Cote:
[0:00] Well, your kids are getting older, you know, mine were getting older and then I had a new kid. And so now my kids, I don't know if that's a mean, a median or an average or, or what it is, but now I think I'm, I've got the, uh, you know, I got a six-year-old, which is great.

Matt Ray:
[0:17] You're the youngest.

Cote:
[0:18] Yeah. And so what I want to know, uh, is how we know I, I have a 16-year-old on the high end, But at what point does Halloween just stop being a thing?

Matt Ray:
[0:32] Well, it comes back around. So probably around the time there, I'm not going to overly generalize, but let's say 13, they're like starting to be too old-ish for trick-or-treating. But then as they get older, the Halloween parties start up. So then you have like, oh, going over to so-and-so's house, they're having a Halloween party. And then when they get off to university, who knows what's happening there?

Cote:
[1:01] Always a party. It's always Halloween at university, right?

Matt Ray:
[1:05] Yes they're always in costumes and and and eating things from strangers.

Brandon:
[1:10] Yeah i would concur like uh we're i think i'm in the firmly in the halloween party phase so and we'll have to check back in a few years about university stage but yeah it seems to be seems to track across across continents what are you observing.

Cote:
[1:23] Uh i i don't know i think i think i think my son it's sort of he i don't know he makes cause he made a costume he made a costume that is uh, he was working on it for several days way ahead of time and it's like this giant, like uh stovetop hat with a built-in monocle and, i don't know what is this it kind of i don't i don't know if i said this or he said it but he was like he's being abraham lincoln and i was thinking, i don't think he had a monocle but it's, Mr.

Matt Ray:
[2:00] Abraham Carnegie.

Cote:
[2:02] I think Mr. Peanut is a good one. Yeah. But you know, I think, uh, The other thing is, when do you think you can put the kids on giving out the candy duty? It feels like there might be this window where they don't want to go trick-or-treating.

Matt Ray:
[2:18] Yeah.

Cote:
[2:18] But then also they're, like, too cool to, like, stand at the door and give candy out to kids.

Matt Ray:
[2:22] Oh, they come back around on that.

Cote:
[2:23] There's maybe another window where they're like, I'll give the candy out to the kids. That'll be fun.

Matt Ray:
[2:28] I think there's probably, like, a year or two of sulking that they're not out there, you know, collecting the candy. But then they're like, you know, oh, here they come. and my kids like handing out candy.

Brandon:
[2:38] I think it's an easy sell, right? And, you know, just put a bowl by it and just, you don't have to talk about it. It's more like, hey, why don't you just do it? And they'll naturally take over.

Matt Ray:
[2:46] If you just put a bowl by the door, some, you know, some future venture capitalist is going to grab the whole bowl and dump it and go.

Cote:
[2:54] Well, and sell it the next day.

Brandon:
[2:55] The monopoly.

Matt Ray:
[2:56] Sell it, strip it for parts. You know how it works.

Cote:
[2:59] Yeah.

Brandon:
[2:59] Well, it'd be better to like someone in the private equity comes in and like he, what they do is they just, they leave some candy in a small bowl and then they take the rest of them, the candy, right?

Matt Ray:
[3:08] And they're going to be saying- All they leave are the wrappers.

Brandon:
[3:11] Right, and they're just like, and it's efficiency. That's how private equity would do. Like this was an efficiency play. You guys don't understand. We don't need all this candy. You had too many candy per treater was way off. We reallocated it.

Matt Ray:
[3:24] They unpeel each piece of candy and they put the wrappers back in the bowl and they're like, those wrappers could tame aluminum. You can get at least three cents on the dollar.

Brandon:
[3:33] Yeah, but just like, I can't believe you trick-or-treaters aren't thankful for the candy wrappers we're providing.

Matt Ray:
[3:39] This is obviously the way to go.

Cote:
[3:41] This sounds more like private equity people than VC people.

Brandon:
[3:45] That's the private equity. That's what we need.

Matt Ray:
[3:49] Private equity is buying the candy, hoping that it pays off somehow.

Cote:
[3:52] Yeah, the kids would come up to give the candy and they'd say trick-or-treat. And you would say like, whichever one you want, but it's going to be $5. Yeah.

Cote:
[4:03] Just making sure you're bringing in some income. Well, you know, speaking of trick or treat, it looks like there was the, I think we could have a weekly beat here. What happened in security last week and may still be happening? It looked like, you know, I think I've got, I don't understand exactly how it worked, but fill in some details for me as always, you two. You, Matt, you're the security expert around here. You know, you're always with your lockpicks and your CCTV cameras, things like that. I guess that's physical security, right? Did you ever get lockpicks? Were you one of those people?

Matt Ray:
[4:39] No, no. I appreciate, the fun of that, but it's not for me.

Cote:
[4:47] I had a friend who, it probably doesn't matter, but I'll have them be nameless. And they had an apprenticeship in high school with a locksmith. And so, you know, one day as you do in high school, he this person and someone else was hanging out at the railroad tracks, probably doing questionable activities and uh some some cops came around and of course they looked in his car and so what did they find but like like not only lock fix but like car lock fix and uh you know of course that looks suspicious right don't you have.

Matt Ray:
[5:19] To like carry some paperwork or.

Cote:
[5:20] Something yeah yeah and so he's like eventually shows them the paperwork and you know it's like well, carry on with whatever you're up to. But anyways, speaking of lockpicks, big problem in the PHP world. It looks like what you could do is you could execute shell commands if this, that, and the other, but it was a big deal. And then now here's, we should, I want to get to this eventually, is it also seemed like it was known about for a couple of years and people were debating how to fix it, which seems like you got a great story going on there about open source mailing lists. Probably something like fine, right? Like it's probably not a big deal, but it also like, that's an interesting angle on it. But it also seems like it was the usual thing where like, well, there is, there are known problems that are really like not that big of a deal, but then you bring the robot in and he's like, I'll make it a big deal. And like, you can figure out how to like connect things together. And then, and then, so you've got this vulnerability, everyone's following, the decorum rules of like we should just talk with each other and figure it out before we make a big deal and then I think.

Cote:
[6:25] The chain guard people were like well I think it's bad enough we're just going to release it we're going to release the patch to people and then this is perhaps, let's see, And usually the AI security drama is on the AI people where you're like, hey, how about don't do that? It's kind of like, I think what we've been experiencing for the past six months. And then they're like, yes, but we've got to make the AI smarter. And then they just, you know, keep doing it. But here, I think it's been divided, or it's been diverted to we all need to follow the rules of we don't talk about anything. It's almost like a prisoner's dilemma. One of the prisoners ratted the other one out. It's like we can't talk about it until we're all ready to talk about it at once.

Matt Ray:
[7:14] That's how embargoes work.

Cote:
[7:15] Yeah. And so that's all the angles there. What exactly was the vulnerability? What could one do if they were using this terrible PHP thing?

Matt Ray:
[7:27] Well, so the PHP to shell is, that's the label for several CVEs that are kind of related. Essentially, if you send the right incantation to a PHP server, it's like, whoa, whoa, I give up, have a shell.

Matt Ray:
[7:46] There was actually a really good Wiz podcast where they interviewed. Wiz was one of the research firms that discovered it. And when you said it was kind of around, there had been a similar vulnerability reported 15, 16 years ago that they were like, hey, is this thing still valid? And they're like, whoa, whoa. They mispatched it or it showed up again somewhere else on the code base. And so Wiz and OpenAI and a third firm discovered this. And I want to say like, you know, maybe two months ago, three months ago. And they properly, you know, they disclosed it behind the scenes to PHP. They weren't even trying to get into PHP. They were trying to get into, I think, Drupal. And, you know, they asked it. According to the story, they asked, you know, one of these high-end frontier models. Hey, can you find any exploits that look like this in Drupal? And I was like, I can't find that in Drupal, but I found it in PHP, which is the engine that Drupal runs on top of. And so by extension, they also hit WordPress and about 70% of endpoints on the internet are PHP. And so, And the vulnerability goes back for like 16 years of aversion. So basically the whole PHP ecosystem is screwed.

Cote:
[9:15] Yeah, like, you know, I use Pinboard, once Delicious went out of business for bookmarking. And I think that is that guy's name, Marcin? I forget what his name is, but he just shut it down for two days. It was great, great security measure just in that it was effective. But he actually brought it back online before like.

Matt Ray:
[9:34] After a day or so once you patch things up yeah i mean so, so they you know they responsibly disclosed this vulnerability and the php maintainers, um were like okay we're gonna we're gonna slip out the patches you know we're gonna put them out and tell people it's related to these cves we won't disclose details and we'll make sure that all the, all the downstreams of Note are ready. So they get Red Hat to put out new RPMs. They get Debian. They get all the distros. Everybody's lined up for this big, October 21st. We're all going to release this at the same time. That's how it works.

Brandon:
[10:17] It's worth mentioning. But the goal is that when it comes out, everybody or most everyone has a way to patch that utilizes their normal thing. Like nobody's at like a disadvantage. Like I, I, I have this problem, but I can't patch because my system doesn't have it. So that's the whole idea. So keep going, Matt.

Matt Ray:
[10:33] Yeah. So that's, that the stage is set and depending on who you talk to, um, you know, the, the evidence has not been widely distributed. Um, somebody got ahold of this vulnerability maybe the day before. And um this is according to like the chain guards ceo cto whoever um dan lauren dan.

Brandon:
[10:59] Laura i think it's dan.

Matt Ray:
[11:01] Lauren yeah with the ends in a c yeah and so he said you know ship it you know, so much for the embargo about six hours before the embargoes everyone's supposed to announce it chain guard's like, you know, Hey, there's, um, new chain guard images available for all our customers. And, you know, any, and, and there are some, you know, 9.8 CVEs attached to this thing. You'd need to start patching. And so that set off like a little firestorm because everyone else was waiting for six hours later. And some reports I've read said that in that six hour window, people reverse engineered what chain guard described and found the vulnerability again, independently in that six-hour window. That's how fast the frontier models have got. So, and then, you know, everybody gets mad at Chain Guard because they're essentially looking out for their customers and not the rest of the internet.

Brandon:
[11:57] I think there's one other thing to add, though. I think one group accidentally posted a video of the exploit beforehand. That was like an error. That was also out there as well. So it sort of was like, I guess the chain guard position was customers were already being impacted and this vulnerability was already known. So that's the chain guard position is like that. Therefore, they felt like they were justified in breaking their embargo and doing it six hours early. And then, of course, the PHP group, I mean, they mince no words here, right? I mean, they basically say these people broke, you know, they broke the code. They broke the embargo. I don't really actually know. I was going to ask you, Matt. Like, I don't know what the repercussions are from this, but they basically said they did the wrong thing in every sense of the word. And for those of you, don't worry. Don't think I didn't bring some rigorous science to this. I took an official software-defined talk poll in the Slack, asking everyone what they thought. So of the people that voted, 18 people responded. 17 people said they broke the rule and they should be kicked out of the inner circle, that being chain guard. One person said it was okay because customers were at risk. And one person said it's complicated. So they had no opinion. So there you go. So 17 out of whatever, 19, whatever that math is. So that's the official software-defying talk poll says ChainGuard was in the wrong.

Cote:
[13:24] Sentiments against ChainGuard, the survey says.

Matt Ray:
[13:27] And, you know, so even in ChainGuard's defense of, like, it was already out there. We had to protect our customers. Now they put their customers at risk because next time there's... A vulnerability like this chain guard is off the list they don't.

Brandon:
[13:42] Get notified but my question is like are they really off the list or were they is it like one of these things like if you do that again i'm really going to be mad at you i don't know right how do you.

Matt Ray:
[13:53] Know if you're not on a list well.

Brandon:
[13:55] I don't know i'm just wondering well i don't even know how do you i guess everything about this like how do i even get on the list i would assume it's something like the people like looking at just look at like i, it seems like if you were putting this together you would go out and say let's find all the big distributions that a lot of people are using and let's get a representative from every one of them and put them in the inner circle because the bulk of those people need to know, right?

Matt Ray:
[14:16] Exactly.

Brandon:
[14:17] And then, so I would assume that's how you get on the list.

Matt Ray:
[14:20] Yes.

Brandon:
[14:20] But I don't know of like, do they just send them an email and be like, listen, we're not, it's not even like we're breaking up, it's just ghosting them.

Matt Ray:
[14:30] I think you get ghosted.

Brandon:
[14:31] We're just ghosting. I didn't hear about that. Did you hear about that? I didn't know about that.

Cote:
[14:36] You get kicked out of the WhatsApp group? Is that what happens?

Brandon:
[14:40] Well, no, it's like a new WhatsApp group has been created to the side. Like, just don't use that one.

Matt Ray:
[14:44] That's the public WhatsApp. They name it responsible disclosure minus chain card. Yeah, and they're like.

Cote:
[14:51] Oh, we can finally set some new wallpaper on this thing. It'll be better.

Brandon:
[14:55] Well, is there any, I don't know, Coach, is there, I mean, I don't even know how to take the opposite position just because like everyone seemed to be so against it. But like, is there any justification just to be like, well, I mean, I mean, people were being impacted, so it kind of doesn't matter, right? Like, I mean, is there any way we can get there logically?

Cote:
[15:13] Well, I mean, you could. I think what Matt was saying is the accurate thing is the –, The risks to being cut out of future things is really like more weighty than like what happens within, you know, if it's a six hour window, sure, things can happen. But like you've had to consider, are you like you're you're you're privileged to be in this group where you're going to have people disclosing to you? I don't know if you have to pay or whatever, but like I assume it's something you want to maintain. So, well, it's easy to understand like someone just responding to urgency and doing something that seems good. Also, if you're with a group of people on something like this, you kind of have to just go with what they're doing. And it's difficult. On the other hand, you could, you could also imagine a scenario where, uh, whatever one, one of the, one of the group, uh, didn't, like they knew that something bad was happening and they, they had customers and they didn't release a patch. And then like, I don't know, JP Morgan chase goes down and then like, that's, you wouldn't be like, well, yeah, but then they also.

Brandon:
[16:30] If the exploit is so big and costs so much.

Cote:
[16:34] I mean, if like three banks globally went down, we wouldn't be like, well, you know, they were following the embargo.

Brandon:
[16:40] Right.

Cote:
[16:41] Like it would be more like, why wouldn't they just release this? I just lost $50,000.

Brandon:
[16:44] Well, there's also some nuance in the Chain Guard CEO post where I think he says something like they got wind of it, right? I guess it was like, and that they used a very simple prompt. It was something like find vulnerabilities in PHP. And they said, and therefore it was like, I don't know, it was almost like one of these clean room discussions. Like, well, I didn't really break the rules because I found this independently of what you were doing. You only found it because someone kind of gave you a heads up.

Cote:
[17:14] Even though- I guess another question would be, and I don't remember when I read it, is, well, did before, you know, let's say, give yourself 30 minutes before you decide you're going to do whatever box in the prisoner's dilemma, like two by two matrix or however many it is. And it's like, do you tell the other people? Are you like, hey, other people, like, this is how you break out of the prisoner's dilemmas. You can actually communicate with them. And so you would say like, hey, I think we should, we should release it now because I have blah, blah, because this is happening. Or do you not do that? Like, I don't, I don't know what the situation was here, but it seems like that would be the other thing. And maybe, you know, then you have an even more difficult, uh, analysis from what you're saying, Brandon, like if you did share it with everyone and then everyone else evaluated and they were like, no, that's not bad. That's not bad enough. We should still do it. That's even more complicated. But at least you've like, I don't know, tried to coordinate with people in this little window of time. So I guess there's like a few missing details of like what would be the, I don't know, ethical thing to do. Ethical is too strong of a thing.

Brandon:
[18:23] But I wonder if we just come up with like a risk assessment would be so, okay, so chain guard says it's being exploited, then they release it. Therefore, those people that didn't know about the exploit at all, now everybody knows. So somebody that wasn't planning to do anything, some nefarious person, now clearly knows there's a problem. So therefore, they have six hours, which, used to be a short amount of time, but with Claude and your agent friends, you just like, they can quickly come up with some type of exploit, right? I mean, I'm sure they're easily done. hour head start like right so not.

Matt Ray:
[18:57] Everything's fixed at that.

Brandon:
[18:59] Right so you really have six i mean you have basically six hours where like all these other people aren't going to be patched and you get a chance to like like if you were someone that was like i really am been, trying to find a way into this specific website and this group and i've been planning an attack like it's almost like releasing the whatever chain guard is trying to mitigate, you know almost has to be weighed against what they're actually instigating right like is And that's the part that I guess you would have to like, I mean, I don't really don't know, but like you could definitely make the case of like, you quote unquote, protecting the chain guard customers is just made the larger internet unsafe, which would seem like, that seems like it would carry the day in the Slack channel as we were all arguing about this would be like, okay, like, let's not make it worse, right? For everybody else.

Matt Ray:
[19:45] And and and the seeds that get set with all chain guards customers now are now chain guards are more at risk because they're going to get left out next time.

Brandon:
[19:54] It seems like, I guess, I want to know how we will know that. Because, I mean, I, because there is a part of me that's like, would you, if there was a big exploit.

Matt Ray:
[20:04] Yeah. And, like, it was going to. There were multiple big exploits last week. That's what's crazy.

Brandon:
[20:08] Well, that's true. I guess it's not, not if there was. There's going to be another big exploit. And say you had the knowledge and you're working with other people. And, like, wouldn't you want to, like, you don't really, like, you want to think of the chain guard customer. Like, you want to think about them. Oh, I know. I don't want them to be penalized, you know, completely in the dark because I don't like their provider. Or maybe I do. I don't know. Maybe it's like, that's why.

Cote:
[20:28] I think you would find out, right? If there was another PHP problem, then you could say like, I don't know how many, let's say there's 20 people in the group. Like if there's 20 people in the group who would get the PHP thing and 19 of them all release the patch within the same like 60 second window and then the 20th releases it like three hours later, then you kind of know, maybe someone was on a vacation but probably they weren't in the group.

Brandon:
[20:56] They're not in the secret group.

Matt Ray:
[20:57] Yeah.

Cote:
[20:58] You see when the release is. But yeah, it is like, yeah, I mean, I think, I guess what you do have to do is in a case like this is, yeah, you have to go with the group because that's like the whole thing instead of, and then if you don't go with the group, I mean, it's kind of like a movie. Like if it actually, the conspiracy theory is actually real and like, there's only one of the 20 who actually knows what the case is and you know it's the final scene where they're running to I don't know do the right thing then at least, it would be nice to have some evidence of that or something that proved it out. In which case, then it's kind of the reverse. It's like, oh, they've saved us, the earth.

Brandon:
[21:48] Well, I just want to throw it out to all the listeners because I'm always interested, if someone wants to find me in Slack or email, whatever, just let us know. I'd be interested if you were a Chain Guard customer and, are you deciding to make any changes because they did this early? Are you worried, so therefore you're going to move your containers to like one of the other, there's a bunch of them right so it'll be interesting that would be interesting now because that's going to be the only real repercussion anyone really cares that's going to change anything would be like hey Chain Guard, we're worried you're not on the good list anymore you're officially on the naughty

Brandon:
[22:22] list and we have to be on the good list so we're going over to one of our other providers.

Cote:
[22:29] Now Matt is this like how does this stuff normally work you were mentioning Node we go to all the big projects Is there some RFC that people follow? Did their local municipalities send out rules about how to do this? Or how is it all arranged? How does this happen?

Matt Ray:
[22:46] There is, I think GitHub actually has a security template. Or back in the day when I was working on a CNCF project, there was a health check that they did for all their projects. And one of them was you had to have a disclosure statement for vulnerability management. And they provided a template. I think GitHub provides a template, too. And essentially, you tell people, and in GitHub, at least, there's a setting where you can have private vulnerabilities reporting. So rather than post to a mailing list, there's a button you can hit, and it goes to a maintainer's list, for review of security stuff. And yeah, So that's, that's how, you know, I did it, you know, three years ago or whatever.

Cote:
[23:38] And then, and then like, how do these groups form and govern them, govern themselves?

Matt Ray:
[23:43] Well, it's the internet, right? So everybody is kind of, uh, decided in it for themselves.

Cote:
[23:49] So it's emergent is maybe a word that you would use.

Matt Ray:
[23:52] And, you know, obviously, obviously with CNCF, like they've got hundreds of projects under their, you know, their tent. So they've had time to kind of work out the kinks of what, they think good looks like. And I think a lot of projects probably should at least start from that posture of, hey, this is a known good working template. And if you diverge from that, that's fine. But just make sure you have a policy in place. And like I said, GitHub at least tries to make it easy. They've got all the backend tooling to keep things, private disclosure you're handled. And, you know, I had to deal with it a few times. Um, there was a fair amount of, trivial stuff like people like oh you know this is this is a you know, this should be a cve and you're like dude that's you know that's nothing and they're like where's my bug bounty and that was three years ago and so now everybody is like spamming that you know everybody being ais or just spamming you know, cves into the list and i read that uh, i think curl has said they're just they're opting out of anything but criticals being private so, everything is going to go on the public bug list and you know they're just like you know hey if you're tired of complaining about us not fixing things we're just going to put them all on the on the board you know patch is welcome but we're not dealing with this anymore because of the volume.

Cote:
[25:20] I you know i think we cover this in the summer but i think that guy he's got the best policy which is i'm going on vacation and If you want me to fix something, send money, which I think that seems like a whole Fosdom track that they should have, going on vacation, send money option that we have. Well, you know, meanwhile, it looks like I think I think as maybe Matt Levine wrote it, happy Anthropic S1 day.

Cote:
[25:48] They publish this stuff. Now, of course, I have not. I've read and listened to lots of commentary. I haven't read it that closely myself. There's all sorts of all sorts of details it reminded me of uh all those years of the cloud, where they would have their quarterly calls and the only thing i could think is like that's a lot of money i i don't know what to do with that looks like lots of money but my question we can get to the details is, uh you know you you look at this amount of money being spent and things happening and and i wonder, is this just like a crazy weird amount of money and figures because it has to be, because of the structure, how much money is being spent, the requirements that you have, like what's happening, or are like these people just weird? And if you start with weirdness, you end up with weirdness and all sorts of structures. Like, you know, There's a whole bunch of different structures of the founders and the not founders and this stock and that stock. So it's, I don't know, does it have to be this way or is it just like, this is just the way that the people doing it want things to be?

Brandon:
[26:54] I would say more like this. It's like having consumed a lot of different people writing about the Anthropic IPO and there are many people, a lot of finance people out there writing about it. It's like, in the end, I actually think it's pretty much kind of like standard in the sense of like, the numbers are very big, right? And the reason, but it's on every side. It's like, we've never seen growth this fast, right? And therefore, we've never seen any company require capital and compute at this level. So it's sort of like, I think when you just kind of get down to it, it's like, that's what's sort of breaking everyone's brain, right? And it's just that it's so big. Right. And it's just like, because I think it was like, they went from like $600 million or something and like, you know, whatever, two years ago, now it's like $14 billion. It's like, I mean, these are growth rates that people have just, no one has ever seen this before. It's just, it's never happened, right? And so they're well on their way to making that money. And now, of course, they record a big loss, right? Which is what everybody, if you want to be, if you're inclined to be like, it's all gonna, it's all fake, they're all gonna lose money, you point to that but that's really not real it's not real money right it's all it's saying is that like the company's appreciated so much.

Brandon:
[28:09] That their obligation to the you know ultimately the stock that they sold right to like the other providers is worth a lot of money to them therefore it's money they didn't get but it's not like it's not actual like cash flow it's not operating income, so if you look at the operating income side of it.

Brandon:
[28:25] It they are projecting a profit right which is like, whichever. So I think that part is like, so that's the side of the narrative. You're like, hey, it's actually a profitable business and it can continue to grow. So you can take that side of it.

Brandon:
[28:37] And then you can flip to the next page and you'd be like, but when I go to the next page, they're on the hook for like $700 billion in compute capacity over the next X amount of year. So I go to that page and be like, they have taken out so much debt that they'll never be able to pay it back, right? So if you want, if you're inclined to think that way, you're like, that's your page. The paid commitments is where you go. If you're inclined to believe the story and the growth, you go to the growth side.

Cote:
[29:04] And so it's just like- Everyone's got their own page, depending on your viewfinder.

Brandon:
[29:07] Not only that, Everyone has their own page. Everyone has their own charts. You can just pick the chart that you want, right? And so, and the chart that I think other people have shown is really interesting was they were talking about essentially retaining revenue. So like, you know, if you retain 100% of your revenue, all your customers renewed. But really your goal is to have your customers, if you will, buy a little more. So like a really good rate would be like 150%. So the customer spent 50% more this year than last year, right? That would be like phenomenal. Maybe you get to 175, that would be phenomenal.

Brandon:
[29:43] Anthropic is showing a rate of return that some group of customers, of 900%. So some group of customers are spending nine times the amount of money they were in the previous years, which is a number so laughable and so different. Like no one has ever like, no serious business person would have even entertained what you're showing them, right? So that's the page if you're really optimistic, you say, see, people are buying this and people that touch it can't get enough. They're buying almost 10 times as much as they were using. So this would be like Kote. This is like us starting on the $20 plan and then, you're at the $200 plan. So you're buying it and then next year you're going to be at the $2,000 plan. And obviously at some point it breaks down. So again, that's the statistic you say if you want the growth story. And then of course, on the other side is you say it's like it's too much debt. There's just absolutely no way you can continue to grow at this level.

Brandon:
[30:38] And you would say like beyond coding and a few other things, there's just not going to be a growth story. So I feel like the IPO was sort of like it didn't really settle anything. It just sort of said, like, here's all the data. Now, please construct the narrative that most suits your worldview. And we'll all check back in a year once they've been public. Because that's the one thing that's good is we get to see the data now every quarter and we'll be able to see what happens. So that was my take. But Matt, I'm sure you either have a long position or a short position. What are you considering?

Matt Ray:
[31:11] See, I'd hope I'd get to interrupt and put you on the spot first. So, yeah. Kote, you've got $100,000. Are you in on the IPO or are you out?

Cote:
[31:28] I think I'm definitely in. I'm going to put it all in, Matt Ray.

Matt Ray:
[31:31] Okay.

Cote:
[31:32] Brandon's saying? I'm going to watch it for a day, and if it goes way up in one day, I'm just going to sell it all. And if not, I'm going to be sad.

Matt Ray:
[31:43] So so so you're you're you're buying the uh the boom and.

Cote:
[31:48] Uh you know it's stick around for the space it's it's just so, everything's so like weird and unknown that like it's it's hard to like you know i i was i was thinking of this earlier like it is uh and and for the record i'm on i'm on the max hundred dollar plan not the 200 oh sorry okay well next year you can still go again next year but but you're only you're.

Matt Ray:
[32:08] Only 500 growth.

Cote:
[32:10] Yeah i mean it is like yeah this stuff is great. It's hard to imagine life without it. So, sure. But I have no way of evaluating, like, is too much being paid for all of it? Or maybe it's also like, I've been given a free car, and of course, everyone else is around, riding donkeys, and I've got a car, so everything's great, but someone's subsidizing my car. So I don't really realize that I have something that I shouldn't have. But yeah, it seems like it's hard to... I don't see what could go wrong. That's the famous last words.

Brandon:
[32:57] We should definitely clip that. Mark it down.

Matt Ray:
[33:01] Yeah, write that one down. So here's my page one versus page two point. It's like that page two, that $700 billion of commitments, we're already seeing the people downstream like, getting like convulsing based on that right we had microsoft announced that they're giving uh 25 of their workforce the offer of early retirement so they can pay data center, uh costs uh you've got oracle like who are now junk bond rated on uh on their investment stuff because they're all in and building data centers and they're not getting built so.

Matt Ray:
[33:42] Does this affect Anthropic when they can't get the data center capacity that they need? Undoubtedly. Are they on the hook for paying some of this off? Yes. And so like, that's, there's a whole lot of like, oh, don't worry about that. Look at this, you know, 900% return. I don't think that's, I think, you know, my own position is, yeah, I probably would buy in at the IPO, but I would probably try to get out fast, because I think there's going to be a spike I think there's a whole lot of like sky's the limit but as we saw with SpaceX like sky's the limit and now it's under where they IPO'd and, I think, you know, eventually the real economics of the world have to catch up with you.

Cote:
[34:32] Yeah. And then there's also, you know, there's also the, well, this one is difficult, but there's a defensible problem where, I don't know, is there a big difference between like Codex and like Claude Code and then like Grok and then whatever? Like not, not really. And then, so then the, the, the, the moat is just like how much it costs to get into it, which is one thing. But then you also think like, but I don't know, in like three years, isn't my laptop going to be fast enough to just run that stuff or not? Like, so it's like all over the, uh, that's, that's the other issue is like the longterm, even, even if the stuff is great, the question then becomes like, how do you, how do you monetize the stuff? In a defensible way so that you get enough revenue and profits to pay off these things.

Matt Ray:
[35:26] I mean, I'm going to keep beating this dead horse, but Brandon was a Cursor ride or die guy.

Brandon:
[35:32] Well, I think it's true. And honestly, if you invested in Cursor, you would have made a lot of money. I was sort of right in the backdoor way.

Matt Ray:
[35:41] But that's okay.

Brandon:
[35:42] That's what accounts.

Matt Ray:
[35:43] That's all that matters. Where's Cursor in your toolchain, right?

Brandon:
[35:46] Done. I haven't used it. and I don't even know, I don't think it's inside, I don't think I uninstalled it. But I will say this, like a couple things that I've been thinking about, and I've heard other people say, and I think it makes sense, is like,

Brandon:
[35:56] One is to just all remind ourselves, human beings are very bad at exponential thinking. Like we just, as you guys were talking, it's like, well, how much better is it going to be next year? It's like, if it is truly and exponentially getting better, it's going to be exponentially better, right? It's going to be, you know, not twice as good, 10x, right? And so that sort of opens up like, what is this like if it's 10 times better than it is now? It's just been two years, right? You were saying before, and it's like, and it's completely disrupted coding. Like nobody codes by hand anymore. I just was doing an interview and he was saying the same thing everyone else says. So it's like, and the thing you have to kind of say, it's like, and this is like, listen, I'm not saying it's going to happen, but like, I don't think anyone saw Claude Code and Codex coming, at least to the level of like where it is, where it's completely autonomous. So it's not unreasonable to think that like, whatever it is, the next X thing is just on the horizon. And we're all going to be like, you know, talking about like, I can't believe that we used to do this thing that we all did and we spent all this time and like, now we don't even have to do it again.

Brandon:
[37:10] And so I think that's just like a hard, it's very hard to like keep that in your head as a human because we're very used to like linear progression. It's like, yeah, next year will mostly be kind of like this year, maybe be a little bit better. Like you were saying, Cote, it's like, maybe I'll just run the model because we've been saying this, but like I'm always using Claude. I'm always going back. I'm not using like chat GP 3.5. I'm like, no, that thing's trash. So like in a year from now, we're gonna be like, Like, you know, I could just use the free open source model or I can just continue to pay the $20 and have access to like the best models. I think we'll just continuously find ourselves being like, no, I want the better thing because it can do more for me and it does more for me and it earns its value.

Cote:
[37:53] Yeah, you know, so yeah, see, you're winning me over Brandon and I think maybe a test of this extreme thing, I don't think we talked about this last week, but I didn't call up my usual sources to verify this and get the New Yorker fact checker bureau on it. But I remember seeing some headline that there were some like, whether it was Anthropic or OpenAI employees who started smoking because they were like, well, we're going to cure cancer soon. So it's not a big deal. And I guess there is a sort of like, that's a good extreme expression of like your faith in exponential thinking is like, would you pick up smoking for it, for that? And, you know, obviously that's an absurd situation because you could be like, well, there's lots of types of cancer. Why do you assume this one will be addressed? But there is like tracking like behavior change and thinking through what that would look like would be, I don't know, it kind of helps test out the, it's something beyond like $100,000 investment, right? Like would you change your behavior because regardless of the stock performance of anything, like how are you changing your behavior because of this exponential increase in capability that AI Goop will have. And I don't know, that's, that's, that's not much of that happened. There's not a lot of people who are picking up smoking because of AI. Only a small group of people.

Brandon:
[39:19] No, I think, I mean, I think it is. I mean, I guess, and obviously the bear case is just to say, it's like, no, like we're just, we're just one, we're just in this mode of time where it looks like it's going to be exponentially better, but it really isn't. There's got like, we're in like a local plateau, right? Or whatever, local maxima. And we're kind of, we're just at that and we just don't realize it now. It'll take us probably two to five years to figure it out. Because the one thing that on the compute side, the one thing I tend to agree with that most of the, hyperscalers have come out and said is they basically come out and said like they've sold all their compute for next year. And I don't believe and normally I'd be skeptical of all this, but like I actually believe it. I believe on the books they have contracts for everything. So it's like you want GPUs or compute next year and you don't have it bought. You're either going to like have to pay a lot or you're not getting it. So if you think about that, the hyperscalers are going to book their numbers. It's kind of like this NVIDIA thing we've been talking about. It's like NVIDIA sold everything for next year. The hyperscalers have sold all their compute. The models, people are still using them. They're still growing. So it's like in the next year or two, it's like I don't think anything's bound to change much, right? At least from like a crash. You're not going to suddenly see.

Matt Ray:
[40:30] Oh, you jinxed this.

Brandon:
[40:31] I'm just saying. I mean, now you could say in a few years maybe it would go through. But like, I just, because back to your $100,000 bet, it's like, well, it's, I mean, we're seeing it. I mean, forget $100,000. Like, you're seeing everybody go all in. Like, you see Facebook issued, what, a third class of stock. They're going to issue, what, like another $80 billion. I mean, so they're essentially betting $80 billion that this is the next big thing, probably thinking that that will turn into like several trillion.

Matt Ray:
[41:00] Wait, wait, wait. I mean. They're betting $80 billion. It's got legs.

Brandon:
[41:04] Yeah, hopefully. He's got all my national legs this year. So, I mean... But I think if you're on their side of it, like what, I mean, if you miss, right? I mean, I got, that's the thing, right? Like the penalty for missing, I mean, you can only, I mean, this is going to be probably the dumbest statement I've ever made on this podcast, which I got to say high bar.

Matt Ray:
[41:23] That's a high bar.

Brandon:
[41:24] So it's like, but like, hey, the worst you can lose is $80 billion. So that's your downside. I mean, the most you can make is like trillion. So, I mean, that, I think if you're on like that side of the bed, it's like, yeah, we got to do it. Like, we have to be in this. Otherwise, you could be completely cut out of the whole thing.

Matt Ray:
[41:43] Well, that's what's so insane about all this. There was an article, right up from Apollo, like an investment group, and they said they're calling it the S&P 493 because if you take out the seven FANG companies or whatever, the rest of the economy is in deep recession. And so, like, if 493 of the S&P 500 are in deep recession, who's going to buy all this? Who's going to pay for this? You know, everything is going down except for these tech companies. And you can only do circular financing for so long. Like, somebody ends up— See.

Brandon:
[42:22] This is the only answer to this. Like, I just come back to, like, I feel like this is distilled down. It's like, all that matters is there's continuous demand. If you tell me that the demand drops off, and we would see this in the numbers going forward for Anthropic, if the demand, if you look at their revenue number that is going up like faster than any revenue number we've ever seen in our lives, right, and you say, well, it's not going to go up anymore, then you're absolutely right. Things are going to be bad. But if you say to yourself, I'm just looking at the chart, the chart, you know, and it's not linear scale. It's logarithmic scale, right? And as long as that chart keeps going up, it's going to be great. There's going to be tons of money in the economy. So the circular financing, it works its way out. If demand goes up, I don't care where the financing comes from. If demand goes down or flattens, we are in a world of hurt. I mean, it is that simple. There is nothing more to like, you can have as many super smart finance people on, but that's the only question you need to ask yourself.

Matt Ray:
[43:23] Well, put me in the, I'm putting me in my 100K and we're in for a world of hurt.

Brandon:
[43:29] Matt's putting it under a mattress? Where are you putting it? In a mattress?

Matt Ray:
[43:32] No, no, no, no. I'm in, but it's short term. And I think we're in for a world of hurt.

Cote:
[43:39] Well, what you need to do is you got to hook up Clodder Codex to Chrome and then tell it what you want to do. And then when it does it for you, it invests your $100,000. You'll be like, wow, this is magical. It actually works.

Matt Ray:
[43:52] Or just log into my Schwab account and do it.

Cote:
[43:54] I know. I know you could do that too. But I think that's, you know, like when I read through stuff like the Apollo thing, it's like such a cliché response. but it's just like, I feel like we're not using the same software. Like, I'm using some software that, like, it seems pretty great and does all of this stuff. So I don't know what, are they using the same software I am or something different? And, you know, I had a, you know, a comment on some LinkedIn thing from one of my old high school friends. And they were like, we have Copilot here and no one uses it. And so like I go and I show them like, why don't you type in here, look through my email and help me schedule things. And then it does it for them. And it's amazing. Like, just like these little things that I messed this story up kind of to make it simpler to tell. You know, it's just these little things of, it's almost like in Word and Excel, you have all these functions and everyone only uses their own 10% slice of them instead of using all of it. And so, I don't know, like, does that Apollo guy, does he have Cloud Code installed?

Brandon:
[45:05] Is he like running it and using it? Well, there's also like, I mean, people say like they're quote unquote not using it, but like, you know, so I'm in the process of trying to acquire another car here in a few weeks. And so it's been really interesting because I was like, okay, I'm going to use my agent to do most of this, but it's still mostly human and loop. I just ask it like what I should do and how, and it tells me what to do. And I just basically do it. But then on the other end, like I'm interacting with all these dealerships. And of course, like I can tell, not that I think it's wrong. They are responding a lot with AI, right? Like the responses are AI generated, the questions I ask are generated. And so I'm like, I was like, we're pretty close to just being like, Like, we're really almost kind of there. Like, I don't think either human being on the side is doing that much work. Because I'm, like, just looking at it enough to cut and paste some emails. I think they're generating quotes just enough to get them to me. And then they've got, like, their agent basically pinging me. And I've got my agent, like, kind of, like, going back. And it's, like, really, at this point, the human beings are not needed, right? It's just, it's, and you can, but you, like, you literally can see it. Like, it was just like, we're both watching the agent, but mostly not doing any of the work. And we really could just turn the agents to let them talk and work it out.

Cote:
[46:21] Maybe when you finally go in, you should just put your phone in voice mode and then have them put theirs in voice mode. And you guys go get one of the free coffees and you come back and see what happens.

Brandon:
[46:30] But it kind of feels like that with so many things. So when people say that, it's like, yeah, I think, I mean, I think it's happening a lot more than people say. And also the people that don't want to do it. it's like, yeah, well, I think a lot I get when people are frustrated and they don't want to do it, but I think the people that are having success with it in the real world, the normal people, don't spend a lot of time talking about it. They're just like, yeah, I'm getting all my work done faster and I'm going home and I'm not going to, if you're not into it, I'm not going to bother evangelizing it for you. I'm just like, I just make my reports a lot faster.

Brandon:
[46:59] I get my slides done faster. I get my meetings done faster.

Cote:
[47:02] Well, you know, if you had taken Matt Ray's $100,000, several centuries ago and invested it in a little something called bureaucracy, you would be a quad trillionaire by now. I think if one, you would have to be a vampire to have lived that long. But you know, in order to become that wealthy, you've got to do all sorts of things. Wouldn't be such a big deal. But speaking of, what is bureaucracy doing this week, Brandon, that is allowing those vampires to live comfortably?

Brandon:
[47:34] Well, I sent some stickers to, So I believe it's pronounced Izak in Denmark. Hopefully I said that correctly. So it was great to hear from him. And if you would like stickers, just send your poster address to stickers at softwaredefinedtalk.com. I will be happy to send you a sticker anywhere in the world.

Cote:
[47:50] And there's some, not as many conferences as usual, but I'm going to be coming up on November 2nd, which is next week. I'll be speaking at SRE Day Amsterdam. Then I got invited to speak at the DevOps Amsterdam meetup, not DevOps Days, Amsterdam. But I hear they're doing that this year. They had to cancel last year. That's November 10th. I'll be at VMware Explorer London November 18th to 19th. And then Cloud Native Denmark on November 19th and Build Stuff, which is going to be in Villeneuve, Lithuania on December 2nd to 4th. And I should also be at Configuration Management Camp, if only attending. It's great to go there every year, February 1st to 3rd. And then one of our favorite conferences, scale 24 X's in Pasadena, April 1st to 4th. And if you want to, there's one of those, the one in Denmark has a discount code. If you want to get it, you go to softwaredefinedtalk.com slash 596 and you can check out that list there. Now, another list you can check out when you go there is what we, what I think everyone knows is Brian Grace Lee's favorite part of the episode, the show, is the recommendations. What do you have to recommend for Brian this week, Matt?

Matt Ray:
[49:02] So a quick one is, I saw a video for this one-man band called Steel Beans, and it's just jaw-dropping as a, former musician of sorts. Just watch the link in the show notes of this guy playing drums and guitar at the same time and singing. Just not my genre of music so much, but amazing. But my real recommendation this week is I'm going to be taking down my personal computer hardware, back down to the studs and rebuilding everything. So I'm looking for recommendations. If there's anything that maybe I've overlooked or, haven't checked out yet, feel free to drop me a note, either in Slack or wherever, and give me your recommendations. but starting from scratch and, Going to be trying to drive some of it with config management and AI. So we'll see how it goes.

Cote:
[50:08] So is this like a one-man band? Like, was it Burt and Mary Poppins?

Matt Ray:
[50:14] Yes. It's exactly like Burt. He's got, it's impressive because he's sitting at a drum kit with a guitar and playing at the same time.

Cote:
[50:25] Ah, not walking around with penguins.

Matt Ray:
[50:28] No, no. He doesn't have a harmonica strap to his face. he doesn't have the bouncing around to do the kick drum alright.

Cote:
[50:38] Well that sounds like fun just check it out.

Matt Ray:
[50:40] It's entertaining at least.

Cote:
[50:42] How about yourself Brandon? what do you have to recommend?

Brandon:
[50:45] Well two things, one I thought you were going to steal it but it sounds like you're not Kote, I just wanted to, re-recommend my favorite term editor, it's Ghosty so I was just telling Matt he should check that one out if he's so inclined because they just released 1.4 I think it is just the nicest, best, terminal editor, and I still end up using it in lieu of the Cloud Code co-work. I still like the terminal as well. And then for everyone, we were just talking about AI and stuff and what you can build with it. So I've built a native Mac app that lets you edit podcasts. And you know what? We've been talking so much about AI, I try to put at least my time and effort where my thoughts are. So I want everyone to download it if you are so inclined to have any type of music slash podcast editor, go to podeditor.app slash beta. Link's there. You can download it. You can try it out. You can tell me, does it look like a professional Mac app that you would use? And if it's good, tell me. And if it's bad, tell me what's not working. I would love to get your feedback. So check all of those things out.

Cote:
[51:49] Well, I was at DevOps Days Istanbul this past weekend. There's a big, I guess they call it a storm. Storm for me, and maybe for you too, confusing. It was called Storm Austin. I don't think it was Storm Austin. It was Austin, like with an E instead of an I at the end. I don't know how to pronounce that, but whatever. It was a big deal over here. And then there was another storm coming. And so they shut down. They didn't shut it down, but they canceled a bunch of flights back to Schiphol. And so I had an extra night in Istanbul there. And then I had a very early morning flight at 7, 15 a.m., which normally would be fine, but it takes like an hour to get to the Istanbul airport, depending on where you are. So you're looking at like waking up at like 3.30. But it turns out they have one of these tragically named Yotel, where they've got a hotel that's behind, that's actually in the airport, behind security and passport. And because Istanbul is like a 24-hour airport, even though you have a flight at 7.15 a.m., you can actually go there at like 5 p.m. The previous day, and then you can just check into your hotel. Now, you got to hang out at the airport, but it's a lot better than waking up at 3.30 in the morning. And, you know, it's kind of a ridiculously small hotel room, but it's fine. They don't have coffee in the room. You know they do you know I do carry around a bag can't you just.

Brandon:
[53:18] Go right from there to like one of your favorite airport lounges and get your coffee like.

Cote:
[53:21] Is it yeah.

Matt Ray:
[53:23] They don't want to waste your time.

Cote:
[53:25] Yeah it turns it was actually it's great if you have an early morning flight is this like one of those like where you got like a little cubby or is it an actual room you can buy those but I had an actual room like they do have ones that are just like little beds like did it have a bathroom or was it a shower yeah I had a bathroom and a shower and, the bed it had was one of those like old people beds So it's like a crash.

Brandon:
[53:45] It's like airport crash pad kind of thing.

Cote:
[53:47] Right? Yeah, yeah. It's nice. And it's also like the Istanbul airport is like relatively brand new. And so it's big. It's nice to walk around, lots of things. So now I know it very thoroughly after spending several hours there just walking around. But it's, if you find yourself where there's one of these, as they say, airside like hotels, I think it's pretty nice. It's not cheap, but it's definitely better than waking up that early and stressing out about stuff. Because, you know, Istanbul is one of these airports where, you got a security check just to get into the airport. And then you go through another security check. And then you got to go through the passport. Just lots of stuff. Who knows? So check that out. They call it Yotel.

Brandon:
[54:33] It feels a little too close to like YOLO, you know, so it's like, I don't know if that translates. Maybe that doesn't translate in Europe, but anyway.

Cote:
[54:41] And I think maybe they're saving costs because when I got my key, they don't give you a little paper envelope with it. You just get the key. That's it. That's how they do things. Well, speaking of how, what things are done, you've listened to another episode of Software Defined Talk. If you want to get the show notes for this episode, which has links of things that we talked about, many things that we didn't talk about, those conferences, links to recommendations we have like Brandon's podcast editor and, you know, son of Bert from Mary Poppins, it sounds like, then you can go to softwaredefinedtalk.com slash 596 and check that out. And with that, we'll see everyone next time. Bye bye. There's something that's been happening in the past year with every episode, it feels like there's something wrong. So here's what happened with me. I was sitting here and then all of a sudden there's this loud buzzing in my ears. And I think the Rodecaster just like froze up and just was like...