Richard Moot: [01:19:40.12] Like, 100x. And that’s just thinking about how a regular person can now go enable this stuff. But that’s also not accounting for the very savvy developer who goes “Well, why spin up one agent when I could spin up 20 agents to go do work for me?” And so it’s just going to be this exploding problem. And so the thing I keep thinking about is “Can all of us handle the volume of a bunch of bots going around calling all these things?” Are we just going to see a huge influx of DDoS, and…? I mean, it’s hard to understand what the second order effects of this are when you have just tons and tons of agents being spun up everywhere.

Jerod Santo: It gives you some confidence that you wouldn’t have otherwise. And I think that’s very valuable. But like you said, or maybe you didn’t say it, but I was thinking it while you said it - there’s no accounting for the real world. So like Mike Tyson’s famous statement, “Everybody has a plan till they get punched in the mouth”, or something like that.

Beyang Liu: These days it’s a little bit different, because the whole world is talking about reindustrializing, with all the geopolitical shifts going on in the world, the macroeconomic shifts… I think a lot of people are thinking about “How can we build the gigafactories of the future, and restart that process, that kind of tech tree exploration in the West?” So now I think it carries a very different connotation. But what we meant by it and what we mean by it today is really – it started with this observation… When you think about software engineering as an industry, software engineering is actually quite unlike every other industry in the world, in one specific dimension, which is every other industry, as you scale production, you get economies of scale. Like, you build a larger factory, you can produce the next incremental thing that you’re building at a cheaper cost, or more efficiently.

[00:12:01.08] So things get better and cheaper as you scale up. In software engineering, it’s the exact opposite. In fact, at best case, they asymptotically approach some upper bound. Worst case - and I think the reality in a lot of organizations - productivity goes down after you scale past a certain point. And as a consequence, every piece of software that becomes successful very quickly becomes a victim of its own success. Because if your software gains users and gains revenue, it will also acquire feature requests and bug reports… And as a consequence, you’ll hire more developers, you’ll increase the number of contributors to the codebase, the codebase will grow over time, you’ll lose that cohesiveness of vision… And then it’s a frog in boiling water approach. Every incremental day you don’t really notice it, but one day you wake up and the codebase is a mess, there’s all these constraints, it takes forever to get a simple feature across the finish line… You wake up and now you can’t get anything done. And there’s kind of two consequences to this that are very salient.

One is that means that the vast majority of software that actually gets used day to day sucks… Because any – again, any successful piece of software with a lot of users becomes this. So almost definitionally, any piece of software that you’re using, you’re using it because it was a successful piece of software. But by virtue of its success, it can no longer move quickly. The developers building it can no longer move quickly and build new things and keep that up to date.

The second consequence for this is the disruption cycle actually occurs much more quickly in pure software than in any other industry. Every other industry, we talk about the innovators dilemma. It’s like, okay, yeah, I get it, every once in a generation something comes along down the line that shakes the foundation of this very industry, and then you get a whole new generation of companies that emerge. In software, it’s literally every 5 to 10 years that happens naturally, because whatever – you can literally see, in the past five or six years alone we’ve gone through multiple generations of accounting software for small businesses. Every couple of years there’s a new YC company that basically does the same thing, but it’s “Oh, we’re going to do it better, because the old thing sucks now.”

So this disruption cycle – there’s something more than the innovators dilemma in software disruption. It’s this kind of phenomenon of as the codebase grows due to its success, it falls victim to the very forces that made it successful, because you’re going to grow the number of lines of code, you’re going to add more functionality, you’re going to have a hard time preserving the cleanliness and sane architecture of the original codebase. And then at some point you can no longer make forward progress. And then some two-person startup comes down the line and does it a lot better, and then eats your lunch.

Gerhard Lazu: [01:05:41.17] And he is the top contributor on Varnish. Some would say Varnish is his idea. But what’s really surprising… So let’s go to Poul-Henning again… And he has – not a FreeBSD. There’s that… Okay, so we’ll go through GitHub… phk.freebsd.dk. So freebsd.dk apparently is his TLD, and he just has a subdomain. I think that’s really cool. So apparently, Varnish has a [unintelligible 01:06:10.05] license - I had no idea about that - and he’s very transparent about the accounting. Like, he runs a lot of the software behind the Varnish docs, and a couple of other things. And he’s very transparent about how he spends his time, and how much he charges for it… I was fascinated as an open source project how transparent it is. And who contributes the most, and things like that.

So popping the stack and just going through who he is… So FreeBSD, apparently, MD5 Crypt, jails, nanokernels, timecounters, and the Bikeshed.

Kurt Mackey: First of all, Rebel Alliance is something investors ate up. There’s always things you can pitch that you will get a huge amount of funding for, that actually when the rubber meets the road - or whatever euphemism you wanna use - you don’t go that way. So the general belief here was that if you take the top 50 AWS services… AWS has like 300 services, and 50 of them are pretty good. And like 10 of them are really good. And so if you take the top 10 AWS services, there’s probably a really big startup for each one of those. There’s probably a really big RDS startup. There’s probably a really big EC2 startup, or Lambda, or whatever you wanna call it. That’s us, by the way. There’s probably a really big – what was the other one I was thinking of? There’s storage ones, there’s DynamoDBs, there’s really big caching services… Anything you can provision that isn’t – if you go to like Vantage… You know Vantage, the cloud billing accounting company?

Quincy Larson: Yeah. So you could lay off one of every five developers, maybe. One of every six, or something. I’m not sure exactly how the math shakes out. But yeah. And that’s basing it on the productivity increase… But we haven’t laid anybody off. We don’t believe that – and we’re using this stuff extensively, internally. There’s just been so much work to be done, we just shift people around. So I can talk about how we’re shifting the team around… But let me talk just a little bit about people who are on the job market. If you’re listening to this, if you’re on the job market, trying to get a job as a developer - the jobs are going to come back. Hang in there. There’s a very slow correction… It takes forever for these hiring cycles to happen. It takes forever for the Gartner hype cycle to ride the wave from the peak of inflated expectations to the trout of disillusionment, to the plateau of productivity. If you’re familiar with the Gartner hype cycle, it’s this phenomenon that pretty much every technology has gone through. And LLMs are going through that. And when people say AI, they’re talking about LLMs. That’s been the major breakthrough.

So I think that if you’re in a situation where you are trying to learn to code and you’re hoping to get a developer job, my advice would be don’t quit your day job. The same thing I’ve always been saying. Like, if you’re working at a Starbucks, or if you’ve got a job at some accounting consultancy… I worked as an accountant for a while; I did temp work, essentially, moving from company to company… Doing that sort of stuff, it sucked. Keep doing that work. Whatever’s paying the bills, whatever’s keeping food on the table, and keep paying down your debt, and doing all that stuff. But just plan long-term. Expect it to take a couple years.

If you look at the pre-2000 bubble, if you had basic HTML, CSS skills, if you knew how to run a web server, FTP some files or something like that, you could get a job as a web designer. And then in 2012-ish, I would say, the tools became so good that a lot of people could get jobs as WordPress developers, or doing basic Ruby on Rails work… That’s what my first job was, doing Rails dev on a small team, just maintaining a Rails codebase… And over time, it’s gotten a little bit harder, but the jobs were increasing, so we didn’t really think too much about it. It’s just “Oh, now we’ve got to learn React. Now we’ve got to learn about a whole lot of security considerations. We’ve got to think about accessibility…” There’s always been this layering of additional things you need to learn, and that’s not going to go away. It’s just going to get harder and harder in terms of the actual skills that you need to know to work as a software engineer.

But at the same time, the number of openings started to fall… So now there’s this bigger gap between what needs to be learned, and the rewards or the likeliness of being able to find a job. And I do think that if you just continue applying for jobs patiently as you continue to build your skills, your network, your reputation, then you will eventually get a developer job, but it may take a little bit longer now than it took in 2022. That is kind of my thinking on that.

[00:33:58.21] So my advice to people who are on the job market is just be patient and keep learning, and don’t give up. Because if you give up, you’re never going to get a developer job. But if you keep at it, you will eventually be able to build out, through your community, through people you know, through different social groups you’re a part of… Hopefully, you’re going out and putting yourself out there and trying to meet people, through building projects and publishing stuff on Twitter, Reddit, wherever you share your stuff… Eventually, you’re going to have a decent portfolio. Maybe you’re going to build a big, impressive app that ties a bunch of stuff together, and is impressive from an engineering standpoint, and you’re going to be able to get a job. It’s just going to be a grind.

Adam Azzam: Yeah, it’s a great question, and it’s something I obviously try to think a lot about… I would say that right now there is way too much emphasis on single-machine, local LLM or agent workflows. Here’s what I mean by that. You pull up any framework in the world to run LLM things, or to build an agentic workflow, and it’s like happening in a local process, on your machine. It spins up an input field in your terminal, and then you have to type your answer to what your favorite color is, and then it goes and writes you a poem, or something like this. But businesses who are building LLM workflows or building on agents, at the model level we see that frontier models are accounting for – sorry, frontier model providers are accounting for a lot of the core sources of failure. So structured outputs from Open AI managed to wipe out just a whole host of your classic resiliency issues. And the resiliency issues I think are going to be around planning, and so the ability to add idempotency and transactions to LLM workflows is really what we would invest more into. You had a plan that executed ten things in a row, you found out at the 11th step the plan was bad. But you’ve already done ten things. How do you walk that all back? You would do that with transactions.

Where I am really interested in long term is - when Daniel asked earlier “Talk to me about how I as a human go from a locally running function to something that’s running elsewhere”, I think that the “me as a human” part of that is going to go away. And it’s often going to be an LLM in the course of solving a problem decides that it needs to create and massively parallelize a function to call out to.

And so now you need to be able to give an LLM, on demand, the ability to create and provision infrastructure, and submit a whole bunch of jobs to it. And so while we’ve built Prefect to be something so easy a human can understand, that’s going to play into a lot of strengths of “How do we expose an API that can really be taken advantage by an LLM?”, if that’s the intended audience of how to provision infrastructure.

The third piece is - at companies now you’ll have so many teams that are basically building LLM workflows in parallel to each other. So you’ll have like the conversation team, that’s trying to build in LLMs into how it talks to customers. And then you’ll have like the platform team, which is trying to use it to give feedback on internal pull requests. You’ll have teams that are trying to use a bit more human in the loop for commenting on like a design doc, something like this. But fundamentally, you have tens of thousands of parallelized executions or calls against LLM APIs, so how do you solve that coordination problem across the programs that are trying to invoke LLMs?

And so really trying to figure out, if I have 10,000 agents all trying to access the same resource at the same time, how do you govern that in a way that doesn’t cause them all to crash? If I have 10,000 engineers that are all trying to access the same LLM API, how do I make sure that they don’t all consume the same token budget all at the same time?

So that’s a bit more on the practical side of like – you know, future of agents, future of LLMs aside, there is still a very, very interesting, fundamental engineering question, which is “How do you get tens of thousands of concurrent API calls to Open AI or Anthropic all behave sanely, and not lean into a commons problem of everybody cannibalizing the same data resource?” And so that’s like the very boring thing that I like to think about. But orchestration is one of these very fun, but ultimately worst-case scenario disaster planning style things.

Jimmy Miller: But the basic idea for that one, just to be clear, is salespeople – obviously, there’s the real accounting. I know there were some comments on Hacker News of like “That just sounds like fraud.” There’s like the real accounting system, and then there was the rewards system, where they’d get bonuses and stuff… This was the rewards system. And yeah, they were trying to get bonuses every month. And if they made a big sale at the end of the month, and they’d already gotten their max bonus, they would just move that to the next month, so they could get their bonus for next month. So they had a cap on commissions, and things like that, and this was moving it around…

Jerod Santo: Have you ever considered accounting for the mouse somehow, like split keyboard integrated mouse device?

Adam Stacoviak: I really don’t want to do this necessarily, but I talked to David Hsu recently from Retool. And I’ve always been a fan of them, and they are a sponsor, so take this with a grain of salt, listeners. We also don’t like to blur the line. This is not an ad spot. But as an example, there’s a lot of opportunity in the internal tool space, inside of companies. People are being tasked with doing more with less, and that’s a lot of the reason why Retool is very successful, because they help you do more with less. You can be a backend engineer, or an API developer, and leverage Retool, and build out tooling for your company and not have to be a frontender. So you kind of get to minimize that footprint of a person.

You could become a specialist in understanding what SaaS companies need from an internal tooling standpoint, and find the ones that aren’t using Retool, and specialize in that, and join their team temporarily as a consultant, and say “I will just come in and tell you how Retool works, and implement Retool for you”, and I bet your Retool would even sponsor you, if you added so much value to them that you went company to company to company and did that kind of thing.

And then his version of that. There’s versions of leveraging, like you said, these companies that are doing their accounting differently. You mentioned on paper with Excel; I thought the place you were going was where they’re outsourcing to tooling that specializes, where they don’t have to be specialists. They can be generalists, and spend money on a tool, versus having to become the domain expert and do it themselves. They can sort of outsource a task, so to speak. But I’m thinking like “Gosh, if I was a backend engineer”, somebody who really understood APIs, really understood how a lot of the internal tooling needs to happen or should happen for SaaS companies, I would become that kind of expert, and go out there and just implement Retool for people.

[00:35:48.26] And you get to leave all the management behind, right? Because Retool is going to do it all. All you are is an implementer. You provide your value, you get in, you get out, maybe you stick around for some consulting or some future whatever… But at that point, you’re like in and out. Maybe that lasts for a season, maybe that lasts for THE season between the dip in the bell curve and the rise. Maybe it’s not a long-term thing, but that’s – I really didn’t want to use this sponsor, Jerod, but that was the best… It was what came to mind, it was what percolated. Like coffee.

Birk Jernström: So being merchant of record, what that basically means is that we’re integrating Stripe, and Stripe Connect specifically. And so we’re the platform account that all transactions go through. And then our customers or developers using Polar, they can connect Open Collective, or their own Stripe accounts that we then transfer that funding to through payouts, once it’s ready to be paid out, essentially.

And so legally speaking, as well as in terms of money flow, customers are buying these products or services through Polar. So they’re getting the receipts from us, we’re in charge of managing VAT in case the sale happens in Europe, from say a Swedish customer… And these are things that are like massive headaches for individuals… Especially when I talked to a lot of open source developers, people who wanted to explore sort of Caleb Porzio models, they have been concerned doing that with GitHub sponsorship, because they know that if you offer value adds as part of your sponsorship package, technically speaking, you’re offering a service, which makes you liable and required to capture sales tax or VAT for those transactions. And this is not something that GitHub handles, and so you face some risks there as a developer.

And so we take that on, which means we get all of the payments processed through Polar, we capture VAT on a quarterly basis, I work with accountants and do all the reporting and accounting work to make sure that that’s filed appropriately, and work with lawyers to make sure we are compliant… So yeah, it is a lot of work, and I would not want any individual to have to bear that burden, and so that’s why we’re doing it instead.

Louis Pilfold: I’m not sure really… It’s tricky, because I wouldn’t say – you can take a language like Zig, for example, and there’s a really clear way that you would slot that into an enterprise… You’ve got a big, difficult to compile C project that you need to cross-compile and distribute around. Obviously, you’re just gonna use Zig for that. We don’t have that. We’re just a really good language, I think… So you can kind of use it for anything. So I think at that point it’s less of a question of what is Gleam good for, it’s more about spotting opportunities for inside whatever the circumstances of that business are for introducing something new.

I know one company wrote a HTTP proxy… They needed to write a HTTP proxy, and someone went “Oh, I’m gonna do that in Gleam.” And now they’re using it for that. I know a company – what did they do…? I don’t have to explain what they do, because it’s too complicated… But for their internal accounting/tracking system thing… I don’t know what it is. Because it’s an internal tool. They just made a new thing, and they just made it in Gleam. So I think it’s more about finding the opportunities inside the business than being a specific Gleam thing. And if the people inside those businesses were big fans of Rust or Go, they could probably make an argument for using those things instead.

[01:04:02.20] So I think the really valuable thing is to make it really obvious that Gleam is a really good, solid choice, both from like an engineering perspective, but also from the point of view of the company. One company has to look at the Gleam project and go, “Okay, that looks really solid. Oh, it looks like it’s well funded, it looks like the team are really responsive, it looks like there’s good documentation”, that kind of thing.

Kris Brandow: [00:43:57.26] I mean, I would equate it to – and maybe this is a good model for it, too… Like accounting and bookkeeping. I feel like the argument is actually equivalent to that, like “Yeah, it’d be great if you just didn’t have to care about bookkeeping, because you’re a small company and you just need to go.” It’d be much easier to just “Spend money, it’ll be okay, and then we’ll figure out how to actually do bookkeeping accounting later, when we’re big enough to actually get an accountant or bookkeeper and have them do this work.” And it’s like “Yeah, but by the time you get there, you’re gonna have such a nightmare that it’s going to be really hard to dig yourself out of it.” And I think knowledge management is even a worst thing.

The reason I say do it when you’re a small organization is because there practically isn’t a point along the continuum until you’re huge, and the problem is intractable, that you can actually stop and say “Okay, yes, we will hire someone.” Because even once you are 10 to 20 to 30 or 40 or 50 people, you’ll say the same thing of like “Well, we’re just trying to move fast. We’ve got to keep going. We don’t have time to stop. And there’s already this mountain of stuff. It’s fine. We’ll be able to do it well.” And the point just never comes.

Of course, there’s plenty of large companies that managed to get along without having these people, and small startups, and lots of organizations. So obviously, we’ve been able to work as an industry along this path of being able to get out there. But I think that we’ve underestimated how empowering someone with this type of skill set can be to the organization.

I think it’s a lot like e-sports teams, and how in the past it was just kind of like “Oh, we just have a group of five, probably dudes, or some number of dudes, and they’re just playing.” And then we added a coach. And then everybody started to get better. And then they added a sports psychologist, and then they started to get really, tremendously better at these things. And it’s like, if you went to an e-sports team and you’re like “Yeah, you should hire a sports psychologist”, they’d be like “Why would we do that?” “Well, because your earnings are gonna go up by so much, because you have this person that’s going to be able to power everybody.” And I think this type of knowledge management role is the same thing there.

And I think our codebases and the state of them and how they are pretty bad… I mean, Johnny, you and I both said that in our combined nearly 50 years of doing this, we haven’t come across a codebase that’s just good when we get to it. That has things set up well, where you can actually do things where you don’t have to go and fish some information out of somebody’s head… So it’s clear that there’s a problem here that needs to get fixed in some way. I’m just advocating that this role is it. There’s probably other ways to do it as well. I don’t think AI is the way; I really don’t think AI is going to help us here. But I think like if we wanted to macro level solve the problem in the big, it would be having this. But I also recognize that, as you said, Johnny, this is impractical for a number of reasons, for most people. It would take a startup that wants to be, or a company that wants to be innovative in that small space. And quite frankly, most companies just don’t want to innovate in that space. They don’t want to make changes; they want to just pick up the playbook and just go forward with it. And that’s fine. Just recognize that your codebase is probably not going to be great when you start scaling. And it probably might not ever be like a nice, good codebase unless you happen to stumble upon and hire somebody that does engineering, that also has like these skill sets to manage knowledge well. Or you have a CTO or an SVP or whoever who pushes - kind of like you are, Johnny - really hard to make sure that knowledge is well managed, and it’s not just getting stuck in people’s heads.

Jason Hall: Yeah. And it has a huge impact on the number of vulnerabilities that scanners pick up in your image, right? If your Debian base image has 50 tools in it, and Python, but you only need Python, then CVE scanners are going to pick up issues in all of those other things, right? You don’t actually need it, and there is a cost of having it. There’s a cost to your scanner results, and you’re accounting for those things.

Samuel Goff: It goes back to having enough nodes on the system that concur with your accounting.

Cory Doctorow: Like, literally, if you went into a store and shoplifted it, you would get a much lower penalty. But probably if you knocked over a truck full of CDs of this book, you would pay a lower penalty. So this is what Jay Freeman calls felony contempt of business model. It’s a way for Amazon to use its market dominance to make it a literal felony to do things that Amazon wishes you wouldn’t… So that every dollar you spend on an Audible audiobook is a dollar you will have to surrender if you leave Audible, break up with them and delete their apps. And the more power Audible has over you as my customer, the more power they have over me as a supplier. Because if they know my customers won’t follow them to another retailer, then they can turn the screws on me. And indeed, there are some pretty drastic screws they’ve turned.

[00:08:08.09] So Audible has this platform called ACX, which is the Audible Content Exchange. It’s like a self-serve platform, like Kindle Direct Publishing, or even like going to Zazzle or something, where you just upload some material and they put it in their storefront. And ACX is used by independent and small publishers to do audiobooks. And audiobooks are expensive to produce, beyond the time that it takes to write them. Making a good audiobook is quite expensive, especially if you’re paying voice talent.

So these independent authors, they’re sinking a ton of money into ACX. And Audible changed the way they did their accounting so that they could hide what has now been determined to be about $100 million worth of accounting fraud, where they stole from those authors. And the authors, even after it was disclosed – first of all, they couldn’t sue, because they’d all agreed to binding arbitration as a condition of using the platform; that was in the fine print. So they have to arbitrate those cases one at a time. But even so, they’re all stuck around… Because what are you going to do, right?

Daniel Thompson: [53:52] I think, just to address it - I made some mistakes, engaging in this idea that Tauri is better than Electron, and here’s why… And I even got into a Twitter battle with [unintelligible 00:54:04.00], where I proved that we were better in some way… And after reflecting on it, I think that there’s a lot of things that Electron brings to the table.

For example, you might consider it a bad thing, but it does bring a unified web interface to the major desktop platforms. It’s the same interface. If you look at it in Windows, it’s gonna look the same as it is on Linux. So I think that that’s something that we don’t currently have.

You also get an amazing general runtime of Node.js, bundled with joy, that can do anything. Basically, if you can think it in JS, your isomorphic skills are going to come in totally handy. You’re going to be able to follow documentation that’s been built over – I mean, Electron’s like almost… Is it 10 years old now? They’ve been around for a while, and a lot of people loved it and grew up on it, and made documentation, made whole tutorials. You can learn about it and not need to step out of your comfort zone. So I think that those are things that Electron has going for it.

What Tauri has going for it are you only ship the parts of software that you need to run it. You don’t need to ship a generalized runtime. So by doing that, we can reduce the actual engine size of a Tauri app down to 500-600 kilobytes, maybe 400, depending on how aggressive you compress.

Tauri is also – I might get some flak for saying this. Like, people do benchmarks, and they benchmark, and they compare, and like “Oh, this is a Hello World Electron app. This is a Hello World Tauri app. And this one starts up this fast, and this one starts up this fast. I know which is better.” But ultimately, what’s happening under the hood, what’s happening inside of the core runtime is fewer sys calls, less memory pressure… And believe it or not, a quicker startup. The time it takes to open up a large binary is linearly longer than opening up a small one. We’re talking milliseconds here; I guess you could split feathers… But once you start thinking at a global scale of the trillions, quadrillions of apps that are installed out on the planet, do they all need to have an individual 8 or 12-megabyte Node.js runtime, if you have 10 of them on your desktop? Not so much.

I’m very much convinced that as Tauri technology gets adapted by more and more teams, it does become a financial factor once you start to consider massive traction. I mean, if your app is downloaded a million times a day, the difference between 200 megabytes and 10 megabytes is going to mean something to somebody in your accounting team. And that’s just the accounting side of it. The transfer of this massive bundle costs electricity. We’re not in a cold fusion world yet; maybe at some point it won’t matter anymore, and we all have our little fusion packs built into our wrist.

Haroon Meer: Okay. So effectively, what we do is we build products to let people know when they’ve been compromised. The opening logic is – so in our previous lives, most of our early team worked as pentesters, so breaking into networks. And one of the terrible secrets is that for years and years we’d break into networks all around the world, and nobody knows. Not until you hand in the report. And this hasn’t changed much. So it happens when you’re doing pentesting, it happens when real attacks happen. And so companies just find out they’ve been compromised months after. And so our whole pitch is to try to fix that.

So canaries are an old concept, which are honey pots. And honey pots have gotten a bad name historically, because mostly, they were used by the research community. So people would put up honey pots and say “Look at how many attacks were from Russia. Look at how many attacks were from China”, which is pretty useless for real world activities. And what we do is we say “If you had honey pots on your network, and they were really low effort to deploy, they end up giving you a really high signal.” So you find out at two in the morning that Bob from accounting just tried to log into this machine that really shouldn’t be there. And what it works on is just the logic that the people on your network or in your infrastructure know your infrastructure, but attackers who land there need to situate themselves. And so typically, those attackers run around like bulls in China shops, and they get there. And so they explore things and they touch stuff. And inevitably, they touch these canaries, giving you a really high signal that badness is happening. And that’s all we do with Canary. We make it super-easy to deploy them, so that people actually do it, and then we focus really hard on not generating extra noise. So customers with like hundreds of canaries will get four alerts a year, so that when they get an alert, they know they need to react to it.

[07:50] And so Canary was the first product we built, and then we built Canary tokens, which are the same concept, but much smaller trip wires. And for the broad applicability, for your audience, we’ll give you for example an AWS credential file. You put it on your CFO’s laptop, and when anyone uses that credential file, that API token, you will get a message saying “Listen, the AWS creds that were only on your CFO’s machine - somebody just used it to log it.” So again, you get a really high-quality signal that tells you someone was on your CFO’s machine.

And so Canary tokens are bunches of little tricks like that, that are really hard for attackers to resist, but gives you a really high-quality signal that something is going wrong. And for Canary tokens, we give them away free. And so literally, millions of people have used them, or use them to figure out when they’ve been breached.

Kris Brandow: I would say as long as you have the knowledge on the team of like the actual study… You’re not just gonna be like “The whole team is gonna share accounting responsibilities.” No, you need to have someone that knows accounting.

Jonathan Carter: They also handle accounting and a lot of really boring stuff that no volunteer really wants to do. Even though we do have a treasurer team, we’re glad that they mostly take care of the numbers coming in and going out.

Kris Brandow: I think if you have a good understanding of the trade-offs, and it’s not like a – like, I guess it’s about how much future harm are you going to do in this, and also how much is it of a best practice thing? Like, if you’re skipping best practices, then obviously you shouldn’t be doing that, so it’s not really debt. But I think a thing that might be akin to technical debt is choosing to use a library or framework instead of building it yourself. So it’s like “Oh, I’ve assessed how long it would take us for us to build it, I’ve assessed the risk of taking on this dependency, and actually using this framework, and all of the knowledge that’s needed for both options, and we’ve decided that taking on this framework makes more sense, even though it’s more risky.” I think that’s closer to – especially the way businesses use debt. Businesses aren’t just going out and being like “I’m gonna go get a big ol’ loan just for the hell of it.” It’s like, no; you’re gonna sit down and assess what are you actually going to use the money for, how are you going to use it, how are you going to repay it, all of this stuff.

[01:06:03.13] So if you’re doing all of that math and risk assessment, then what you are doing is likely a debt-focused thing. But that’s rarely, if ever, at least in my experience, what people are doing. They’re just kind of not doing the things they should be doing, and then being like “Oh, we’ll just fix it later.” And then later literally never comes, and then they just throw out the whole thing, and they’re like “Okay, we’re gonna do it right this time”, and then they do the same thing again.

I guess the thing I think it’s more akin to is using single-entry accounting for your multimillion dollar company, and then having no notes in your single-entry account. “Money is going places; where does it go?” “We don’t know.” It’s that level of thing. And it’s like, how do you clean up a single entry accounting system and turn it into a double entry accounting system down the road?” It’s like, that’s going to be awful for you. You should never do that. If you know you’re going to build a big enough business where you’re going to need double entry accounting, just start with it. And it’s the same thing with this. If you’re not building something, you’re gonna throw away in six months, then just write the docs, just write the test code; think about what you’re doing. It’s gonna make you go faster in the long run. You’re not gonna get that much speed if you’re like “Oh, I’m gonna do this, because it’s gonna save me like a few hours here.” It’s gonna save you a few hours here, it’s gonna make you spend four weeks trying to unwind it in like six months, or less.

Damien Riehl: Really, what we’re describing here is there’s a scarcity mindset, and there’s an abundance mindset. The scarcity mindset is that – around 1979 accountants were really worried with this artificial intelligence that’s called the spreadsheet. Because they said, “Wow, all we do all day is use ledgers, and we add and subtract numbers, and machines can do that in seconds. That’s gonna put us all out of work.” But what happened was that when the clients realized, “Oh, it’s not going to take me a week to get that ledger back, but it’s going to take seconds… Let’s do scenario two, and scenario three, and scenario four, and run more scenarios”, and now we have more accountants than ever, because the tools are actually a force multiplier, that now there’s more accounting work, rather than less. So that is an abundance mindset, that is not a scarcity mindset.

So the real question in my mind, and maybe it should be on all of our minds, is “Is the scarcity mindset that I described with worlds one, two, three and four - is that going to be our future? Or is there an abundance mindset where we just have 10x or 100x productivity and we keep growing and growing?”

Cory Doctorow: Yeah, sure. Well, so Chokepoint Capitalism - I co-wrote this book with my colleague, Rebecca Giblin. She’s a great copyright scholar at the University of Melbourne. We wrote it during lockdown on Zoom calls with shared G docs. And we had spoken together at an event in Melbourne while I was out on a book tour in like 2017, and both of us had been involved in kind of copyright liberalisation for a couple of decades each. You know, the Napster wars and their sequels, right? And those debates are terrible. Every one of those debates comes down to “Why are you doing the business of big tech?” or “Why are you doing the business of evil record executives and publishing companies?” And there’s no room in that debate to be an advocate for artists directly or audiences directly. You can only advocate for these companies, which are said to be the proxies for audiences and artists, right? So tech companies proxies for audiences, entertainment companies proxies for artists. Neither of them are very good proxies for either, right? Both of them are really bad at being proxies for either. And what we wanted to do was write a book that tried to explain how you could be suspicious of ever-expanding copyright, and still be on the side of both artists and audiences. And it starts from this observation that we have made copyright bigger and bigger for 40 years. It lasts longer, it covers more kinds of works, the penalties are harsher than they’ve ever been, and it’s easier to prove infringement and secure those penalties than it ever has been.

The industries - music, movies, TV games, publishing - they’re bigger and more profitable than they’ve ever been, proportionally and in real terms. And the share of income going to creators whose work they sell is smaller proportionally, and in real terms, than it’s been in 40 years, and it keeps declining. So the question is, how could you give creators this bargainable right, this copyright that they take to market, and try to get a better deal with from these intermediaries, publishers, labels, studios, tech platforms? How is it that we keep giving them more of those rights, and they keep getting less money for them? And the answer is that we live in a world where there are five giant publishers, four giant studios, three giant labels, two giant ad tech companies, also two giant app companies. One of those is the same company. And one company that does all the eBooks and audiobooks.

[34:30] And in that world, giving the creator extra copyright is like giving a bullied kid extra lunch money. There’s just not an amount of lunch money you give that kid that will buy them lunch. All it’s going to do is a kind of roundabout transfer to these firms that control the chokepoints, that have the audiences corralled with DRM, lock-in, network effects, all the things that they use to control the market, and whatever we give artists, they just take as a condition of reaching that market.

So to solve it, you need structural interventions. So first you need to understand how that market has become so degraded, what are the historic forces, how does the market work… A lot of the first half of the book is just untangling these very baroque accounting scams. The finance sector, they use the acronym MEGO, which stands for “my eyes glaze over.” It’s when you make a prospectus so thick that the person you give it to assumes that it must have some substance to it, but doesn’t try to find it. The same way that you assume that a pile of shit big enough must have a pony under it, right? [laughter]

Filippo Valsorda: [30:08] Yeah, exactly. So that’s the legibility. And becoming legible is trying to structure what you present in a way that’s familiar to the counterparty. And sometimes that means, for example, a lot of what I do is I send PDFs, I send a quote, and then there’s a purchase order, and I accept payments through ACH, which to many companies is much more legible than “So there’s this thing called GitHub Sponsors. It involves you giving money to Microsoft, and then they send it back to me, but you need to have a credit card for that, unless you have a contract with them.” And you’ve already lost accounting. Accounting is like “No, this is not happening.”

Kenneth Auchenberg: So in a sense, tying it to what we provide at Stripe is we provide payments infrastructure. So overall, as a company, we are providing the platform primitives and the experiences around payments for you to operate a modern business, whether that is you’re coming to Stripe to do just payments, because I need to accept credit cards, or some payment method in the world, or I’m doing banking, or I’m doing capital [unintelligible 00:32:22.11] I want to do a lending product, or I want to run a marketplace, a two-sided marketplace, and Stripe has various product offerings that we are providing as platform primitives that you can kind of plug into your product. So you don’t have to worry about all the financial complexity, we kind of abstract that away.

In particular, in terms of what I do, these days I’m really hyper-focused on thinking in platform primitives and extensibility, in terms of like, through the products we offer at Stripe, what are the pieces and the primitives we can provide so you can build the next kind of generation product on top of our platform, and really about opening up our platforms so all the primitives we have available internally, how can I make them available to you externally, so you can consume them and stitch kind of new product experiences together? …whether that is I install an app that is synchronizing data between some accounting system and Stripe, or I want to build a whole new kind of experience that runs natively on Stripe. So those are the things that I’m really obsessed with.

I do think that we need to think more broadly about what some of the teams here at Stripe are providing, and that’s our developer experience, it’s our SDKs, it’s our API abstractions, it’s the design patterns that our product is built upon. It is the supporting tools like the Stripe CLI, or it’s the integration of Stripe in editors like Visual Studio Code. So we have a bunch of different teams that cares about different parts of the developer experience, that when combined, is known as the Stripe developer experience and what we offer to developers as our product.

[34:07] So I would say that today, that’s just one element of Stripe, because the reality is that for a large platform like ours, developers are just one segment today. We also have many users that are just using Stripe to run their business. I’m a founder of a company somewhere in the world; what do I do? I open the Stripe app on my phone and I can get an overview of the payments. I go to dashboard.stripe.com to run my business.

So I think it really also depends, and through that lens of who your audiences etc. We at Stripe are definitely a developer-first a company, that cares deeply about developers, but at the same time, we also care about more kinds of people than just developers.

John K. Thompson: They do exist. They exist predominantly in the UK and in the EU. There’s one that’s very prominent called PoolData.io, and they’re working really hard to have their data exchange be out there. And there’s all sorts of other data exchanges going on right now. Across the United States, we usually see these kinds of structures, and they do exist and have existed for many years, in the area of health, and they’re usually related to cancer or heart disease, but they’re more prominent in the area of rare diseases. You know, people that have got hereditary angioedema, or primary immunodeficiency disease, or hemophilia, or something like that. And these exchanges really allow these people to contribute all their diagnostic data, their clinical data, and maybe even their genetic data. So they do exist, and they do operate, they’re in the United States, they’re around the world. Commercially, they’re mostly in the UK, in the EU right now.

And physically, the way it’s going to work is that when these laws come out - and California and five other states have these laws on the books right now… So you can go in and say, “You have to give me all my data, and you have to delete it.” If you live in Britain, or Denmark, or somewhere in Europe, you can do that. What’s going to happen in the future is these data exchanges will sit in the middle. So Amazon and all the other companies are not going to contribute their data to some monolithic central storage unit; that’s not going to happen. Colossus, or Megalith - that won’t be the case.

[18:12] What’s going to happen is they will still own their data, they will still have their data; we will own our data. And through the exchanges, you will go in and say, “For my browsing data, for my shopping data, for my health data”, whatever you have in there, your airline travel data, you will put a monetization amount on it, and you will say that these companies can or cannot use it. So when those companies go to use the data, they will have to pass through the exchange, they will have to check the yes or no, the opt in/opt out, they will have to understand the monetary value associated with it, and when they go back and use it, they will have to have an accounting system where they rack up the amount of money that they owe you, me and everyone for using that data.

Rob Mee: [26:05] Yeah. Values, and of course, it was our mission statement to transform how the world builds software. The origin story of those is always to me quite entertaining and enlightening at the same time. Quite a few people have heard this, but I don’t know if it’s widely known… Someone that I’d worked with since the early days of Pivotal, Edward Hieatt, who was running all of Pivotal Labs at this point, came into my office, and shut the door, and dramatically sort of locked it and said, “We need a mission statement and values ,and I’m not letting you out of here until we have them.” And I thought at the time “What?! What are you doing…?” And he knew my feeling on things like writing down values… I always imagined, being a developer myself, I’m very suspicious of things like that, and picture posters with clouds and doves, and things like integrity and honesty written on the posters and plastered on the wall… And so we’re a relatively small company, primarily oriented around software development. If we write down a set of values, it’s gonna backfire. People are going to find it inauthentic. And Edward said, “Well, actually, I’m here to tell you that I’m hearing from our software developers in particular that they want to understand what our values are and what our mission statement is. So I think we actually need them.”

And a similar time Edward had told me that the software developers were asking for more management at one point. So you know if your developers are asking you for things like more management or values, it’s gotten to a point where you need to do something… Because like me, they’re suspicious and cynical about those kinds of things, and they don’t take lightly to sort of corporate pabulum being thrust upon them.

So I said, “Okay, well, why don’t we just do what we really think and do what we really want if we think it would be palatable?” I mean, I said, “For me, I’d love to change how the world builds software, you know that.” And Edward said, “Yes. I would, too. That’s what I want to do.” “Yeah, but we can’t write that down. We can’t say that. That’s arrogant. That’s so ambitious.” And he said, “No, no, no. That’s a great mission statement. Mission statements are supposed to be aspirational. Why wouldn’t we say that?” And so after a time, he convinced me that that was the right thing to say. And it worked, and it stuck, and I think we grew into it, I would say, as we got bigger…

And for the values - that was a really hard one for me… But I just sat and said, “Okay, what really matters to me every day, as we work, at a meta level?” and I thought, “Well, the first thing is we’ve got to do the right thing. In other words, we have to be ethical. There’s just no gray area there. We can’t bill our clients more than we worked. We can’t allow any accounting silliness to come into play. We cannot be unethical, at any time. It’s just completely unacceptable. Alright, so let’s do the right thing. And people – we’re not gonna tell them what the right thing is, but I think given the people we hire, they will know.”

And the second thing was “Do what works.” Well, that was simple. That’s the basis of everything that we do, the way the methodology works… We’re trying to constantly do things that work and improve upon them.

And then the last one was one that I think is difficult in a situation – especially if you’re doing well on the first two, it’s pretty easy to think “Gosh, if we’re always doing things well and being righteous while we’re doing it, then we must be pretty darn good.” And then it’s easy to be, I think, contemptuous, or impatient, or mean. So you’ve got to remind yourself to be kind, all the time, and not allow yourself to succumb to those baser instincts or reactions. So I said, “Okay, let’s be kind.”

[30:26] And that was it. Those three. And Edward said, “I think those are fantastic. Let’s ship it.” And I have to confess, I was terrified that people would think we were being inauthentic, or something like that. And it didn’t turn out that way. I mean, people really latched on to those; they were on swag, they were on wireless passwords, they were everywhere. Email signatures… People put them all over the place, especially “Be kind.”

Chris Coyier: Yeah, yeah. I reached out to all kinds of people and talked to them about it, and tried to – I don’t know, just spelled it out, see what they thought, see if they had… And then even more so when the numbers started coming around, being like “How would you value it?” and stuff.

I never did get like a valuation of the company done, which probably a lot of people gave that advice… You can pay for that. It just was a little – it’s such a weird company. It’s a little hard to do, and it’s a little hard to find somebody that’s particularly qualified to do it… So I ended up not doing that. But what you know – you kind of know what your company is worth, because you have your own accounting to go on. You can be like “This is what the company earns per year. It has this kind of trajectory”, and then you just have a multiplier, like “Am I selling this thing at a 4x, 6x, 10x? What’s going on here? What are we talking about?” But at least you have kind of a range.