Episode 11: Beads, Speckit, Perles, Opus, Agents, oh my!

free tech shirts.
Okay. Optimizing AI workflows with spec
beat pets and beats. H Beats, baby.
Could have fixed that one.
I did I did see the typo at some point,
but I forgot. Good point. Should update
that.
>> I share my workflow building a project
called the grid, which involves a
Terraform state back end. I discuss how
I've been using and modifying specket
for a more advanced cloud core cloud.
>> Yeah, I haven't updated. It's all
>> is this generated auto by AI?
>> Yeah, Loom. It's I'm paying for Loom.
And so Loom automatically does the
transcripts. It's a pretty easy editing
experience.
>> Oh, that's we need to do transcripts for
the podcast. That was my next little
epic.
>> Hey,
>> I wanted to share with you my AI
workflow. So, I'm currently building
something called the grid, which is a
>> I always find when people show their
toolbar,
it's a bit distracting.
>> Yeah. And there's too many like um icons
on there like bookmarks. I also noticed
it when I was rewatching.
>> Command B. I'm always conscious.
>> It's like it's like it's got to be a
name for it.
>> I know a terform state back end. It's
not very hip, but it's not a trivial um
project. So it requires a little bit
more advanced Claude Code usage than just
traffic.
>> I can't I can't help but notice this
jur.
>> You can I never watch myself at at at
one. I always watch myself at 1.5 and
when I'm edit editing I watch myself at
two double speed.
>> I find it interesting that you call opus
a planning agent.
>> You will have a couple of
>> a lot of people do. Yeah. Then
>> so you you were saying that like when
Spectit updates you update, right? But
>> yeah, so I have a local copy of the
prompts and I go through their change
log and I pull in uh and try to merge my
changes together with theirs. For
example, one of them is originally
Speckit generated very nonsense branch
names, but then they modified the script
to um automatically like LLM create like
a nice branch name. Do you ever PR back
some of your suggestions back to them or
it's like you've personalized this or
something?
>> I am thinking about it. I'm not sure. I
I I really think it would be nice if I
could contribute it back and align mine
more with upstream. So, but I didn't
notice a lot of effort um lately on the
project. That's why I haven't um
contributed it back.
>> Oh, okay. Okay.
in my in my employer.
I'm I'm reluctant to to name it just
because I don't want to get myself in
hot water, but we have like quite a lot
of interesting material about how to to
launch. I think we call them inceptions.
I think uh it's it it's just how to to
to gather requirements, NFRs. There's
there's a lot
and and I can't help but think it must
it must match well to this sort of
stuff.
>> This is cool. This is cool. I'm just I'm
just thinking aloud that like uh in my
workplace we always have to do an ADR
for for things. What I don't like is
doing the ADR
before we implement it.
I don't know if you have any thoughts
about that, but I mean an arch
architecture decision record. Okay, this
this is a spec. You you're talking about
specs. an arch architecture decision
record isn't quite the same. But anyway,
it's just a thought at the moment. So I
just had maybe you can dive a bit on
that because I just had a call as well
uh with someone who's building more like
a multi- aent system to like when cloud
has completed some work kick off a
review agent or one or more review
agents to get feedback and I was like
why do you do the review and and
[clears throat] then this examples he
gave me was like
>> the review agent needs to validate that
the implementation matches the user like
uh story or the business value and I'm
like actually speckit inverses that and
I feel like is it is speckit more
waterfall like than agile because you're
making a lot of decisions up front
you're doing like a a resource
>> research but I also think and I think
this so yes speckit is doing anversion
of like making sure that the
specifications are defined first um but
what speckit also does is
it's like 70% planning 30% and um agents
writing code. So you do the check-in of
the of the specifications, the user data
and all that and the tech research and
then I imagine you go off on another
branch, you let the agents write all the
code and then if you encounter any
issues with that design, you just throw
away because it's so easy uh and so
cheap to generate code and you go back
to the research and you're like, "Hey,
we tried this. We we got stuck there.
There's some problems with this design
because course adjusting midway is not
that easy." like in if I'm in the middle
and I have like generated 20 tasks and
they assume that I've gone down this
path where this file exists over there
and that turns out to be a wrong path,
you must be able to backtrack. So I
think that's something I'm not doing
right now because I'm trying to course
adjust. I think specit is kind of agile
in that way.
>> I I don't I didn't quite get that. So
when you course adjust are you saying
that your initial spec doesn't keep up
the specs don't keep up with that course
adjustment or
>> yeah if the whole you know idea here
that I'm I'm I'm highlighting why I like
speckit is that it goes through all of
the code and it highlights clearly like
okay we're going to introduce this
feature and it's going to touch these
five components in this component we
have to change this in that component we
have to change that and there's a
contract between them, right? So, you
get very small tasks and you send them
off into agents to to to complete those
tasks. When everything comes back, you
should, you know, and you're building a
bridge, you have to meet in the middle,
right? Not not like and
>> so so if in the middle one guy was
successfully building against the
contract, but the other guy had like a
massive issue, maybe you need to be able
to step back and course adjust where the
rest of the plan is like laid out
according to that path. So, that's kind
of like
>> the hard bit about it. But I think
>> I think you have the same if you do an
ADR right you you will have gone through
several parts identifies the issues and
backtracked right
>> yeah like the whole point of an ADR is
to to be honest ADR's arch architecture
decision records are are different for
every company but the expectation in my
current gig is that they that you have
like three choices you you have your
three vendors or whatever your three
things and you and you basically
show that you that you done some due
diligence in comparing the three
options.
So, it's not quite it's not the same as
a spec, but I I can imagine all feeds
into each other because
yeah, it's anyway, it's that's but
another point [snorts] of feedback that
I got u when I explained the specket um
workflow to the guy who's building the
to Zach who's building the beats uh UI.
He he also highlighted to me that in
agile you will have a retrospective and
speckit doesn't have that retrospective
the way he understands it right now like
where you go back and adjust the the
prompt templates to like make sure that
you don't go do make those same mistakes
>> and and then furthermore like specit is
for driving AI like I feel like we
almost need a speck it for driving
humans because like all these workflows
all these things it's complicated
Well, is it? Yeah, it is. It is. We're
all learning here.
>> We're all learning how to drive the AI
and like it's it's quite it's not easy
um to keep everyone on board cuz it's
moving quite quickly too, you know, like
like I mean some of my stakeholders are
like non-technical like if if I go
rampant with the AI, I mean they're not
going to keep up basically.
[snorts]
>> Yeah. Y more areas. So one one thing
that's come up on my radar a lot is this
is this term uh pro progressive
disclosure when you write these markdown
files
would you say they progressively
disclosing the the task or how or does
it even feature in here? I I guess the
AI is expected to read the whole damn
thing and the end of Right.
So I think that's where um beats comes
in very nicely which I'm going to
mention next when I show this 1,300 line
file which um it's beats allows the AI
to stay focused on just um a small
portion of the of the markdown. I don't
think markdown is the best way to
progressively
um disclose like the details. I think
with Beats you actually get like the
high overview and you can drill down
into one issue and then get exactly that
like design acceptance criteria
>> in in the anthropic documentation. I
think the I mean they don't say this but
my interpretation is that like with the
skill markdown you you structure your
mark you you structure your markdown to
have 1 2 3 4 5 6 7 8 9 10 with the
realization that the thing might not get
to 10 you know but anyway
>> tasks. So you label them. Interesting.
So you must have a reason for labeling
them prereec edge status
validation inference web app.
>> So the the problem was when I was
playing with beats I realized that there
wasn't really a good way to query the
list unless you use labels. like you can
see the next set of ready tasks but if
you have like multiple feature branches
then there will be a complete mixture of
different tasks in that database because
they are shared right it's on the root
of the repo so if you have like multiple
branches but you're merging things in um
there is actually the beats database is
shared this is very different between
specit which the task file is for one
feature but beats is like a central
database and and I realized you couldn't
really query that database case unless
you use labels. So labels were the only
way to like slice and dice the the the
issues.
>> Yeah,
>> fair enough. I guess I'm always thinking
hierarchically for some reason, you
know, like I'm thinking epic feature du
du du.
>> I will show you the the the graph in a
>> Yeah.
>> Oh, I thought you were going to mention
BD ready, but maybe you're going to do
that. I mean, spec implement is BD
ready, right?
Yeah. Um, kind of it's it's you have to
augment implement with with the next
steps to do. I'm I'm actually not using
BD ready. I'm usually telling it like
we're going to work on user story one.
We're going to work on user story 2. And
usually I want the ready to be filtered
down to user story one or user story 2.
So um they just added that with
capability. Before you could not um
filter ready by label, but now you can
and and I updated my prompt as well like
use the BD ready but with these label
filters.
>> It's interesting that you use user
stories for some reason.
I mean every every every
card, every task for me has a user
story. But I'm guessing you're using
user story as a more of a high level um
a high level feature that you want to
implement. Okay.
>> Yeah. So basically when you run like
specify it's going to generate user
stories and then it's going to create
functional requirements and when I do
after I do the research it's going to
generate the tasks and every task must
be backed by a functional requirement or
a user story. Right? So every task. So
we I I get like epic. Then I have user
story which is feature because um beats
only has like epic feature and task and
I map them from specify um feature to
epic and user story to feature and task
to task. So
>> So your task doesn't have a user story.
It just has like some like
>> it's a child of a user story and has the
labels of the functional requirements.
>> Interesting.
>> Yeah. So you will see that I think when
when we look at the UI like
>> okay
>> cuz that's the next step
>> on the topic of context window I'm I'm
loving how beads allows me to manage the
context window loving it
but in the future the context is is
bound to grow right and I'm just
thinking to myself like I'm I'm doing
all this effort to to to manage the
context more effectively
if you know tomorrow they they launch
uh Claude Son 6.0 and it has like
practically unlimited context.
Am I like have I just wasted my time is
is the thought that was running through
my mind.
>> My thought is more more that like
anthropic is bound to build beats into
Claude Code and bound to you know build
spec it into Claude Code so that you you
you know and then it's going to be their
workflow. Um, and you're going to map
yours towards it.
>> Um, so everything I
>> Exactly. So everything I'm doing right
now, I keep in mind that that's just
>> the way I'm using Claude Code right now
because
>> there's no like there's some something's
missing, right? [snorts]
>> Yeah. Yeah. Yeah. It's going to change.
I mean, oh man, we're we're in for a
freaking ride here. That's for sure. I
mean, like Yeah. I'm almost thinking we
could we could make a video every day
about what's going on almost.
>> I don't really like the word toy. I
prefer like terminal baby.
>> Man, that's so fast.
>> What's in progress and what has great
>> how how is pearls implemented? Rust
>> it's SQL light queries, right?
>> So fast.
>> Okay. Epic feature task. Epic feature
task. Cool.
>> What does the P1 P2 What does that mean?
priority. Um but he just did another
update because um he added little status
indicators. Um right now on the left
side you see the tree and you see at the
top the little progress bar. It says I'm
75% done with this epic. Um, if I filter
it down and you see little like green
circles and little check marks next to
to them and then if you go all the way
to the right side, which is the type,
yeah, there the metadata, there's
children there and you can't really say
which ones are closed and which ones are
opened. Okay,
>> so he just added that in uh this
morning. So now if you use PAL, you will
see every single one um if it's already
closed or not.
>> Sweet. And but this progress bar is a
bit aggressive, isn't it? This is for
the whole damn thing, right? Or does it
get broken down depending what you're
looking at?
>> Depending what you're looking at. So, if
if you zoom in to just one phase, it's
going to show the progress of that
phase.
>> Cool.
>> Yeah. Yeah. Yeah.
>> It's a really good tool.
>> What I kind of missed here when I went
through them real quick, you would see
that every task has like the title, the
description, the design, which tells you
which files.
If you go a little bit back.
>> Shoot.
>> With this.
>> Yeah.
Yeah.
>> Yeah. This one I I have to fix the
order. Right now it's showing acceptance
criteria before design, but design
should be first. So you see the title
there's a little like what we're doing
like update the seat policy to grant the
product engineer role. And then the
design is you go to this migration file
and then you add fourbin policy rules uh
to the product engineer role. I just
realized changing the migration is
probably not the thing you want to do.
You should probably add a new migration.
So this was probably a wrong task. But
sometimes I tell Opus like hey this is
nowhere live. Don't need to worry about
migrations. Like just put all in one
migration because we don't have any live
life live data to migrate.
>> So
>> yeah like
>> yeah I I couldn't help but but observe
that the the tasks are so actually very
tight very tight. I like it.
>> So finally
>> and that's all opus opus created. So,
Opus is creating all the tasks using
beats. Um and again like the concept of
user story it comes from specit right
specit creates the um creates like the
user stories and the functional
requirements and then when we go to the
phase um sorry to the task generation it
has a template document and you know LLM
are great at looking at example and
following the examples right so these
template documents like this task MD
says tells like any LLM really this is
what I want you to do you know look at
the user stories break them down into
phases when we generate task our task
are focused like our first user story
here which is the MVP is to be able to
rename a state so the first one uh no
the first one is the foundational phase
and then we have user story one rename
state logic and under there are all the
tasks and and and that's like P1 because
that's the MVP when we reach reach that
we can immediately like build the whole
stack so we're building the API, the
CLI, the SDK, I guess, everything.
>> The the way that I've worked on software
projects, and I'm just sorry,
slight tangent, is that I like to like
do something like Excaladraw, like draw
things out.
And I'm just thinking aloud.
You know, for me looking at this, it
does it does seem quite well structured,
but at the same time, I'm still very
tempted to to whip out my uh you know,
pen and and paper, excal to draw things
out a bit.
I I don't know if that's a consideration
with um the visas. Anyway, side note,
>> let's move on. Let me quickly go out of
open cloud last session.
>> Oh, dash c continue.
>> And it will show you all of the prompts
that I did to get the session going.
>> Did you did you move your thing while
recording or did did Loom do this
automatically or something weird?
>> No. No. Um I cut so my my face was over
it and I dragged it and then when I was
editing the video I cut the part where I
dragged it.
>> Yeah.
>> So did you already put this in this?
This is ready running in an a as an
agent when you do specker implement.
Okay. So you got your terminal, you got
your clawed interactivity back, right?
>> Yeah. This is a history of my prompts.
>> Okay.
>> So this was a a session that I just did.
So what I did was I opened cloud
continue last session. I pressed the
double escape to look at my prompt like
history.
>> Okay.
>> There. And you see this one
>> it literally one two three four five six
prompts. Two of those were, you know,
like run the test this way and then
update the memory to say like from now
on make sure you always run the test
this way, right? So really it was like
three prompts. One was showing the the
the actual user story which is ASC grit
asse 3.4 and I also want beats currently
does not show the comments when you do
BD show. So I tell cloud specifically
you must do always show and comments so
that you see both because
>> so what do you what are you using the
comments for just for updating and
>> yeah so there was a problem with beats
uh version 0.21 where BD update didn't
work. So after the task was created and
I wanted to add in a note that didn't
work. So I I adopted this workflow of
adding comments. So I also told Gemini
and cloud whenever you're doing
something um close the task with the
reason why it's closed and add comments
um even when I'm doing a cross reference
check like look at the the specification
versus the plan versus the task that
were generated it cross spec clarify
then I say hey to all of these task make
sure to add a comment to pay attention
to use existing helpers don't rewrite
helpers because like I want haiku to
pick up the task know that there are
existing helpers and don't just build
another helpers. This is interesting. So
>> I I'm more interested in the way that
you manage your agents because because
like say say you're working on your
implementation, you want to you want to
spit out like three agents,
>> don't you? And get them running in the
background and then if you go control if
you go C, then the agents are killed or
how does this work?
>> That so I tried it like three or four
times and it hasn't worked well yet. So
at this point I'm still the reason why
you want to run those agents in the
background is that they they have their
own little context and they can do all
of the work and compile and verify and
and fix.
>> Yeah, I got that. But like how do you
how do you manage them like a process
task manager?
>> I think Claude Code not yet. Um
doing it
>> a lot to do
>> and cl code is at the forefront here. I
mean, Codeex and Gemini haven't caught
up in these regards, right?
>> Well, I say that, but VS Code does have
um asynchronous uh agent support in a
way.
>> Yeah. Yeah. I'm I'm glad you you
basically are advertising your workflow
here. Oh god.
Yeah. So, Loom um they do this when you
when you make a lot of videos and people
watch them at the end of the month. It
gives you like, you know, gamification.
It tells you you have saved this many
minutes across all of like all of the
people watching um minutes saved in
meetings and all that. So, Loom is a
it's a pretty smart thing.
>> Yeah, I guess um
I mean there's a lot of like internal
video sharing tools nowadays. And the
thing that bugs me is that I usually
like to to record in quite high quality,
you know,
>> full screen resolution. They always mess
up. I mean, I'm I'm noticing that that
they cut corners there by pixelating the
hell out of it.
>> Um,
compressing the hell out of it rather.
>> When you're going to replay this,
nobody's going to hear what I say in the
video because your voice is way louder
than than the video. So, you may need to
like, I don't know, play with the audio
if you want people to hear or copy over
the audio track. I don't know. Um,
>> from my point of view just now when I
was I was listening.
>> True. We didn't I didn't record the
audio. Oh [ __ ]
>> Maybe on your machine it's recording my
voice louder together with your voice,
but on me watching it through Zoom, I
didn't hear myself very clearly. But uh
yeah, I don't know. You can always work
on that
>> when you when you do a share.
I I should have made sure that I was
recording the uh Oh, yeah. Maybe could
if you could. But how the hell am I I'm
going to sync up the video. This
>> I can download the MP4 and then you can
split the audio from the video if you
want.
>> Oh, no. This is This sounds hard. Okay.
Well, I'll I'll try. Good luck.
>> Let's see what what what was capt.
>> So, can you talk about I thought it was
quite exciting that you talked to the
the guy behind uh Zack behind Polas.
Could you could you uh share what he
said or was that a bit too uh
>> No. Um basically
because I'm I'm using it and I'm sharing
these really complicated di like
dependency graphs right you see the tree
is very complicated and he's asking me
like what what are you doing that
[laughter] you have such a complicated
>> task um you know diagram that's what
>> um yeah so he was asking like is this
like across like multiple repositories
is like a central database he just
wanted to understand a little bit more
how I was using beats
and we talked about a lot of things, but
he was very um you know bullish on beats
being really one of the core ways that
you know agent memory will be you know
handled and context will be managed.
>> I mean I don't know of anything better.
I mean beads is next level. I saw just
funny on on LinkedIn the other day,
Beans announced and I thought like they
made a typo, right? And they said it
like three times and Beans is the
another tool which is to give context to
your agent, but it's using like markdown
as a as a as a storage mechanism. I was
like, what are they doing? They're
copying the name and they're not even
using it, dude.
Anyway, no, but he's adding some really
cool stuff and he's saying all of it is
a lot of it is opus and um he has a very
like good vision on the product. Like I
did some PRs where I tried to change
things and he was like um I don't really
like that. I think we can do it better
if we do like this and like that. And
then he just went off and he did his
thing and it's like yeah that's way
better. That's like really nice.
>> What do you mean like a product like
>> Yeah. user experience like and the BQL.
If you like Jira, I think you're going
to love Beats because it has this query
language and I didn't throw that in my
demo, but you can create
>> I'm aware I I use the the Jira query
language with this weird plugin. Uh I'm
trying to remember the name of the
plugin. So, what do you mean? So, you
were chatting with him and he came
across as a as a better product owner.
So, he was what refining the user
stories or he had a different
>> Yeah. I I did a couple of pull requests,
right? And then he always asked the
question like what is it that you're
trying to achieve like and are there
other ways? And he's always thinking
about the most logical way. For example,
I added a tree to the to the details
view. But then we both kind of realized
it made more sense if you're on the Kbar
KBAN view like when you see the columns
and you want you're on one of those
issues, you want to press T and you get
immediately the full tree.
>> You're talking about per you're not
talking about the grid, right?
>> Yeah. No, no, purely about per pearls,
his product.
>> Pearl. Sorry.
>> We didn't talk about mine. We talked
about Per.
>> Okay. So, you were So, he he had he had
a strong vision about how everything
should I mean I mean his is his baby. I
mean, he's probably spent many hours uh
thinking about it. Like any I I often
feel like the barrier to entry when you
when you like introduce like a junior to
a project like the the junior is going
to get like bombed out the water, right?
Because Yeah. didn't you think about
this? Like, no, I've only been thinking
20 minutes about this product.
[laughter]
>> Uh, yeah. No, he has, of course, he
knows also because he added this idea.
Originally, he had the columns and then
he has this query language which has
like a lexer and a parser. It's really
nice and it translates to Yeah, it's
like a query lang language that
translates down to SQL queries into the
the the issue database. If you go to um
>> it's up there in under internal there's
a whole implementation.
>> Okay. So he's using it for the for
different views and okay
>> he has the idea of the expand down and
expand up and I saw it in his code when
I added the tree view. Um I used the
expand to expand. Uh but I added
something different and then he said the
whole idea behind expand was to create
those type of trees within the columns.
Um, but it kind of evolved now. Like you
have the combine board. When you go into
details, you see the the the tree on the
side as you as you saw in what I just
showed you. But like
>> since yesterday he had a topo sorting,
he added labeling like more indications.
>> Well, I mean that kind of like
>> if he's adding a ton of features, then I
feel like that means people are going to
use pearles in like a million different
ways. And I'm I'm all I I'm kind of
thinking like a prescribed, you know,
workflow is somehow is what I'm looking
for. like I I don't want too much
variability, you know, because you can
>> projects
>> to to like give actually what you and I
talked about about how to package up
your skills, your plugins and your
tools, everything as a bundle, which he
also said like I want to onboard the
engineering team, 6,000 people at the
company he's working at to to adopt LLM
workflows.
>> So, what was his position in the
company? Is he just like a lowly
engineer or?
>> No, [clears throat] he's like director
level, I think. Uh,
>> really?
>> Yeah. But
>> who does he work for? I mean, what is
his company?
>> Click on his profile. Says Square, which
is now Box. It's a Fortune 500. And And
>> you mean Square the gaming company?
>> No. Uh, no. It's a
it's it's it's
>> And this guy is French, I guess.
>> No, he's from the US. He just likes
French words.
Okay. Um All right. So, he works for big
organiz So, he's Yeah, I'm I'm actually
fascinated by the human aspect to it
because because Yeah, like how do we get
people adopting these workflows in in an
engineering organization? he has the
same problem and there's I think quite a
few people
>> a lot of people are looking at how to
build out um
adoption internally um matching internal
um quality standards right
yeah
I mean like there was a blog
uh hold on let me stop my share because
I'm probably going to share something
crazy
um
Like I mean I think I can say this. I'm
going to say it anyway. Like at my in my
at my current client, we have so much
problems about just administering
GitHub. Like people a lot of people
don't know who the who the hell is
administrating it. No one can seem to
decide whether copilot is an acceptable
risk. So some people are are using it.
Some people are not allowed to use it. I
I got this email 16 hours ago. It's from
GitHub. I don't know if you can see it,
but basically it says like fine grain
control um delegate AI management. I'm
thinking this is actually a fantastic
thing for my current gig because because
no one wants wants to have the
responsibility uh to to do this. So if
this can be employed, I'm thinking yay
>> dedicated team.
Well, I mean it's it's sad, but like I
mean what I'm trying to say is that like
we're hardly even out the gates with my
client um never mind pearles, you know,
it's it's really sad like like MC uh MCP
access is um disabled and I and I asked
uh one of the guys why is MCP able um
disabled? He says oh because it can
harvest your code and I was like m and
MCP is for uh tool tool calls not for
harvesting code. He says oh if you use
the GitHub MCP it will harvest your code
and I'm like what
the the protocol is insecure. I don't I
mean the protocol
>> there's a lot of security blocks about
the ma massive gaps in in MCP servers.
Um I I I can understand from a security
perspective it has been a nightmare.
Everyone just running Do you think do
you think the tool call will somehow ask
ask the AI to to basically upload the
code or something crazy? uh prompt
injection there can be you know these
tools inject instructions into your
context and it can tell the they they
have all
>> so you're saying that with if if you if
if um you're in a big company
>> and
>> yeah malicious MCPs or malicious
contributors to MCPs
>> but isn't but isn't that like the case
for any dependency really but like like
like this person was worried about the
GitHub MCP and like we're using GitHub
how can be worried about the GitHub MCP.
It's like integrated in VS Code. I was
like mind blown.
>> Yeah, it's true.
>> Yeah, I I don't know. It's
[sighs]
>> I guess it's just one of those risk
management things, but it's someone just
needs to do the work, I suppose. Um
yeah, so I'm glad to see this update
from from GitHub. That should make
things easier.
And um yeah, I guess we're in for a wild
ride of trying to get people to adopt
everything,
>> trying to manage the adoption as well,
right? Trying to make sure that um it's
I think we talked about this as well in
the past. Um the worst thing a company
can do is completely blanket prohibit
>> because people will just you know copy
paste and it will be even worse. better
is to put in place um access meth
methods that you know there's outdated
capabilities there's observability and
monitoring monitoring around it so
there's quite a lot of companies that
like offering this as a security
solution as being an AI router that you
adopt and so you can see all your
>> but I'm always like a bit knee-jerk
reactionary to like process I feel like
you know we talked about how AI it's
evolving so quickly
And then a lot of people talk about oh
we need these processes in place to do
the things like yeah
we do need process we're discovering pro
I mean we're discovering workflows but
these workflows cannot be uh static they
have to change very quickly day by day
almost and yeah
>> security right
>> I don't think any company is ready for
that um for you know like how many it
it. Yeah. No company's ready for that
cuz process is usually something
enshrined in the company after some
debate and it's like a law and then it
doesn't change or you have to fight like
hell to change it.
Yeah, I think I think this is a battle
security always has been fighting and
even if you look at the recent events
with React,
it's far from over. I didn't realize
that the second Cloudfare outage was
caused by this React CVE. Did you know
that? Or
>> really? [laughter]
>> Yeah. So, Tio did a I have to admit it
now. I must be a Tio subscriber because
I bring him a puppy call now. [laughter]
>> I don't know because I watch one of them
now. I see all of them. So whatever hate
I give to Tio, I have to I have to
>> Well, he's one of those I mean I think
it's almost in the the YouTuber DNA to
be a little bit uh
controversial and disliked, you know.
Yeah. So anyway, he he did a really nice
coverage of this uh React RC and the um
industry response to it. to how Versel
and Cloudflare mitigated early against
this remote code execution because it's
a very severe bug and even even this
morning I saw there's another exploit
against the the fix. So they released
16.016
and there's another exploit against
that.
>> But this is nothing to do with AI is it?
I mean
>> uh it's no it's not
>> software supply issue right?
>> Yeah it's a software because we talked
about security and and and process
around it. I I just thought it might be
relevant to bring up um that security
always had this battle not just with AI
but any type of um tools that we
incorporate such as adopting NexJS uh
and then using server components which
is the React part that causes all of
these bugs all of these exploits lately
and and so B apparently this was
responsibly disclosed by the researcher
who found the bug in the
uh protocol and then Versel and
Cloudflare
uh put firewall rules to detect the
payload like the attacks so they could
block them. So for people that did not
update their react or uh the moment that
it goes public, right, they they publish
the fix immediately
>> like intelligent firewall type thing,
>> right? So
product,
>> right? So they they they put the the
protection in the firewall. So the
second cloud flare outage was caused
because they were rolling out they had
to increase the buffer size of the um
the firewall software to be able to take
in a bigger context.
>> Yes. And then as they were rolling it
out it noticed some some issues. So they
do um a gradual roll out across the
regions of this like increase of buffer
size. But that that must be quite a
complicated rule like they must detect
somehow.
>> Yes. So the rule is really this react
version and
>> Yes. And apparently the rule
>> and it's all compile decompilation.
>> No no de like the rule is bloody Lua.
>> Yeah. L is nice and fast. It's uh
probably better than running shell on
the edge.
>> Yeah. But it's not better than than a
typed uh like language where you you
discover.
>> Um, so basically what happened is that
the ex the rule when they tried to roll
back. So the the bug the the problem the
outage wasn't caused by the roll out the
outage was caused by the roll back when
they they triggered the global config to
roll back wherever it had been out
rolled out and that component that does
the global roll out that
>> why did they roll back? Sorry I didn't
get that. So they were doing the roll
out of the increased buffer size to
capture uh to improve the firewall rules
and as they were rolling it out
gradually they noticed some issues. So
they wanted to roll it back but when
they rolled it back they didn't do a
gradual roll back. They just kicked off
this one service to do the roll back and
the rule engines had got into like an um
a state that shouldn't be possible. So
the execute rule was null was uh was was
was null but it was still loaded. So it
was like throwing errors. So that's kind
of what he was saying um was the cause.
So I I thought it was funny that
everyone's complaining about uh
Cloudflare two outages in in in like a
month. How's it possible? And it's still
so central to every like the internet is
not distributed. It's like too
centralized on a few big providers and
and how can they have two outages? And
it turns out that second outage was
caused by this React. Um,
>> yeah, I'm always I'm always befuddled or
interested in how overthe-air updates
work uh because I rolled my own system
years ago and um using Git FS and uh it
works really well and then and then a
lot of you know every company on this
planet now has to has to be able to ship
updates very effectively and roll back
or roll forward what what have you. And
um
most often than not then these are where
mistakes happen or bad implement you see
bad implementation but anyway
um it's almost time for me to run off
and take my kids to school.
>> Mhm.
>> Give me give me now. Okay. So I guess
this this chat we can call it
about spec kit ples workflow.
What did we call the last one where we
talked about God knows what did we talk
about?
>> Yeah.
>> Hey, thanks for listening to Vincent's
and I conversation on AI and
infrastructure.
Do please comment below on the YouTube
channel. Um any questions? Uh we'd love
to incorporate your feedback into what
we do. And uh this podcast, if you're
listening without video, is available on
Spotify. The website
thebase.com/mpodcast.
I think it's even available on Apple
Podcasts. And you can perhaps leave a
review. Um I don't think I've ever had a
review on a podcast, so go crazy. I
don't care.
just as long as I get some interaction
from you would be awesome so that I can
be enthused to keep keep carrying on
with uh recording our conversations and
and uh staying a breast of the latest AI
infrastructure stuff.
I also wanted to mention that I will be
in Fosdam this year in a month's time
and I'll also go to an infrastructure
centric meet uh conference called config
management camp. I'll mention the the
link in the description. Um so yeah,
hope to catch you up with the listeners
and watchers
then and there and in the comment
section and wherever. Bye.