SED News: OpenCode, AI Code vs. Shipped Code, and the LiteLLM Breach

SED News is a monthly podcast from Software Engineering Daily where hosts Gregor Vand and Sean Falconer unpack the biggest stories shaping software engineering, Silicon Valley, and the broader tech industry. In this episode, they cover the resurgence of ARM and CPUs as serious compute infrastructure for running local AI agents, a supply chain attack on LiteLLM https://www.litellm.ai/ that exposed API credentials across thousands of developer environments, and the arrival of OpenCode https://opencode.ai/ as a fully open source alternative to Claude Code https://code.claude.com/ and Codex http://codex/. They also discuss the diverging strategies of Anthropic https://www.anthropic.com/ and OpenAI https://openai.com/ following the Pentagon contract controversy, and what it signals about where each company is positioning itself in the enterprise and government markets. Gregor and Sean then dive deep into what the AI coding boom actually means for shipping software. Finally, they highlight standout threads from Hacker News, including Doom running entirely over DNS, the psychology of seafoam green in Cold War-era control rooms, a Tesla https://www.tesla.com/ Model 3 computer assembled from salvaged crash components, and Apple’s quiet discontinuation of the Mac Pro. https://i0.wp.com/softwareengineeringdaily.com/wp-content/uploads/2023/11/Gregor-Vand.jpegGregor Vand is a security-focused technologist, having previously been a CTO across cybersecurity, cyber insurance and general software engineering companies. He is based in Singapore and can be found via his profile at vand.hk or on LinkedIn. https://i0.wp.com/softwareengineeringdaily.com/wp-content/uploads/2023/10/Rectangle-3-2.pngSean’s been an academic, startup founder, and Googler. He has published works covering a wide range of topics from AI to quantum computing. Currently, Sean is an AI Entrepreneur in Residence at Confluent where he works on AI strategy and thought leadership. You can connect with Sean on LinkedIn. Please click here to see the transcript of this episode. http://softwareengineeringdaily.com/wp-content/uploads/2026/04/SED1921-News-April-2026.txt Sponsorship inquiries: [email protected] https://cms.megaphone.fm/organizations/619b680e-d813-11ea-9750-e7ecac406436/podcasts/e60108fe-e328-11ea-b2b6-1348249f900a/episodes/3913370a-bc44-11ed-ace6-8b1f96d82bba/[email protected] The post SED News: OpenCode, AI Code vs. Shipped Code, and the LiteLLM Breach https://softwareengineeringdaily.com/podcasts/sed-news-opencode-ai-code-vs-shipped-code-and-the-litellm-breach/ appeared first on Software Engineering Daily https://softwareengineeringdaily.com.

• 0:12Speaker 00

  Hello and welcome to SED News. We are your hosts. I'm Gregor Van And I'm Sean Faulkner. And as I think a lot of you do know already, this is a slightly different format of Software Engineering Daily, where we pick off some of the big tech headlines that you might have seen in sort of more mainstream news. We're going to dive into a bigger topic in the middle. And then we just look at some of our favorites from hacker news towards the end, which usually ends up in sort of weird and wonderful rabbit hole type projects that developers have been working on. So as usual, we just like to kind of catch up on what we've been doing. What has been in your sphere, Sean, since we last did SED News last month?

• 0:56Speaker 00

  There's been a lot in the last month. So I moved into a new house, which has been great. But while I also moved in a couple of weeks ago, I actually have traveled each week of this new adventure in this new house. So I was in DC and then I was in Seattle for our data streaming world tour last week. And then my wife was away this week. So we've been here almost three weeks. And there's never been a completely full week where everyone as a family has been in the house yet. So I'm looking forward for that happening. And then Confluent also, the company I work for, was officially acquired by IBM about a week and a half ago. So that's exciting news. That's all completed then, yeah? Yeah, everything's been completed. So lots and lots of conversations now going on with those folks over at the IBM side, figuring out how we're going to work together, which is exciting.

• 1:42Speaker 00

  Lots of stuff happening. And then, you know, looking ahead to April, my kids are going to be on spring break, which means that everybody's going to be on spring break for vacation. So we have some travel. Coming up and then I had some work travel to Cloud Next and then I also going to India. So lots and lots of stuff happening over the next little while, but what's going on in your world? You're in a different location than usual. Yeah, well, I'm in Scotland. So that's where I'm from originally. I try and come over here for a month or two of the year. And when I do, I'm up in the far north, in the Highlands of Scotland. So it's always kind of fun. That's what technology makes possible. You can still do a podcast from all the way up here where there's, I actually looked it up, the town I come to is a population of eighty, eight zero people. So.

• 2:27Speaker 00

  I thought I was from a small place. Yeah. So I didn't actually grow up here, but it's sort of where I've decided is where I come back to now when I come back to Scotland. So, yeah, it's always quite a change from Singapore. Yeah. But that's, I think, by design. But yeah, no, I mean, work wise has been kind of exciting, actually. Obviously, small plug here for Superbase, of course. But yeah, we've just launched. So Stripe, we've been doing this interesting project called, well, called Stripe Projects, which is a CLI tool effectively. So you install it through the CLI and basically there's a bunch of partners, it's not just Superbase. You'll find like all the usual names on there, but it's been really great. I've been kind of overseeing that one and it got out yesterday. So we're recording this on a Friday and this became kind of public in preview yesterday.

• 3:09Speaker 00

  It's just awesome when you see something like actually hit the public sphere that you've been working with engineering on for the last, like we've really been crunching on this last couple of months and nice to see that go out. So yeah, check it out. And yeah, I'll be in SF later this month as well. And that's for sessions, that's Stripe Sessions. So for obvious reasons, as I've now just disclosed, is like we're working a lot with Stripe and stuff. So yeah, if anyone is at Stripe Sessions, do look me up and say hello. Always great to meet new faces as well. Yeah, that's exciting. That'll be our first opportunity to meet in actual person. In real person, yeah, in real life. Yeah, yeah, sure. Yeah. For anyone listening, Sean and I have never actually met in person. So yeah, this is gonna be cool. And you're coming to Singapore at some point as well. Yeah, we have two opportunities.

• 3:53Speaker 00

  There we go. Yeah. Whether we'll do an in-person episode, that's, that's a different thing. Like, because actually recording in person means. Like a whole studio setup, I think, or something for us. It's actually, I've done a few in person. It's, there's a lot more technical complexity with doing in person than just recording on your computer remotely. Exactly. Yeah, I've had a couple of guests on SE Daily just say, oh, can we go to a studio? And they're like, well, we don't have a studio. SE Daily is a remote podcast. That's how we do it. So. Right. Moving on to the headlines. So some of you that do listen to this SED news a lot, we have talked about ARM in the past, but more so the lack of ARM.

• 4:35Speaker 00

  But I think the headline here is ARM is back in a big way. And this all kind of focuses around CPUs. Because the headline stories of any of this compute inference, the story's really been around GPUs. And we did talk a little bit about TPUs, which are Google's derivative of that. But we are really going back to CPUs. So yeah, Sean, what did you pick up on this one? I mean, it's like everything in text, like the old thing is now the new thing again. Like it's always cyclical. I think part of it, the reason we have GPUs, we have TPUs and now, you know, CPUs are back. Like it's just, you need a lot of compute to run all this stuff. If you're running models, you want probably GPUs, TPUs to be doing sort of the matrix multiplication there. They're really good at that.

• 5:18Speaker 00

  But CPUs are also good at certain things. You know, they're good at logic and branching and task switching. And I think given now that people are running these agents on their desktop and not just running one, like running multiple agents. I talked to a startup that I work with recently and I was like, how many instances of Quater you're running simultaneously? And they're like, well, I start to lose track of things when I get up to like six. So that's a lot of compute that you're running locally. And I think essentially that's what's kind of driving this is that people are running these agents locally. I don't know that that was something that we necessarily foresaw in the industry a year or two ago, that so many people would be kind of running these agent experiences on their local computer versus the cloud or something like that, where you maybe are using some other type of compute.

• 6:01Speaker 00

  But if you're going to be running these locally for things like Open Claw or some other version of Claw that now exists, or you're doing it with the agentic engineering tools that are Out there, you're just going to be consuming up a lot of CPU and a lot of memory. So there's now a lot of, I don't know, appetite, I guess, in the industry to find more of this compute. Yeah, and I think one of the interesting pieces here is that ARM is actually going into more of the actually manufacturing their own chips. Not fabbing exactly because your fab being effectively the sort of manufacturing plants that can do this. And those are incredibly, there's only three really players that have those, I believe. TSMC, the Taiwanese, is the main player.

• 6:46Speaker 00

  Intel do have that capability. And Samsung is actually the other huge one that has that capability. Not entirely clear who's fabbing these for ARM, but the difference being that ARM traditionally was supplying the designs of chips. Like, that's their whole thing. Virtually every chip that is created has some design piece in it that comes from ARM. And so they basically take a royalty, if you want to call it that, off almost every single chip that is created in the world. But they hadn't really gone full on into, hey, this is like an ARM chip with an ARM logo on it, for example. And this is kind of where they're going. And yeah, as you've called out, Sean, it's the rise of agentic tasks.

• 7:30Speaker 00

  And it really has just accelerated, as we touched on, I think, in the last SED news. And in the last like two, three months, that suddenly everyone's doing agentic stuff. Not just engineers, like anyone seems to be quite interested now in getting an open cloud running and like leaving it on overnight on their Mac Mini or something. So there's clearly just a lot of appetite now for having these independent environments that have their own CPU to run a specific agent. And I think that's kind of what we're seeing here. Yeah, and I think that's only going to continue. Like, these companies, whether it's Anthropic or others, are verticalizing a lot of their success around cloud code, cloud desktop to be geared towards finance and geared towards lawyers and whatever profession that you have.

• 8:15Speaker 00

  So every sort of white collar job eventually is going to have people who are running these things in some sort of environment. So you need compute, you probably need some sort of containers and security perimeters around this. So there's not just, there's, I guess, like a ton of people, startups, all the way to large companies that are really trying to meet the needs of the market right now. And it's something that, like everything now, when it comes to AI. It's exponential growth. It's not this kind of like, you know, nicely growing linear thing. It's like, as soon as something takes off, it's like extremely viral. And companies have to move really fast to essentially meet that demand. Yeah, I mean, Nvidia are like, are in this space as well. You know, they offer CPU racks, but I guess they're still known, I guess, on the GPU side.

• 8:58Speaker 00

  But yeah, it's kind of, I would say like, quote, great to see CPUs coming back. I think the fact that they've powered so much to this point in time from a technology standpoint. And then everyone kind of thought, oh, they're like yesterday's technology almost. They're incredibly powerful, but for a specific task and you don't always need like a incredibly expensive GPU running every single task, as I think a lot of people have decided just for the sake of, if they can afford it, that's what they're going to do, but it isn't actually needed. Yeah, when I did an SED episode, unfortunately, I can't remember the person's name, but he was a Turing Award winner in supercomputing. One of the topics of conversation that we had was how the industry's focused so much on workloads catered towards, is essentially the math behind model crunching and inference,

• 9:41Speaker 00

  has led to essentially poorer performance in supercomputers for certain types of tasks. So there is always like a trade off, right? Like if you overly specialize in something, GPUs are really good at a certain type of math. TPUs are even more biased towards being really good at that particular math. You're also giving up something that might be important for other types of logic or compute that doesn't essentially fit the profile that you're going to run on one of those other pieces of hardware like a GPU. And when you're running agents, it's not like it's just model crunching. There's all kinds of other things that they're doing where you want to be able to ideally use the right compute, depending on what the profile of the task is.

• 10:22Speaker 00

  Exactly. And it is just the volume here, like there isn't really a sort of realistic world for like an average person at the moment where every agent has its own GPU. So even for most people in tech, like the numbers don't add up if that's like what it takes. So if you want the number of agents that you think would get your tasks done, you're probably looking at CPUs to run most of those logic tasks. So yeah, very cool to see ARM back in the fold. And yeah, I read a book about ARM kind of just before, I think it was just before they IPO'd or something like that. And I just, I really fully at that point and understood like, wow, they have just behind the scenes powered so much of what we We take for granted with all these designs, but never really got the recognition for it.

• 11:07Speaker 00

  So it's kind of, yeah, it's fun to see them actually stepping into branding their own CPUs as well. So exciting. Moving on to, this does sort of hit the main tech headlines in the sense like this was a lot of reporting by TechCrunch on this one. And I think especially anyone in software engineering has maybe seen it on Hacker News as well. But I do think this kind of really crosses into main news in terms of our world. The Light L L M hack, now this was a takeover of a dependency effectively that then extracted the credentials of many services. So Light L L M basically gave nice API access to a multitude of L L Ms and helped with like things like metering and so on and so forth.

• 11:52Speaker 00

  So it was a pretty used tool by so many developers out there. So that kind of makes it unfortunately incredibly ripe as a target for someone to think about what can we do if we can get the credentials to that. And I think it's just the focus here, Light L M themselves were a X Y combinator. And then, yeah, the sort of the kicker here is the fact that another Y combinator company, Delve, they were already in a bit of hot water for potentially fabricating. So they're a compliance startup, SOC two reports giving, you go through the checklist and you get the SOC two is still a funny industry where it's actually accountants that do the final stamp on things. That's a whole other story, but they apparently. Your auditors as well.

• 12:37Speaker 00

  Yeah, exactly. They're your auditors and it just, it still seems like kind of strange that you've got effectively a financial company saying that your security of your technology is up to scratch, but that's how that system was put together. And the, yeah, there's been allegations that Delve have been fabricating the sort of the rubber stamping of these reports. Unfortunately, Delve had given one of their reports with a clean bill of health to Light L M before this happened. And it doesn't, I think that people, pains to point out, getting SOC two does not mean they have checked every single process that is going on in the developer's workflow within Light L M, for example, but it should be a pretty good indicator that they're following best practice.

• 13:19Speaker 00

  And while something kind of wasn't going by best practice here and it's had a catastrophic effect on a lot of developers. But yeah, that's. I guess this sort of slight security minded focus from me, but what did you make of this one, Sean? Yeah, I mean, I think it's just another example of where like compliance isn't necessarily security. Compliance is really a series of kind of checkmarks where you're saying, yes, we are following the best practices. But every company pretty much that has some sort of data breach, has some sort of hack is in compliant. They pretty much all have like SOC two or whatever, various ISOs, like whatever sort of security checkmarks that they need. And I think in a lot of ways, like compliance is really about insurance, while security is actually about trying to stop the attacks.

• 14:04Speaker 00

  So there's a very big difference between, I would say, like the companies are really like secure by default. And they take a hard stance on this versus people who are, hey, we have to make sure that we have these badges. So that when we're going through procurement with a vendor, they're not going to immediately just say no. I also think the interesting thing here is where a lot of times when we think about hacks historically or breaches. It's like, what is it that people are trying to go after? Well, they might be trying to go after someone's password. They might be going after credit card information, banking information, personal information for like identity theft. And here I think there's now this like new industry that's going to be, the value is, hey, I want your open AI API key. Or I want your anthropic API key.

• 14:47Speaker 00

  And then not only can they run up bills on you, but they could be leveraging those models to be doing something malicious against a bunch of other people too. So they can, so they spin these things up using your precious tokens. Run up a big bill for you while also using that thing to attack somebody else. Yeah, so this was discovered by a guy called Callan McMahon of Future Search, which is a company that offers AI agents apparently for web research. But he like documented how this all unfolded. Basically it ended up with his machine being shut down. So that's a pretty clear indicator that something has really gone wrong here in terms of how deep this sort of hack has gone.

• 15:29Speaker 00

  It's something we've covered on SED Daily with guests, obviously of companies that help to mitigate this. The one that comes to mind is Wiz. We had Rami McCarthy from Wiz. And we actually covered a case that he'd worked on that is exactly this. It's like a dependency. It has a sort of leak within. The maintenance of it and that just cascades through so many other packages. And this one particularly, just the number of developers right now using Light L M is just shown to be such a problem. I think these kind of like dependency supply chain attacks are hard to catch. And it's easy thing for attackers to kind of exploit. And then in a world, and we're going to talk more about this during sort of the main topic, but in a world where we're

• 16:12Speaker 00

  using AI more and more to generate code and maybe not always looking at that code that closely. And is picking up packages in order to do some type of work on our behalf. We might not have as clear a handle on what those dependencies are. We're kind of just looking initially at the outcomes of that. Does it pass the tests? Does it kind of look correct if it generates some sort of UI? Based on what it is that we're trying to accomplish, we commit that thing and then we get it running in production and then boom, we have some sort of problem. Yeah. So the next headline here, I guess, again, this might have crossed more slightly into the hacker news from a headline perspective, but

• 16:52Speaker 00

  I think it was interesting that, yeah, open code really made a lot of noise in the community here. And this really goes to like the fact that agentic coding has just taken off. But most of the time we were talking about either Claude Code or we were talking about Codex from effectively chat G P T. And that means you're buying into again, one of the big names. And here was a product that's able to say, hey, we're actually fully open source. You've got access to local models, you've got access to free models. Or if you really want, you can hook it back up to Opus or something like that. But I think that's just the amount of opinions that were then given about it is kind of really interesting. Yeah, I think we're going to, of course, see more and more of these open source alternatives.

• 17:35Speaker 00

  In a lot of ways, it reminds me of, you know, if you looked at the IDE market, maybe 15, 20 years ago. It was very similar to where open source IDEs started cropping up as alternatives to the mainstream ones. And the thing that I've always thought about or since people start, even with GitHub Copilot was, I think we've always gotten to Place where developers don't really like paying for their tools. And then you end up with like open source alternatives. And then with the IDE market in particular, the IDE very much became like a commodity. And there are certain IDEs that survived that and people pay for. But predominantly, I would say most became open source or were given away, even things like Visual Studio that historically had been like a big moneymaker for Microsoft.

• 18:19Speaker 00

  So today, people are able to monetize these agentic and engineering tools because what they are incredibly valuable. If someone took away my Claude code, I'd be very upset about that. So there is a lot of value there, but as you have more and more of these open source equivalents that are maybe, even if they're not as good, they might be as good, but even if they're not as good, maybe they're 80% as good. People are happy to use something that's 80% as good if they don't have to pay X dollars a month to use some other tool. So then you get into a world where people are willing to pay for the tokens, but people aren't willing to essentially pay for subscriptions at scale to have those tools. So if you want to monetize that market, like how do you create a big enough

• 19:00Speaker 00

  value and a big enough moat around what it is that you're providing so that people don't just go to the open source equivalent? Yeah, and it was kind of interesting just to look at some of the conversation around it in Hacker News as well. And I guess what maybe even I hadn't sort of fully appreciated is the fact that like Claude code, okay, it runs in your terminal, but it is actually an Electron app. I didn't even realize this and like, that's how you kind of achieve all these amazing visual niceties effectively. Like, yes, it's in a terminal, but there's a ton of stuff going on from a rendering perspective, like terminals are yeah, being hacked a bit in this way. I love the visuals, but then I was kind of starting to think, how is this even possible inside a terminal?

• 19:42Speaker 00

  Codex apparently is done in Rust and people say that that is a tangible speed difference. And one of the things, yeah, yeah. And I think one of the things that has been questioned about open code is the fact that basically you're using up a gig of RAM basically for a terminal and that it's a pretty chunky TypeScript codebase that's running this thing. So this is When you're designing these kind of tools for developers, well, guess what? You're going to have some pretty, I think, spicy opinions on like, how did you put this tool together in the first place? So I think that's going to be an interesting adoption data point that they have to think about. You know, there's a lot of these tools now available.

• 20:22Speaker 00

  You have Claude, you have the mainstream sort of commercial tools from OpenAI, from Anthropic and from others. You have the open source equivalents, like you have Klein, you have OpenCode. There's a whole plethora of these. How many can the industry really support? I feel like sometimes when these tools crops up, kind of catches fire for a period of time, gets a lot of GitHub stars and love and people start using it. And then it kind of like tails off as the new hotness system market as well. So I don't know that that's like sustainable in the long. At some point, I think some of this stuff starts to level out and they'll emerge like a couple of main players that dominate the market. And maybe there's a couple of alternatives, but I don't think you can have like a hundred alternatives. Yeah.

• 21:03Speaker 00

  And just to round out the headlines, this sort of, I guess, broke cover maybe a couple of weeks ago, but I think it just sort of is useful to touch on a slightly wider story that we're seeing play out, which is how OpenAI and Anthropic are kind of, how are they playing their markets now? And there is obviously a lot of noise around how the Pentagon, they wanted to, the Department of War or Justice, or whatever they're called these days, wanted Anthropic to allow Claude for what they call all lawful purposes. And that it does include things like surveillance and autonomous weapons. And Anthropic refused and they didn't get the contract. And then apparently OpenAI quotes sort of swooped in and signed a deal.

• 21:46Speaker 00

  And there was a lot of, I think, user backlash around this and it did make Anthropic look like the real human winner there. If you want to use one of these technologies, like why would you use the one that really wants to get in with the government, the US government? And if we kind of then just like play that through to like, well, where have we seen OpenAI versus sort of Anthropic, like where are they positioning themselves? Like it does to me at least look like OpenAI started to becoming this kind of super app. Type construct, which we've touched on before, Sean, like in sort of other deeper topics. And Anthropic, Claude, they're really going like full enterprise and in a sort of say in a positive way,

• 22:29Speaker 00

  but they're really going and saying, we can be the enterprise tools that you need. There's all kind of them. If you look this back to the whole Pentagon thing, well, a lot of companies really don't want to be associated with a company that they think is like aiding the government with, say, surveillance, or as we speak, the Iran conflict is on right now and we don't know how the technology is being used there. So just kind of staying away from that, I think, is what companies are looking at. And it's just a very interesting development, I think, in the sort of the landscape of the two companies. Yeah, absolutely. I mean, I think that it ends up kind of highlighting, I think, something where those two companies are already somewhat have like opposing views of what is the right thing to focus on when you're building, you're sort of responsible for building these models.

• 23:13Speaker 00

  And even this Dario and some of the other founders at Anthropic were at OpenAI at one point and they kind of split off because at least the story goes that they didn't agree essentially with the philosophy that OpenAI was taking towards like building models or releasing models. They wanted to make sure that as a company that before they released the model, it was really well tested and really like security and trust was sort of the number one value. So they splintered off, built Anthropic. And I think this whole thing that's happening politically has been probably some of the best marketing that's ever happened to Anthropic. Like you saw people leaving or cancelling their OpenAI subscriptions.

• 23:53Speaker 00

  I think even under the best of circumstances, like with politics, people, companies, individuals might not be that comfortable with a company supporting something like surveillance of individuals or automated warfare or anything like that. But on top of that, we're also in a place in the United States where politically things are very polarizing right now. And there's a large chunk of the country that doesn't want to be associated with the government at all. So this is a very, very polarizing issue and it's kind of Anthropic's kind of chosen to take one stance on this. AI has taken a different one. And as a result, I think it just highlights the differences between the two companies even more. Yeah, and it's not like we've seen things like this probably appear in the past where a company

• 24:37Speaker 00

  potentially anchors itself a bit closer to a government or not. I'm not going to bring up any specific examples, but what I will say is like in the past, okay, would one have refused to use, I'm just taking pure examples that might not be true here, but would I have refused to use Google if I knew that they were aligned with a certain government? I'm not sure because like, okay, it's a lot of your search history and that kind of thing. But now that we're talking about what L L Ms are used for, well, it's quite often people are divulging a lot of their personal information beyond just, oh, this is what I purchase, or this is where I'm located right now, which is, you know, it's personal information, of course, but people using L L Ms, they're kind of writing about their deepest, darkest thoughts. And in companies, especially, people are just literally

• 25:22Speaker 00

  hooking up whether through official integrations or full on just pasting in Slack conversations and documents. And that's it. Like, where does that information end up then ultimately? And I think that's why it's such a concern for companies especially. Yeah, absolutely. There's something I think more personal about chat than necessarily search. I think people have kind of Exactly. Like taught themselves that, okay, well, maybe I shouldn't put my social security number into like Google search. I don't know that people think of that necessarily with chat as much. Or they, you know, paste documents in, they're incredibly sensitive, not really thinking that through because of the value. There's just so much value with using these tools that people kind of

• 26:03Speaker 00

  throw out maybe their reasoning skills sometimes with like, should I actually be sharing this? What is the consequences of sharing this information? Yeah, I've definitely noticed that people that previously would have said, I will never divulge certain information to a tech company. And then the next day, oh, I've had this amazing conversation with Claude and told them all these things. And I don't comment on it. I just think that's really. Just observing is very interesting that this is someone, for example, that I know would not have done this in the past, but actually just they've felt some trust there. That's a whole topic for a different day, but I think it just underscores like why, who you give your information to, especially between the, you can call it like the two main players here.

• 26:41Speaker 00

  Anthropic and OpenAI, as soon as one then anchors themselves to a entity that people disagree with, that's like adds a whole extra layer. So we'll watch how this plays out, I guess. And yeah, we'll sort of see, does this affect OpenAI enough that they have to walk anything back? Or are they kind of going more like Palantir style? They actually think there's too much value to be had by being very close to the government and helping them achieve things like, I guess we'll see how that happens. Yeah. And I think from like a consumer standpoint, a lot of times when there's so much value behind whatever the product is, consumers end up turning off a blind eye to maybe things that they wouldn't normally agree with. You know, you can take any retailer, major retailer in the world.

• 27:25Speaker 00

  That's probably manufacturing goods in developing countries where maybe the standards of work are not necessarily great. People kind of sort of know that, but they also like their inexpensive, you know, T-shirts and or whatever, you know? And they're kind of willing to turn that part of their brain off because they're focused on like their own personal outcomes. And I think you could potentially see something similar with, you know, even if you don't in conversation, agree with what OpenAI or any other company is doing, there's so much value behind their tools that you kind of turn it off when it comes to your own personal objectives. Yeah. So it's that time within SED News, we're going to move to the sort of main topic, deep dive.

• 28:06Speaker 00

  And today we are looking at effectively writing code versus shipping code, and especially the emphasis on shipping code. How does this look in the age, if you want to call that, of LLMs now that, you know, probably at least 50% of developers in a given company are going to be using LLMs to write code? What are the kind of maybe cascading effects on how that code actually then ends up, to be frank, on main branch? You know, what does main branch look like from a speed perspective and actually getting things merged in? And we kind of anchored this around, there was a Circle CI as.

• 28:44Speaker 00

  You know, a company that many people know, you know, in the C I C D space and they did a 2026 state of software delivery report. So that was just back in February. We're recording this just at the end of March. They said that they analyzed, this is going to be quite data heavy, this main topic. So get ready for some numbers. Because thinking about when we talk about writing code versus shipping code is basically all numbers, like lines of code and how many merges were made and so on and so forth. So they said that they analyzed 28 million C I C D workflows across 22,000 orgs in 149 countries. So that's a pretty good spread. This is the interesting anchor points here that the daily workflow throughput was up 59%.

• 29:26Speaker 00

  But it's kind of misleading that the top 5% of teams nearly doubled the throughput. Whilst the median, sorry, the median team increased only 4%. So that basically suggests that super high performing teams could super accelerate their throughput, i.e. things that got merged into main. Again, just to kind of bring it back there, they could double their throughput, the top 5% of teams. But the median, just call it like, you know, the average, I know average and median is different, but when people think about it, that to only increase 4% on throughput for most, for like, just call it the majority. That's pretty interesting because, you know, most developers are saying, oh, I'm so productive. I can, you know, I can do so much more per day now if I use an L L M.

• 30:12Speaker 00

  But if actually from a team perspective and a shipping perspective, the majority are actually only increasing by 4%. That looks way off what we might have expected, I think, from this. Yeah. You know, there could be a couple of things going on. One is that, you know, not everyone has reached the level of the like, the most high performing teams. Adopting some of these tools is still relatively new to many parts of the industry. So you're going to have people who are kind of trailing behind, maybe they're, they're kind of as a company, maybe just, you know, dabbling. Or this is like fairly new efforts. So they're kind of getting used to, how do we get value out of this? But I think the other thing too, you could say is like, well, maybe the teams that are shipping these like, you know, top performers, maybe they're shipping a lot. But are they shipping also a lot of bugs and they're just okay with that?

• 30:57Speaker 00

  Whereas other people are trying to control that. So there's a bunch of stuff that it would be nice to kind of be able to dig into the details of like, why is it that some people are at 4% increase throughput? Whereas you have some people who are double this? And there could be many, many different reasons for that to be the case. The other thing too is that, you know, just because you speed up writing of code, doesn't mean you speed up the entire software development lifecycle. So you have this software development lifecycle of, you know, just a very simplistic one of like discovery, sort of requirements, coding, testing, putting it into production and then running that thing in a loop. Well, if you speed up that middle part of writing the code,

• 31:40Speaker 00

  it doesn't necessarily mean all the other parts of it has sped up as well. So those can become choke points in the company. And on top of that, if you speed up the lines of code, those choke points might become even slower because the thing like, let's say it's your security team that has to review these things. The fact that they were somewhat slow in the past was maybe okay because the part of writing code was really, really slow in comparison. But now they suddenly have like a thousand times more things to do. So what happens as a company? Either you cut corners and you start releasing products that don't necessarily go through that full, you know, security review, which leads to, you know, negative consequences. Or you slow down the entire release cycle so that you only get 4% increase throughput

• 32:23Speaker 00

  because the poor security team is like completely slammed and overwhelmed. I mean, it's the same thing even with reviewing PRs. If we're generating more code, that means that there's more PRs to review, which means that that has to be paid for from somewhere. So either you have your engineers spend all their time essentially reviewing PRs, which slows down, of course, things getting to production, or you leverage LLMs to also review the PRs, which then also potentially has certain consequences where less and less people within the company really sort of deeply understand what is happening in the codebase, what the dependencies are. And then you end up with some sort of issue on production. And then the people who are debugging it are also not that familiar with it because AI wrote it.

• 33:05Speaker 00

  Like there's all these kind of like consequences of what's happening in the industry right now. Whether it's like, hey, we're not really seeing the full throughput value of the LM because we're generating code a thousand times faster, but. These other things are getting completely bombarded and slowing things down. Or we're generating code a thousand times faster and we're pushing it out of production. And then we're also generating bugs a thousand times faster. Yeah, the kind of stat that does really make this, you can really visualize it is that feature branch, like this report that came from Circle CI, they saw the feature branches, the throughput was up 15%. So, okay, great, 15% generally more feature branches are being created.

• 33:48Speaker 00

  But the main branch throughput itself was down 7%. So basically, but actually, sorry, that's throughput and the actual creation of branches, feature branches are up 50%, whilst the main branch, again, only like sitting only at 1%. So it basically just means that a ton of code is being generated and a very, very, very small fraction of that code is ever making it onto main branch. And I think to kind of go exactly to what you were just saying there, Sean, you know, that middle piece, the hu- human in the loop there is still obviously like the biggest question mark, you could call it bottleneck, but I think most companies are saying it's still the most critical thing that they believe needs to be there.

• 34:33Speaker 00

  Like, it's all very well generating a ton more code or a lot faster at least, and having all these supposed features or so on, like all queued up and waiting to be potentially merged in. But the actual review piece, well, that's where anyone really is going to be saying, well, hey, we're not comfortable with these just like being whisked through by like an L M that sort of knows how we do things. And I think that's the piece that's going to take like a lot longer to really kind of make it through to say like, production, production. Apparently, there's an example from the new stack back in March, we're in, we're still in March. So I mean, coming out in April, but we are. Time is a flat circle, Gregor.

• 35:16Speaker 00

  Yeah, well, it is in AI terms, yes, but, or AI age, but VS Code, so they've actually moved to weekly releases after 10 years of monthly. And they say AI is actually making this possible, but they say that only works because they say, I mean, they obviously, I think VS Code specifically probably have, you know, reasons that they at least want to push the idea that this is all possible. But, you know, they say it only works because they have strong automated checks. And a team that's invested in this review pipeline. So yeah, I think it's just like, what does it actually look like to try and get your team around this paradigm? I think is probably what a lot of people are wondering about.

• 35:56Speaker 00

  Yeah, I mean, I think that the reality, at least at the moment, is like organizationally, you have to probably change. Because if suddenly the resources that are scarce is not necessarily the production of code, but the resources are for that scarce are essentially verifying the code is correct. Like Adi Asmani has written about this, said, you know, generation is not the bottleneck anymore, verification is. So if it's all about PR reviews or in the world of like infrastructure, the core piece that a lot of times really matters is like networking, security, how you do authentication. And if you mess that up, you've basically, you might destroy the core infrastructure of thousands of different, you know, customers.

• 36:39Speaker 00

  You can't mess that piece up, or it's going to be dramatically net negative consequences to your business. So that's where you really need to take care, care, and maybe you have to deploy more resources there. And you could kind of cut back resources in other places where suddenly people are, you don't need five people to maybe generate as much code. But you do need five people to verify the code is correct. So it kind of, it's almost like we're shifting the problem. Where the problem historically has been, it takes a long time to write the code. That's been the sort of hard, long cycle. And then now I don't know that we've, we've really sped up everything. Like I was saying, like we, we've kind of shifted where the problem occurs essentially.

• 37:20Speaker 00

  I think the really negative part of this is that in the sort of media, we focus so much on these headlines of like, you know, such is such a company replaced a team of engineers with one engineer and, you know, six open clause or whatever it is. Or people were going from idea to app with one prompt and built an application in 20 minutes. And I think the thing that we're confusing is that, you know, when the demo comes together in afternoon, afternoon, I think it ends up recalibrating what the stakeholders think possible, like executives who watch some AI generated prototype naturally ask like, hey, if we built this in a day. Why does production take six months? And it's this whole like ninety ten rule that has always existed in software where

• 38:02Speaker 00

  first ninety percent of the work takes like ten percent of the time and the last ten percent takes the other ninety percent of the time because there's all this other stuff that has to happen around productionization and we're really confusing like prompt to prototype with prompt to production. And I think that is going to have massive consequences in the industry and I know engineering teams are under tremendous pressure right now to be shipping at the speed of essentially prototyping. And you either end up not being able to do that, which could be negative for your career, or you end up in a situation where you bypass the normal checks and balances. And then that's going to, I think, lead to more and more of these like outages and failures.

• 38:42Speaker 00

  I mean, even if you just statistically take, like assume that with human generated lines of code to the number of errors that you have, if that statistically stays the same for AI generated code, then if you're generating more code, you're going to have more errors and you're going to have more production outages. So I don't think it's a particularly bold statement to say that we can expect more outages from companies over the next, you know, year easily because of the fact that if companies are on the, in the place where they are actually able to put this into production faster and there is all this pressure to do that, we're going to end up just generating more code that generates more bugs at some point. Yeah, and as you touched on this, it's going to be a complete, it's a sort of a culture

• 39:27Speaker 00

  competition at this point because the company that's already wasn't putting a ton of thought into, you know, the pre-writing code and then the post-writing code piece, well, they never saw that anyway. So like, well, awesome, we can just accelerate the bit that we thought about most, which was just generate code and generate stuff and ship it. And yeah, I think they're starting to get sort of a bad surprise in many areas when, when things are, don't suddenly like accelerate ten X because the problems have accelerated ten X. And it's the companies that already have these, literally from writing whatever people call them, like PRDs or RFCs before something gets shipped. Again, use, if you augment that process with LMs, well,

• 40:08Speaker 00

  Actually, that's very interesting because a ton more thought and discussion can happen around something before it's even thought to be getting code written against it. And then the code being written against it potentially gets sort of accelerated. But I can't say that I think the best features are getting accelerated by L M. It's actually, I would almost argue, is it is that maybe that first piece where the L M has done a ton more thinking behind the whys and the hows that everyone can then read it over and comment on. And then, you know, a classic pizza team works on the feature itself. And that's still exactly what should be happening.

• 40:50Speaker 00

  Not to make me send anti L L M on code, but because I'm very much pro. It's just interesting to see where does bringing L L M into the loop actually affect the the final outcome and the quality of the outcome, including security and robustness and all and all these kinds of things. Yeah, I agree. I mean, I think that I certainly don't want to come out sounding like I'm anti A I generated code. It is absolutely not the case. I think these tools are tremendously valuable. And as I said earlier, you know, I'd be very upset if Claude Code went away.

• 41:21Speaker 00

  Like very dependent on these things at this point. But I think that the problem here with sort of sensationalizing the fact that you can go from prompt to, you know, building a compelling demo and then sort of confusing what that really means hides some of the real value here. Like, I think one of the things that this gives us is very interesting. And you kind of touched on it there, where in many ways, like, software has become a thinking tool because the cost of essentially generating that idea is so low now. So as a, you know, product manager like myself, I could spin up a working demo of an idea instead of writing a one pager and then hoping, you know, my stakeholders can kind of visualize it.

• 42:01Speaker 00

  The demo isn't the product, but is a better way to have a conversation essentially about the product that we want to build. And in many ways, I think we're entering this era of where A I is kind of making software ephemeral. And that's a real shift in how we can do work because we can, anybody. Not just people who are technically adept, like suddenly you have people who, you know, with a little bit of training, can have the ability to convey their ideas through software. And I think that's very, very interesting because, you know, if software can only be created by a small set of people in the world, you're of course going to have certain biases that come with that or certain worldview. If suddenly you open that up where it doesn't mean that you're building production software,

• 42:45Speaker 00

  but if anybody can kind of prototype something, then it's a way, I think, for a completely generation or essentially a completely different set of people to be able to convey their ideas in software. And I think that could lead to some really, really interesting outcomes that we haven't seen before. And that's always the case when you kind of bring new worldviews, new ideas, new cultures to something that didn't have it before. So I'm excited about that. And I think that there's tremendous value here. I just think that a lot of the real value gets kind of lost in the conversation. And by over emphasizing the idea that, you know, prompt leads to faster productionization, it's going to have negative consequences that companies don't really necessarily foresee right now.

• 43:29Speaker 00

  And it's hurting engineering in general by sort of misleading where the real value is right now. Yeah. So kind of the, I guess, the sort of TLDR here is just effectively that your sort of validation layer. If you think that LLM coding, like the point of it basically is to increase throughput generally. And by throughput here, we would define that at this point is as merging domain in a state that you are, that meets the bar of quality that you as a company think is acceptable. Then, you know, the validation layer effectively needs to keep pace with that. And at least, yeah, I mean, where I sort of sit, I'm not talking Specifically about where I work, but like, you know, you can look at a bunch of code bases, open source, et cetera.

• 44:14Speaker 00

  It does not look so far like that is quite keeping pace if that's your kind of metric because rightfully, probably at this point, the human in the loop is still very much there and still a lot of like post discussion happens and a lot of the volume of code needs to then be reviewed by a human and that that's a very labor intensive task because I get the impression that a lot of people aren't then comfortable saying, well, I'll just use an L M to review the code that was generated by an L M. Okay, sure. Like I know that people use models to like to rank outputs of models, but like this is precisely the piece. I don't think anyone's going to still have a job at the end of the day if they told their engineering manager, well, the code that was written by L M, all I did was have it reviewed by another L M and then I pressed merge.

• 44:57Speaker 00

  Like in professional software production for big companies that you, for example, that we work at, that just is not going to have you a job at the end of the day. If something, if something goes wrong, it will just be you on the end of the line saying like, well, that was not the way to achieve that. Yeah, I mean, we both work for companies where if we mess up something in our core infrastructure, that means we mess up the core infrastructure of potentially thousands of customers. Oh yeah, like six figures of people could get messed up easy by one problem. Yeah. Exactly. So like, there's like massive, massively negative consequences to something like this. I think like part of it also is companies kind of have to think about, you know, where it, if you want to accelerate things,

• 45:39Speaker 00

  are there certain parts of the stack that you could accelerate? Like, are there places where, you know, a bug is more forgiving than other places? You know, maybe it's not networking, but could it be, you know, part of the UI layer where you can move faster? Because, you know, if you end up messing up the UI like some way, like you can, you know, fix it immediately, push out a change. It's maybe less catastrophic depending on what, you know, what the company provides. I think you kind of have to think of this as like layers of an onion, like which layers of that onion do you need to be? Really, really scrutinize and make sure are up to, you know, whatever your par is. And then are there other places where you can be a little, you know, looser on that? And the consequences are not going to be as catastrophic.

• 46:21Speaker 00

  I think that's a great place to leave it. So yeah, just some, hopefully some interesting thoughts there on writing code versus actually shipping code. You've probably got a few anecdotes, listeners thinking about how, how you work in your own companies now. And just like, what does that look like in your own flows? So, and we're always happy to hear about those as well. So moving on to our final piece of the show, usually our kind of favorite piece of the show. This is Hacker News, but nothing too serious, just interesting things that have popped up on Hacker News. Think I could scan to see what Sean's is, and I want him to go first because this, this, I definitely saw this as well. And I was like, I guess we're going to cover this because spoiler, it's to do with Doom. So you know, it's going to be Doom on something.

• 47:07Speaker 00

  What is it this month? Yeah, it's so funny to me, probably every week, certainly every month, there's always going to be a Doom on something project on Hacker News that, you know, catches our eye. But it's also funny to me how like Doom has just become that thing that everybody wants to like jam in anything. We're going to run Doom on a watch. We're going to, you put it in your wifi enabled earbud like, and now this is Doom on over DNS. Cause why not? So really, really fun project. I think then one was the, the person who posted it. There's a GitHub you can take a look at, but so the project compresses the entirety of the shareware Doom, splits it into nearly 2,000 DNS text records.

• 47:48Speaker 00

  And across a single cloud flare zone and then plays it back at runtime with, using nothing but a PowerShell script and public DNS queries. It's just like amazingly absurd, but incredibly awesome. I do think despite the Doom in type script types, which was an incredible feat. And we did have an episode on that with one of our other. I've got to say, this to me is creatively just one step above because I don't think anyone thought that writing software via DNS was a thing or could be a thing. No. And as usual, Doom, I think, I guess, why is it always Doom? I mean, it's just a kind of meme, developer meme at this point, but the fact that it's this very tangible outcome that as soon

• 48:32Speaker 00

  as someone's like, well, it's Doom. It's not just saying, oh, I created like a calculator app by, from DNS. It's Doom, a game. That's insane. So, yeah, that's very, very. Yeah, I'm sure the creators of Doom, like back in the day, had no idea. They had no idea that they were going to become like the, it's almost like some sort of benchmark standard at this point, where it's like, can you get Doom to run on, you know, X device or whatever it is? Yeah, The Two Johns, I read that book, Masters of Doom. That's a great book if you want to ever hear about how Doom actually came to be, but nothing to do with all the funny ports we've been talking about. But yeah, on my side, a couple of sort of just interesting ones. One

• 49:11Speaker 00

  was why, this is called why so many control rooms were seafoam green? So I often do bring up like some of these maybe more designy ones that hit Hacker News because it seems like Hacker News has this amazing community of people that can sort of dig into like why things were designed a certain way, whether it's pure colors or so on and so forth. So this was posted by user Amori Meltzer. Thank you for that. And the TLDR is seafoam green is apparently, when we talk about seafoam green, we're talking like a sort of very light green color, mossy, light, very light moss in Scotland right now. I can see it everywhere. But think about very light, pale green and it's on walls in these sort of bunkers of

• 49:51Speaker 00

  control rooms. And why is that the case? Well, the TLDR is there is a chap by the name of Faber Birren, who was somebody at the Art Institute of the University of Chicago.

• 50:06Speaker 00

  And when he was in New York, he actually became like a color consultant and he helped people understand, well, if you paint your walls this color in a certain restaurant, like, or a butcher, for example, like, that might drive more sales of steak. So like, because the meat looks redder against a certain color, for example. He was then hired by the government to, during World War II, to create palettes for different like buildings, effectively, to help people like just understand, like, oh, this area is a danger zone. Like, so fire red was used sort of for all emergency stop buttons, which I think we would think of as pretty obvious these days, but that was not obvious before some thought was put into it. Anyway, light green, that was simply used to reduce visual fatigue. Apparently

• 50:51Speaker 00

  it's seen as a color that you can sit in a bunker with all these switches and dials all day. And that is apparently the color that reduces fatigue on the eyes. So given that you've got to be staring at, back then, certainly staring at all these other machines. So very just interesting, funny bit of trivia there. I've heard sometimes like certain fast food chains choose a particular color in order to encourage people to not like stick around because they want to like turn over the seats. I don't know how much truth there is to it, but there's definitely something where, you know, certain colors, I think, do affect people in different ways. The one that I never understood, and it's probably why I have not flown this airline for maybe four, can't even remember, since I was a teenager, literally, Ryanair. I'm

• 51:35Speaker 00

  sure some people know about Ryanair. It's a very low cost airline in Europe, but they used to put a very bright yellow plastic thing on the top of their seats. And it was just like headache inducing. And the problem is you can't leave the plane. You're on the plane. You can't get off for the next two hours. So I have no idea why this was, they have a very controversial CEO. But yeah, you were just talking about wanting to make people leave your establishment. Well, that makes sort of business sense to me, but why trap people in a plane where they probably want to get out? That does not make sense to me. But what else did you pick up? Yeah. Well, so the other one that caught my eye here was a guy who basically took Tesla Model

• 52:15Speaker 00

  Three like crash car components in order to assemble the Tesla Model three computer on his desk. And this was motivated by Tesla's like bug bounty program. But he had to like salvage a bunch of this hardware from these various parts. The article kind of goes into detail about like how he did this. So the, I guess the car computer has two main parts. There's a media control unit, which is like the MCU and there's an autopilot computer or AP. Then you need like power supply, you need a touchscreen. But I think the, the thing that they ran into, he ran into the most challenges around was just kind of like connecting everything. Because the actual connectors in the car is kind of like this, like massive cables, you know, like wiring.

• 53:00Speaker 00

  Crazy amount of cables. Yeah. Yeah. So then he had to figure out like, how can he actually connect the MCU to the other devices in some way where he could, you know, provide the right cabling. Because essentially no one, it's hard to find that part because it's either been destroyed or it's like just this massive of cable that's not like super useful. Yeah, that does feel quite depend bug bounty. Okay. It has provided a reason for that, but yeah, still that is like, you've got to be really into this kind of stuff to like pick through how on earth this is going to all fit together. So. Yeah. Yeah. Just a quick one to round out. I think it's interesting. Yeah. The Mac Pro has been discontinued by Apple. No. Yeah, I know. I can still remember. Yeah. Going into Apple store, you know, in like

• 53:45Speaker 00

  2012, maybe in New York and like the Mac Pro is like this, like beautiful aluminium box. And it's like, that was if you were any kind of like serious industry, especially, you know, video or something like, if you had a Mac Pro, like that meant you were a professional on, on this like. But apparently, yeah, Mac Studio is kind of where their head is. Mac Studio. I actually looked this up. I wasn't fully aware of it, but Mac Studio was kind of looks like a Mac Mini. But it's just got, you know, beefy internals and it looked like their kind of product lineup was a bit muddled by this point. But they had the Mac Studio and he still had the Mac Pro. They've decided to officially kill the Mac Pro and just focus on, on the Mac Studio line.

• 54:28Speaker 00

  So probably quite a sensible move, but yeah, a little bit sad for some of us that still remember like all the, that was the sort of, if you ever wondered in someone's office and they had one, it was kind of cool to just use it and know that this was the most powerful Mac on the planet at that point. Yeah. I guess briefly looking ahead, anything you're you're thinking might pop up when we're talking next? I kind of already stated my point of view on prediction, but I think we're probably looking at more outages.

• 54:56Speaker 00

  With this extra code and code and validation problems. Yeah, yeah, for sure. So definitely something to keep an eye on. Yeah, yeah, absolutely. My side, I think, again, not to plug here, but I it has been interesting, the Stripe projects thing. People are asking like, does that make them like a marketplace in a CLI? I can't give the answer to if it's yes, definitely yes or no on that one. But I think what we are seeing, and I think we're going to see more of this, are other players coming into this CLI driven market. I think it was sort of surprising that to some people that Stripe had decided to branch over here. Perception was quite positive. So I think we're going to see more of that. I think we're going to see more companies that never would have thought to like,

• 55:38Speaker 00

  go back to their CLI and maybe think that that's where they now need to target some product releases, for example. CLI is kind of getting a moment again because of, especially because of, you know, MCP versus CLI. That's that's actually a whole other topic we should cover maybe next month, but CLI is coming back in a big way. Oh, yeah, CLI is, it's crazy. Like, everything I think is now about the CLI. And I wonder, you know, I think there's probably a bigger topic conversation around CLI versus MCP versus, you know, APIs and all this sort of stuff. But yeah, CLI is definitely having a moment right now, which is interesting. Yeah. So I'm sure something to that effect will hope will pop up, I think, by our discussion next month.

• 56:18Speaker 00

  So thank you again, everyone tuning in to SED News. We hope you have a good April and we'll catch you next month. Yeah, thanks, everyone for listening. We'll see you next month.