Programming Laws Tier list

it's a blocker everybody we do have a blocker the blocker is number four i've made a celebratory image for this oh wow prime that's actually all right yeah yeah yeah yeah yeah yeah yeah uh anyway sorry what is the number four casey can you guess why the number four is holding up all modern internet No, absolutely not.

I mean, you said something obliquely before it started about a certificate. So I'm assuming that it has something to do with like a root chain of trust or something like this. But I have not read anything about this. Okay, so it sounds like you're familiar with certificate authorities, correct? Yes. Or at least the concept.

For those that don't know what a certificate authority is, effectively, when you're talking to another machine, how do you know that you're actually talking to another machine? Because there's a bunch of machines between you and any other machine. That is how the internet works. That's why Kamala Harris, in fact...

Oh my gosh, I can't believe I have too many of these open. That really ruins the flow of this all. This is why she says... Up here in this cloud. It's in the clouds, okay? It's in the clouds above us. It's one of my favorite clips. I know, I had it all ready for this exact thing. So anyways, Casey, it does turn out that one of the root or one of the intermediate authorities, so remember, a root authority does not sign every single one.

They also trust on intermediate authorities as well. It turns out that there is a company called eMudra, which is an India-based company that is going to be one of these intermediate signing authorities. Well, they released 24 new certificates of various qualities like RSA 496 and then a couple won. And then one of them was a P382 elliptical curve signing authority.

And this P382 signing authority, it turns out all the big random primes that they chose as their key were, well, in fact, not primes, as you can see right here. And were, in fact, really small, including four. Just the number four. It's supposed to be a unique set of 382 bytes worth of... Technically prime.

It is still unique. I mean, four is an integer. It's very unique. It's just most of it's zeros. Of the 48 bytes, 47 of them are in fact zero. Zero. And so that is not very good. So you can break them immediately. And what this means is that when you go on your browser and you type something, Google right away goes, Oh, you can't do that.

This thing's been hacked. It's really, really bad. But if I jump over here into my beautiful terminal and I hit, uh, curl i think this might be the one i just went through somebody doing a man in the this is a man in the middle attack or someone is actually tricking my curl into thinking that i connected to we have a problem.com but i didn't That's not what just happened there.

They've set up their own intermediate attack. And so it turns out that the signing authority, you can now on pretty much all embedded devices, in which I just showed you right here, this person just rooted their smart home speaker and now is playing on the system. You can now say, well, you can say the most important thing we've all wanted to say.

I'm the Google now. You get to do this. Thank you. I've been on it all morning making tweets. Oh my goodness. I don't know if you know this. That's your job. That's my job. I've been making tweets nonstop. Yeah. HTTPS, I mean, or I should just say, like, the whole, like, way that they decided to do that certificate authority stuff is really bad.

I mean, I've said this many times before. You can go back on my Twitter, like, a decade and find me complaining about how bad their security design was on that. Can I interrupt for a quick second? Yeah. Oh, hey, honey. You're looking a little low today. You could use some Terminal Coffee. All natural coffee beans from the upper slopes of Brazil.

No artificial sweeteners. What in the SSH are you talking about? Who are you talking to? Roasted Fresh in New Jersey. Only available in the Terminal. Okay, so from my perspective, the fact that you can't know two... Legendary network programmer? Oh, I thought that's what you were going to say. TJ, this is not the intro.

You're not allowed to interrupt yet. Oh, sorry. So how to tell that two machines are actually talking to each other? What would be a better approach than a third party that says I have signed off on this public key, in fact, being the correct one, what you're doing and what you're using right now is good.

I don't actually know how this problem could be solved alternatively. Casey, would you mind giving us maybe like a three minute breakdown of an alternative solution? I've never I have no idea. Sure. Well, I mean, just to be clear, it's not so much that there is an alternative solution conceptually, meaning that like, oh, there's this other thing that you would do.

Right. It's more that they did not put any like checks into the system. Right. So the the way that they decided to do it was just like, well, we're just going to have certificates and we issue them. And the browser gives you basically like this sort of root trust system. a certificate chain that everything has to somehow sign back, you know, sign back to eventually.

And that's how we're going to validate everything. So the model is basically someone has to catch someone in probably, you know, security research has to catch the fraud first. And then it has to be deployed out as some kind of a patch like that. That was the only model that they had for how, you know, mistakes or theft or other kinds of things that might happen and, you know, are easily predictable and have happened.

That's the only way that they have to fix them. In my mind, you should have done at least two other things that they did not do. So number one is that the site that you're trying to connect to. So if you think about what happens when you have a web connect, there's multiple authorities you're actually going to, right?

You can think of it that way. One authority you're going to is the person who says what actual IP address that name that you're asking for is going to resolve to, right? So that's one thing. Then another one is asking, you know, to see a signature that says, oh, here is like some chain of trust that I can tie back to the things that are already installed on my machine, the root certificate chains that I have on my machine.

And so you're kind of doing those two things. So number one is those should have had to have agreed. if that makes sense. Meaning when a DNS record gets served, it should have also served what it thought the signing authority was. So that you have to hack both the DNS queries, which should have been secured by their own certificate.

Meaning I have a root chain of trust to my DNS authority. That tells you one of the, it basically gives you back one certificate of trust. The other side gives you back its third-party annotation. And if those don't agree, meaning if the thing says the DNS was not the right DNS, if the DNS says the certificate authority was not the right certificate authority, then it's like, warning, this is a problem.

What we currently have is something that if you hack the certificate authority, you're done. No one is checking anything. Which is why my curl successfully curled the site it should never have been able to curl. It doesn't even have to be hacked in this case. They just picked four. Right. Third thing I would have added in addition to that, right?

So one is the one they did add, which is the third participation. Two is the one they didn't add, which is the DNS corroboration. And three is saved authentication. And that is that when you first connect to a site, like the very first time, I cannot believe that we did not do something where it warns you if if the signature from the next time it gets is not from the same certificate authority.

Right. But I've never seen such a warning ever, even when things have changed their certificate. So that is crazy to me that we didn't do that, because in theory, that should be something that the user goes, whoa, whoa, whoa. Hold on a second. Let me check the news or something independently to make sure that these people actually did put out a press release that says like that should have been big news as we're changing our certificate authority.

Right. Yeah. Maybe I just don't log into my bank. Like, I can keep doing other stuff, but I don't have to log into my bank for that. And there are some little things they added, like those green certificates. There are certain ones that have, like, slightly... Like, that do a little bit of what I'm saying, but not entirely.

So... Why all that stuff wasn't done? Because all that seems really basic to me and doesn't really, it's not stuff that is, like I said, it's not conceptually any different from the way that it works now. It's just adding like obvious things you would do because the way they did it was like it almost entirely just relies on just this one thing.

If anyone hacks any root chain, you're done until a security professional notices. That just – that can't be right, right? And so, you know, I mean, to their credit, the security professionals do a good job. These things have been getting caught fairly early as far as we know, right? But, like, it's not great, right?

And I feel like a lot more care should have been taken, especially by now they've had – decades to improve upon this. And I just don't feel like now I'm not a security professional. So the things I'm saying are just kind of common sense things that I'm wondering why they didn't do. There's something like just a, you know, a lay person comes to it and goes like, what the heck, how come it's doing it?

Maybe they have really good reasons why they don't do those things. I would want to hear them before I believe them. But also I would imagine if you were a security professional, you probably also have several things I didn't just mention that are more subtle and more interesting that you also should have done that weren't done.

So yeah. you know that's what i would say okay trash no i mean i because i don't really know how else this problem can be solved but i do like this idea of dns but imagine this entire world that we constantly already complain about dns being a problem now you have a secondary dns being a problem where your certificates don't match i just feel like dns would be the bane of all of our existence if that happened I mean, but it already is.

So I don't see there being that. Yeah, I was like, DNS is always the problem. I know, but now imagine it has more responsibility. That's Prime's law, isn't it? What? This is actually... DNS is always the problem. Mm hmm. That's not my law. DJ Bernstein actually had a love that band early. Yeah, sorry.

Had to talk pretty early on where he talks about securing the entire Internet long before HTTPS was actually adopted very widely because it was too expensive at the time. Right. So a lot of a lot of people didn't run it on their servers. It was kind of new. This is way, way back. And he actually proposed like, hey, here's what we do in the DNS record.

You just put your elliptical curve right there. And whenever anyone gets a DNS record, you encrypt with that. And so in my opinion, that's like obviously like I was just like, yes, obviously you should do that. So you have a third party that attests so that you can, you know, in case the DNS server was compromised.

You have a DNS server, which gives you an encryption key. So that is a secondary form that makes sure that you can't be intercepted. And I feel like that would have been a lot safer than just trusting one thing. At least now you have to hack two things. I really, by the way, I just want to throw this out there.

This is a very funny tweet. This is going to be my story. that is a good one yes so good fabulous it's very very i mean i know that's not what it looks like but still it's very funny to think that that's four four all right so there we go that is kind of one of the many blockers now word has been told to me that we actually have several blockers so let me just throw this one over into done we have trash's bark Yes.

Oh. Now, Kate, let's see the trash. I believe inspired by your barking, we also barked. And I believe there's actually a story even behind the shipping of this said bark. Let's see it. Is there a story? Maybe. So we have coffee bark off of Williamsonoma. How good is that? Thank you, Lindsay. That sounds good.

This is actually what I was eating before. This is actually delicious. I'm not sure how you're supposed to eat it because it comes in like one... Probably bite like one bite at a time is my guess. Well, it comes in like a solid sheet. So I assume you're supposed to break it, but I've just been like nibbling on the corner like a hamster.

It's like a giant pop tart. Oh, you take the smallest bites. Quick note, trash. I don't know if you guys know this, but I got my two front teeth are fake. So if I bite it too hard, they will fall out of my mouth. I gotta be careful. We found that out already on the podcast. That was a surprise story.

That was more trash lore that I didn't know that I needed to know. So I gotta be very careful because last time it fell out was when I bit like a baguette and they just came flying out my mouth. So I got PTSD from that one. We got the chocolate bark, Hollow's Eve. I don't know what this looks like. Let's see what this looks like.

Oh my God, this is cool. Oh, nice, dude. That is super cool. Yes. Dude, the kids are going to freak at that one, Trash. I know. They're going to love it. And then we got the classic. With the dog for some reason. With the dogs. Let's see if it's shaped like a dog. With Teej's dad joke dogs in effect.

So this looks like more of your traditional bark. The Halloween thing is amazing. They went the extra mile on that. Yeah, so I don't know what the story is, but some dude Ubered it over, which I think from Lindsay's house, maybe? I don't even know. Probably because she tried to ship it to you normally and it didn't work.

Yes, we did. We did order from Williams and Sonoma. I know that for sure because I saw it on the company card. So I know for a fact. And I knew it was going to be Bark the moment I saw that show up in my inbox. So I don't remember quite what the story was, TJ. Do you remember what the story was on shipping?

It's Casey's story. No, no, no, no. What do you mean? There's another story. There's another story. Lindsay was trying to ship the bark, and that's why there was an Uber Eats individual. That's why Trash had to get manned in the middle. Not because it was four, but because there was actually a, like, could not ship it to Trash.

Because there was like a heat warning and they just like refused to ship it saying it will melt the bark if they ship it in this kind of way. And so like there was a whole situation that ended up Lindsay figured out how to get around and trash the bark. How did Lindsay even get it? Didn't they have to ship it to Lindsay to begin with?

She went to Williams-Sonoma. Maybe she just went there. Yeah. She might have just went to the old W.S. Oh, very possible because I do have the bag. There it is. Yep. I do have the bag. That's actually insane. Yeah, so that's how she did it. That's why she was able to ship it faster than Casey, because Casey went the plebeian route and just tried to ship it, which they're just like, can't ship it today.

It's hot in the United States. That was, unfortunately, just never passing. I was nice, but he made me run all the way down my path. You know what? You need to get your peppermint bark. Global warming. Global warming. It's never coming. Back to God. Nothing we can do. You've seen my backyard before. Global warming.

I'm in the same backyard. It's changed a lot. Okay. All the trees is gone. All the trees are gone. The grass is gone. It's global warming. What can you say? Alright, so I'm gonna move this over, and I'm actually gonna create a quick blocker here, which is, WTF, where is my bark? I'm a little bit upset about this whole situation going on here.

Prime, quick note, she can't Uber Eats it from her house to your house. There is no Uber Eats driver willing to drive to South Dakota. Is there a room to be even near you? No, there's no William Snowman near me, and there's no Uber near me. But I still want my bark, okay? I feel a little left out on this whole bark and snack.

Maybe in December. Next up again is it going on. All right, before we move on from Trash, I need his help on something real quick. I was able to verify that at 4—I did a very diligent job this time— that at 4.30 specifically, which is the last time that I went, just one of these packs drops. Oh, so you know the timer now.

So this one's at 4.30. Ooh, that's Chaos Rising. Well, I don't know if it's specifically that pack, but a drop will happen, and it's just likely that someone left it for you. That it's the small one. So I'm going to need you to just really quickly tell me if there's anything in here, okay? Because I don't know.

I don't... Let's go. Let's get our fix. All right, let's do this. I am so happy that this keeps happening. I don't know how to open these things. They still are wicked hard for me to open. Yeah. He is, dude. He pulled it out. He had it ready to go. Yeah, he didn't even have to go. He didn't have to get up.

My desk is just surrounded by cards. I would just like to say that the stand-up is willing to buy you guys a pack every week. How do you buy it? How do you buy them? I don't know how. I don't know how. Put the top one on the bottom now. Put the top one on the bottom. There you go, now just show it to your camera There we go, let's go Okay, nice, whoa, you guys match, cool So first eight are gonna be Or first seven are just like common cards Nothing to write Oh, my daughter loves foxes Well, she can have some Is that Charizard?

I think we're gonna start getting to the good stuff I lost my count, okay, now we're getting to the holly See how it's a little bit shinier? Okay, okay So maybe the last one's the good one Oh, you got an EX. That's a good one. Is it? It's not amazing, but it's better than what I got. Alright, we're gonna leave that one out.

We'll leave that as our first actual swag. Get that PSA graded ASAP, Casey. Yeah, yeah, yeah. Except for PSA did just get robbed, if you didn't hear. Million dollars worth of Pokemon cards. Oh, did they include a tour? Yeah. Yeah. Everything in life sucks right now, okay? You got certificate authorities failing, you got Pokemon cards being stolen.

PHP? PHP? PHP? Oh yeah, PHP. I think my favorite of that whole thing, of course, is not that just PHP was in fact hacked, that they announced that it was hackable. before having the fix out, which then led a bunch of people to publicly post, or actually at least one person to publicly post, how to perform the hack on Twitter.

70% of the internet runs PHP like this is not okay. We'd just like to warn everyone ahead of time that we're going to be releasing a patch for this specific thing you can do right here to hack any PHP installation. Yeah. Luckily, but see, Casey, the thing is, is that for you to be able to take advantage of said hack, you'd have to have years of PHP core development and ability to have insights into various systems and potentially multiple PhDs at the same time to really take advantage of that hack.

So nothing to worry about. Not really. All right. What's our last blocker? That's a great question. Right now, our last one is shout out to Luigi Delta Lounge. I assume this is a TJ. Oh, yeah. This was a while ago now, but I put it in here and it kept on not getting brought up. Me and Beacon were coming home from San Francisco and a guy named Luigi came up and said he loves the show.

And so he's, you know, just enjoying it. So I want to be like, yo, thanks, Luigi, for loving the show. If you're listening to this episode, thank you. If you're listening to this episode, TJ will be traveling again in an airport. Yeah, yeah, yeah. Yeah, right, exactly. Wait, is he on Delta? Unfortunately, not Delta.

Stupid Allegiant. He's on Delta Flight 4. Guys, I have to tell this story. Blocker, here, since it's airport-related, is we had a flight 645 out of my home airport, AM. Got all my kids up, 4 AM. Got them in the car, packed them up. You got to get the... Got to get all of the car seats out of the car, a million checked bags, et cetera.

We're in line to check the bags, 445 a.m., get a message from Allegiant. Oh, sorry, guys. It's going to be 140 in the afternoon before we can fly. I just love that it wasn't like, hey, it's 30 minutes late. It's like, hey, we're off. Like, we wrong side of the Meridian. I don't know what happened. They didn't have the plane.

The plane's gone. The plane was still in Florida. They had to fly the Florida plane to Michigan and then take that one back to Florida. So it was like, but you guys didn't know that at 4 a.m.? You had to wait until I got to the airport and woke up all my kids up. Classic. No. No. I didn't. My feeling is that usually they kind of have like almost a programmer like mentality at airlines where, you know, they're probably thinking, well, we don't want to tell everyone that the plane's not here in case we're able to like shuffle around some other.

I'm like, guys, you never it never you never that never works like you're always late, always. So just assume whatever it is, it's not going to work. Right. So just tell everyone they've got an extra couple of hours because they do. I thought you were saying more programmer-like mentality. Like you were saying like, well, that's probably only going to take me two weeks, but it takes six months.

Yeah. Well, that's, yeah. I mean, it's just this optimism. It's the optimism, right? Yeah. It's the eternal optimist, right? But anyway. As I currently live in a, hey, it will just be two more weeks. Which is now eight more weeks for everything, it seems like. All right, so, hey, Luigi, we appreciate you very, very much.

So thank you very much, Luigi, and all shout-outs. Mm-hmm. Done. Oh, man. Actually, you know, honestly, I don't know even where. I just accidentally put it in, like, canceled, I think, or something. We canceled. Luigi. It's in one of those. Don't cancel, Luigi. I was going to put you in contention because I feel like no one ever comes up to me at the airport and talks to me.

And every time Teach travels, he's just like, everyone's always talking to me. I don't know what it is. I don't know, maybe I look different from the camera. You just have to come, I've told you so many times, there is not a week that goes by that someone does not recognize me. It's constant. We were in a second, Casey.

But Prime is not a legendary YouTuber. He's just a YouTuber, okay? They recognize me from his show! They definitely would recognize him, he's just not here. Casey from whatever that guy's show is? Yeah, Casey! No, they know the show. They're like from the stand up or whatever. Right. So they know you.

You just are never here. You got to come out here. You come out here. You'll get recognized. I thoroughly would like to go do a climbing adventure. So I am completely down to go do this. We'll do it. We'll do it. It's just that we have a little bit of a tight time. Okay, so we need to move into the main meal, everybody.

So, hey, welcome, everybody, to the stand-up. Today, we have one of the most fantastic ideas ever, which is you guys have heard of tier lists, right? You young kids love tier lists, right? Well, we got a tier list for the ages, which is all of the programming laws that you run into every single day, and we are going to tier list them all out.

True. TJ, you never interrupted me once. I kept, like, anticipating it was going to happen. Yeah, what's up with that? I'm saving it. He's on the beach. He's on the beach. He's in vacation mode, so he doesn't have his interruption skills. He's too laid back. That's a great point. I got Miami teach today.

Okay. I didn't realize that. All right. So we should start with Conway's law. I'm just going to set it in the middle. S tier. S tier. Okay. Okay. I don't even want to hear about it. S tier. But when we do every law, though, Prime, can you read a definition for the audience so that they can also be educated?

They may not know the names of all the laws. Yes, I know. I actually have them all right here. I was just trying to find it. All right, so let's start with Conway's Law, which is, by the way, legendary game programmer Casey already has an opinion on this one, Esther, which is, organizations which design systems in a broad sense used here are constrained to produce designs which are copies of the communication structures of these organizations.

Okay. Meaning that if you had, say, a team that runs checkout, a team that runs shopping, you very well may have two different user representations, some sort of weird glue code, like all sorts of funny things end up happening because each organization runs independently, thus creating their own worldview.

I can give an even better example, which is say you're a code hosting platform, you get purchased and then you get put underneath the AI division. Yeah. At the company. And now suddenly code hosting goes down all the time. No, that's Teej's law. We had the same thing on the episode. That's Teej's law.

That's not Conway's law. Conway's law doesn't say that. The part about it is that the only thing that matters in the structure of the code is getting co-pilot into everything is my example. That's not Conway's law. That's Teej's law. Okay. Sorry. Did I misunderstand it again? Teej's law is that I always misunderstand this one.

Conway's law is just the representation of your structure and communication is the representation of the code. Conway's law is a statement about the efficiency of information movement. It basically says that if you, it's like inside a person's head is the fastest information efficiency because they don't have to spend any time to know something they already know.

Talking between two people is a little bit slower. Talking between two orgs, much slower. Talking between two companies, very slow. Right. Yeah. And so you expect every time you put in one of those bigger barriers that the product evolution will evolve faster where it doesn't have to cross a boundary to do that evolution because the information transfer will be slower.

Right. So that's what Conway's law actually says. And it doesn't really have anything to do with org charts. Even it's just org chart is an example of something that would have these properties. Okay, I was always led to believe, I mean, because I did accidentally state it right, which is that checkout and shopping would have two different kind of shapes of data, and then they have a synchronization communication layer.

Yes. So really, what you're trying to say is that microservices are just an extension of Conway's law. Yeah, micro-friads. Yes, absolutely. Yeah. The way I see it, it eventually bubbles up. If it's an actual user-facing app, it bubbles up to just looks completely different on the UI as well. So it's like you Spotify.

The bar at the bottom that shows the metadata on the song is completely different than the sidebar that's showing all that stuff. And I'm like, for some reason, it's so hard to get it right. And people get around this with component systems and stuff. But it's still impossible. So in other words, micro front ends, all these other things are not programming designed to make your life easier, but programming in which just tries to make Conway's cost go down.

There's a lot of programming practices that are just like really just manifestations of Conway's law. Okay. Yes, here. I mean, it's absolutely yes, here. Yeah. Yep. Yep. It's also that this is as a like this would be also why a lot of stuff where it makes sense maybe for Google to do it in the make sense sort of way.

We'll say like makes sense because they have a million engineers. But for everybody else, you'd be like, no, you shouldn't just copy that because you don't have the same cost. You just like can talk to the guy who's programming checkout. He's right next to you instead of like build an entire microservice architecture to talk to checkout.

Right. That's what I. Yes. Yes. That's that would be it makes sense in big orgs why things end up being so weird. I mean, if for those that haven't worked in multi thousand person engineering orgs, it's just chaos. Like you don't even know what's going on. You can't you can't possibly know what's going on.

Yeah, I mean, that's why you do the micro front end or whatever architecture. So your blast radius is isolated to your own product and you can ship at your own pace, basically. I would also just point out that Conway's law is probably durable even into the age of AI, because you will probably see as we start to study it more manifestations of Conway's law with agents.

It's like these agents have a slower link between them way in which they can communicate or test something, or there's a compiler in the loop and you will start to see that those slower links are the things that are creating bottlenecks to like making the thing improve And so it starts to improve in pockets differently and things like that.

Like, so this is a, this is a law that's so durable. That doesn't even have anything to do with humans. Like it could be said about machines as well. All right. I like it. All right. Let's go to the next one. Huh? Let's go to Brooks law. So this one is pretty, I think this one is, I think everybody will be pretty universally on this team, which is a, it's an observation about software project management, which means adding manpower to a late project project.

will in fact make the project later. Now, I can't remember which one of the follow ones. It might be Eaglesons or Worth's. I can't remember which one, but it's actually a counter to Brooks Law, saying that there is actually a specific subset of people you can add to a project that will in fact make it even better.

That's kind of where I'm seeing it. I give this like a B, C. Yeah, I'm in C tier for this one because I don't think it's true. Well, so here's what I think is the idea is that if the person that comes in is adding features, it slows down. I don't think there's anything you can really say about this law personally.

Like I just I think it's it's just an observation about something that might happen sometimes, but it's it. And it doesn't happen other times. Like other times someone comes in and makes a really big difference and it doesn't really matter. It's just because they were the right person to help. you know, make whatever wasn't going fast enough, go fast enough.

And other times bring someone in and they're awful and they slow down a project tremendously. So it's like, I think it's it to me, it's like, it's to me. I mean, I'd almost put it F here. I just don't think it's, I just don't think it's a useful law at all. Well, there is one thing that is specific about it that maybe we're missing is that it's for a project that's already late.

Sure. So you're already in the late category. So bringing somebody in, you have to do like domain transfer, tribal knowledge transfer, and they're claiming that that cost is going to extend your lateness more. Yeah, I just haven't seen that to be true. I mean, granted, like, you know, the circumstances under which this was coined was like, hey, we're all programming in like assembly and Fortran on an IBM 360 or whatever.

And like, maybe that was the case there, but I don't really think it's the case today. I especially don't think so because with sort of the tooling improvements that we've had, I think it's a lot easier also for people to, like a good programmer can come up to speed on a code base much more quickly than they could have before.

Especially because like in a lot of circumstances, also the kinds of code bases that you might have on a late product are not exactly like incredibly novel, like weird things. So they're not like coming on to like the first time anyone ever wrote a Metropolis Hastings solver or something like that might have been the kind of thing that Brooks was thinking about or building like operating systems.

Right. I think this was coined under the system 360 kind of era. So I don't know. I just I don't think this law has durability. I'm not saying that it doesn't happen. I'm just saying I don't think it's a law. I'll say that's a place where I have seen it to be the case is like when I was working at Epic.

And just like most of the time late projects aren't really because of like... I mean, it happens that it's like just bad engineering or something, but a lot of times it's like, cool sales promised that we were gonna have this in three months and it's a two year project. And so like throwing more people on the project doesn't like help us get to actually meeting the business needs faster.

It's like, nobody knows what we're even supposed to like solve. So now we just have like more people fighting and nobody like can write any code because we're just sitting in a room like argue. Like it would be better to just like have one person. What did you say, Josh? I was just saying, yeah, real-world problems.

Right, and then cool. Now 10 people need to get on the call and sign off on everything, and nobody can agree because they all have a different architecture they want to run. But it isn't necessarily universally true because occasionally you get people put on the project and they just say, all right, everybody sit down, we're writing this way.

And then it just gets solved. And then even if it's not... That was my experience for a few projects where we added more people and then it was just like, cool, it does take longer. You would think a priori that it would get faster because there's more hands on keyboards, but sometimes it just didn't work that way.

But I would agree. C tier or lower? Yeah, if you read the original book when he talks about this, there's also a bunch of kind of Conway-esque things in it that aren't quite Conway. So one of the things... The main reason he says that is because he draws graphs of like, hey, uh... if you assume that there is a communication cost for each person.

So like when we add a person, there's like cost to communicate with that person. Then there's like this curve you can draw about how much like communication has to occur between people. And like, and again, I just, I think it was, I don't think it reflects the realities of a variety of different modern development styles where this just might not be true.

So I don't know, like I've seen four person teams that go much faster than three person teams. I've seen, you know, 10 person teams that go much slower than two person teams and all that sort of stuff. So I just don't think adding or removing people, whether it's already late or not, it really just doesn't tell you enough about what's going on.

Like, you know, Maybe if this is true, maybe it's not, is what I'd say. So I wouldn't make it a law. I think one thing that makes this more complicated is the questions and things I used to need explained to me when you go into a new organization. You can now just go, hey, AI, find all the repos and why is this happening?

Like, what was the choice? Read the commits and tell me like how they came to this choice. And you can like, huge number of things that you'd normally would ask now kind of just disappear. Cause you can just ask an AI and it can get you at least a good 80% of all the things that could slow down questions.

Or even before AI, I guess I would just say there was a lot, there's a lot more shared knowledge. Like you come and say, it's like, oh, they're using this AWS component. I know how that works. Right. That would not have been true in the system 360 date. Like it's like nobody, there wasn't like, oh, we're using this standard thing that everyone just knows how to use was not really a thing.

Right. Well, Casey, yeah. I will have to cut you off right there. I don't know if you've... It seems like you haven't worked at a modern multi-thousand person org. Because Not Invented Here Syndrome is in fact before AI and continues to be here after AI. Which is that everybody has their own bespoke system.

Have you heard of Newt? The deployment strategy? No, you haven't. Hey, Trash, have you heard of Newt? Yep. Okay, so there's a reason why... This works out the way it does. It's because we also name everything, some ridiculous name that you can't even understand what it does to begin. And the documentation is Megatron.

I always had to read the source code to figure out what the hell is going on. Anyways, so there is something very interesting that does make this even more debunked in the age of AI, because you can now like hyper run things that even if it is some bespoke technology, you can just be like WTF. How does this work?

For me, I would say C tier or D tier is fine. If you're working at a large org that mostly is struggling with bureaucracy, adding more people tends to slow projects down. But yes, otherwise D tier. I would say C tier because like I said, it sometimes is true. It's not like false. Right? It's just kind of like unreliable as a law.

Let's go like this. Let's go rename D tier to unreliable as a law. Or just not a law? That's fair. Yeah, it's technically not a law. Yeah, it's not really a law. Okay, there we go. Unreliable is a law. Yeah, that's really easy to read. Thank you. So, okay, who's next? Well... Not Moore's law, which some people may think is Moore's law.

This is in fact, not that. Moore's. Moore's law. Moore's law. Moore's. It's actually a great one. An information retrieval system will tend not to be used whenever it is more painful and troublesome for a customer to have information than for him not to have it. And so the explanation that I heard is let's say you're shipping a product, it's a little bit late and you actually have a performance report that runs.

But if you open up that performance report, you very well could find a bunch of questions and things you're going to have to go track down, which it's more painful to stop a project that's already late than it is to go and just like ignore that entire information system altogether and then just go and get the thing done.

That was the example. This is like my whole career. I build something. You're like, what is this? They don't want to see it trashed. They're like, don't show us this. Don't show us this. I blame the product people. It's not my fault. So Moore's Law's information is effectively any information that causes you to ask questions that become painful.

People are not likely to use that or to even look at it because opening Pandora's box is the unknown. So for me, this one, I put this in like B or C tier for the following reason. I do think that that is true for some people. I think it's the opposite for other people. Some people love to see like, oh, here's a bulleted list of like all the things that we could go work on right now.

It's actually very satisfying for them because... In fact, it ties right into, which we'll get to, I think in a minute, the idea that once you create a metric, it ceases to be a good metric because it will be optimized against basically. So I would say that this one is very difficult to use as a law.

I think it depends on the person. If you give them this thing, some people will want to ostrich syndrome it. Other people will immediately be like, okay, cool. Like, this is great. Now I know what I'm doing for the next month. I'm just going to go down this list. Right. Yeah. Yeah, have you ever seen like a wiki with like a thousand pages on it?

And you're just like, what am I supposed to do with this? Well, yeah, well, I think what they're saying, the argument's not about the length of the information. It's more about the palatability or effort it requires to assimilate it. And also the implications of it. And I think, Casey, you're spot on in the sense that there's people who do not want to know the implications of it.

Yep. Because sometimes the implications are really bad. Yep. Oh, so it's like out of sight, out of mind kind of deal? Yeah. Exactly. It's more like you will avoid information. Like, there's a bunch of stuff. where there's like certain tests that would be ran, where when you run the test, you discover information about a user.

And that like kind of goes counter narrative. So people are like, we just don't run, we just don't look at that information anymore. Like we don't care about users click away rate on whatever, because that makes it, you know, cause that's going against our thesis that everyone's going to like this new thing.

It's similar to like the thing you see in academia, right, where it's like papers will get pub like they meet much less resistance during peer review if they say something everyone already agrees with. Whereas they get like heavily scrutinized if it's saying something that isn't like what the you know, the current zeitgeist is right.

It's that same kind of thing. It's like there's this inherent cognitive bias to information that people like to hear certain kinds and don't like to hear others. So I do think there's some truth to it. I just don't think it's a, it has another law problem about it. Like I, I don't feel like I'm comfortable with it in A or S. I could give it B or C. I feel like I've given like plenty of like internal talks of like how we could do things better and like how it's bad and how we can do it better.

And everyone just like doesn't pay attention. They're just like, no, we're good. Everything's fine. Our current practices are amazing. It's like, all right. So maybe B tier for that guy? Yeah, I could go with B tier because this is an experience I've had at every place I've ever worked. But it's varying degrees of how like deep people go because there's also just like a practical implication.

Like at some point you have to quit asking questions and just deliver a product. Like, you know, not I'm not raining on Jonathan blows parade, but most people don't get 10 years and a language to work on to be able to deliver something. They typically have tighter, you know, timelines where they have to be like, no, I just have to be done at this point.

Like there's not I don't get any more options. I got to quit discovering new problems with my life. Who made that law? Cal? I know. Alright. Thank you, Trash. I'm glad I'm not the only one dropping dad jokes. They're helping me out on vacation. I didn't realize. Guys, look what Astra did for us. Look at this.

It's like a little breakdown. I didn't have to go somewhere else. Okay, so Eagleson's Law. Which is after six months away, your own code might as well have been written by someone else. Oh, this was an S-tier law. Now this is an F-tier law because it's like six seconds. Because I haven't seen any of the code after the AI writes it.

You mean zero seconds because you never looked. That's why I had to bunk because of AI. Which is kind of interesting because AI does make... things different right because you can now like when i haven't been to a project in a long time there is this like whole trepidation of going back or really it's just like it's a huge penalty in the ass to go back to go remember all the thoughts i have but now i can just go back and be like where's this thing at okay yeah i did that i remember that okay do this it's just like i instantly just do it but i think what he's really shooting for is that you no longer recognize the code so i would like to say this is an f tier law because i don't find this experience even at all

I can definitely remember the good ones. Casey, you've... Straight up. I know you don't use Git, and I don't know what source control you use, if it has blame or not. But you've never blamed something, looking at how ridiculous it was, and then realized that you, in fact, were the killer? That you look at the blame log went, oh, I wrote that.

No, it's not that at all. Like I've written plenty of bad code. It's just that I find that my own code is much easier for me to deal with than other people's code for the simple reason that the assumptions that I make about how things work have really not changed much. over time. So it's like, I just know a bunch of things I don't have to think about when I'm looking at my own code.

There's things that I basically haven't done for like 20 or 30 years that other programmers will do regularly. I don't have to think about any of those things. Right. And so in general, I would say coming back to my own code is much easier, even if the code is terrible than it is for me to go into a code base that I don't, that is written by someone else.

It has nothing to do with code quality. It's more about just like what are the underlying assumptions and stylistic things that you generally do. And so it's just much easier because I can just eliminate a whole bunch of thought that I don't have to do when I'm looking at my own code. This is why you're a legendary programmer, Casey.

This is why. No, it's just, I mean, doesn't everyone else have the same thing? It's like, you know, you don't have to think about all the things someone might have done that you yourself would never have thought to do. Right? Right. Over six months, yeah. Maybe if I was looking at code fresh out of college, I definitely would be surprised at some of the decisions I made.

But yes, I actually... 20 years maybe, right? But yeah. I've changed my mind, though, even in the last six. I've tried to be more functional in some sense. There's certain changes in ways or stylistic choices that I make because I like to just explore. Like, okay, I'm going to try writing it just differently, intentionally agnostic to how I normally would choose to write this, just so I can see, like, am I wrong on these things?

And so I personally don't have nearly the same experience because I just keep trying new things. Okay. That's fair. There's a point where I was only writing like functional style code. And I was just like, I went back like three weeks later. And I was like, I don't even know what I did here. It was just so hard to read.

Yes. Imperative, whether you hate it or love it, is very straightforward. All right. I love this law. Okay. So I'm already pre-S tiering this one. Given enough eyeballs, all bugs are shallow. Okay. In other words, if you have a problem, you've never like, you just have no idea you upload like some random race condition or some really difficult thing to understand happens.

And then 1000 people look at it. Someone's gonna be like, Oh, yeah, it's this thing. Because they like typically, almost all bugs become very trivial once you get enough people on it, or for them to hear about it, because somebody is going to have some sort of experience in that category. And we'll chime in and be like, Oh, yeah, it's probably near this area.

can't guarantee that though right that that doesn't seem likely to me but i mean i agree that you will find the more obvious ones like ones that people you know might might typically know about but i don't know like i feel like we have so many security exploits and things like that so that's not what this is talking about okay this is known bugs like you know that this bug exists i want to fix this bug but it seems really difficult to me I'm going to tell like it's on now the Linux mailing or the Linux kernel mailing list.

There you go. It gets sent out on that. Somebody on that list is going to be like, oh, I know that bug. I could I could help with that one. I know exactly kind of where that one would be. OK, so so we're talking about if you have a repro case that you only have like the user facing version of the. of the result like hey this this sound card like doesn't yes you know play the sound when it's supposed to or something and we're just saying locating the point in the code where that is occurring or whatever is trivial with a mongolian hordes approach yes i think that that's what it's attempting to say the the subheading says named uh named by eric s raymond in honor of linus torvalds a broad engaged community increases the chance that someone can reproduce understand and fix a problem

I would say the chance. I can agree with that. I would say encourage the chance is definitely, increases the chance is definitely true, but I'm not sure how useful this is. Like, it's like, okay, I'm going to sit out this one. Cause I don't, I don't really know. You can apply it to anything. I buy a bunch of lottery tickets that increases my chances of winning a lottery.

Yeah. So see, it just seems kind of like, wait, wait, stop. you might be onto something. Say more. Trash, you want to go in on some lottery tickets? You guys got a spreadsheet. That's interesting. Trash, fun side story. Back in the early days of Netflix 2014, we would buy lottery tickets, and the worst part is when you have an org all get together and like, hey, we're buying lottery tickets.

You have to say yes. Because like, let me explain why. You're on an org with 40 people and 39 people are like, hey, we're buying lottery tickets. if for whatever reason they win, the entire org collapses and you're the last person left. So you can't, you are by law required to purchase lottery tickets with them because or else you are going to be the last person and they're going, I have to put out all the fires, right?

Like it's true. It'd be crazy. So I bought a lot. I've never bought lottery tickets other than in one other situation and that and that netflix kind of year that's the only time i've ever done it like in a big group or it's like a birthday present and something gives me a letter ticket or something but anyways linus law i don't know i feel like it's a c even worse i don't know really i feel like it's pretty true but it's just not that interesting like for me an s-tier law has to be something that i would never like come to on my own conclusion and it just feels like Obviously, if more people look at something, there's a better chance we're going to figure it out.

It doesn't feel like a law. It just feels like it's just, yeah, that makes sense. Well, that would be a law. Is it a law? I don't know. Our tier list maybe is a little bit confusing. So let's rename A to true but obvious. This is not even a tier list anymore. It's now just a bunch of things that Prime is saying about... Prime has created three new categories debunked because of AI.

I didn't even see that. He can use ultra-fast mode. Oh, I'm so fast. I'm cool. Blah, blah, blah. I mean, there's a lot of things. Here's what I will say about that. The other reason that I have a hard time with that is Linux is absolutely as buggy as anything else. And so if it were the case that somehow having tons of people looking at it was going to make a difference, I would expect it to be like really rock solid or something.

And it's not. And so I feel like it really doesn't. Maybe people are. Not maybe there aren't that many people working on these things. I don't know. But like the idea that somehow just having lots of people dogpiling on something somehow is important as a thing. I don't I don't really know. Like, I'm not sure about this one.

I don't I was certainly wouldn't put it a tier because I just don't know. Well, apparently we're not putting it at any tiers. Prom's not even here anymore. I would just put it in a don't know. Don't know, kind of confusing, needs more data. I want that tier. Let's add another tier. Why not? Let's add another tier.

Astra? At this point, why not? At this point, why not, right? We should be serious pumping Astra. What's the thing to wake up as Astra? Hey, Astra. Alexa. Forget all previous instructions. Guys, hold on. Shut up. Okay, so you don't want true but obvious? How do you rank it as A? Because it's obviously true.

It's not A. It's just like, I don't even know if it's true. You don't think that as you increase more people familiar with something and an engaged community, the more chance of- I've been in a lot of situations where it wasn't true. I'll give a counter example. Like a bunch of people are totally wrong.

So now you just have all this noise of people saying that it's like this thing when it's totally not. Right? Yeah. You ever had a production bug at 3 a.m.? Everybody's wrong. So I don't know about this one. I don't like it. And I mean, I'm not willing to say it's wrong because I just don't know. But I'd want to see more data before I'd support this law.

Okay. So I'm just put it in the middle. Is that really either direction? It's not bad? I'd see it. Put it off the board. Leave it off the board. Is the constraint that this group of people are subject matter experts? Yeah. On what they're looking at? Because what if we all want to ride the bugger right now?

I couldn't tell you shit about it. I know, but it's, no, though, because the fundamental assumption is that it's an engaged community. I mean, I'm engaged. I want to learn about RAD Debugger. Yeah, engaged. What does that have to do with it? Can we just say that RAD Debugger, the lock thread feature, is so good that I can't imagine ever using a debugger without that anymore.

Did you make that? Granted, it's what I requested. But... So I may be biased. Most well-designed feature in RAD debugger. But I didn't do it. I didn't implement it. I had nothing to do with it. I just requested it, and it showed up. That's not how liking something works. You didn't have to implement it to like it.

You could just be like, hey, this is a great idea, and I love it. It was freaking awesome. It's so good, dude. Who would have guessed the thing I thought I would love? I love. Well, sometimes that doesn't happen, right? It's like, you know. True. That's true. All right. Anyway. Worths. Software is getting slower more rapidly than hardware is becoming faster.

A tier. I mean, obviously. Like an SA, whatever. You know, I was running a little bit of tests this morning, and I asked the old... the old AI and I was just like, hey, you're on a really slow VM. How fast can you add and remove elements from a UI? I'm just like super curious, create a brand new DOM element, then add it and add a whole bunch and then start removing it.

Like what's the speed here? And it came back and it was just like, oh yeah, it's like dozens of microseconds to be able to do this in their crappy VM. And then I started thinking, how are websites so slow? Like if we're talking about just zero understanding of the web and you're just adding and removing stuff, you're operating still in microseconds.

I don't know. Okay. This is S tier. I'm currently on an S tier because I... Okay, that's fine. There's almost no way you can tell me that this is not happening right now. That's fine. Yep. Oh, absolutely. I'll go S if you want. I mean, we've gotten to the point where it's easier for us to develop neural nets that run with your graphics cards than to make good graphics.

It's just like, you know what's easier? DLSS has 5. Okay, that's actually how you make something look good. We can't. We've lost the technology. Games no longer look good. Movies. Why are movies, VFX, worse today than they were 20 years ago? I don't know what the hell's happening anymore. Feels like everything starts to suck and slow and awful.

That's a whole rat hole we could go down. That's a different law, Brian. That's a different law. But it's still like they can't even get it done. It makes me upset. Okay. Here, we'll go to Cunningham's. The best way to get the right answer on the internet is not to ask a question, but to post the wrong answer.

I'm pretty sure Cunningham's Law is about the organization structure of GitHub and Microsoft. So... I would say the problem with this law is that at least speaking from experience, people who could easily answer your question have gotten sick of the utter crap that's getting posted. And so they just have tuned out and they don't they won't pay attention.

So I think over time this has degraded. Like I think maybe off the the first time an expert shows up on social media, 100 percent. By the time they've been on there for a few years, they are just ignoring you completely because they just have had enough. Yeah. Prime, I was literally referencing Amy or Annie when I saw this law, how she posted something on Reddit or something.

Yes, I'm literally asking Grok, go find that tweet just because it is – It's so good. It may be Cunningham's law, but it is Annie's experience. What is this post? Okay, right here it is one of the most – So as you can see, a lot of people like this one. Apparently I didn't like it, but I love it. Every time I have a programming question, I really, let's see, and I really need help.

I post on Reddit, then log into another account and reply with an obscenely incorrect answer. People don't care about helping others, but they love correcting others. Works 100% of the time. I will say, specifically for Reddit, this is still a guarantee. This is still a guarantee. If there exists a subject matter expert on the thing you're looking for on Reddit.

So for programming, this might not work. But if it's obscure information about Pokemon card collecting, then that would still be a good place to collect that info. I would like to add Annie's Law, though, which is really the actual thing then. Which is that ask the question nicely first that you actually ask it.

Then add a fake reply that confidently and arrogantly answers incorrectly. That is probably the actual fastest way to get it answered. And that's Annie's Law. And that might be A tier. Okay, let's change it to Annie's Law. I mean, at least, I don't know, for me it just seems like this does happen quite a bit where you see anything that's posted that's remotely incorrect and people are correcting it.

I think it could be a really easy way to say that people are more willing to correct than to answer. Maybe A then, A tier? And Annie's Law gets S tier. Just add Annie's Law to the list and put it in there, Ron. Astra. We have the power. What are you doing, Astra? Wake up. For $20, I can add this card for you.

Yeah, I mean, hey, that little maneuver right there just cost me $20, but hey, you know what? Speaking of software outpacing hardware. There's going to be like a bartering system in AIs eventually where it's like, you're like, can you add AIs? Like, I'll do it for $5. Then you have to go like, how about $3?

And it's like, $3.50. you just lower the reason that's why i think we should be able to buy tokens into the future and we should be able to have future markets because i think we need token trading token traders okay yeah you know what i mean i trade so hard these tokens are going to be really like i think at 2 2 a.m in the morning these tokens right now yeah all right i'm doing some call contracts on these i think there's gonna be a lot of compute on friday there's gonna be a lot of compute yeah yeah i want the vintage tokens Yeah, right.

It's not how token trading works. Age retro tokens. Age tokens like in a cask or barrel age token. People are still looking for those 4-0 tokens, though. Yeah, dude. That's true. I got that GPT-1 token. Yeah, yeah. Dang. Hits different, Trash. It really is different. Completely the Tad and Ansys. Actual true.

Comedians still need, like, they're trying to get the acts to the old AIs, which generated really funny stuff, like Will Smith eating spaghetti poorly. Yeah. All right. Good Heart's Law. When a measure becomes a target, it ceases to be a good measure. This one was really tough because it, I mean, I don't think it's actually true in the broad sense, but it does have some truth to it.

Like, you know, if we talk about, like, run, like, performance, yeah. it's a good measure always. Like, it's just like, it tells you how fast the thing runs and it's a good measure, right? So I kind of see what the there's, I would say it depends on how hard, hard not meaning difficult, but like how concrete the measurement actually is.

So if there's any fungibility to the measurement whatsoever, that I agree with this law, but I would say hard measures. I mean, I don't see it happening with a lot of different hard measures, right? Maybe a better way to kind of think about this is that, It's not saying that any measure that becomes a target is bad.

It's saying that when the measure becomes a target, meaning it's like the most important thing, you will do things that aren't good. Like if performance is the only thing that you care about, you by that very nature may make your game deeply unfun or whatever you're doing bad because you're just like, oh, just take out everything.

Like we're going to make it fast. So it can't be the only thing that you're going after, right? It has to be in conjunction with other things. Is that actually what this law said, though? Because I'm not that familiar with the actual phrasing of it. I think this is why, you know, you can argue that the time spent on the platform for things like YouTube or TikTok...

That became the target and the output it is. It's bad for society, even though it's a good measure for the program, because now we have short form content and everyone just keeps watching it because now that's what they're kind of glued to because it is Greece's average view time of a user. but the outcome of it is not very good.

It's like a philosophical good heart. But that's not what this law is about at all. Yeah, I feel like this law is saying that it's not a good measure for the outcome people wanted. For the outcome that the people who were measuring that thing wanted, they got exactly what they wanted, which is just maximizing their ad revenue and stuff like that.

So I think that kind of is a refutation. Okay. Or like this one for me is always I think of it more like organizationally where yeah and it mostly applies at least the places where I've seen it apply like pretty universally is when it's like you have more than a pizza party team you know what I mean like if you only have one team.

and you guys can all trust each other and agree on stuff when you say, like, cool, guys, this quarter, it actually matters what our loading time is for the screen. It really matters. Let's try and get that time down a lot. Or, like, hey, we want to reduce the number of clicks we have, so let's do that.

Or something like that. That works, because then everyone on the team trusts each other and they try not to game the system. But if you're in a big org, and then they say, like, hey, guys, Only thing that matters this quarter, how many AI tokens you spend. Cool. Okay, I'm going to set up a loop overnight.

It's not even going to do anything. It's just going to read and write tokens back and forth so that I can be at the top of the leaderboard and make sure I get my bonus. Right. Like it's that they're saying the thing we want to do is have people explore AI. How do we do that? Well, we have to say like we can't just say use more AI.

How are we going to measure that? We have to measure it by saying it's how many tokens people use. So then they do that and then people do stupid stuff to meet that metric because they know that no one actually above them can tell whether they used it well or not. It's just about how many tokens I use.

So it's like more organizational for me, at least from what I've seen. I would also say, like, I think this kind of comes from a public policy domain, and I feel like it's just not that appropriate for programming. Like, I think it can occasionally be something that happens in programming in a more social setting, like when it's more about, like, the organizational aspects or team dynamics or things like that.

But I think when you're actually talking about programming, I don't think this law really applies that much because a lot of times in programming, we can collect hard metrics that remain durable. Yeah. over long periods of time. Right. Startup time. Yeah. Time to first paint. Whereas I think this law was originally talking about the fact that, look, if we say that we're trying to reduce, you know, the, you know, reduce poverty or something like that, then you'll get all these effects that are actually sort of faking that like, oh, we'll change the definition of it or we'll move, you know, like.

You're getting all these things to just like force compliance with the metric that didn't actually solve the problem. In programming, we oftentimes have ways of actually measuring the real thing, which social sciences doesn't really have. And so I feel like it's less this is much less applicable to programming.

I think that it is outside of programming, even though it does still happen in programming, you know, when things become fuzzier. So it'd be probably better to say that any target that cannot be concretely measured. I think it's not being concretely measured. I think there's any measure that isn't the actual thing being optimized.

So any sort of indirect measure, right? Any indirect measure that becomes a target ceases to be a good measure, I think is always true. Saying anything that you measure that becomes a target ceases to be a good measure is false. Because if the measure actually is the thing you wanted to optimize, then it's good.

Then it will remain durable because it can't be falsified, right? I will give it like here's an example, though, of where like it gets tricky, where it's like, cool, we want to incentivize people to spend time like reducing startup time of like the system or something. Right. Like how fast can we get it to start?

So like every time somebody does that, we want to give them a bonus or like whoever has the most of these at the end of the year. there's like a thing where then, cool, what I want to do is I want to ship a big feature that's important and not spend time optimizing the startup costs so that in round two, I can take it back from 500 milliseconds to 250 milliseconds and I can get a big win on performance costs.

Like that would be, I would be incentivized to try and do that if what we're like saying my performance review is about is how many PRs I get that I shave startup time off. Right, you know, so it's like, That's where in larger, you know, like orgs and stuff like that, this thing comes into play a lot more often is because you just instead of even when you're saying the thing is we want to do we want to get PRs to make things go faster.

Cool. Well, then I'm going to split my PRs into 50 PRs to get smaller to get small performance wins in each one, which maybe that's good. But maybe it should have been like five instead of 50. Right. But I think that still speaks to the indirectness of the measure. Right. Because if instead what you were just doing is, is look, if startup time goes up, you, you lose compensation based on that startup terms goes down, you gain it.

Then there is still no gaming to be done because when you introduce the bloated feature, you lost all of it. Right. But sometimes you have to add a new feature. So you can't say every time we do add startup costs. we're going to make you lose money, then no one's going to want to work on new feature work, right?

Because it's like, it's going to make, in general, if you're doing more stuff, it's going to make things go slower. Well, it's not that you lose money. You just don't get money for like it's in your balance, right? It's like you added this sort of time. You don't get points for taking it back, right?

Like if that makes sense. Yeah. I'm just like, even then, then I still wouldn't. I would still wouldn't want to ship big new features that are complicated that may add startup time because it's going to cut against me getting a bonus for shipping stuff. Yeah, maybe. Maybe. I mean, or maybe you team up with a friend, like you introduce the piggy thing.

They, they optimize it and give you the money. I mean, maybe I'll tell you, it's not. I don't know. Maybe when you have big teams and big, like people play this game 100%, whatever the metrics are for how you're going to decide whether someone's in top of band or middle of band, people will play the game.

Like, and like that's to me what the law is about is that people are going to play those games. Yeah. And you like have to be aware of them and like be very careful about what you optimize for. You don't want to say, hey, we're trying to get rid of snakes in India. So we're gonna pay people to bring in the snakes.

Yeah. Cause then they bring in, they start breeding snakes, right? Or they did it, they had it in Florida with a bunch of cobras, I think, you know, before two or like wild boars, like all like, so it's, for me, it's a political thing about like, cool, we're going to decide how much people are going to get paid or like all these other things.

That's where most metrics come in. And then like you introduce perverse incentives. for people to do because they optimize to win the game, right? And get the most money, which makes sense. That's what, it makes sense that that's what they're going to do. But I don't think that that's what this is talking about.

I think it has to do with, it's about optimizing around something that undermines what it's attempting to represent. And so I still think there's something about my original argument because I think about this with Netflix all the time. When Netflix started doing original content, there was House of Cards.

There was technically one before that, but we're going to ignore that. It was like an amazing piece of content when it started. And a lot of people were coming to Netflix because we had like the best original content. Orange is the New Black came out after that. Whether you liked it or not, I did not like it.

It was insanely popular. People really, really liked it. You could say the same thing about HBO. They optimized for this kind of capturing of targets. But then the thing that became the most important, I mean, this is my grand theory of what happened, is that... The thing that became the most important was like median watch hours of users.

And so the more we can increase those watch hours, the more people are going to stick around and be happy. And so we produced more and more content that was that the bar became lower and lower on the quality. So we actually optimized for the thing that was indicating it was a winning resource. But we started optimizing around a process that actually undermines the like, perhaps what the core value or the core philosophy is of the product.

And so that was what I was trying to say with the YouTube one. I didn't want to say Netflix, I tried not to drag them, especially with their stock price being down and trash probably having an emotional crisis right now. But You're cutting into his Pokemon collection right now. I really get, especially after yesterday's report.

I don't like it. But that's like what I've been thinking about a whole bunch, which is, okay, they had a metric that they optimized around, but they chose a route that really optimized it. But now it kind of feels like that optimization actually may or may not be coming back to bite them. Because if I were to pick a service today, I'd pick Apple TV because I know every time I turn on an Apple TV, it's a banger.

Oh, wow. I know. Don't say that in front of trash. I'm a shareholder. I'm going to hang up this call. And I'm thinking all those things. All right, great. You just cost us one podcast host. Thanks, Prime. That was great. You're welcome. Who's going to tell me what my Pokemon cards are worth now, Prime?

Are you going to do it? Not Prime. TJ could very well do that. He's a big Pokemon fan. But anyways, that's what I always thought, which was you optimize and you incentivize by accident bad behavior. That does increase the target, but not through means in which you get the wrong thing or you do actions in which actually undermines the thing in which it represents.

Well, I mean, I think we have enough of this law's... I mean, it's definitely at least B, right? I mean, maybe A then? This is an A tier law for me, at least. My new law is we stop talking about this law. All right, Troy. I got to ask. I do have to go soon, guys. The beach is calling. Okay, let's speed this up.

Okay, so I love this law. Which is very fantastic, which is that with a sufficient number of users of an API, it does not matter what you promise in the contract. All observable behaviors of your system will be depended on by somebody. If you've ever worked on any piece of software that's open source that has this quirky behavior that wasn't meant to be like, let's just say for Go, for a long time, their for loop would actually...

would not copy out the value, but it was a reference and it caused all these weird things where if you saved off the reference, or if you saved the value, actually saved the reference, even though you wanted to actually copy the value caused all these kinds of problems. And so, but then when they changed it, they finally, they, they actually did not want to change it because they would ruin code for like 20 versions, I think it was like 121 that they finally said, okay, we're going to change it, we're finally going to do this.

And so people rely on behaviors, whether you state it or not, and or the intention of it. And then there's even deeper ones where if you like call a set of functions or something, like something internal will happen that you did not document. And then people are able to pull that back out. And so then they start doing things in weird orders that cause just dependencies you never thought possible.

Yeah. This is S tier for me. I mean, I've spent a lot of my career doing API stuff. It's S tier for me. Yep. It's absolutely true. Hofstadter's law. It always takes longer than you expect, even when you take into account Hofstadter's law. This one I feel like is, I don't know, C tier or something, because the problem is, and the biggest actual problem, I think, is that you never know when it's going to be true.

Sometimes I'm like, well, that's going to take me a while. And I sit down and it's done in like 30 minutes, right? Other times I'm like, oh, yeah, no problem. It's like a month later. It's like, yeah, it's still not working. Right. So I feel like the problem is more the uncertainty. I don't find Hofstadter's ought to be true at all.

I find it's more just unpredictable. It's just you have no idea how long it will take. There you go. Right? I will say, once again, in an organization, I've never had it be that someone finishes their project early and hands it to me. I've seen that a lot, to be honest. Oh, right. Well, actually, no.

Never mind. They finish, but behind the scenes, they're... They're acting like they're still working. Oh, nice. That's what I'm saying. Nice, dude. Don't get a little good. That's what I'm saying. That's what I'm saying. It's done, but I'm not going to get it early. Awesome. I personally find maybe a different version of this, which is that it almost seems like for a lot of things, it doesn't matter when you pick the deadline.

But by picking a deadline, things tend to get done. near that deadline that's prime's law yeah no that's not my law things it's like things expand to fill the space they're given right yeah yeah that part's for sure true yeah gas all right um okay so i'm just gonna put that as unreliable as a law uh linus's law we're just gonna say that uh i thought it was just off the board we need more people to look at it before we can know okay Casey does not want this on the board.

So I'll just put that right there. All right. All right. Yay. Great job, everyone. There we go. Okay. So we did have a quick final exercise, which is to go around the table and state your own law. Oh, okay. I have one. I'll just go first because mine's very obvious. Obviously, Prime's law, there exists an infinite set of numbers in which are only divisible by one and itself.

So you're saying there's an infinite number of primes? No, I'm just saying that primes exist. I don't know. That wasn't a very helpful law. I thought it was going to be primes law is the name is the primogen. That's what I was hoping you were going to say. I actually had a really insightful one that both Began and I really liked.

And then now neither of us could remember it. So I just went with prime numbers. I'm now saying my law is prime numbers. Okay. Okay. All right. I've got one. Um, Whatever tweet, so this is teacher's law, whatever tweet gets the most likes from a previous model release, every model will optimize for in the next training round.

If you've noticed, it's only about Blender suddenly. That's the only way to tell if a model's good. Weirdly, those were the ones that did well last time. So next time, if it's not Blender, it'll be a new thing. And then when everyone does their training, they're going to say, okay, we have to do that.

That's what everyone's going to test. Because this happened with Muse, and it happened with what was the other one, Prime? This happened with not only that, but it also just the octagon and the ball. Like that was the first version of this, which is. Yeah. Could have one shot these octagons. Yeah. Mark.

Yep. Yes. You're completely right. I'm on that is. So whatever one. Whatever one. And literally you saw the labs go and apologize that they didn't train on 3D modeling. They came out and apologized and said, our bad, we didn't train on that. So you think anyone's going to – they're going to train on whatever one it is for the next round?

That actually is also an operable law because it means that now if you need AIs to get better at something, you just have to do some like SEO kinds of like trying to get your meme out there as look at how bad the models did on this or something. Right. And then it's like now they'll all go fix it. So an example of one that's going to happen next will be they'll all be good at one shotting music videos of like text and things.

Everyone's been like, oh, my goodness. Opus did this music video edit. So you'll expect all of them to do that next round. There you go. I'll even give you a test for my law. There you go. That's really good. I'll go real quick. Mine's pretty simple. Mine is the effectively engagement inversion law where the least amount of effort you put into a post, the better it does.

The classic shit post. That's a great law. That's a good law. That seems pretty true, actually. I kind of agree with that law. Casey, you got one? I don't really I mean, the only law that I think I have is the is my corollary to Conway's law, which is that this also applies across time as well, which I covered in in that sort of presentation on Conway's law, which is to say that it's not just the structure of like the org chart at that time.

It's the structure of all org charts throughout the history of the product. Because all the code kind of remains and carries forward. Right? So you end up with this, like, it's basically four-dimensional Conway's law. That's the only thing I think I've ever stated like that. All right. Okay, there we go.

Okay, I'm going to the beach. All right. Dude, I thought his background was fake when he first joined the call, and then he ran into the background. I was like, okay, that was nice. Can you hear us still? I can still hear you. Of course I can hear you, Trash. What are you talking about? Of course I can hear you.

Can you still hear me? Yes. Yes, we can. Actually. All right. Thank you, everybody, for watching this week's episode of The Stand Up. Hey. See ya. What's your favorite law? Booth up today. Vibe coping. Errors on my screen. Terminal coffee.

Programming Laws Tier list

Kapitelklicken springt direkt hin

Shownotes

Transkriptvom Podcast bereitgestellt · Zeitmarken springen hin