Just spent the last 7 days on the front lines of the vulnpocalypse fending off an active cyber attack on one of our products. Some thoughts: - Software factories are going to be required equipment for everyone. There’s just no way to keep up with the pace of highly automated adversaries without one. - We were lucky because we had spent the last few months getting our software factory running well. It is nice to have for product development but proved to be absolutely essential this week. - At the minimum you need to have a coding server in the cloud pre-provisioned with read only access to all your logs and all the services you depend on for observability. With that in place you are a prompt away from reasonably good situational awareness, ongoing monitoring with loops, and ability for coding agents to validate fixes against your actual, observed attack patterns. - Shared coding server also unlocks multiplayer incident response where everyone can see every session and jump in as needed. Sharing session links that can be forked is much higher bandwidth than re-explaining things. - You don’t need to be Ramp/Stripe/Uber scale to have a working software factory in the cloud. We are a team of 3. Ours is built with an @opencode server (thanks @thdxr!), a forked version of compound engineering optimized for automated workflows (thanks @kieranklaassen!) and a multiplayer agent in slack that handles crons (we have our own harness but pick your favorite here). - To get our software factory up and running well, we had to stop all new product development for ~6 weeks and just focus on getting the validation systems working that enabled us to reliably shipping PR without human code review. This felt very painful in the moment but was totally worth the eventual speedup in velocity. - KYC for @AnthropicAI & @OpenAI cyber programs is now easy and quick (at least for defensive access), but a day felt like a lifetime this week. Submit your app now before you really need it. - Getting Mythos access unlocked a deeper level of analysis that helped us shift from reactive mitigation to proactive patching. Wish we had done this a few weeks earlier. Get started now!

my personal fast takeoff continues, finally have 24/7 code factory running for @groupthinkAI and doing a lot of fine tuning on costs but 📈 daniellemorrill.com/building…

Tired: Two-pizza teams Wired: Two-slice teams @danshipper on the best team structure in the AI-era

Cyber is having a moment Across 21 major software companies, including Apple, AWS, Microsoft, and Google: - Reported critical vulnerabilities never cleared 100 per month in four years - Since spring they've jumped to over 600 per month

also use your voice in the Voice Olympics: partiful.com/e/MKk7MH8bDwLRK…

I think the "difficulty" of software engineering is essentially constant no matter what abstraction level you move to, because human cognition adapts to new tools until it can fully utilize itself. Tools are only affordances, not a magic wand that makes work disappear. Great software engineering was immensely challenging before. It is still immensely challenging now, despite very different workflows.

America is banning AI in schools. China is using AI to create geniuses. Introducing Aristotle: The AI tutor that solves America’s broken education system. heyaristotle.com