I talked with them, and that was a crazy market. This market is even more crazy for experienced engineers… And a lot of people think it’s because of remote work, and Covid, and people start to work remotely, and now we can hire in different areas… But it’s actually just one of the many elements.

[32:12] What actually happened is there’s just a huge amount of money being poured on the market, that’s coming from a couple of sources. The first one was – and everything starts with Covid; Covid was this tick started a lot of parallel things happening. The one thing that it started, which is very interesting - I talked with a couple of heads of engineering and heads of mobile at some large retail banks in the U.S, and some more traditional companies… When Covid started, people stayed home because of the lockdowns, and they started to use online services more. For example, on mobile, one of the biggest U.S. banks told me that what they saw is they saw a bunch of user complaints, and their user numbers went up because people above 70 started to use their mobile apps, and they didn’t know how to use it. These people always went to the bank… And now they’re actually at risk of losing these customers if they couldn’t do this, so they suddenly started to build features to make it easier for these people to do… And also, what they noticed is it’s a huge profit if people use the mobile app. Whoever uses the iOS app for this bank churns a lot less, they basically spend more money… So it’s their goal to get them on there. And it’s not true for people who only use web, or only use some other platform.

So this bank started to – they actually reallocated a massive amount of budget mid-year to hire more mobile engineers. They couldn’t hire fast enough, so they actually are retraining some of their web engineers. And they are one company. So this is a traditional company; it’s not a Facebook, it’s not a Google…

Then you have some of the other side of the money coming in, where some of the large tech companies also realize with Covid the game is on, the competition is fierce, they are pouring more money… And the capital markets are going very strong, so startups are raising more money than ever. There’s this joke that the seed in 2021 is the new series A five years ago… And I’m advising a couple of startups - I’m in some of these groups, and I’m seeing pre-seeds, people getting 4 million dollars and a 12 million evaluation for a pre-seed for an idea, a product.

So there’s all this money coming in… And basically, everyone has realized that there is now a limited time, the next 3-5 years the winners will be decided in the global digital market… Both in traditional companies who need to become more digital, they realize they need to compete with Google or Facebook… So the likes of Macy’s, for example, IKEA - some of these companies are hiring executives from the big tech, from Google, from Facebook, from whoever they can. The banks are doing the same thing. The VPs of engineering at Uber went to Goldman Sachs, where they’re probably gonna build some consumer-facing thing.

So everyone has arrived, and everyone wants the senior people, so the market has literally exploded for senior people, and it’s everywhere. So in California, offers are – year-on-year, offers are up about 20%-30%, depending on where you are… But this is in California. In lower-cost regions, because of remote, it’s even higher.

The craziest thing about this market - it’s a booming market if you’re an experienced technologist/engineer. It’s also spilling over to all these engineering managers, technical program managers, to some extent to designers as well… The one group that is not feeling any of it and is the worst market for them is junior or entry-level engineers. No one wants to hire them. Because of remote, every company knows they don’t really know how to onboard them… And what everyone is spending money on is they’re building more complex systems; large, scalable systems. They need that expertise.

And to top it off, the cherry on the top, which just shows how absurd it is - there’s actually fewer senior engineers on the market. Usually, in a booming market people will come out of their hiding holes, if they’re doing something… The opposite is happening, because people are burning out because of Covid, they’re quitting with nothing lined up to just take a break for a couple of months, from 3 months to 12. They’re changing careers, like myself… I have a bubble where I know some senior engineering managers who are now becoming coaches and whatnot… And this data point is a bit anecdotal… I have data points in my newsletter for all the other ones, but…

[36:03] So it’s a crazy market, where demand is going up, supply is going down, and we’re not going to have more senior engineers in the next year or so… And it’s a race to the top, basically. So the likes of Google, Facebook, Apple - they’re still able to hire, but crazy stuff is happening that I had never heard before. For example, Apple is known to not negotiate too much. They give you an offer; it’s Apple, you accept it.

I now have multiple cases where I was advising people on their sale negotiation where Apple not only negotiated, they bumped people up an extra level. So someone was offered a senior engineering role, and they got a staff. And they didn’t even have a competing offer; they said they were talking with other startups where they might have a competing offer, and Apple just said “Alright, we’re bumping your comp with 30%. You’re getting a higher level without any interview.” And this just shows how even those companies are having trouble both hiring people, and also retaining people. A lot of people are leaving.

So yeah, it’s never been a better market to look around and change jobs, if you’ve got the skillset to interview, if you’re experienced… And if you’re starting out, it’s super-tough. Just get your foot in, it’ll get better, but it’s really interesting, that market.

Kevin Ball: You almost alluded to one there, in network stability. There’s the ability to function in some form or another without internet; the whole like local-first, or something in that domain, where maybe you can load it asynchronously with this inconsistent network, but then once you’ve got it loaded, you’re able to interact there.

Paul Vixie: So a lot of companies see it in their best interests. They need a better internet to provide more value to their customers, and so they send people to the normal engineering task force meetings, where these protocols are debated, and [unintelligible 00:28:15.09] They will often fund an employee to work on what is now called open source software, although when [unintelligible 00:28:24.21] that name hadn’t been created yet. But if you’re in the tech business, you have to be an innovator here. You have to, well, have a seat at the table, and you do that by contributing. There’s no way you could get an internet without openness. And you can’t have openness without a big tent.

Aside from that, one of the nonprofit companies that I started and ran for a while was called the Internet Systems Consortium. And they still exist. I left them on 2013, but I’m on very good terms with them. And they’re still very much in the thick of all of this. And we used to simply accept contracts, either from companies or from government agencies [unintelligible 00:29:13.14] Advanced Projects Research Administration of the DOD paid us to add DNS security to the bind software. And it’s a normal-looking software development contract. We want these features, we want them by these dates, and this is a milestone of when we will pay you how much. And after we signed that, and everybody knew what to expect. And that was often – that’s the way a lot of this stuff got done back in the ‘90s and the 2000s. Because there were things that had to be done, where there wasn’t a critical mass of commercial interests who all saw “Yes, that’s vital.” Or if they did, they said “It’s vital, but I don’t want to work on it in conjunction with my competitors.” But they would all be willing to go to, let’s say the W3c, or the Apache foundation, or us at the Internet Systems Consortium and say “Look, you’re in Switzerland in this situation. As long as you do what the IETF has decided will be done, then we’re totally ready to pay for it.” So this is all the norm now, but it was pretty controversial in 1990. But it’s the norm now.

Break: [00:30:36.22]

Anna Pobletts: Adam, you were talking about your mobile military ID, or something like that, that you use at Home Depot… This reminded me of a really cool thing that is kind of post passkeys. It’s probably a while out still, but I think it’s the future, and it’s a really cool thing to think about, called verifiable credentials. And it’s basically verified mobile IDs, and things that. And so letting you store your verified military ID in your wallet, in your iPhone wallet, or in your 1Password, and using that to verify over the internet, without you having to scan your phone all the time. And it’s very much similar to a passkey type of protocol. It’s sort of like the next evolution of that, and something that’s kind of coming after passkeys, and I think it’s cool how there’s just so much exciting identity-based new technology coming out in the next few years, I think. It’s just a lot of cool stuff to make your life easier on the internet. And the fact that you brought that up just kind of reminded me of that.

Ron Evans: Not on the Arduino hardware itself, other than TinyGo, but all of their command line tools, and their tooling that they’ve rewritten in the last couple of years, it’s all written in Go… The Arduino IoT cloud is all written in Go, and uses a lot of open source… So they’re really, really active in the Go world, without necessarily getting a lot of attention for that… But they were so kind as to sponsor the community hardware hack day, so we had like – I forget… 300 Arduino kits using that exact board, Tobias, that you have.

So one of the reasons why they’re such great support is – well, first of all, we had to do it, or else we were really uncool, but also, we had all these people, hundreds of people all at once, using these… So we got a lot of bug reports and pull requests. It was just a frenzy. It was so exciting and satisfying, and a lot of people who I really like and respect, who work at Google, came over, because their room was empty, sad, lonely… And our room was packed with people having fun, and doing all this cool stuff with Go… Thank you very much to the Go team, we couldn’t do it without them. But that’s one reason why it’s a really well-supported board, is the community that is around Arduino just in general is really strong, and the TinyGo community has been really supportive contributing things back…

So combining those together - it really spread out a lot. Especially the Wi-Fi capabilities - that’s a really important thing. I mean, it’s internet of things - without internet, they’re just things… Which - things are cool. I like things. But you need wireless things. So yeah, the Wi-Fi is really important. Even though the boards are named the same, the two boards that Tobias was mentioning are actually based on completely different processors. The Nano 33 IoT board is based on the microchip SAM D21, which is a very inexpensive but powerful chip that’s used in a lot of boards. A lot of the boards from Adafruit, a lot of the boards from SparkFun, several different boards from Arduino, a lot of other manufacturers as well… So - a very cool little chip.

[24:12] But then the other chip that they have in their other – the Nano IoT BLE, that’s actually a Nordic Semiconductor chip, the nRF52840. So that’s a really common Bluetooth chip. A lot of the Bluetooth dongles that you might buy for a USB port for a long time have been based on Nordic Semiconductor chips, or chips that license their stack… So - unfortunately, they’re two different stacks of hardware, and they’re not really compatible with each other. So if you have one chip, you can use Bluetooth; if you have the other chip… It actually does not have Wi-Fi built in. It’s actually using what I think Tobias had mentioned, another chip - kind of a co-processor - for Wi-Fi, which is actually an ESP32, which Vladimir I think had mentioned, is wanting to have the support for. So that’s a very common co-processor for Wi-Fi that’s bundled on a lot of the boards… Which sort of makes sense as a pattern for hardware that you see… Similar to your notebook computer has many different processors in it. It’s got a small microcontroller that does nothing more than deal with the keyboard, for example. And so on.

So combining these different chips together and creating a system out of them - that’s really what the hardware is about; it’s about combining these interfaces, and there’s some standards that already exist for doing that. So kind of our overall story arc of TinyGo is the more of these standardized interfaces that we support, the more that we make it possible to do really anything that you can do with any C program, being able to do that with a Go program… Except, of course, it’s memory-safe, you have all the cool tooling, you’ve got the concurrency… There’s a lot of great things.

Alex Sexton: Yeah… I tried to do a Google search without internet connection - zero results. [laughter] Zero. None. Deal with that. [laughter]

Matt Aimonetti: It’s all around the country, 23 prisons. Defy Ventures is the name of the organization, and the founder is this amazing woman who’s been working on that project for 20 years now, and she’s really fighting to give a second chance… It’s not even giving a second chance, it’s giving them the tools they need to be successful, because those people are very talented people. They were just not given the chance to do it.

Anybody can go…They have different levels. It can be just like helping them practice their pitch or coaching… They teach programming to people who are interested in learning how to program. But it’s extremely hard… What I realized going to prison - I knew it would be hard and everything else, but they have no access to internet, ever. No access. If you want to learn how to program without internet, it’s actually really, really hard. It’s only with books. You also have no coffee, which… I should have thought about that, but there is no coffee, ever, in prison. That’s something that surprised me a little bit, and makes a lot of sense. But imagine a programmer without internet and coffee, trying to be better. That doesn’t really help.

[48:24] So if you can find some of your time… And this is not about going and saving those poor people in jail, this is about you learning a lot about yourself, and also giving them a chance that maybe you got from someone else when you were a kid.

Zach Latta: [12:03] Yeah, sure. So by way of background, I’m Zach, I’m the founder of Hack Club. And I grew up in Southern California, where both my parents were social workers. My mom worked in foster care, and my dad in homelessness, and I went to public schools, that like most schools in America still today didn’t offer any coding classes. And I was really lucky enough to be part of, I think, one of the first generations that really didn’t know a world without the Internet. And when I would get home from school, starting in like third grade, I would just – like, I could not pull myself away from the computer. It felt like “Oh, my God. This is where the secrets of the Universe lie.” And when I realized that you could learn how to code and not just consume stuff from the computer, but be one of the creators, that was the most exciting, interesting idea, and I’m like “Somehow I have to figure out how to be one of these wizards that knows how to do this.”

And I, got involved, I taught myself after school on the internet, and when I made it to high school, I felt so incredibly lonely, because it felt like the one thing I wanted to do with all my time, which was make things with code, was also the one thing I couldn’t do at the one place where I had to spend all my time, which was school. And I think generally – I kind of had felt like there’s this whole path that’s set up for young, ambitious people. First you do x, then you do y, then you do z. And I always felt like a bit of a misfit within that. And I ended up dropping out of high school after my freshman year. I had moved to San Francisco when I was 16 to become a programmer. I helped make one game that became the most popular game at the App Store at the time. It’s called Football Heroes, you can still download it. I was like a junior programmer on the team, and probably held us back more than I contributed… And that was like an incredibly meaningful chance to work on a real piece of software for the first time.

And then I helped build an app called Yo!, which was like Facebook Messenger but the only word you could send to people was the word yo. And the idea was like “What if we build an app that’s like so silly, so ridiculous that it can become viral just from that premise?”

[14:07] “Guys, something interesting just happened… So I downloaded Wajeed’s Bro app out of curiosity, and found it very sticky. I’ve never felt like I was anyone’s bro before. The only people who have used that term with me were assailants… But I started bro-ing people, and getting bro back. And all of a sudden, I’m bros with all kinds of people, including a guy from Branscomb Ventures.

Branscomb? That’s a solid shop.

So we bro-ed about this and that, and then when he heard I worked at Pied Piper, he got excited, he tripled-liked my bro, and he asked about meeting us.

Jared, what did you tell him?

I was waiting a bit to bro him back, so that I don’t seem overeager…

Bro him back, bro him… We’re not dead yet, guys.”

And that just absolutely blew up, and became the number one app on the App Store.

Kevin Ball: [01:04:35.29] …which is - kind of to Amal’s point… You know, we make trade-offs about what we’re going to do in technology all the time. And businesses make trade-offs all the time. What has been missing, I think, is the realization that this is a trade-off that is being made. I think for a very long time - in web years anyway - React or a React-like framework has been the way. It is the way you do it; you’re gonna win on how fast you can ship things, you’re gonna win on how nice a thing you can ship, you’re gonna win that your developers are gonna be happy, you’re gonna win on you can hire people for just this one skill set…

So when everything’s motherhood and apple pie and everything’s positive, there’s no trade-off being made. But what we’re saying now, and what I think Alex has been sounding the bell on, and other things, is there is a trade-off, it’s just been invisible. And the trade-off is your site is going to be so slow that if you want people who are not using top-of-the-line iPhone to use it, they won’t be able to use it. If you want it to be usable in rural areas, or countries without fast internet, they won’t be able to use it. All of these different pieces. And that’s the trade-off you’re making. And if we can make that trade-off explicit and visible, and then have options where you can choose different parts of the trade-off, and different layers… “Okay, we’re gonna have a slightly more complex DX”, because I think as good as Astro is, you do have to context-switch a little bit more. You have to be a little bit more specific. But we’re gonna have a slightly bigger trade-off there, because for our use case and for our users that performance benefit is worth it, and that’s a trade-off we’re gonna manage explicitly as part of our technical and business decision-making, rather than implicitly, because this is the way things are done.

Jacob Kaplan-Moss: And you also have to figure out not just every time you have one of those differences from one candidate to another. You have to decide whether that difference matters. Is this signal? Is this something that I should include in my hiring decision? This person I mentioned who needed to take a bunch of extra time on their work sample test, is this something I should be considering in my hiring, or is this something I shouldn’t be considering? And every single piece of information you get from a candidate, you kind of have to decide, is this signal or is it noise? And sometimes it can be really, really difficult to tell.

If someone calls into a video interview and their audio and video really suck - is that, “Whatever, fine. Working from home is hard”? Probably. But what if they’re in a position that’s going to be primarily client-facing, where they’re going to be spending six to eight hours a day on video calls with clients? Maybe you need to ask them about their video setup and whether they would be open to some feedback and some improvement there, or just ask them what’s going on. “Do you live in a place with really bad internet access?” Maybe that’s a deal-breaker for this job, right? But you have to be really intentional about all of that. It’s really easy to get someone on an interview and be really frustrated by a bad internet connection, and make a decision not to hire them or to score them lower because of that internet connection, without actually thinking, does this matter? Does this just mean if we hired them, we would need to pay for them to get a better internet connection, or do they live in a cabin in the woods and literally can’t get a better internet connection? Every single door has this, like, “Is this core related or is this not?” And it takes a lot of thinking and intentionality to ask that question over and over and over again.

André Staltz: I actually don’t have hope that people would switch on the basis of privacy. I really don’t have any hope that people would do that. But I do have a big hope that people will start using something that they’ve always wanted to use, but they haven’t had internet. So then we’re talking actually about millions of people in Africa, in the Amazon rainforest in Brazil, for instance, that would really be interested in using this. Then you have a very fast growth vector. This thing could grow and become big at scale, and then we’re talking about an alternative internet maybe growing there.

That’s the big plan with off-grid. It has to work without the internet, so that we can support alternative internets. That’s essentially it in a nutshell.

Kim Crayton: Well, there are two points to that. One is it’s gonna affect them as well, and they don’t understand that. And the second one is, when I talk about the law of attraction and focusing on what I want and letting that expand, I also believe in starving the oxygen off things that don’t need my focus. So although there are, as you say, both good and bad actors on Twitter, the bad actors have always had the privilege on the platforms, whereas people like me have not. I could not afford – as long as I have internet and a mic and my Twitter, I can say whatever I want to. I never had that freedom before. So the bad actors have always had the platform and the power to craft my narrative. I for the first time can tell them, “No, dude. That’s not how this is gonna work. You’re no longer speaking for me.” Then there are us coming in volumes. Where other people see chaos, I see liberation, I see movement, I see these great things happening. If you know anything about change, it does not happen when people are comfortable.

So these people who wanna continue to be isolated, they’re gonna further isolate themselves until they’re starved from oxygen. And that’s how I just look at it. I have this thing, I’m not gonna debate you; I’m gonna debate you about my lived experience. I’m not trying to convince you about it. I’m gonna say what I have to say, and there are people who wanna hear that, and then those people will influence the people that they wanna influence, and that’s how that grows.

I try to be as apolitical as I possibly can, but I’m gonna tell you, I live in Georgia, which is a traditionally red state. The fact that a black woman almost flipped this state to blue couldn’t have happened without the internet. The fact that we wouldn’t have known about how many ways that votes were being disenfranchised couldn’t have happened without the internet.

Nick Nisi: Yeah. The problem is that not everything is moving towards it. There’s still Safari and WebKit, and WebKit as a mobile browser is super-popular because you have no other choice… So where does it leave that? And then of course we can’t forget about Firefox. They’ve had a very good history of going against the grain in terms of IE. They really pushed IE to move forward, and pushed the web forward a ton, because we could still be on an old version of Internet Explorer without that.

Seth Vargo: [19:57] Definitely a great question. Almost all of our tools, with the exception of Vagrant, are written in Go. The reason Go is a great choice for a tool like Vault is the concurrency model. As I said before, Vault is a client-server relationship, so clients are making requests to Vault, so we need something that’s highly available and can handle tens of thousands of requests per second if you’re in a large enterprise setup. We get amazing performance out of Vault. We’ve done our own internal benchmarks, I’ve done my own benchmarks… I can push about 25,000 requests per second through a single Vault instance, which is insane when you think about it, considering it was running on a t2.micro on Amazon. So really great performance out of the tool.

What we also get out of it is the ability to statically compile across different architectures without the need for a complex build pipeline. I’ll explain that a little bit more. Go has native cross-compiling. What that means is you write your code - you write Ruby, you write C, you write Python - but then whenever you wanna distribute that to Windows and Mac and Linux and FreeBSD and Raspberry Pi’s and Arduinos and Android phones, you often have to have one of those to build.

I’ll take Chef as an example - when I worked at Chef, we had a very complex build pipeline where we had a Red Hat box, and a Debian box, and an Ubuntu box, because that was the only way to build packages for those systems. When we look at Go, go has this really great build toolchain where on my local Mac I can build static binaries for Windows, down to Android phone if I want to, in a single command. And it’s all on my Mac. It’s not relying on cloud services, I can do it completely without the internet… It’s actually built into the tool itself.

When you go to download Vault, you can download Vault for everything from OS X, we support all of the BSDs (FreeBSD, NetBSD, OpenBSD), Windows, Linux. We don’t personally publish the mobile stuff, but you could build it yourself from source. Go gives us this really great build toolchain where – a lot of people still run Windows and they have hybrid environments where some servers are Linux and some are Red Hat, some are Debian… Things are all over the map; it’s very rare that you walk into an organization today that has like “We are 100% the latest version of Debian.” There’s a mixture everywhere, so being able to support that without basically any overhead is really one of the great things from a post-production standpoint.

The way anyone at HashiCorp can cut a release of any tool from their local laptop - which is great, because we reduce single points of failure, we’re not relying on this huge centralized build system that has a huge backup of queues… We build stuff and we can push it out into production very fast. Most of our tools build in under 2-3 minutes, and that’s across the entire fleet, with all of the binaries ready to go. And they’re single static binaries, so you don’t have to worry about putting a whole bunch of files in place. You download it, you unpack/unarchive it and then you put it in your path and it’s ready to Go.

Bruce Schneier: No, because I’ve always done it my way, and that means I can do my stuff without having an internet connection.

Mike Fix: Yeah. So that’s why I was saying I really wanna keep it pretty not featureful, in the sense that we wouldn’t want to create a ton of different movie files or something, and then you have to have an encoding server in the background, and maintain all this infrastructure just to create a moving image… But there are things that you can do in the browser. You can create a GIF in the browser without having an internet connection. That seems like a perfect MVP for us to create, get the feature out the door, let people start exporting GIFs, and it still fits the rest of the platform without too much overhead. Yeah, if we can keep it on the frontend, we can keep it open source, we can fit it in with the rest of the code that’s on GitHub, and people can run with the bugs, and then post the bugs themselves, fix the bugs themselves… And that helps a lot with the sustainability of these sorts of features, too.

Marc Boorshtein: So there was actually a really specific reason that triggered it. It was one of these things that we always wanted to do as long as we had time and budget… But what the actual thing that triggered it was we wanted to have a secondary instance. So when everything started, we were very heavily focused on this fiber network. Stuff that was running on the fiber network. Stuff that was accessible via the fiber network. And we had a couple of apps that were hosted on the internet, but for the most part, everything was on this fiber network. Well, times change. I mean, it’s been 20 years, and most of the apps have moved to the commercial internet. At the same time – we’re at the point now that… Like, if America turned off our internet, the world would survive without us, from an internet standpoint. I think that’s true. I don’t think I’m making that up. I think that happened in the last decade.

Don Beyer: A lot of them staff, but really interested in the speakers, and what they can learn. And then the individual – we have smaller groups; half of the Democrats belong to the new Democratic caucus, which sort of defines itself as being pro innovation, pro business, pro trade… And so they have their own AI caucus. The progressives I don’t think have one yet, but they’re really interested in it.

And then probably the most important one is the speaker, Mike Johnson, and the Democratic leader Hakeem Jeffries appointed a 24-person Task Force for this year, to try to look at the 200 different pieces of legislation that have been introduced on AI, and focus it down to the handful that we should pass this year, that would be building blocks for the years to come.

You can probably elegantly put it in four or five buckets, but clearly, the deep fake problem - not just deep fake, but the whole copyright plus problem, for music, and illustrations, and photographer, and text, and voice, obviously, Scarlett Johansson, that piece… Then there’s the whole piece about generative AI, and what can we expect, and what can we rely on from the large language models that are springing up. The whole safety concern, which – one of the I think most encouraging things… By the way, all this is on the background of social media and the fact that we’ve done nothing in the 25 plus years of social media, except make it impossible to sue them, section 230. And no one has been able to come up with an agreement on how to modify 230 to allow people to be held accountable without crashing the whole internet, making it just endless lawsuits. So we’re trying to get ahead of that… First of all, humbly, Congress will never be ahead of the American people. But we want to get ahead of where Congress typically is, by looking at significant legislation.

Liz Rice: I would say when people first sort of get the idea of eBPF, one of their first questions is “Wait a minute, this is all powerful. Is it safe?” And the verifier that Thomas has been talking about is a huge part of making sure that it is… But also, users need to treat it with the same respect that they treat root privileges. It is all powerful, and so is root, and that’s why we are very careful about who we allow to have root access to a machine. The same should be true for eBPF tooling as well. You need to be running – don’t download an eBPF program from the internet if you don’t know where it came from, the same way that you wouldn’t download any other code from the internet; you shouldn’t just download any other code from the internet and run it without knowing what it is. And things like the signing will really help to give people confidence about that.

Jerod Santo: The site’s creator, Nathaniel, says this about it: “Everyone should be able to use the internet to perform basic tasks without being bombarded with popups, compromising their privacy and security, or damaging the environment.”

Mat Ryer: [01:14:05.04] What you want is a good developer experience like Ntfy when you’re just posting – it’s just a command, it’s just an HTTP POST, and that’s something you can use. That developer experience, I think, is really important. And this is part of, I think, what makes the tools good; tools that we pick, they have usually a good developer experience when we’re developers. And I think that’s something that, when people just write tools, they don’t spend enough time thinking about like making that sort of 10x experience for people. I.e. make it just perfect, make it seamless; you shouldn’t have to be fighting with config, and things like this.

As an example is something I’ve built recently. We have an API for this tool that we’re building at Grafana, which is this incident management tool… And the API has a client - we built a client, we auto-generated it - that you can use. And in the client, you can switch it to stub mode, so that you can just use it without it reaching out across the internet, and it just gives you canned responses. So it’s like built into the tool, it’s expecting you to write tests with this, at some point, and making that easy for you to do, in a way where we sort of own the responsibility for making that right, and people can just sort of rely on it.

So it’s little things like that, I think, make all the difference. And obviously, a lot of this 10x talk was kind of – you know, ,I was being quite silly… But if you want to really deliver something that’s amazing, spend the time on that polish a little bit, and do less. Have fewer features, but make them really good, and pay attention to that developer experience. It makes such a difference. Most people will just breeze through it, and they won’t give it another thought. And in a way, you’ve succeeded if that happens. But it gives you such confidence when you use the tools, when it’s just slick, and it’s like a pleasure to use? It makes all the difference.

Kris Brandow: And of course, they’re using all the shiny things with Kubernetes, so that’s using Istio. No one actually knows how any of this works. It’s just like, “Oh, this is what we’re supposed to be using.” So we have this big ol’ cluster, and it’s running, and our DevOps people are pulling their hair, because they hate all of this… And I start like reading through the codebase and looking at things, and I’m like, “Okay, these auth policies look a little funky.” And then I go talk to people, and they’re like, “We don’t really have any auth policies. Everything’s just kind of open right now. Like, everything in the backend can just talk to each other. There’s no auth policies.” And I’m like, “Are you sure? Because I see these auth policies in the codebase.” And they’re like, “Yeah, but we don’t think they’re being used for anything.” I’m like, “Okay…” So I just kind of like let it go, and go about my business… And then I have like a few more of these conversations, and I’m like, “This feels weird. But you know, all these people know more than I do.”

And then months and months later, someone stumbles across this one auth policy that has no labels, and no access rules, which in Istio language means that it applies to literally everything, and allows all traffic in. So this one policy had just opened our entire API, including the public API, to the entire internet, for anybody to do anything without needing any authorization. You just needed like a JSON web token that you could easily get from anywhere. And I was just like – so it caused all these problems, everybody’s freaking out, and then they just rip that policy out and they’re like, “Okay, well, without this policy, we’ll be fine.” But then all of those auth policies that had been sitting there, that I was like, “These look funky”, all those took over, and all of those were broken. So then it broke all the APIs. So then they had to put the other policy back, and then go through, and like, go find every single auth policy within Istio, and then fix all of those auth policies, and then they could finally remove that one policy that was opening everything to the world.

I think the total amount of time that the door was just open was about nine months, and to the knowledge that people had, nothing bad happened… But yeah, it was quite horrifying.

Ryan Dahl: Unfortunately, it’s really hard to audit all of your code these days. I mean, we depend on society-level infrastructure, right? There’s no possible way – if you plan to be a productive developer, to go out and actually read through all of the dependencies and the transitive dependencies of your dependencies.

By the way, you’re talking about curling Bash scripts - when you npm install something, arbitrary code from the internet is running on your computer, without any security sandboxing. And beware, when you are npm installing something, you are completely and utterly open to having your computer taken over. It takes one bad actor in the ecosystem to make that happen.

Jerod Santo: Yeah, exactly. We aren’t actually very good, and our ideas kind of suck… And there’s lots of reasons why we still fail. But that’s been a superpower for software engineers ever since maybe the dawn of the internet. We could just take an idea, without permission, build it, put it on the internet, be the next Jeff Bezos, or whatever it is.