Balancing Innovation and Safety: CTOs Check-In About AI Evolution

0:00 Scott: With all these things people are creating that aren't being created by professional software engineers or being created by people in the marketing teams and finance teams,

0:07 what are the concerns of a professional software engineer that maybe they aren't aware of?

0:30 Welcome to another episode of How Many CTOs Does It Take?

0:35 My name is Scott Porad and I'm here with my trusty co-host.

0:38 Brad: Brad Hefta-Gaub.

0:39 Scott: Brad,

0:40 how are you doing?

0:41 Brad: I am doing great.

0:43 I've been busy.

0:44 And it's been busy and fun.

0:47 Scott: So today's episode is

0:49 Brad: Yeah.

0:49 Scott: a what's on your mind episode because

0:51 Brad: All right.

0:52 Scott: it's been a while since we just talked about what's on our minds. What has been on your mind lately?

0:57 Brad: I've let's see one of the things that I've been really busy with lately and been on my mind a lot is security. And I've got, you know, I've got multiple clients that I work with and they're all.

1:11 all going through various different stages of either preparing to have to really worry about security or having to worry about security or and I personally I just I don't know if you saw this but there was just a amazing like exploit that got released as part of a standard LLM LLM mini LLM pack

1:36 package that there's a python package that a ton of people use and somebody did add a full secrets uh exploit uh if you have installed this thing now fortunately i don't install this thing i don't have this thing installed none of the teams i work with have it installed but it was like literally getting environment variables secrets github secrets it was going after crypto wallets and it's just like

2:01 Boom,

2:01 that kind of stuff is happening all over the place.

2:04 Scott: And.

2:06 I've heard about this. It did not affect me or the company I'm working for, but was this a malicious attack or was this the LLM going off on its own and being rogue?

2:17 Brad: No,

2:18 this was a intentional malicious supply chain attack by somebody who knew what they were doing.

2:24 And it was very hard. Somebody found it. It was very well obscured.

2:29 Scott: We had an incident last week as well.

2:32 as well and I wonder I actually don't know what it was because our we CrowdStrike cap caught it for us in just a matter of seconds and it was also a supply chain issue I wonder if it was the same thing okay

2:44 Brad: Yeah.

2:45 Well,

2:45 anyway,

2:45 so I would say security and AI and packages and supply chain,

2:50 that's on my mind. I'll tell you that.

2:52 Scott: it's interesting because that is on my mind also but in a different way but I want to ask you a question first before we explore that

2:58 Do you remember about 2001 or so Microsoft like called a code red and like for six months they just went on like security and we got to fix all of our bugs security

3:09 Brad: Yeah,

3:09 Scott: holes.

3:10 Brad: right.

3:10 Scott: Do you remember that?

3:11 Brad: Sure.

3:11 Scott: I have a very uncomfortable feeling that.

3:15 We are about to head into another era like that of just security vulnerabilities all over the place.

3:22 Brad: This speaks to the other sort of things, and I posted this on LinkedIn.

3:25 I basically posted something on LinkedIn the other day where I was like, hey,

3:29 two credential theft stories that are kind of related and one's easy and one's hard. And the easy one is this exploit that kind of popped this week.

3:41 But the other one is I am convinced that all of the LLM data like Anthropik and OpenAI is just littered with secret keys and the

3:54 Scott: Yeah.

3:55 Brad: following evidence I have for it.

3:58 I was setting up a package.

4:01 It was a basic scaffolding for a React Native web app and it was it's open source and it was really well done with respect to it.

4:09 All of it had no secrets in the code and it had a very clear read me on how to set up all your secrets, you know, to either install them as part of your GitHub secrets or use a secrets manager,

4:19 set them up in your environment variables. But like the code was very much like.

4:23 you know, secret agnostic.

4:25 I asked Quadco to,

4:26 hey,

4:27 go set this up for me and configure it and get the basic framework up and running.

4:31 And it was running away and I looked over and I noticed that it was generating database passwords and generating API keys for various services like, you know, Supabase and Expo and all these basic tools that this framework was based on.

4:48 and it was literally passing these secrets through the llm in clear text and i had to go stop stop stop stop stop no no don't do that don't do that but by default it was basically just passing secrets in clear text and that means that it's sitting in a log file somewhere in anthropic you know and if anthropic ever gets hacked all that stuff is going to get exposed like i don't think i don't i doubt that anthropic would ever violate my secrets

5:15 secrets but if they ever get hacked all those secrets are going to get exposed

5:19 Scott: How did the LM get the secrets?

5:20 It read them from something you had told it to

5:22 Brad: oh

5:22 Scott: set up?

5:22 Brad: the setup and the setup instructions were like configure super base so you know super base is a you know online uh database platform so you know super base command line basically says create create database and it like you have to create a you have to set your own password when you create the database and so it went off and

5:41 ran a you know ran a cryptography library to come up with a random password took its value and use that to go create the the database right

5:50 Scott: Interesting.

5:50 Brad: if you were the sysadmin right you would have done that manually you would have been like oh i need to set up this database i'm going to go create a secret i'm going to go store my secret in my secrets manager i'm going to go set up the database and and at no point would you have been passing you're not emailing those to your devops team saying hey here's the password i

6:08 route I want you to use on the database you're setting up please yeah

6:10 Scott: Right. You use some sort of disappearing kind of thing to

6:14 Brad: exactly

6:15 Scott: pass those around.

6:16 Interesting.

6:17 Okay,

6:17 so here's the thing I had recently happen that's been on my mind.

6:21 We had a false alarm where it appeared that using Lovable,

6:26 somebody at our company had exposed all of our company's data by plugging it into our data warehouse.

6:31 Now between lovable and getting to the data warehouse,

6:34 there was a page where you had to authenticate with Okta and so it wasn't a risk.

6:37 But at first it was like,

6:39 oh,

6:40 it's really,

6:40 really, really, really, really, really bad.

6:42 Brad: Yeah. In other words, like the fear in the moment was somebody minted some kind of a token that has enough credentials to read our database and that token was put up into Lovable. So Lovable's got.

6:58 It's got access to that token,

6:59 Scott: Or,

6:59 Brad: something like

7:00 Scott: I

7:00 Brad: that.

7:00 Scott: don't know, I don't know, we use Snowflake, so maybe Lullable has some Snowflake connector so you can like just,

7:05 I don't know,

7:06 I don't know what the answer is.

7:07 But okay,

7:08 the point is this,

7:08 we've got company values.

7:11 And we've got two values that are in conflict at the moment.

7:15 And I'm going to abbreviate these one, one value is obsess over customers,

7:20 and the other is move fast.

7:23 Okay.

7:23 Brad: Yeah.

7:23 Scott: And so the tip of the spear on the AI stuff is saying, hey,

7:27 our values say move fast.

7:29 Brad: Yeah.

7:29 Scott: And the InfoSec guys say,

7:31 hey, our values say don't lose our customer data.

7:33 Brad: Yeah.

7:34 Scott: And as the CTO, I feel stuck in the middle.

7:37 I actually don't know. I'm trying to figure out how to navigate this. On the one hand, yes,

7:42 I absolutely want people to move fast, experiment with these things, figure out how to do stuff with.

7:48 stuff with it. The landscape and the marketplace is changing and we got, you know, I want people using these tools and figuring it out.

7:54 That's the tip of the spear move fast crew.

7:56 On the other hand, I think about it this way.

7:59 With all these things people are creating that aren't being created by professional software engineers,

8:04 they're being created by people in the marketing teams and finance teams.

8:08 What are the concerns of a professional software engineer that maybe they aren't aware of? Stability and scalability.

8:14 and performance and cost and those

8:17 Brad: Sure.

8:17 Scott: kinds of things and security and all of those things are two-way doors with the exception of security meaning if you're not scaling or if it's not stable or if it's costing so too much you can either shut it down or you can throw people at it to try and figure it out and make it better

8:32 But that security is a one-way door. Once your customer data goes out the door,

8:37 it's never coming back.

8:37 Brad: Yep.

8:38 Scott: And I'm just trying to figure,

8:41 I'm just in the midst of it trying to think about and navigate,

8:44 how are we going to handle this in our company?

8:47 Brad: Yeah. And I guess that's part of the point behind my story, right?

8:51 Like, I

8:52 Scott: Yeah.

8:52 Brad: think I know a thing or two about security.

8:56 Scott: Yeah.

8:56 Brad: And it was a demo app of a framework that and so

8:59 And so it doesn't matter, like there's no customer data in it.

9:01 Scott: Mm-hmm.

9:02 Brad: So like the AI agent was,

9:04 it was being professional,

9:06 it was being proficient, it was doing things mostly correctly,

9:09 but it was this one thing that it didn't consider about the fact that it was passing information,

9:14 you know, it was treating the security in a way that it was treating it like it was in a sandbox when in fact it was sending itself back and forth.

9:25 to this cloud-based LLM, right?

9:27 And it was so fast and it was so subtle and it only happened because I glanced out of the corner of my eye.

9:35 and watched it do this command and i was like oh shit i can't no wait did you just do that like i like i had to like rewind the tape and go wait did you just do that Mm and then

9:46 Scott: -hmm.

9:46 Brad: i had to basically stop it because it had done some very it had done the similar move already a couple times so i was just like fuck this whole like all my databases and all the environments that it just set up for me i gotta tear all those down because

9:59 you know all the keys were basically like burned at that point it's like then i got to go and that's the funny part about that is to then tell the agent hey i still want you to set this up but don't do it in a way that you're passing the secrets then it's like the agent's got to work extra overtime to basically write scripts that it's going to run locally and not you know it's just and so you know and i talked to some of my some of the engineers on one of the teams i'm working with i talked to them about that i told them the story

10:25 the story and they were like oh yeah dude like there's no way that tens of thousands of people aren't making that mistake every single day today and and they don't notice it

10:35 Scott: What about the e-rotation agent you have that you'd say,

10:39 hey, every night go run around our environment and change all of our keys so that we're secure.

10:45 Brad: right right well

10:46 Scott: Yeah,

10:46 man, weird.

10:47 It is weird times out there,

10:50 man.

10:50 Brad: if somebody if somebody okay if

10:52 If somebody, if an external bad actor hacks Anthropic and gets into their logs and their telemetry, right, is able to basically see those chats or

11:02 Scott: Or OpenAI or Gemini or any

11:05 Brad: yeah,

11:05 Scott: of them.

11:05 Brad: yeah, I'm picking,

11:06 I just picked one of them, right?

11:08 They're going to sit on it.

11:09 Scott: I guess this is where job security is,

11:11 is be the human key rotator.

11:17 Brad: Maybe that sounds like a grim job,

11:20 but yeah.

11:21 Scott: You know, I mean, I met a guy this week.

11:24 This is his business, his job. He has a specialty and he fixes the chips.

11:32 in marble countertops in like kitchens you know they gets easily chipped on the edge and he's got a bunch of he's a crafts person has a bunch of techniques that like he knows how to like do that which

11:42 Brad: Oh, yeah, absolutely.

11:42 Scott: if you have a marble i don't have a marble countertop but that is i guess they chip easily because it's just stone so you know he's found this little niche for himself and charges a lot because

11:52 not

11:52 Brad: Yep.

11:53 Scott: a lot of people do this you know sort of do it so my point simply is i guess maybe a human key rotator is

11:59 Brad: Yeah.

11:59 Scott: the job of the future kids

12:00 Brad: Yeah.

12:00 Scott: kids if you're listening yes

12:02 Brad: You were zooming the camera out and saying like you're sort of seeing this as well.

12:08 Scott: it's it's a similar problem it's it's the similar category which is this is all moving so fast and there's this one and i guess it's okay to be that a lot of it moves fast

12:18 fast but you've pointed out an example i've got an example of like oh actually in this area it's not okay to move fast this area and it's over 30 years as an industry because this wasn't as much of a concern it was just sort of client server local network kind of situation so like over 30 years as an industry we've developed all these techniques and practices to prevent these problems

12:38 Brad: Yeah.

12:39 Scott: because they were real problems and

12:41 Brad: Yeah.

12:41 Scott: i just think at jurassic park we're so what was the expression you know we're so focused on whether we could we didn't think about whether we should that's

12:50 Brad: Yeah, right.

12:50 Scott: on my mind big time and it's probably you know i mean i think we're going to see some big breaches because of it

12:57 Brad: Yeah,

12:58 I think I think you're right. I think that's a given.

13:00 Well,

13:00 by the way, recent episode that you weren't able to attend because you were.

13:04 on a vacation or a business trip, but I was speaking with a security expert and,

13:10 you know.

13:11 Though one of the points that we ended up talking a fair amount about was the fact that it's so easy for humans to essentially become fatalistic about whether there's anything they can do about security and therefore they then like just don't bother because they're just, what can I do about it?

13:32 You know, there are a combination of he made the point that there's a combination of evolutionary reasons why.

13:38 is why by default we kind of we're an interdependent species we kind of have to trust each other and there is a percentage of us that are absolutely untrustworthy but the majority of us are trustworthy and we're so interdependent that we kind of default to trust but if there's only three percent of us that are psychopaths or sociopaths that's a lot of sociopaths out there yeah

13:59 Scott: you don't even need three of three-tenths of a percent three-tenths of a tenth of a percent what is that i don't even know that's a

14:04 thousand percent well

14:05 Brad: Yeah.

14:06 Scott: so like we've developed things like SOC2 so that I'm sure came in response to some breaches and things like that right do you think we're going to we're going to get the next generation of that something like that'll come along

14:19 Brad: Well,

14:19 it's interesting you say that as I'm working with a team to working with one of my teams to get their SOC2 compliance done.

14:25 And I'm reminded by our work that we did at.

14:29 health tech company when we worked together last that I don't want to say that SOC 2 is like security theater, but it can be done in such a way that it's really just kind of checking boxes.

14:41 Scott: Totally.

14:41 Brad: How many people out there have SOC 2 logos on there?

14:45 You know, on their websites and actually are just checking boxes.

14:49 Scott: I don't know, but I do know that when I have been in the situation of working towards SOC2,

14:55 I have preached to my teams, the most important thing is to actually be secure.

15:00 I remember having an incident,

15:01 I mean, it wasn't an incident,

15:03 a conversation bordering on butting of heads with the CISO at a company I was at who was asking us to do something to meet a compliance.

15:11 regulation. I was really frustrated by it. And I finally said,

15:14 look,

15:14 I will do this as long as you will just agree that this is less secure than what we have now.

15:20 Brad: Oh, my God.

15:22 Scott: and and she was like yes i understand your point it is less secure and i was like okay thank you yeah

15:26 Brad: That's wild.

15:27 To meet some security requirement,

15:31 you actually had to make it less secure.

15:33 Scott: i mean we we found a way to not do that but like it was this it was this the the framework was saying do something a certain way and we had done it a different way which was better so i've always just kind of said like tried to reach the team like

15:46 At the end of the day, I will go to bat with the auditor for the more secure option.

15:50 Brad: Yeah,

15:50 Scott: We

15:51 Brad: totally.

15:51 Scott: should not be,

15:51 I will fight to the death on that one because I actually want it to be secure.

15:57 The framework is just a guideline for how to get more secure.

16:00 And by the way,

16:01 it,

16:02 Ascrab, it has saved our bacon recently. Well, I mentioned in this podcast,

16:06 it saved our bacon this week.

16:07 Framework said have malware.

16:10 malware showed up malware and you think to yourself oh malware like blah blah blah malware system catches it within seconds and you're safe and

16:19 Brad: Yep.

16:19 Scott: that was because the framework served as a guideline for us and knock wood paid big big dividends

16:28 Brad: Yeah,

16:28 totally.

16:30 Scott: That's on my mind. What else is on your mind?

16:32 Brad: Well, here's another thing that's on my mind.

16:33 I love a good automated CICD, automated,

16:41 high quality, like local dev staging production.

16:45 I love it when you've got all that stuff dialed because I think it just makes your engineering team go so much faster.

16:54 Scott: So beautiful.

16:55 It's just beautiful.

16:56 Brad: And I'm reminded of this because one of the teams I'm working with, which has a really good setup,

17:03 they started building a new piece of their platform.

17:06 It was difficult to give themselves like dev staging and production.

17:12 Scott: Mm

17:12 Brad: And

17:13 Scott: -hmm.

17:13 Brad: so they don't quite it's like, you know, it's different enough. It's like shared services and it's like it so they don't have that. They don't have the clean automated.

17:23 I mean, they have, you know, they still have a deployment system,

17:26 but they don't have the ability for the developers to run local builds and they don't really have the ability. I've always told you about how this this one team I'm thinking about, they've got as soon as a PR gets made, boom,

17:38 an ephemeral environment.

17:38 environment kicks up and anybody that wants to go play with the full stack ephemeral environment can go play with it and test it and critique it but they've been starting to add some new services that are these shared services and there's not a clean way to kind of create that and it's slowed them down slowed them down big time this past two weeks and i'm struck by the it's

18:01 Not that they're going that much slower than anyone else would.

18:04 In fact, I'm sure other teams go much slower.

18:07 But they were so fast with their really well-run dev ephemeral environment machine.

18:16 They were so fast with that that they look like they're crawling.

18:21 without

18:21 Scott: yeah

18:21 Brad: any is

18:22 Scott: one little bit of sand in the gears why

18:24 Brad: yeah pretty serious piece of sand in the gears yeah well

18:27 Scott: why is that whole smooth cic ephemeral environment blah blah blah that whole stuff why is that so hard you think that would just be like out of the box we're 30 years into this that should be out of the box

18:40 Brad: i mean obviously tools like

18:43 Docker Compose or Kubernetes,

18:45 these types of tools make it a lot easier,

18:48 you know?

18:48 Scott: Mm-hmm.

18:49 Brad: You know, those are relatively new tools, like 10 years old,

18:54 you know? They're not like, Docker yeah,

18:55 Scott: Compose, let's see,

18:56 I did my first Docker in 2013.

18:59 That's 13 years ago.

19:01 Brad: my

19:01 Scott: Did my first Docker, that's a funny way of saying it, by the way.

19:05 Brad: first Docker.

19:07 Scott: Sidebar.

19:09 I had the hardest time understanding containers when they first came out.

19:12 Like I knew machines,

19:14 I knew VMs and then containers.

19:15 I was like, what?

19:16 I don't get it.

19:17 I mean, I figured it out. I mean, I was so confused at first.

19:20 Brad: yeah it's a good question why isn't that just out of the box i think maybe that's i i don't know maybe it's because there's just so many i don't know you i don't know that's a good question i i think that like a lot of development teams think they don't

19:34 don't need that sort like there's i think there's this at least in the startup space that i'm in right the startup space that i'm in like you're so many people are just like i just got to get it up crank crank this out really quick like the demo like they're trying to crank out the demo right and i think with like ai coding agents it's going to be even more of this where it's like you can ask the agent to build the thing and it builds like the full thing running and you're like woo i got a whole app and everything you know but then to actually

19:59 Scott: Like, make it have a clean deployment to production and then to say to yourself,

20:04 well,

20:04 I want to have this staging environment where I can let the stuff settle before I release it on the public,

20:11 you know, that's like you have to have that thought process that say that you want that and then to say, oh,

20:15 I want to be able to actually like have full stacks that are.

20:21 ephemeral for every feature change like i think maybe that's a pretty sophisticated thing to want yeah

20:27 Brad: maybe i thought github had it or maybe microsoft i should say had it nailed for a while they had this trifecta this this three-legged stool they had visual studio code they have github and they have this thing called github codespaces and i thought they were just going to make it all just like effortless to work together and i know a few teams using it but like it doesn't seem like i thought it was

20:47 I thought it was just going to take off like nobody's

20:49 Scott: Yeah.

20:49 Brad: business, but it doesn't seem like it did.

20:51 Scott: Maybe that's just because the architectures are always so different,

20:55 you know, like how many different containers do you have in your.

20:58 in your cluster you know yeah

21:00 Brad: But I think that's what I think I don't know I never really worked with it that closely or here's another thing on my mind

21:07 Scott: yeah

21:07 Brad: The kids so you and I both have kids that are in like their 20s, right?

21:12 Scott: i just listened to your episode with the that you had with the david espinoza on with the ai co-host of his podcast and you guys you guys talked about the kids

21:23 Brad: Boy, did we because I don't remember what I said

21:25 Yeah, you were just like, hey, what are we going to do? Like if AI takes over all the jobs,

21:30 Scott: the entry level jobs, then what are the kids going to do?

21:33 Brad: that's well i've been thinking about it more from what are the kids going to do perspective not the job i wouldn't think you know like

21:38 Scott: Yeah,

21:38 Brad: i've got

21:38 Scott: exactly.

21:38 Brad: two

21:39 Scott: What are the kids going to do?

21:40 Brad: i've got two young adults in their 20s one has recently graduated college one is uh still in college and you know i saw this report recently it was pretty cool it was um a vision a data visualizer of jobs in the united states it had like a

21:58 from Bureau of Labor Statistics jobs that had like, I don't know, 200 million different jobs, like actual individual jobs.

22:04 It showed the number of jobs in each category and then they were grouped by all these different categories. And then it was color coded and you could have a little toggle where you could change what the colors meant. So you could have one which was like the growth of the sector. Right. And then another toggle was.

22:23 the average income in the sector and so like if you did average income like you know low paying jobs were red and high paying jobs are green so like the green ones were things like finance and tech you know and those squares had sub squares you know which got more detailed and then there was another and I don't know how the author of this little visualizer got to this data exactly but um

22:47 digital ai exposure you

22:49 Scott: Yep.

22:49 Brad: dabble that one and it was like an inverse all of a sudden tech and finance went red and things like labor went green right from red to green and so i just it's gotta be crazy hard to be 23 years old and graduating or 22 24 graduating from college right now

23:09 Scott: Yeah.

23:10 Brad: unless you have got a really clear thing that you really really want to do just trying to figure out what to do with all this uncertainty forget climate change forget war in the middle east forget all that stuff just the ai thing and what's that what that's doing to your head about the rest of your life i

23:26 Scott: I have a there's an engineer working for me that's he's like in his mid 30s and he's just like, I don't know what I'm going to do for the rest of my life.

23:34 Brad: have a friend who's my

23:36 my rh he hung it up he's like yeah you know i gotta i've been doing this for 30 years it's been a great run and i just don't think i have the energy to go learn it all again he's not as excited about it like you and i've been excited about he's like i'm gonna go be a preschool teacher

23:54 Scott: Yeah.

23:55 Brad: i like kids and go hang out with kids all day that'll be fun so

23:58 Scott: There you go.

23:58 Brad: i've been thinking about that that yeah i've been thinking about not those little kids i've been thinking about these college age kids who are graduating and who their whole world is so uncertain right now

24:07 Scott: Yeah.

24:08 As you know, I have kids same age as yours, a little bit older,

24:12 but basically in the same cohort.

24:13 And yeah,

24:14 it's a real concern.

24:17 You know, I guess if I try to put the CTO hat on for a second, take off my.

24:21 my Baron hat and CTO hat on.

24:23 I think that I also, in a world where capitalism drives us to not hire junior people anymore because

24:31 Brad: Mm-hmm.

24:32 Scott: the robots can do the job,

24:34 what are we, what's the end game there?

24:37 Because you, how do people become senior?

24:40 They become senior and experienced by first being inexperienced and junior.

24:44 So if we're not hiring any new, new talent.

24:47 then eventually all the old talent ages out is the end game that we think the AI will eventually reach that level and they'll be taking those jobs too and so we don't need any more senior engineers we don't need any more architects we don't need any more principal engineers because we're not going to we're not going to grow them anymore if we're not hiring junior people

25:06 Brad: So I've worked on consumer products for my whole career.

25:09 I mean, I worked on consumer products. I worked on some B2B businesses,

25:14 but they're always sort of been consumer products.

25:16 But that's relatively high level.

25:19 There still needs to be people to work on lower,

25:22 you know, there's still people working at Anthropik and there's still people working at the layers below Anthropik or I don't know, working on GPUs or whatever and figuring out how to make these data centers. So maybe.

25:33 actually the tech jobs actually just get pushed lower in the stack the tech jobs have been moving up and up and up the stack for my whole career and now they're like at the very top it's like oh you just talked to whisper what's this whisper thing called now whisper uh i can't remember you want to talk about oh

25:50 Scott: No.

25:52 Brad: I haven't tried it yet.

25:53 I just heard about it this week. It's basically Siri,

25:56 Scott: Uh

25:56 Brad: you

25:56 Scott: -huh.

25:56 Brad: know, but it's a new version of Siri called Whisper. It's not by Apple.

26:02 Scott: Whisper. Okay.

26:03 Whisper. Whisper flow.

26:04 Brad: Whisper Flow.

26:05 Scott: Yes. Think it, speak it.

26:06 Brad: It's just a much, much better like voice thing.

26:10 And so now the programming has moved all the way up to where you're just talking to it. You're just saying, hey, Alexa,

26:15 can you write me a fantasy football app?

26:18 Scott: Right.

26:18 Brad: to share with my friends i'm not making this up in the last 24 hours i've gotten two apps from two different friends one of them wrote an app for like baseball another wrote an app for golf they're little fantasy sports games and then these two one of them is a former computer programmer one of them has nothing to do with computer programming so now they're just saying hey alexa write me an app

26:41 for my friends and I to play fantasy baseball right that's like we moved all the way up at the top of the stack but maybe the real tech jobs are actually going down the stack because somewhat something has to be underneath all this stuff or maybe the robots figuring that out are the robots going to write the chips like how's that all going to work Well, I mean

26:59 Scott: okay,

27:00 I would say like I'll say

27:03 I agree that there's people with computer science degrees that really understand the kind of low level things like compilers and operating systems and kind of like really understand architecture.

27:14 I think those people's jobs are more secure for longer.

27:19 I think that's a given.

27:20 But there are a lot fewer people in those jobs than people who are described as software developers.

27:26 Brad: That's

27:26 Scott: Right.

27:27 Brad: right.

27:27 Scott: I mean, I can't count the number of times.

27:29 times in my career that I've had been working in organizations where I mean there's always people that are much more skilled and people that are less skilled.

27:40 Brad: Mm

27:40 Scott: And,

27:40 Brad: -hmm.

27:40 Scott: you know, you might recall during the time that you and I worked together at HealthTechCo,

27:45 you know, it was a seller's market,

27:48 like engineers were jumping ship all over the place. And there was just like this massive demand for engineers during that kind of that COVID boom and things.

27:58 And I think that there were a lot of people that got hired as engineers who were not as talented as.

28:05 the engineers that, you know, are the ones building these low level things, right?

28:10 Brad: Mm

28:10 Scott: Like,

28:10 Brad: -hmm,

28:10 Scott: I think, you know, we got people that were kind of coming out of code, you know, code boot camps and getting

28:15 Brad: mm

28:15 Scott: landing

28:15 Brad: -hmm.

28:15 Scott: jobs as, you know, full stack software engineers.

28:19 That's the stuff that the AI agents can do.

28:21 trivially now right so those people certainly are either going to have to rapidly up level their skills and that might be really hard or those those jobs are for sure going to get washed out that

28:33 Brad: Yeah. Maybe there's just many fewer jobs in the tech industry,

28:37 but they're much more technically demanding.

28:39 Scott: would be my that i'm i'm an over on that outcome right i think that i think that's the more likely outcome

28:45 Brad: But that doesn't account for.

28:47 If you were interested in going into accounting,

28:50 or if you were interested in going into any other of the 75% of the jobs in the economy that AI is going to get to.

28:58 Scott: Yeah,

28:58 I mean, I think there's a...

29:00 bookkeepers, those jobs are easily replaced and accountants are less likely to be replaced,

29:06 you know, and you know, there's like a difference there, right?

29:09 Brad: A little bit. Yeah.

29:10 I mean,

29:10 I just use that as one example, but it seems like there are so many jobs that are going to be affected,

29:15 so many industries that are going to be affected.

29:19 Scott: Yeah, I agree.

29:20 I agree.

29:20 Brad: Hey,

29:21 you know what's not going to be effective?

29:22 I see the guitar on the wall behind you.

29:25 Guitar repairman.

29:28 Scott: Well,

29:29 I guess so.

29:30 Brad: Poor women.

29:31 I can say repairman because I recently took a guitar to get repaired and it was all dudes.

29:38 Scott: Ever tell you the story about that? I had to take my Ampeon one time back when I was in my regular playing days and my amp had all these like punk rock stickers all over it.

29:50 And one of the stickers on my amp was from a band called.

29:56 you know we'll have to keep the keep this clean but but i i won't be able to say the true band name but it was the band name was fs up right oh

30:04 Brad: We swear on this podcast all the

30:06 Scott: yeah

30:06 Brad: time, by the way.

30:06 Scott: okay the band name was fuck shit up and it was a sticker on my amp that said fuck shit up

30:12 and i took my amp in to get repaired and they had to basically like unscrew something to get to the inside of the amp and and uh had to cut through my sticker but i wasn't there when i dropped my amp off and so when i got back i got my amp back they had like carefully with like an exacto knife cut just enough of the sticker to be able to open my amp up and then

30:37 they repaired it as nice as they could and i was just like you could have just taken that sticker off and they were like well when i hadn't seen i didn't see who you were but you bring an amp here in with us with a sticker that says fuck shit up and i didn't want you to i didn't want you to fuck my shit up for ruining your your sticker

30:56 Brad: It's a pretty punk rock sticker.

30:58 Scott: Yeah, there you go.

30:59 Brad: Well, we've digressed today,

31:01 Scott: We

31:01 Brad: Brad.

31:01 Scott: have digressed.

31:02 But there you go.

31:03 We covered the rise and fall of security thanks to AI,

31:08 the rise and fall of the economy thanks to AI,

31:10 and the rise and fall of guitar amps thanks to punk rock stickers.

31:15 Brad: That's right.

31:16 All right. Well,

31:17 with that, let's call it a day.

31:18 Scott: Let's call it a day and another episode of...

31:22 How many CTOs and what do we say?

31:23 Brad: Smash that subscribe button rate

31:25 Scott: Rate and review.

31:25 Brad: review see you next week.

31:27 Scott: See you next week, Scott.

31:29 Brad: Bye

31:30 Scott: This episode of How Many CTOs Does It Take Podcast was edited by Saffron Eptigal.

31:35 Our theme song was AI-generated by Brad.

31:39 Please follow us on all the social media platforms at at HowManyCTOsPod.

31:44 You can find us on YouTube,

31:46 LinkedIn,

31:47 Instagram,

31:47 Facebook,

31:48 Threads, X,

31:49 TikTok,

31:49 and Patreon.

31:50 Or at our website at HowManyCTOsPod.com.

31:55 And remember to rate, review,

31:57 and subscribe on the podcast platform of your choice.

32:01 Thanks for listening.